Iran is conducting a direct action campaign against US and allied targets in Europe as part of its war effort. Defining Iran’s actions as state-sponsored terrorism, while creating effective legal frameworks for prosecution and responses, obfuscates the nature of Iran’s campaign. Iran’s direct action campaign is a military campaign designed to achieve discrete operational and strategic objectives in its war with the United States. Direct action is “short-duration strikes and other small-scale offensive actions employing specialized military capabilities to seize, destroy, capture, exploit, recover, or damage designated targets.”[i] Terrorism could be used as a tactical tool in a direct action campaign, but it is not an end in and of itself as “state-sponsored terrorism” implies. Direct action attacks therefore represent Iranian military action against sovereign states in pursuit of a political objective.

Iran began its attacks in Europe in March 2026, shortly after the Iran war began, by sponsoring and supporting attacks on Jewish targets across Europe.[ii] Many of these attacks failed, and not every planned attack was executed.[iii] The Islamic Revolutionary Guards Corps (IRGC) and its Iraqi proxy, Kataib Hezbollah, sponsored and supported these attacks through a front group called Harakat Ashab al Yamin al Islamiya.[iv] Iran commonly uses front groups or guns-for-hire to obfuscate its involvement and create plausible deniability for both terror and cyber attacks.[v] These attacks on Jewish targets, while heinous, did not seriously affect the Iran war’s trajectory. The attacks stopped in late April. Iran later began conducting direct action attacks on critical infrastructure and military bases in the United States and Europe in Fall 2026 to greater effect, however.

Iran is likely learning that direct action raids and the threat of raids are far more effective than terror attacks in Europe. Iran attempted to attack US bombers based at RAF Fairford in late September 2026, which prompted the withdrawal of US B-1 Bombers shortly afterwards.[vi] Twelve KC-135 air-to-air refuelers left RAF Mildenhall, reportedly in response to another Iranian threat.[vii] The KC-135s moved to Germany, but the B-1s returned to the United States.[viii] These withdrawals, which Iranian officers will assume have operational implications, have likely shown the IRGC that direct action imposes operational costs.

Direct action can also include cyber attacks against foreign infrastructure. These attacks destroy and damage designated targets. Iran hacked US water treatment plants in 12 states and disrupted refrigeration systems at grocery stores on six US military bases in Summer 2026, for example. The attacks on water treatment plants were generally not severe, except in Georgia, where the attack increased the risk of water contamination, resulting in a boil water advisory.[ix] Iranian-backed hackers replicated the refrigeration attack in France in Fall 2026 and caused spoilage nationwide and millions in losses.[x] These attacks likely sought to impose political costs on the countries involved, rather than serve a discrete operational purpose. The attacks failed to cause serious political repercussions, but they demonstrate Iran’s intent to use cyber direct action to generate political effects in the future.

Both the United States and Europe must understand Iranian actions as part of a broader military campaign, not as “terrorism” or other criminal frameworks. Terrorism and the law provide a useful framework for prosecution. But this legal framework contributes to a tactical myopia that makes it very difficult to see—much less understand—the coherence of a global Iranian strategic effort to defeat the United States and its allies. Prosecution intends to deter future criminal actions by individuals or crime organizations, but arrests alone will not deter states pursuing political ends. Defining these attacks as direct action instead situates Iranian actions within a framework of war that implies the attacks interact with other military and political efforts to pursue political objectives. Reckoning with the reality that these attacks are one tool Iran uses to wage war allows one to fully conceptualize the scope of the challenge and how the attacks interact with other threats. Governments can then develop responses across the full spectrum of a state's capabilities, rather than relying upon law enforcement alone to devise largely reactive solutions.