At the end of June, Cypriot police detained a man with a camera near the British airbase in Akrotiri. The detainee was a 40-year-old Azerbaijani with a British passport who was posing as a tourist. As the special services soon established, he is an agent of the Al-Quds special unit of the Islamic Revolutionary Guard Corps, operating in Cyprus under cover.
Almost simultaneously, another «tourist» of Azerbaijani origin was arrested in Crete—according to some sources, he had a Polish passport, according to others, a Polish residence permit. He was secretly filming and photographing strategic objects at the NATO naval base in Souda Bay. Greek and Cypriot special services speak of a coordinated operation by Iranian intelligence. However, they are silent on the main point: behind the actions of Iranian agents, coordination by Russian special services is becoming increasingly apparent.
Iran and Russia are strategic allies and have been strengthening their cooperation in many areas in recent years, from the supply of Iranian drones to Russia for the war against Ukraine to the creation of logistics routes to circumvent sanctions. Their cooperation is not limited to this. According to sources at the Center for Investigation and Research (CIR) in the security structures of Eastern European countries, there are signs of possible involvement by Russian special services in coordinating Iran’s intelligence activities in the Eastern Mediterranean region.
In particular, this involves providing technical support and logistics to the Islamic Republic’s agent networks and helping to «legalize» agents in EU countries.
According to information received from the intelligence services of one of the EU countries, as early as 2024, the Russian Foreign Intelligence Service (SVR) gave its Iranian counterparts access to a network of «sleeper» agents in Europe, including Cyprus, to monitor NATO and Israeli targets, critical communications infrastructure, and Israeli citizens living or temporarily staying in the EU.
In Cyprus, Iranian agents made several attempts to organize terrorist attacks targeting Israeli citizens and facilities linked to Israeli interests. It is noteworthy that one of the recruited perpetrators of the failed attacks turned out to be an Azerbaijani with Russian citizenship, which clearly indicates coordination between Iranian and Russian special services. It is impossible to imagine that the Russian special services were unaware of the recruitment of their citizen by their Iranian counterparts.
There have also been cases of coordination between hacker groups linked to Russian military intelligence and Iranian cyber units working for the Islamic Revolutionary Guard Corps.
According to Israeli security services, hackers from Russia and Iran, acting under the control of their countries’ special services, were involved in the Hamas attack on Israel on October 7, 2023. This refers, in particular, to cyberattacks on early warning systems, communication channels, and infrastructure facilities carried out in the run-up to the attack by Palestinian terrorists from Gaza on Israel.
Cyprus has long been considered a weak link in the EU’s security system. For decades, Russian spy and sabotage structures have been formed and expanded here, turning the island into their agent center. Organizations and companies directly linked to the Kremlin are still operating on the island. Moscow’s agents of influence operate freely, and Putin’s sanctioned oligarchs keep their assets hidden under the guise of legitimate European businesses.
The British RAF Akrotiri airbase, near which the detained Iranian agent was operating, plays a key role in defending Cyprus from attacks by dictatorial regimes in Muslim countries in the Middle East and in Western coalition operations in the region. It is from this base that aircraft take off to monitor the situation in Syria, Lebanon, Iran, and Iraq, ready to repel any attack on Cyprus, whether from these countries or from Muslim terrorist organizations based on their territory.
It is not surprising that information about this facility is of interest to Tehran and its strategic ally, Moscow.
«We are seeing increasing mutual use of capabilities. Russian intelligence is helping the Iranians with legalization and forged documents in the EU, while the Iranians are providing Russia with access to data on Western facilities, to which Moscow lost a significant part of its intelligence channels after 2022,» said an officer of one of the European special services, who wished to remain anonymous, in a conversation with CIR experts.
The situation is similar in Greece. The Bay of Suda in Crete is home to one of NATO’s key bases in the Mediterranean. Naval exercises, equipment transfers, and visits by American warships all came under the scrutiny of an Iranian agent arrested in Chania. As in the case of Cyprus, he had maps, a camera, a laptop with encryption equipment, and USB drives. It has been revealed that he transmitted data via a VPN registered on a Russian server in Kaliningrad. This can hardly be considered a coincidence. It is curious that some Russian IT companies that have moved from Russia to Cyprus in recent years also use servers located in the Kaliningrad region for their work.
Since invading Ukraine, Russia has increasingly been acting through proxy structures and allies. In Iran, Moscow has found not only a supplier of drones and missiles for the war against Ukraine, but also someone to do its dirty work in EU countries. «If a Russian agent had been detained at a NATO base, it would have caused a huge scandal. If an Iranian with a Polish or British passport does it, Russia remains in the shadows,» notes the CIR analyst.
It is time to admit that the Eastern Mediterranean is no longer a peaceful resort. It is the front line of a hybrid war that Russia is waging against the European Union together with Iran.
Boris Demash, specially for Cyprus Daily News