Iran has increasingly tried to source material in Europe for its nuclear and ballistic missile programmes, German intelligence believes.
A security assessment said in 2021 there had been a “clear increase” in procurement efforts linked to Iran’s nuclear activities.
It said Tehran was using cyber espionage to gain knowledge on products it cannot easily obtain because of sanctions.
The findings come as Germany and its allies France and Britain try to restore Iran’s compliance with the 2015 nuclear deal, which was meant to keep sensitive technology out of Tehran’s hands.
A deal on restoring the 2015 limits appeared close until talks broke off in March, after the war in Ukraine complicated the position because of Russia’s presence at the negotiations.
That deal, formally the Joint Comprehensive Plan of Action, does not cover the ballistic missiles that Iran has developed and is suspected of supplying to Yemen’s Houthi rebels.
“Procurement activities in that regard are continuously high in Germany — with an upward trend,” said the annual report by Germany’s Office for Protection of the Constitution.
In addition, there was “a clear increase in 2021 in indications of Iranian procurement attempts for its nuclear programme”, the report said. It did not say what Iran was trying to obtain.
The agency said evidence on potential breaches of the JPCOA had been “forwarded to the relevant authorities”. The deal appoints the UN’s nuclear agency in Vienna as arbiter of whether its terms are being met.
Since the US quit the deal in 2018, Iran has openly flouted some of the JCPOA’s limits, including by producing 60 per cent enriched uranium – which western powers describe as having no plausible civilian use.
Separately to the stalled JCPOA talks, Iran is in a tug-of-war with an impatient UN agency over monitoring of its nuclear sites. Western powers want to censure Iran for its lack of co-operation.
Tehran is under sanctions over its weapons programmes and human rights record but German intelligence believes it has turned to cyber-attackers to clear some of those obstacles.
The report said Iran’s espionage in Germany was aimed mainly at educational and research institutions, although it also took aim at potential Iranian dissidents living in Europe.
The main method of state-backed hackers was to use spear-phishing attacks that trick people into handing over sensitive information, it said.
However, it said some hackers use home-made malware or ransomware to make themselves look like cyber criminals rather than Iranian regime operatives.
Operations such as these are expected to become more and more professional as Iran tries to gather intelligence, the German agency said.
Cyber-attacks are used to “obtain know-how and information about products and processes, because sanctions against Iran close off other routes”, it said.
Thomas Haldenwang, the head of the intelligence agency, said the level of espionage against Germany in general was comparable to that during the Cold War.
