MAX Intelligence: Hezbollah UAV Threat in Europe

Executive Summary

• The uncovering of a Hezbollah-operated network used to manufacture unmanned aerial vehicles (UAVs) in Spain and Germany reflects the group’s established logistical and financial operations in Europe.

• Although the primary objective of the network was seemingly to transfer components to Lebanon, the operation underscores the risk for the same infrastructure to be repurposed by the group to support attacks within Europe at relatively short notice.

• Such attacks could potentially be carried out by the group on directives from the Iranian regime, of which Hezbollah is a proxy, and which has consistently demonstrated its intent to carry out attacks in Europe.

• The overall failures of the group to conduct notable attacks in Israel further raise the potential for it to seek to utilize its networks in Europe to carry out attacks in the region, primarily against Israeli or Jewish targets.

• Travel to Europe may continue while maintaining heightened vigilance for the latent threat of potential attack plots by Iranian proxy terrorist groups, including Hezbollah.

Current Situation

• On April 1, Spain’s Guardia Civil, the national gendarmerie, arrested three individuals in Barcelona’s Eixample District in connection with an ongoing operation targeting the Lebanese Shiite Muslim terrorist group Hezbollah. The arrests were carried out during raids of residential properties and Spanish companies directly involved in acquiring materials needed for constructing unmanned aerial vehicles (UAVs) capable of carrying explosive payloads.

• Reports indicate that the arrests were conducted near the Basilica Sagrada Familia and the Jewish Quarter. One suspect remains in police custody, while the other two have been released under security conditions.

• Authorities have not confirmed whether UAV components were discovered in the recent raids. However, such components were discovered in the early stages of the operation in July 2024, when the Guardia Civil detected suspicious purchases by Spanish companies managed by Lebanese nationals. The purchases were of materials and components used to manufacture military-grade UAVs, namely; electronic guidance systems, propulsion propellers, gasoline engines, more than 200 electric motors, over 12 tonnes of resin, and other hardening agents used to make fuselages, and wings.

• Police also detected links to such purchases in Germany, including by a registered toy company, resulting in coordinated arrests by Spanish and German law enforcement. Three people were arrested in Barcelona and Badona, Spain, and one person was arrested in Salzgitter, Lower Saxony, Germany.

• Authorities believe Hezbollah may have constructed over 1,000 UAVs using these components, with reports indicating that components were discovered in neutralized UAVs in Israel fired from Lebanon since October 8, 2023.

• The operation targeting Hezbollah’s logistical network in Europe is ongoing, with Spanish law enforcement coordinating with Germany’s Bundeskriminalamt (Federal Criminal Police), France’s Direction Generale de la Securit Interieure (Special Intelligence Service), and the British Counter Terrorism Command (CTC).

• Spanish authorities have confirmed that Hezbollah operatives also used other illicit methods to purchase materials, including through fake businesses. For instance, the group gathered data of individuals who purchased football tickets from online vendors to falsify invoices and fragment the purchases of materials, enabling them to circumvent control mechanisms. They also concealed the nature of and destinations of shipments from Spain and other countries to Lebanon.

Assessments & Forecast

Uncovered UAV manufacturing network reflects Hezbollah’s established logistical and financial operations in Europe

1. The uncovering of Hezbollah’s UAV manufacturing network in Spain and Germany underscores the group’s established logistical and financial presence in Europe. European security agencies in multiple countries have intermittently uncovered logistical networks run by Hezbollah operatives aimed at supporting operations in Lebanon in previous years as well. In 2020, the USA accused Hezbollah of continuing to stockpile ammonium nitrate – a chemical substance used for explosives in attacks – in Europe, claiming that stockpiles still exist in Greece, Italy, and Spain. The group is known to import ammonium nitrate into Lebanon from abroad, with the 2020 Beirut port explosion also triggered by the ignition of a shipment of ammonium nitrate suspected to be linked to Hezbollah. Moreover, Hezbollah has also been linked to the militant Irish Republican Army (IRA), with IRA members reportedly visiting Lebanon in 2018 to establish weapons smuggling routes between Ireland and Lebanon.

2. In the recent case, although the arrests and raids were carried out only in 2024-25, the complexity and geographic spread of the network, involving coordinated procurement of UAV components across two jurisdictions, point to a sophisticated logistical setup, suggesting that the network may have been active for several years. That the network is believed to have already manufactured over 1,000 UAVs and that such components were discovered in neutralized UAVs in Israel fired from Lebanon since October 2023 adds credence to this.

3. In addition to its logistical operations, Hezbollah also maintains a financial support network in Europe. Hezbollah members are known to utilize European ports and links to local organized criminal networks to traffic narcotics from Latin America and West Africa for financial gain. Hezbollah operatives also launder money through a range of methods—including the sale of luxury goods and falsified invoices—while leveraging charities, businesses, mosques, and Islamic community centers as fronts to conceal the flow of illicit funds. This was confirmed by Europol in its annual Terrorism Situation and Trend Report in 2022.

