“Sleeper Cells” and extremist networks in the Western Balkans – is the region at risk?

The United States intercepted encrypted communications earlier this month believed to have originated from Iran, which could serve as an “operational trigger” for sleeper agents around the world. Military analysts and experts agree that Iran is unlikely to direct its activities specifically toward the Western Balkans; however, they warn that “dormant” extremist networks and individuals still exist in the region and could be activated under certain circumstances—from terrorist incidents and sabotage to cyber operations.

Written by: Petar Rosic

An explosion outside the U.S. Embassy in Norway at 1 a.m. on March 8 was, for many, an indication that the conflict with Iran had spread beyond the Middle East.

Although media reports remain limited in detail, incidents across Europe have further fueled fears that Tehran has activated its “sleeper” terrorist networks. Just one day later, a bomb exploded in a synagogue in the Belgian city of Liège, and on March 14 another explosion was reported near a Jewish school in Amsterdam.

Additional concern was raised by a statement from the U.S. federal government indicating that the United States had intercepted encrypted communications believed to originate from Iran, which could serve as an “operational trigger” for sleeper agents, as reported by numerous global media outlets.

The notification refers to a “preliminary analysis” of signals of “likely Iranian origin” transmitted through multiple countries shortly after the death of Ayatollah Ali Khamenei, who was reportedly killed in a U.S.-Israeli attack on February 28.

Two days ago, the United States was further unsettled by reports of unidentified drones allegedly spotted above the Fort Lesley J. McNair military base, where U.S. Secretary of State Marco Rubio and Secretary of Defense Pete Hegseth reside. The incident prompted heightened security measures, according to The Washington Post, as cited by Reuters.
Former NATO official Jamie Shea also warned that U.S. bases in Europe could be at risk. Referring to Camp Bondsteel in Kosovo, he stated that it is unlikely to be among Tehran’s priority targets, as it is not used to support current U.S. operations, but cautioned about potential terrorist actions and attacks by individuals known as “lone wolves”—persons inspired by ideologies or groups but acting independently.

“Many Kosovars joined the Islamic State during the period of the caliphate. Some may have returned, and some may still be radicalized. That means there could be certain ‘pockets’ of radicalization. And I am not speaking only about Kosovo, as similar situations can occur in other European countries within Muslim communities,” Shea said.

Three Dimensions of Threat

Military analyst Vlade Radulovic assessed for Kosovo Online that the threat of terrorism in Europe, including the Western Balkans, is “absolutely real” and must be viewed through three dimensions.

“The first involves organizations, groups, or networks linked to existing terrorist organizations, which do not necessarily have to be connected to Iran. These could include groups such as the Islamic State, Al-Qaeda, and similar entities. The second dimension consists of individual perpetrators—so-called ‘lone wolves,’” he explained.

As a third, often overlooked aspect, Radulovic highlights cyberspace.

“There is a third dimension that is often neglected—the cyber domain. As it is colloquially described, hackers operating from hidden rooms… but terrorist attacks are also carried out in that sphere,” he warned.

A Threat Spanning Two and a Half Decades

Speaking about the risk of activating so-called sleeper cells and radicalized individuals, Radulovic emphasizes the continuity of threats spanning more than two decades.

“That danger is absolutely real. From the beginning of the global war on terrorism—since the Al-Qaeda attacks on the Twin Towers in 2001—there has been a constant threat,” he said.

He adds that hardly a year passes without attempted or carried-out attacks in Europe, highlighting as a particular concern individuals not registered in security databases.

“The greater problem lies with individuals who do not necessarily belong to any group or organization. Such persons are not recorded in police databases and are difficult to detect. They self-radicalize by following certain online platforms, form a narrative in their minds, and at some point decide to carry out an attack. We have witnessed this across numerous European cities, including during Christmas holidays,” he explained.

Radulovic also warns that additional security challenges stem from the migrant crisis and returning fighters.

“I am fairly certain that Europe still does not have a complete picture of who entered through the various migration waves. On the other hand, there are returnees from the ranks of the Islamic State from the Syrian and Iraqi battlefields who, unfortunately, have found refuge in the Balkans,” he noted.

Critical Points in the Region: Kosovo and Bosnia and Herzegovina

Discussing the Western Balkans, Radulovic states that the presence of individuals and cells is not in question. He notes that, relative to territory and population size, the largest number of Islamic State fighters who went to the Syrian-Iraqi battlefield came from Kosovo.

“Some of them, along with their families, have returned to Kosovo and Metohija. Another point is that, when examining terrorist attacks in Europe over the past 20 years, it is difficult to identify those with no connection whatsoever to Bosnia and Herzegovina. I do not mean the state itself, but individuals who at some point resided there, possessed Bosnian documents, had links to individuals from Bosnia, or received weapons and equipment from there,” he stated.

