Hezbollah’s terrorist attack in Bulgaria: the remains of the Israeli tour bus after the explosion
Hussein Atris, Hezbollah terrorist operative, taken for interrogation
The Golden Arches hotel in Limassol, one of the sites about which the Hezbollah operative gathered information
Weapons transferred to an Azeri terrorist cell handled by Iran.
Terrorist attack in New Delhi: the Israeli representative’s vehicle after the explosion
1. In late May 2013, the U.S. Department of State released its Country Reports on Terrorism 2012. The findings of the report indicate that the year 2012 saw a “marked resurgence” of terrorist attacks perpetrated by Iran or its proxies. Iran’s terrorist activity in 2012, the report says,“reached a tempo unseen since the 1990s”. Iran sponsored terrorism through the Islamic Revolutionary Guards Corps-Qods Force (IRGC-QF), its Ministry of Intelligence and Security, and Hezbollah, Tehran’s ally in Lebanon. Iran’s terrorist activity in 2012 included attacks and attempted attacks in Southeast Asia, Europe, and Africa.
2. According to the Department of State’s report, in addition to terrorist activity Iran was (and is still) involved in subversion intended to stir up instability in the Middle East by funding and supporting Shi’ite militias in Iraq, Palestinian terrorist organizations, Houthi rebels in Yemen, and the Syrian regime.
3. See Appendix for our short summary of the terrorist attacks carried out by Iran and its proxies in 2012.
4. In May 2013, the U.S. Department of State released its Country Reports on Terrorism 2012, which contains a detailed discussion of Iran as a state sponsor of terrorism. According to the report, Iran stepped up its terrorist activity in 2012. Attacks and attempted attacks were carried out in India, Thailand, Georgia, and Kenya. Iran also provided financial, material, and logistical support for terrorists and extremist groups in the Middle East and Central Asia. To implement its foreign policy goals, Iran used local militant groups, provided cover for intelligence operations, and stirred up instability in the Middle East. The IRGC-QF, the report says, is “the regime’s primary mechanism for cultivating and supporting terrorists abroad”.
5. The report mentions the following areas of Iranian terrorist activity:
1. Attacks or attempted attacks: In 2012, Iran carried out planned terrorist attacks in India, Thailand, Georgia, and Kenya.
2. Support for terrorist organizations: Iran provides weapons, training, and funding to Hamas and other Palestinian terrorist organizations, including the Palestinian Islamic Jihad and the Popular Front for the Liberation of Palestine-General Command (PFLP-GC). Since the end of the second Lebanon war, Iran has assisted in rearming Hezbollah in direct violation of U.N. Security Council Resolution 1701. In addition, Iran has provided hundreds of millions of dollars in support of Hezbollah in Lebanon and trained Hezbollah operatives at camps in Iran. The IRGC-QF trained Taliban elements on small unit tactics, small arms, explosives, and indirect fire weapons, such as mortars, artillery, and rockets. Since 2006, Iran has arranged arms shipments to Taliban members through Kandahar, Afghanistan.
3. Support for opposition groups in Iraq: Despite claiming that it supports Iraq, Iran trained, funded, and provided guidance to Iraqi Shi’a militant groups. In this context, the IRGC-QF provided training outside of Iraq as well as advisors inside Iraq for Shi’a militants, particularly in the construction and use of sophisticated improvised explosive device technology and other advanced weaponry.
4. Involvement in Syria: Iran provides extensive support, including weapons, funds, and training, to assist the Bashar Asad regime in its war against the coalition of regime opponents.
5. Support for the rebels in Yemen: Iran actively supports the Shi’ite Houthi tribe in northern Yemen, including activities intended to build military capabilities, which could pose a greater threat to security and stability in Yemen and the surrounding region. In July 2012, the Yemeni Interior Ministry arrested members of an Iranian spy ring headed by a former member of the IRGC.
6. Assistance to Al-Qaeda members: Iran allows Al-Qaeda members to operate in its territory and enables the organization to move funds and fighters to South Asia and Syria. Muhsin al-Fadhli, a veteran Al-Qaeda operative who has been active for years, began to work with the Iran-based Al-Qaeda facilitation network in 2009 and was later arrested by Iranian authorities. He was released in 2011 and is now apparently the leader of the Iran-based Al-Qaeda facilitation network.