4. Hezbollah’s activities in Europe are facilitated in part by the EU’s decision to treat its “military” and “political” functions as separate entities — a separation Hezbollah itself does not recognize. While Germany and the UK designated Hezbollah in its entirety as a terrorist organization in 2020 and 2019, respectively, the EU only designates Hezbollah’s “military wing” as a terrorist organization. The alleged “political wing” remains unsanctioned, primarily because it holds seats in Lebanon’s parliament, with EU diplomats arguing that sanctioning it would thereby preclude any diplomatic engagement with Lebanon. This, in turn, allows Hezbollah officials to avoid travel bans in EU countries despite the group being on the terrorist list, as well as to continue fundraising in Europe under the rubric of political activity.

5. FORECAST: Hezbollah’s financial and material losses in hostilities with Israel in 2024-25 are likely to result in the group seeking to intensify its logistical and fundraising activities in Europe to cover a part of such losses. This, coupled with the recent exposure of the UAV procurement network, is likely to prompt increased scrutiny of Lebanese diaspora-linked businesses and commercial logistics channels in Europe, particularly those involved in sectors like electronics, aviation components, and industrial chemicals. With that, further raids, arrests, and sanctions targeting such entities are expected. However, considering Hezbollah’s use of intricate networks of shell companies, such as the toy company used in Germany, and the use of online ticket vendors, authorities will face challenges in tracking all its illicit activity. That Hezbollah also uses legal companies, often owned by members of the Lebanese diaspora, further complicates these operations and will allow parts of its infrastructure to remain operational despite ongoing investigations.

Existing logistical infrastructure can potentially be repurposed by Hezbollah to carry out attacks in Europe, reflecting latent threat posed by group

1. Statements from authorities in Germany and Spain that the UAV components were destined to be shipped outside of Europe indicate that the primary objective of the logistical network was to manufacture and export such components to Lebanon. However, the same infrastructure used to facilitate material transfers abroad can also be rapidly repurposed by the group to support attacks within Europe, either on its own accord or if directed by Iran, given that Hezbollah is an Iranian proxy.

2. The Iranian regime has consistently demonstrated its intent to conduct attacks in Europe, particularly against Israeli and Jewish targets. In May 2024, Sakerhetspolisen, the Swedish intelligence services, confirmed that Iran recruited the Swedish Foxtrot and Rumba organized crime groups to conduct attacks on such targets in the Nordics. In October 2024, a shooting occurred outside the Israeli Embassy in Stockholm, and two hand grenades exploded near the Israeli Embassy in Copenhagen, Denmark. Sapo reported that Iranian involvement was likely. Further, on May 3, 2025, the UK’s police arrested four Iranian nationals suspected of plotting a terrorist attack, with media reports indicating the target was the Israeli Embassy in London. Hezbollah itself has also intermittently sought to carry out attacks in Europe, most recently against Israeli travelers in Cyprus in 2021.

3. As such, Hezbollah’s existing logistical infrastructure, coupled with proven Iranian intent to carry out attacks on European soil, highlights the underlying threat posed by the group in Europe. FORECAST: The group can leverage this infrastructure in the region to attempt to carry out attacks in Europe, which, while infrequent, could materialize with little warning—particularly if regional tensions in the Middle East escalate or directives are issued from Tehran. The overall failures of Hezbollah to conduct notable attacks in Israel further raise the potential for it to seek to carry out attacks on Israeli or Jewish entities in Europe. Such plots may involve the use of explosives, considering past discoveries of Hezbollah-linked ammonium nitrate stockpiles in European countries. Moreover, given the recently uncovered UAV-manufacturing network, a more latent and unprecedented risk also lies in Hezbollah potentially attempting to deploy explosive-laden UAVs for attacks on European soil. If such an attack is plotted, it would be significantly harder to prevent than conventional attacks, due to the current limitations in European counter-UAV defenses, particularly in urban environments.

4. FORECAST: The primary targets of any attack plots by Hezbollah are liable to include Israeli and/or Jewish entities, including Israeli embassies, Jewish community centers, Jewish schools, synagogues, businesses catering to Jewish and Israeli individuals (such as kosher hotels, restaurants, or grocery stores), and Israeli tourists. In a less likely scenario, Hezbollah could also seek to target strategic sites, such as airports, seaports, or critical infrastructure — where even limited physical damage can cause extensive disruptions — with the aim of maximizing public fear, disruptive impact, and pressurizing European countries to drop support for Israel. .

Recommendations

1. Travel to Europe may continue while maintaining heightened vigilance of the latent threat of potential attack plots by Iranian proxy terrorist groups, including Hezbollah.

2. Maintain heightened vigilance at locations linked to Israeli or Jewish entities, festive events, major public spaces, transportation hubs, and religious sites with large crowds due to the potential for attacks.

3. Alert authorities immediately upon witnessing suspicious items or behavior.

4. Public, private, and third-sector organizations are advised to increase their awareness of threats on social media through the use of threat monitoring services. Increased awareness of an organization’s political footprint and perceptions from fringe online groups can help uncover potential violent actors and plots before they occur.

5. For further questions and risk assessments, please contact intel@max-security.com.