As British authorities continue their investigation into the terrorism incident at RAF Fairford base, the nation’s intelligence services are warning of a “major shift” in Iranian strategy.
Sir Ken McCallum, director general of MI5, explained this observation during his annual threat update at Thames House on Tuesday. After speaking about threats posed by Russia and China — declaring that the former remains “aggressor number one” — McCallum turned his attention to Iran’s recent efforts toward “subcontracting its UK violence.”
“Today, we continue to see familiar Iranian intent — using criminal proxies to try to intimidate oppositionists, Iranian media organizations, and Israeli sites,” McCallum said. “But 2026 has also seen the Iranians, like the Russians, attempting to expand their hybrid campaign. Over the last twelve months, our Iran-linked operations have led to more than fifty arrests in the UK.”
McCallum seemed to directly acknowledge the Fairford incident in his speech, noting that a “major shift this year has been Iranian ambitions to come at harder targets, like military sites.”
Six people have been arrested in connection with the incident, including five British nationals and one British-Iranian dual citizen. The original five were targeted for arrest after a local farmer tipped off police to a suspicious group of people meandering near the base, in vans bearing fake business logos. The base has been used by the United States during the war with Iran. The sixth was arrested in London afterward.
All six suspects have been released from prison on bail but remain under intense police surveillance and restriction of movement as the investigation is ongoing.
Prime Minister Andy Burnham revealed last week in the House of Commons that the Fairford incident was “almost certainly” a scheme designed by Iran.
“I can confirm our assessment that it is highly likely to have been coordinated in Iran, almost certainly directed by Iran’s Islamic Revolutionary Guard,” Burnham told Parliament. “We will not tolerate these threats on our soil.”
The prime minister announced that his government would take immediate action to combat Iranian infiltration of criminal networks and reduce their ability to manipulate actors in the United Kingdom.
“You will appreciate that, with live investigations ongoing and the need to avoid prejudicing future prosecutions, there are things I can’t say,” McCallum said in his threat update. “What I can say is that those who seek to cause mayhem on British streets — whether hired thugs here or their paymasters overseas — will meet an unflinching response.”
Commissioner Laurence Taylor, head of the London Metropolitan Police’s Counter Terror unit, said all the way back at the beginning of the investigation that authorities are discerning whether the incident “may be activity committed by proxies, or individuals either knowingly or unknowingly, working on behalf of a foreign state.”
Countries across Europe have seen a surge in terrorist incidents carried out remotely by individuals recruited through online channels. The most prominent front-group involved in this scattershot terrorist campaign has been Harakat Ashab al Yamin al Islamiyah.
HAYI, believed by Western allies to be a sock-puppet of the Revolutionary Guard, has taken credit for over a dozen attacks across Europe — mostly targeting Israeli institutions and Jewish communities. These attacks have largely been carried out by local criminals enlisted for payment. These low-level thugs typically are not believed to be formally aligned with Iran.
It is understood that the six suspects arrested by British authorities are not currently believed to have been ringleaders in the plot, despite their involvement in potentially criminal activity at the air base.
A British official explained to the Washington Examiner that the ongoing investigation by British authorities is seeking to understand “the degree to which they are […] complicit, willing, aware” of the broader plot attributed to the Guard.
“Everyone’s focused on the five,” the official said. “They’re being investigated and we don’t arbitrarily detain people unless we’ve got a reason to detain them.”
The U.S., U.K., and 27 other countries issued a joint statement on Monday condemning “Iran’s use of violent attacks, including the acts of lethal plotting, arson, sabotage, cyber-attacks, and other hybrid activities against us and our partners.”
The document recognized “attribution of Iran’s involvement in the incident at RAF Fairford” and explicitly compared the situation to attacks claimed by HAYI.
“Any attempt by Iran to threaten, silence, intimidate, harass, harm, or coerce people on our territories through proxies or any other means is unacceptable,” the statement reads. “Anyone who conducts hostile activities on behalf of Iran, or any other state, should know that we will take action to identify, investigate, disrupt, and prosecute these acts.”
The international media frenzy sparked by the Fairford incident has been a headache for British authorities and officials.
The U.S. rotated its bombers out of the air base earlier this month, though Secretary of State Marco told the media that he “wouldn’t directly tie” the van incident “to the move that was made.”
Ria Reddy, a member of the Iran team at the American Enterprise Institute’s Critical Threats Project, told the Washington Examiner that she believes “attacking US aircraft in the UK is intended to impose costs on the US” and ultimately reduce the American government’s “willingness to continue the conflict.”
“It’s important to emphasize the U.S. presence at this U.K. base. I don’t think this was just a one-off terror attack in the UK that you might see something like [HAYI] conduct,” Reddy told the Washington Examiner. “I think this was part of a strategic objective that we’ve been tracking for months and months — Fairford serves as a forward-operating base for the U.S. Air Force Global Strike Command and played a direct role in some of those strikes.”
She compared the strategy to the Iranian attacks on U.S. bases in the Middle East, which have done little to compromise American military might but have hurt public perception of the war.
“I think the attack helps signal Iran’s ability to attack US assets outside the Middle East and increase this sense of paranoia or fear that Iran could target other US assets or bases outside the Middle East,” Reddy said.
President Donald Trump has both complimented British authorities on their handling of the Fairford situation and made passing criticism of them allowing the suspects out on bail.
He also suggested that the U.S. government knows extensive details about the suspects but has refrained from further explanation.