Summary of terrorist attacks carried out by Iran and Hezbollah in 2012
Attempted terrorist attacks in Bangkok, Thailand
1. In January 2012, Hezbollah, in cooperation with the IRGC-QF, attempted to attack tourist sites in Bangkok visited by Israelis using IEDs. A Lebanese Hezbollah terrorist operative named Hussein Atris, carrying an expired Swedish passport and a Lebanese passport, was detained at the Bangkok airport. Another Hezbollah operative, also carrying a Swedish passport, managed to escape. Hussein Atris’ interrogation led the police to a commercial building in Bangkok where they found a large quantity of chemicals used in the manufacture of explosives (about 4,400 kilograms of urea and about 40 liters, or 10.5 gallons, of ammonium nitrate). In our assessment, the presence of such a large stock of potentially dangerous chemicals indicates the existence of a long-standing, well-established Hezbollah network in Thailand.
2. A month later, on February 14, 2012, the IRGC-QF attempted another terrorist attack in Bangkok, this time using a magnet to attach an IED to the car of an Israeli diplomat. The Thailand police arrested two Iranians who had activated the IED. A third Iranian national was arrested in Malaysia. Two other Iranians managed to escape from Thailand.
Blowing up an Israeli tour bus in Burgas, Bulgaria
3. On July 18, 2012, an IED weighing about 3 kilos, or about 6.6 lbs, blew up in the back of a tourist bus about to take Israeli tourists from the airport to their hotel in the Black Sea resort of Burgas. According to the Bulgarian minister of the interior, the IED had been assembled in Bulgaria. The terrorist attack was carried out by a Hezbollah operative who, according to information from the Bulgarian authorities, had a collaborator. It is our assessment that he terrorist was killed by a technical fault which caused the IED to explode prematurely. The blast killed five Israeli tourists, the Bulgarian bus driver, and the terrorist. In addition, 36 Israelis were wounded, three of them seriously.
4. On February 5 2013, approximately seven months after the terrorist attack in Burgas, Bulgaria issued a detailed report on the results of its investigation of the event. According to the Bulgarian authorities, the investigation clearly indicated that Hezbollah’s so-called military wing was involved in planning and carrying out the attack. The Bulgarian minister of the interior, who presented the report to the Bulgarian National Security Council, said that Bulgaria possessed detailed information about the network that had planned and carried out the attack. He added that they possessed reliable, well-founded information linking at least two of the three Burgas terrorists to Hezbollah (Bulgarian News Agency, Sofia, February 6, 2013). The report did not mention Iran, which is behind a global terrorist campaign against Israel, using Hezbollah as its proxy.
Thwarted attack targeting Israeli tourists in Cyprus
5. On July 7, 2012, the local authorities in Limassol, Cyprus detained Hossam Taleb Yaacoub, a 24-year old Lebanese Hezbollah operative who was collecting information about Israeli tourists arriving on the island by air. He was carrying a Swedish passport. In our assessment, he was collecting information in preparation for an attack on Israeli tourists visiting the island, possibly the same modus operandi of attack Hezbollah carried out in Bulgaria. On March 31, 2013, the Cyprus court charged the Hezbollah operative with collecting preliminary information for a terrorist attack against Israeli tourists.
6. On February 20, 2013,Cyprus made public the written admission of Hossam Taleb Yaacoub, read into the court record at his trial in Limassol. He was tried on eight counts, among them conspiracy to commit a crime, participation in a criminal organization, intent to commit a crime, and obstruction of justice (Cyprus Mail, February 21, 2013). Hossam Taleb Yaacoub has been a member of Hezbollah since 2007. He used the codename “Wael” and was handled by an operative named “Ayman,” who wore a mask to the meetings he held with Yaacoub. Yaacoub admitted to having been trained in the use of weapons. He also used to carry out missions for Hezbollah in several European cities (Lyon and Amsterdam) and in Turkey (Antalya). In all cases he was asked to pick up various items (bags, a cell phone, two SIM cards) and deliver them to Lebanon.
Attempted attacks in Azerbaijan
7. On January 19, 2012, Azerbaijan’s National Ministry of Defense reported the arrest of two Azeri citizens and a manhunt for a third citizen residing in Iran. The three men were planning to murder two rabbis who taught at the Jewish school in Baku. The authorities presented evidence, including confiscated weapons and cash, that the suspects had been in touch with the Iranian intelligence services.
8. In March 2012, authorities in Azerbaijan reported the arrest of 22 Azeri citizens on charges of cooperation with the IRGC. The network exposed in Azerbaijan was planning terrorist attacks on Western embassies and other organizations with ties to the West. On April 6, the Azeri security services arrested 17 operatives and confiscated weapons.