When asked about regional vulnerability, he assessed that it is shared.

“We share this risk primarily because we share the consequences of what befell the Western Balkans after the breakup of Yugoslavia—political instability, societal challenges—and the fact that we have two particularly sensitive points: Bosnia and Herzegovina and Kosovo and Metohija. Therefore, we must remain vigilant at all times,” he stressed.

Diverging Assessments

Analyst Nexhmedin Spahiu, however, believes there is no real danger of Iranian activity in Europe.

“I do not believe Iran will focus on Europe, given that major European countries did not support Trump in the war against Iran. There is no reason for Iran to expend its energy or create enemies out of neutral states,” Spahiu said.

He acknowledged Albania’s and Kosovo’s strong positions toward Iran but considers their global significance limited.

“Perhaps the only countries that have been more aggressive are Albania, which adopted a resolution against Iran and hosts a base of the Iranian opposition with several thousand members, and Kosovo with its declarations. Still, I do not believe Iran will take this seriously, as these are small and relatively insignificant states in global terms,” he added.

Spahiu also dismissed the likelihood of individual attacks.

“I do not believe such individuals exist independently. They are usually mercenaries influenced by some center of power.

If Iran does not direct or encourage them, I do not believe anyone will act on their own initiative,” he emphasized.

Psychological Impact and Regional Concerns

Although he does not see Iran as a force capable of threatening global security, Tirana-based analyst Frok Çupi believes there are still reasons for concern in the Western Balkans.

“Iran is not a power capable of endangering the entire world. That is impossible. However, significant damage has been done globally, particularly in the economy, energy sector, and in terms of fear. People are very frightened, often without fully understanding the information they receive. We must think about ourselves—the Balkans, Albania, Serbia, North Macedonia, Montenegro. Psychologically, this concern is strongly felt, and there are arguments that justify such fear,” Çupi said.

He points to the presence of the Iranian opposition group MEK in Albania as a specific concern.

“For Albania, the MEK foundation represents a potential risk. They are based in a settlement within our country, and people perceive this as a threat. The same applies to the U.S. military base in Kosovo. People speculate—and they have the right to do so—but every prejudice contains an element of risk,” he noted.

Çupi added that Albania has already suffered from Iranian cyberattacks, which caused significant damage, and that officials have recently warned about individuals allegedly paid by Iran to spread disinformation or conduct sabotage.

Security Through Alliances

Discussing Albania’s international engagement, Çupi emphasizes reliance on alliances with the United States.

“We are part of the Peace Committee on Gaza, an initiative of the U.S. President. This is a complex but understandable moment. Why is Albania part of this, taking on risk? Because we are a small country in a historically unstable region. In recent years, we have not always had unwavering support from Europe, and we continue to seek faster EU integration. In the absence of full European backing, we must align with the United States,” he said.

He added that Albania is now better protected against cyberattacks and other threats thanks to cooperation with the U.S. and the EU.

“If Iran were to directly attack Albania, it would effectively be an attack on NATO. And an attack on a NATO member guarantees collective defense. That is the advantage of such an alliance,” Çupi concluded.

Persistent Risk of Reactivation

University professor Cane Mojanoski from Skopje warns that any military conflict—particularly in the Middle East—raises the issue of extremist group activity.

“This indicates that the process is in a state of hibernation, or that certain conflicts stimulate its re-emergence. We witnessed this during the migrant crisis, when various groups appeared alongside incoming populations. Military conflicts in the Middle East have always had indirect effects. This conflict is no different, and the structures that support radical groups still exist. Their activation may be triggered by social, political, or other conditions in the Western Balkans and Europe,” he said.

On the existence of inactive extremist networks, Mojanoski notes that they cannot be considered fully eradicated.

“They may be weakened, but they can regain strength—both in personnel and financing. From a strategic perspective, it is natural to remain concerned. Once such networks are established, they are extremely difficult to eliminate permanently. It is entirely possible that dormant networks in the Western Balkans and beyond could become active again,” he stressed.

Regional Vulnerabilities

Mojanoski identifies key vulnerability factors, including the presence of NATO bases.

“All countries hosting military structures or bases—especially U.S. ones—or those that are NATO members are potentially vulnerable. Albania, for instance, has strained relations with Iran and hosts military facilities. Kosovo also hosts a U.S. base. If military presence or migration routes are the criteria, then all Western Balkan countries are potentially exposed,” he warned.

He concludes that the level of risk depends on the intentions of actors seeking to provoke incidents or destabilization.

“In this context, countries in the region must strengthen cooperation, exchange information, and work to reduce the likelihood of extremist activity and other provocations in the period ahead,” Mojanoski concluded.