By Savannah Hamilton
Inside Iran’s Shadow Networks
It starts the way all good spy stories do. Scratchy static over a radio. Nothing sinister. Until the noise clears for a moment, much like a calm before the storm.
“Tavajjoh. Tavajjoh. Tavajjoh,” you hear suddenly.
Attention. In Persian, probably, you think… no, definitely!
Then numbers. Calm, mechanical, almost… casual.
“Se, hasht, haft, yek, shesh, noh…”
No context, no explanation, just some random guy reading off a string of digits which mean absolutely nothing — at least to you. But to the right person, it means everything. It’s giving an episode of LOST, except this is very far from fiction.
In case you missed it, just a few weeks ago, this same message was intercepted by American intelligence and some passionate radio enthusiasts.
The signal first appeared in late February, almost too perfectly timed — just hours after tensions with Iran flipped over into open escalation, in fact. Coincidence? Maybe. But in politics, timing is rarely random.
When news outlets caught on, the first headlines asked, ”Is this a secret signal to Iranian spies abroad?” Then the more curious questions came — about sleeper cells, political sabotage plots, activation codes, dormant threats, and finally the million-dollar question, “Are they actually out there?”
Long story short… Yes, but not in the way you think.
“The Numbers, Mason, What Do They Mean?”
As someone who loves to provide context and background, I’m gonna keep this short and not turn this into a nerdy lecture.
What you heard is what’s known as a numbers station — a Cold War relic that refuses to die. In fact, in today’s uber-modern age, where everything is tracked and monitored, they’re making a comeback.
These broadcasts send encrypted messages using sequences of numbers, typically decoded with something called a one-time pad. This makes them unbreakable. Not “hard to decode” — we’re talking literally impossible, not even with a supercomputer.
It’s old-school espionage at its finest. No internet, no metadata, no traceable communication trail. Just good old radio waves bouncing off the atmosphere, hiding in plain sight.
(Psst… If you want the deep dive, The Why Files does a dangerously good job explaining the whole thing. So for now, we’re keeping it simple and moving on.)
Because here’s where it gets fun.
This particular station (now labeled V32) showed up on February 28th and broadcast twice daily. Given the timing, everyone naturally assumed Iran was plotting something behind the scenes. After all, Iran has a long-standing history of operating abroad through covert networks — AKA what some might call “sleeper agents.”
Unfortunately, this is unlikely to be the case, as the more people dug into it, the less it pointed to Iran and the more it started raising eyebrows for entirely different reasons.
First, Iran isn’t historically known for using numbers stations. That alone doesn’t rule them out, but it does make it unusual. Second, the signal was being jammed by Iran itself, which strongly suggests they weren’t sending the message. And third, early triangulation placed the signal’s origin somewhere in Western Europe, which, on its own, doesn’t prove much, but paired with everything else, starts to paint a different picture.
This is likely a false flag. The leading theories point toward foreign intelligence services — either trying to communicate with operatives inside Iran, or deliberately stirring tension by making it look like something else.
It’s also worth noting how oddly “contained” the coverage was. The story made rounds in the US media and only lightly brushed parts of Europe. For something that’s giving the start of WWIII, the silence is almost as interesting as the broadcast itself.
Now, weeks later, that story has faded into the background. What remained, though, were questions that this situation raised. For example, if someone in Iran were trying to reach operatives, who exactly were they trying to reach?
Croatia Enters the Chat
To add to the drama, just as the radio waves started turning heads, another conveniently timed moment hit the headlines.
On March 6, Israeli envoy to Croatia, Gary Koren, went above and beyond standard diplomatic small talk, publicly calling on Zagreb to investigate its Iranian embassy while suggesting it could be hosting members of the Islamic Revolutionary Guard Corps (IRGC) operating as spies. And, just to keep things… calm and subtle, floated the idea of severing diplomatic ties altogether.
For most, this wasn’t a neutral or friendly observation. Given the greater context (AKA Israel and the US very much on the opposite side of Iran right now), this landed less as a warning and more as a political pew-pew. Even Croatian President Zoran Milanović didn’t take it lightly, calling it out as foreign meddling in domestic affairs.
Now, by itself? Just another day in Western Balkan politics, but combined with the curious timing of the numbers stations, and now everyone is suddenly asking about Iranian operatives abroad and, more importantly, their reach.
Interesting.
Whether it’s political steering, conspiracies, or whatever you want to call it, the narrative didn’t exactly come out of nowhere because it is very much real and very much a threat.
Sleeper Cells but Make It Modern
It’s no secret that Iran has been playing this game since 1979. Not necessarily loudly, not always successfully, but consistently — and that matters more in the dark ops business of 2026.
At the center of it sits the IRGC, and more specifically, its external operations arm, the Quds Force. If you’re picturing a traditional intelligence agency, you’re not entirely wrong… just maybe a little “underdressed” for what they actually do.
Officially, the IRGC is designated as a terrorist organization by several countries. Unofficially, it functions as a hybrid between military force, intelligence service, and off-the-books business, being the very definition of the word “problematic” on the geopolitical stage.
But here’s where there’s a bit of a twist. This isn’t an episode of “The Americans.” There are no perfectly embedded suburban agents waiting 20 years for a phone call with a code word. That model, while neat and still in use, is now a bit outdated — at least by the new (Iranian) standards.
What Iran has built instead is something harder to pin down and arguably better for modern warfare. They’ve managed to grow a loose network of ideological allies, diaspora, friendly proxy forces, and, increasingly, criminal networks. Call it… a fundamentalist criminal LinkedIn.
Hezbollah is the textbook case. Built, trained, funded, and effectively shaped by the IRGC, it operates as both a regional power and an extension of Iranian influence. But it’s far from the only piece on the board.
