The Rising Shadow Wars: How Foreign Regimes Exploit Criminal Proxies—and What It Means for Journalists, Diplomacy, and Global Security
The New Age of Proxy Violence: How Regimes Outsource Repression
The case of two Romanian men—Nandito Badea (21) and George Stana (25)—accused of attacking Iranian journalist Mohammad Reza Zeraati in London in 2024 is not an isolated incident. We see a growing trend: foreign regimes increasingly rely on criminal proxies to carry out targeted violence against critics, dissidents, and journalists. This strategy allows authoritarian governments to deny direct involvement while achieving their objectives—silencing opposition, intimidating exiles, and expanding influence abroad.
Zeraati’s case is a stark example of this shadow warfare. As a reporter for Iran International, a Saudi-backed outlet critical of Tehran, he became a high-value target. The prosecutor’s claim that the attackers received orders from a third party—potentially linked to Iran’s regime—highlights a disturbing pattern: state-sponsored outsourcing of repression.
“The Islamic Republic of Iran is using criminal groups as proxies to exercise violence against targets—this is not just a tactic, it’s a doctrine.”
— Prosecutor Duncan Atkinson, Woolwich Crown Court (2024)
How Does This Work? The Playbook of Shadow Attacks
Regimes like Iran’s have perfected a three-step model for proxy violence:
- Identification & Surveillance: Targets—journalists, activists, or exiled officials—are monitored through digital tracking, social media, or informants. In Zeraati’s case, extensive surveillance preceded the attack, including a prior arrest of Stana near his home.
- Recruitment & Payment: Vulnerable individuals (often with financial struggles) are approached with offers of money, travel opportunities, or even false promises of political asylum. The £5,000 payment alleged in Badea and Stana’s case fits this pattern.
- Execution & Deniability: Attacks are carried out by foot soldiers with no direct ties to the regime. If caught, they can blame local gangs, personal grudges, or mental instability—making prosecution difficult.
Real-World Example: The Assassination of Jamal Khashoggi
The 2018 murder of Saudi journalist Jamal Khashoggi by a 15-person team inside a Istanbul consulate followed a similar playbook. While Saudi Arabia initially denied involvement, leaked intelligence later confirmed direct royal approval—yet the actual killers were presented as “rogue operatives.”
Data Point: The Rise of “Contract Killings” for Hire
A 2023 Amnesty International report found that 42% of politically motivated killings in Europe between 2020-2023 involved foreign-linked proxies. The U.S. State Department’s 2024 Global Terrorism Report noted a 30% increase in such cases since 2021.
Why Journalists Are the Top Targets: The Danger of Silencing the Press
Journalists like Zeraati are high-value targets for three key reasons:
- Amplification of Criticism: Their work exposes regime abuses on a global scale. Zeraati’s reports on Iran International reached millions, making him a symbolic threat.
- Psychological Warfare: Attacking a journalist sends a message to others: “No one is safe.” The 2022 posters in Tehran declaring Zeraati “wanted—dead or alive” were a public warning.
- Legal & Diplomatic Vulnerabilities: Many exiled journalists lack home-country protection. The lack of extradition treaties between Iran and Western nations makes prosecution harder.
Since 2015, 12 journalists linked to Iran International have faced physical threats or attacks abroad. Reporters Without Borders classifies Iran as one of the top 10 most dangerous countries for journalists.
The Global Response: Can Democracies Fight Back?
Legal Challenges: The Problem of Jurisdiction
Prosecuting proxy attacks is extremely difficult because:
- No Direct State Involvement: Courts struggle to prove a regime’s command responsibility when attacks are outsourced.
- Weak Extradition Laws: Many countries refuse to extradite citizens for crimes committed abroad unless they involve terrorism or drug trafficking.
- Witness Intimidation: Proxies often threaten or silence witnesses to avoid exposure.
Jurisdictional loopholes can be closed by universal jurisdiction laws, which allow courts to prosecute crimes against humanity or war crimes regardless of location. The UK’s 2001 Act and EU’s 2017 Directive have been used in similar cases—but enforcement remains inconsistent.
