Shortly after midnight on 27 September, a local farmer noticed three white vans stopped on a road near RAF Fairford in Gloucestershire, an airbase that has become a critical hub for US strikes against Iran. She drove past the vans with her husband to get a closer look and saw a group of men wearing hooded shirts and masks. She called a Ministry of Defence (MoD) emergency line but no one answered. Then she called 999. Within minutes, she says, a helicopter with a searchlight appeared overhead and armed police descended on the area. A neighbouring village was evacuated as a bomb-disposal robot examined the vehicles. Five men were arrested on suspicion of offences including preparation of a terrorist act.
Donald Trump swiftly praised the British police for an “amazing job”, claiming the men had already been under investigation. “They were looking to do big damage to our fort,” he told reporters in Chicago later that day. “We had them under view for a long time and we got ’em.” A slew of headlines promptly followed about “explosive-filled vans” and an “Iran bomb plot”, framing the incident as a revenge attack by Tehran for the British government permitting American bombers to use the base. The Iranian embassy in London denounced the reports as “unfounded and malicious speculations” intended to “fuel Iranophobia propaganda in the UK”.
But then came the twist. On 28 September, Laurence Taylor, the head of UK Counter Terrorism Policing, announced that the five men, who were British nationals in their twenties living in London, had been released on bail. Taylor also said investigators were considering “every possible angle”, including whether the incident may have been “committed by proxies, or individuals either knowingly or unknowingly, working on behalf of a foreign state”.
As the New Statesman went to press, no such link had been established and none of the men had been charged. Yet Taylor’s reference to “proxies” working on behalf of a foreign government resonates with security experts who track threats against the UK from Russia and Iran. Both states have form for recruiting criminals and other private citizens to carry out attacks, sometimes unwittingly, as part of an escalating hybrid campaign. As Taylor noted, “Often this threat becomes visible to us as criminal activity, often at a small scale and committed by individuals whose primary aim is not terrorism but a quick financial gain.” Such plots can be hard to detect and even harder to attribute to their ultimate sponsors. Unlike individuals with known links to terrorist groups, or foreign intelligence officers entering the UK, the British security services cannot monitor every petty criminal looking to make a few hundred pounds by accepting an offer they get online to move a package or start a fire.
Regardless of what we learn about the incident at RAF Fairford, the wider pattern is clear: we have entered a new era of state-backed shadow warfare that will not be constrained by national borders and is likely to intensify. British troops might not be fighting in Ukraine or the Middle East, but in the eyes of both Moscow and Tehran, the UK is inextricably bound to both conflicts and therefore considered fair game. Iran’s powerful Revolutionary Guard warned the UK government in July, three days after Andy Burnham became Prime Minister, that any bases used to launch attacks on Iranian territory would be considered a “legitimate target”. (An Iranian-made drone struck the RAF Akrotiri air base in Cyprus in March, although there were reports at the time that it had been fired by Hezbollah.) Moscow has issued similar warnings. In May 2024, after the then foreign secretary, David Cameron, said Ukraine could use British weapons to strike targets inside Russia, the Russian foreign ministry warned that British military facilities and equipment could be targeted “on the territory of Ukraine and beyond”.
Russian and Iranian attacks on British soil are not a new development. Twenty years ago, the former Russian spy Alexander Litvinenko was poisoned with polonium-210 in London, condemning him to an agonising death and leaving a trail of radiation across the city as part of an audacious assassination that is likely to have been approved by Vladimir Putin. Two Russian military intelligence (GRU) officers attempted to murder Sergei Skripal in Salisbury in 2018 using the military-grade nerve agent Novichok with a dubious cover story about seeing the city’s cathedral spire. The attack left Skripal and his daughter critically ill and killed a British woman named Dawn Sturgess. The inquiry into her death concluded that the evidence “this was a Russian state attack is overwhelming”. Pouria Zeraati, a presenter for the dissident Iranian broadcaster Iran International, was stabbed outside his home in Wimbledon in 2024 in an attack a British judge ruled was carried out “for the benefit of a foreign power”, with the evidence pointing “overwhelmingly” to Iran.