Other examples include them being major influencers in the growth of Shi’a militias across Iraq, the Assad-aligned networks in Syria, with the Houthis in Yemen, and multiple pro-Palestine groups. They may be separate, but the logic behind them is the same — all friendly with Iran, thanks to the support, and more than happy to return the favor when needed.
We can call them “sleeper cells” for simplicity, but that label doesn’t quite fit the narrative anymore. So much so that some argue this model is redefining how foreign covert ops are and will be operating in the coming years.
“We’ll Always Have… Amsterdam”
Via the Iranian approach, intelligence work isn’t always handled by intelligence officers. Often, it’s outsourced to people who operate on a very different… business model.
This particular way of operating has been speculated and talked about, but no one could quite provide a concrete example. That is, until the Dutch intelligence service did a deep dive on the Mocro Mafia (short for Moroccan Mafia).
Despite the name, they’re not based in Morocco. The term (coined by Dutch media) refers to a network of mainly Moroccan-Dutch criminal groups primarily operating across the Netherlands and Belgium. Drug trafficking is their core business, but contract killings and other dirty work are part of the package deal. According to European intelligence assessments, they’ve more than occasionally been… “useful” to Iranian assets.
In fact, over the past decade, more than 160 cases globally have been linked to Iranian operations involving criminal intermediaries. And quite a few of those trace back to networks operating out of the Netherlands, including alleged assassination plots. It’s neither a formal alliance nor a loyal following. Just mutual convenience.
Benefits abound. You already have experts in illegal affairs (no need for job check references), and Iran gets plausible deniability as the media blames “those damn immigrants” or “gang violence.” Meanwhile, Iran gets their work done, and criminal groups get paid. It’s a win-win!
What’s quite peculiar is that there’s a certain symmetry to it. The Mocro Mafia itself operates through decentralized, hard-to-trace networked structures. Sound familiar? It almost makes you wonder who inspired whom.
Unlike traditional criminal networks, the model is less hierarchical, more… ecosystem. A pyramid of connections where everyone knows someone who knows someone, and accountability gets lost somewhere along the way.
While the Mocro Mafia is the best documented proof, Iran’s footprints are everywhere else. They’ve also allegedly had arrangements with Mexican cartels for attempted assassinations in the US, and most recently, they’ve been spotted establishing their presence in Scandinavia.
Odd place, you’d think at first, but when you think about it, it actually makes perfect sense. Less in the spotlight compared to Western Europe, high-value diaspora communities (think academia, media, even people in political circles), and just enough distance from the usual intelligence scrutiny to operate quietly to get things done.
Clearly, Iranian ops are getting smarter despite being consistently underestimated, and it’s working for them. Which is why their newest little pet project should be raising more eyebrows than it currently is.
Hitmen for Hire, Coming to a City Near You
Now we get to the part that should have everyone’s attention by now, but oddly isn’t.
Because it’s one thing to imagine spies in tailored suits, slipping through airports with diplomatic passports, fancy padlocked briefcases, and carefully constructed cover stories. It’s another to realize that, increasingly, some of the work is being outsourced to people who live in a different world. Our world.
AKA not trained agents or ideological devotees — Just regular people like you or me.
According to recent Dutch intelligence reporting, cited in Politico, Iranian-linked operations are beginning to bypass traditional intermediaries altogether. Instead of relying solely on established proxy networks or criminal organizations, there’s a new trend of recruiting individuals with no formal ties to intelligence services. We’re talking students, bored stay-at-home moms, freelancers, or anyone in the right place at the right time with the right level of access.
Makes you really wanna rethink all those random Craigslist gig ads, no?
Thinking more broadly, though, it raises some uncomfortable but very real questions, such as, if the offer is high enough, the task vague enough, and the distance from the consequences far enough, how many people would actually say no?
This is where espionage starts to look less like a spy thriller and more like a kind of “gig economy” of covert operations. Low commitment, high deniability, and minimal traceability. You don’t need years of training or ideological alignment. You just need access, opportunity, and not to ask too many questions.
In our amazing economic times, where side hustles are not just common but often necessary, the recruitment pool is growing larger and easier to tap into. Furthermore, the model is efficient, scalable, and incredibly difficult to trace back to a central command structure.
Again — smart, efficient, very Iran-coded. Which, in many ways, makes it more dangerous than the traditional intel ops model ever was.
Something Old, Something New
And so, we circle back to where this story began.
A voice cutting through static. A string of numbers. A message that, to most, means absolutely nothing — and to someone else, potentially everything. An old Cold War trick, dusted off in the middle of a decidedly modern conflict.
But that signal was never really the story.
Whether it came from Iran, the US, Israel, or someone else entirely is, at this point, really doesn’t matter. Because what it did was much more valuable — bringing attention to Iranian intelligence networks.
Not enough attention is being brought to the fact that Iran isn’t relying on outdated methods but arguably reinventing the game itself, focusing on establishing a web instead of a network, and building relationships instead of rigid hierarchies where diaspora, proxies, criminal groups, and (coming soon!) ordinary people are part of the plot.
Based on their “success” over the decades, this is a model that isn’t going to die anytime soon and has plenty of room for improvement. And perhaps most importantly, it’s not staying uniquely Iranian.
We’re already seeing copycats of this strategy elsewhere — from Russian recruitment efforts targeting everyday individuals, to other intelligence services experimenting with the same low-cost, high-deniability approach. What started as a workaround is quickly becoming a template.
Which means the broader takeaway isn’t about one country at all, but that the rules of spy games and the stakes are changing in real-time. And that, honestly, should be a bit unsettling for everyone.