9. In May 2012, the Azeri security forces reported that they had detained 40 terrorist suspects who were planning to carry out terrorist attacks during the Eurovision song contest, held in Baku. The targets of the terrorist attacks reportedly included the hotels where the country delegations were staying, including a delegation that represented Israel at the Eurovision.
10. On October 11, 2012, the Azeri media reported that a court in Baku had convicted the 22 members of the terrorist network handled by the IRGC. They were found guilty of conspiring to carry out terrorist attacks on Israeli, American, and Western targets.
Attack on an Israeli diplomat’s car in India
11. On February 13, 2012, a terrorist attack occurred in New Delhi. An Israeli diplomat’s car was attacked using a magnetic IED that was attached to it. In the car was the Israeli diplomat’s wife, who was severely injured when the car blew up. Three Indian civilians were injured as well.
Attempted attack on an embassy car in Georgia
12. On February 14, 2012, the same day as the previously mentioned attacks on Israeli diplomats in Thailand and India,an improvised IED was found in the car of a Georgian employee of the Israeli embassy in Tbilisi. The IRGC-QF was involved in the attacks.
Thwarted attack in Kenya
13. In mid-June 2012, two Iranians, Ahmad Abolfathi Mohammad and Seyyed Mansour Mousavi, were arrested in Nairobi, the capital of Kenya. Officials in Kenya said that, after their arrest, the Iranian agents led investigators to a hideout in Mombasa where they had stashed 15 kilograms, or 33 pounds, of RDX explosives. According to officials, the Iranians were apparently planning to bomb Israeli-owned hotels on the Mombasa beach and attack diplomats and businessmen. American experts said that the amount of explosives found in the hideout would have been enough to level a medium-sized hotel (Israeli daily Yedioth Ahronoth, July 3, 2012).
14. The Iranian agents admitted in their interrogation that they had entered Kenya as tourists and were supposed to get the explosives from a local contact. They were then to deliver the explosives to a golf course in Mombasa, where they would be picked up by another contact and taken to an unknown destination. The detainees’ tourist visas were supposed to expire on June 26, 2012; however, they were arrested five days prior to that, on June 19 (allafrica.com, July 25, 2012).
15. On July 16, 2012, the two Iranians were released from custody on a 2-million Kenyan shilling bond. They were also required to surrender their passports and report to the Kenya Anti-Terrorism Police Unit two times a week (timesofisrael.com, July 16, 2012).
 For more information on the terrorist activity of the IRGC-QF, see our August 21, 2012 Information Bulletin: “The Qods Force, an elite unit of the Iran’s Islamic Revolutionary Guards Corps, spearheads Iran’s global terrorist campaign. The terrorist attack in Bulgaria was, in our assessment, part of the campaign”. For more information on Hezbollah’s terrorist activity, see our December 18, 2012 study: “Hezbollah: Portrait of a Terrorist Organization”.
 For more information on Iran’s assistance to Palestinian terrorist organizations, see our January 7, 2013 Information Bulletin: “Iranian support for the Palestinian terrorist organizations”.
 For more information on Iran’s involvement in Yemen, see our February 10, 2013 Information Bulletin: “Iranian subversion in Yemen: A ship with a cargo of arms originating in Iran and en route to the Shi'ite Houthi rebels in north Yemen, was recently intercepted”.
 For more information on Iran’s cooperation with Al-Qaeda, see our June 14, 2012 Information Bulletin: “Documents captured by the United States army in an Al-Qaeda safe house in Pakistan expose the ambivalent relations between Al-Qaeda and Iran”.
 In the 1990s Hussein Atris married a Swedish woman and received a Swedish passport, which he used for his activities in Hezbollah’s foreign operations unit.
 Bulgaria’s terminology in the report is the same used by other European countries, which differentiate between what they perceive as Hezbollah’s military-terrorist wing, which carries out terrorist attacks, and its “political” wing, which is part of the Lebanese parliament and is integrated into the Lebanese administration. In fact, they are a single entity and there is no difference between the military and political wings. Senior Hezbollah figures have themselves denied that their “military” and “political” wings are separated.
 For more information, see our February 7, 2013 Information Bulletin: “The report issued by Bulgaria about the terrorist attack in Burgas clearly indicates that Hezbollah was involved in its planning and execution”.
 For more information, see our February 21, 2013 Information Bulletin: “Admission of a Hezbollah operative asked to collect information about sites frequented by Israeli tourists and their transportation made public by Cyprus”.
 For details, see our November 4, 2012 Information Bulletin: “Azerbaijan as an arena for Iranian terrorism and subversion”.