Whereas these previous attacks appear to have been focused on internal regime dynamics, Russia has now embarked on a concerted campaign to influence other nations’ politics, including the UK’s, attempting to stoke societal divisions and undermine support for Ukraine. This, too, is less a new dynamic than a return to the tactics of the Cold War, when the KGB pursued “active measures” that included disinformation, forgeries and sabotage. In 1971, for instance, Edward Heath’s government expelled 105 Soviet diplomats after a KGB officer defected with evidence of plans to attack British infrastructure. What has changed, however, is the technology that makes recruiting and directing such attacks substantially easier.
In 2025, the then head of MI5, Ken McCallum, said the threat from groups such as al-Qaeda remained “huge”, but the most significant shift the agency had seen was the rise of state-directed threats. Over the past 12 months, he said there had been a 35 per cent increase in the number of people under investigation for “state threat activity”. This included espionage but also the “ugly methods MI5 is more used to seeing in our terrorism casework”, such as sabotage, arson and physical violence. “We are dealing with these threats every day,” he said. This included tracking more than 20 “potentially lethal Iran-backed plots” during the previous year.
Russia, in particular, has increasingly embraced the use of proxies. In part, McCallum said this shift had been forced by the expulsion of hundreds of Russian spies from embassies in recent years, but these tactics also gave the Russian intelligence services a plentiful supply of “disposable” operatives who could be recruited on social media, paid in cryptocurrencies and readily abandoned if caught. Last October, six men were sentenced to more than 50 years in prison between them for setting fire to an east London warehouse containing aid and satellite equipment bound for Ukraine. The attack was orchestrated by two men working for the Wagner Group, the Russian mercenary organisation. Iranian attacks to date have had a different centre of gravity, generally targeting dissidents and perceived opponents of the regime. Parliament’s Intelligence and Security Committee published a report last July that characterised the Iranian threat as “wide-ranging, persistent and unpredictable”, although less developed and strategic than the threat posed by Russia and China.
The Kremlin’s risk tolerance for these attacks appears to be dangerously increasing. In August, the German government said Russia was behind an incident at Leipzig Airport where an explosive-laden drone landed near a refuelling Ukrainian aircraft. Two more drones were later found. If the attack had succeeded, officials said dozens of people could have been killed. Suspected Russian drones, albeit apparently unarmed, have been spotted over military bases and airports from Denmark to Norway. The MoD recorded 340 incidents involving drones more broadly near military sites in the UK over the past year (up to August), according to figures obtained by the Independent. Drones were also spotted over RAF Fairford in 2024, though it’s not clear who was responsible.
Denmark’s defence intelligence service warned on 24 September that Russia is likely to step up its campaign in the coming months, including “destructive cyber-attacks with serious consequences for critical societal functions” and “sabotage attacks with a high risk of casualties”. Thomas Ahrenkiel, the agency’s head, said there was a “low, but increasing risk” that Russia would directly attack a member of Nato. Poland’s foreign minister, Radek Sikorski, told an audience in New York the following day that they were receiving information from “many” sources that Russia is “preparing something big this year”.
This does not mean Vladimir Putin wants an all-out war with Nato. With Russia barely advancing in Ukraine, Putin presumably understands that he does not have the resources to pick a conventional fight with the alliance. But this is what makes hybrid warfare so well suited to his current means and objectives. Calibrated to fall below the level that would be likely to trigger a collective response – and still deniable – such attacks are aimed at stoking fears and exacerbating divisions in Europe, and undermining confidence in Nato’s Article 5 commitment to collective defence. Outlining a series of incidents in recent weeks – which have included a Russian warship firing flares at a Danish helicopter, Nato jets shooting down a drone over Lithuania and a drone recovered from Polish waters – the EU’s foreign policy chief, Kaja Kallas, told the European Parliament that such attacks were part of a concerted plan. “They are calculated attempts by Russia to weaken our resolve, test our unity and play with fears of escalation,” she said.
None of this proves that Iran, or any other state, was behind the incident at RAF Fairford, though the US secretary of state, Marco Rubio, has insisted that a “foreign actor” was involved. But it is clear that the larger threat to the UK has not gone away. Both Iran and Russia have warned that British military facilities could be targeted, and both have demonstrated that they are willing to pay proxies to carry out attacks on British soil. The British government may regard these as distant wars. Moscow and Tehran do not.
[Further reading: The ghosts of Drumcree return]
Content from our partners
Related
This article appears in the 01 Oct 2026 issue of the New Statesman, Sunshine and Rain
Join the debate
Subscribe here to comment