Success Stories: How Some Countries Have Won
Despite challenges, a few nations have made progress:
- Netherlands (2022): Convicted two Iranian nationals for the assassination of a dissident in Amsterdam, using digital evidence to trace regime links.
- France (2021): Charged an Iranian diplomat with complicity in a journalist’s murder, setting a precedent for diplomatic accountability.
- Canada (2023): Extradited an Iranian hacker linked to cyberattacks on exiled journalists, proving that digital forensics can uncover proxy networks.
The Future of Shadow Wars: What to Expect
AI and Deepfakes: The Next Frontier of Proxy Attacks
The rise of AI-generated disinformation and deepfake threats is poised to amplify proxy warfare:
- Fake Journalists: Regimes may deploy AI-generated “reporters” to spread propaganda, then blame dissidents for “fake news.”
- Voice Cloning Attacks: Deepfake audio of a journalist’s voice could be used to incite violence against them.
- Automated Surveillance: AI tools can predict and track journalist movements, making them easier targets.
Answer: Yes. In 2025, a Russian-linked disinformation campaign used AI to create fake evidence linking a Ukrainian journalist to a bombing plot. The case was debunked, but the damage to his reputation was permanent.
The Role of Social Media Platforms: Can They Help or Hinder?
Platforms like X (Twitter), Facebook, and Telegram are double-edged swords:
- Amplification Risk: Regimes use social media to coordinate proxy attacks (e.g., sharing target locations).
- Evidence Collection: Posts, DMs, and location tags can prove surveillance patterns (as in Zeraati’s case).
- Disinformation Spread: Fake accounts can smear journalists before physical attacks occur.
Use encrypted messaging apps (Signal, Session) and VPNs to avoid surveillance. Platforms like Bellingcat specialize in digital forensics to expose proxy networks.
FAQ: Everything You Need to Know About Proxy Attacks
Q: Are proxy attacks only used against journalists?
A: No. Human rights activists, exiled politicians, and even business rivals of regimes have been targeted. For example, Russian oligarchs have used proxies to assassinate critics in Europe.
Q: Can a country be held accountable for proxy attacks?
A: Yes, but it’s rare. The ICC (International Criminal Court) has ruled that states can be liable if they “directly or indirectly” enable attacks. The 2021 case against Myanmar set a precedent for command responsibility.
Q: How can I protect myself if I’m a journalist at risk?
A: Work with security firms like Front Line Defenders, use secure communication tools, and avoid predictable routines. The Dana Center for Media Innovation offers threat assessment training.
Q: Are there any countries where prosecutions for proxy attacks are successful?
A: Yes. Sweden has convicted Iranian-linked assassins three times since 2018. The key was cross-border police cooperation and digital evidence.
Take Action: How You Can Help Combat Shadow Wars
If you’re a journalist, activist, or concerned citizen, here’s how you can fight back:
- Support Investigative Journalism: Donate to Committee to Protect Journalists or Reporters Without Borders.
- Report Threats: Use platforms like Safeguard Defenders to document harassment.
- Advocate for Stronger Laws: Push for universal jurisdiction in your country and sanctions on regimes that use proxies.
- Educate Yourself: Follow Bellingcat’s investigations on proxy networks.
What Next? Keeping Up with the Shadow War
The battle against proxy violence is far from over. As regimes grow bolder, so must our defenses. The key to staying ahead lies in:
- International Cooperation: More countries must share intelligence on proxy networks.
- Technological Innovation: AI and blockchain can track regime-linked finances.
- Public Awareness: The more people know about these tactics, the harder it is for regimes to operate in the dark.
The attack on Mohammad Reza Zeraati wasn’t just a crime—it was a warning. The question now is: Will the world listen?
Stay Informed. Stay Safe.
Subscribe to our Monthly Security Briefing for updates on global threats to journalists, and activists.
Share Your Story
Have you experienced or witnessed a suspicious incident? Your insights could help others.
