A billionaire donor to Britain’s Reform UK party was previously involved in a business venture with Astan Quds Razavi, a powerful Iranian religious foundation under the authority of the country’s supreme leader, the Guardian reported.
Hossein “Sasan” Ghandehari, an Iranian-born British businessman who has pledged millions of pounds to Reform UK, was the main investor behind a telecoms project in Iran between 2013 and 2016, according to a French arbitration ruling reviewed by the newspaper.
Ghandehari’s HP Trust ultimately owned Ori Group, which acquired a 49% stake in Omran Razavi International Co, a joint venture established to build and supply a fiber-optic network carrying telecommunications traffic across Iran.
Partnership with Astan Quds Razavi
The remaining 51% of the venture was owned by Astan Quds Razavi, or AQR, a multibillion-pound religious foundation based in Mashhad.
At the time, AQR was headed by Abbas Vaez Tabasi, who had been appointed by Islamic Republic founder Ruhollah Khomeini and remained in the post until his death in 2016.
AQR is one of Iran’s major bonyads, large quasi-public foundations with extensive economic interests. The United States sanctioned it in 2021, saying it controlled major parts of Iran’s economy and operated for the benefit of then-supreme leader Ali Khamenei and other senior officials.
Ghandehari’s lawyers told the Guardian that describing him simply as having worked with Iran would be misleading. They said the project was intended to expand access to information and promote political change, and that AQR was the only viable partner capable of enabling the project to proceed.
Venture collapsed in 2016
The joint venture ended around 2016 after Vaez Tabasi’s death and the appointment of a more hardline leadership at AQR, the Guardian reported.
AQR subsequently took full control of the project. Around the same period, project chairman Mohammed Reza Noory was imprisoned in Iran and later sentenced to 18 years.
Ghandehari’s lawyers said he himself was later targeted by Iran’s Supreme National Security Council with accusations that he had worked with hostile Western powers. They described those allegations as false.
Ghandehari has said he has not been to Iran for three decades and that his wealth has no connection to the country. His representatives also said family assets in Iran were confiscated in 2016.
Links to another Reform donor
The Guardian also reported that Ghandehari had business ties to another Reform UK donor, John Richard Simpson.
Ghandehari’s HP Trust had owned Orico General Trading LLC, a company contracted to supply telecommunications equipment from France’s Alcatel-Lucent and transport it from Dubai to Iran. After 2016, ownership of Orico was transferred to Simpson, who told the newspaper he had acquired the company to wind down its operations after the project ran into difficulties.
Simpson’s design firm, Interior Architecture Landscape, counts the Ghandehari family among its clients and donated £200,000 to Reform UK last year, according to the Guardian.
Farage has taken a hard line on Tehran
Ghandehari emerged as a major Reform donor this year, pledging to make regular contributions worth more than £1 million and donating £50,000 to party leader Nigel Farage for World Economic Forum passes.
Farage has taken a strongly critical position toward the Islamic Republic and has supported US pressure on Tehran.
The Guardian said Ghandehari’s past business relationship with AQR raises questions about the extent of his previous dealings with state-linked entities in Iran, although his lawyers said the project was approved by authorities in France and the United States and was intended to expand internet access rather than support the Iranian government.
An Iranian state-sponsored hacking group used command-and-control infrastructure hosted in the United States this year after a months-long pause in operations, according to cybersecurity firm Semperis.
The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.
Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.
Operations resumed after months-long pause
SecurityWeek, citing Semperis, reported that the group halted activity for about three months after the US-Israel war with Iran began on February 28.
Semperis said operations resumed on May 27, when the group deployed new infrastructure and restarted data theft. Within a week, one of its malware tools had extracted more than 1,800 files from a single victim, according to SecurityWeek.
Bar said the group’s victim count remained relatively small, which could indicate highly targeted operations or difficulty compromising new systems.
New infrastructure hidden among legitimate sites
Semperis said the group changed its hosting strategy after returning to activity, moving away from virtual private servers and instead using shared hosting in the United States.
The server identified in August was linked to Tornado, one of the group’s newer malware families, which can steal files through Telegram-based channels.
Bar said the use of US shared hosting was unusual for this particular group because it allowed the infrastructure to blend in with thousands of legitimate websites and other online services.
“This is the last place we expected to find Prince of Persia hiding,” he said.
Semperis also said the group later began building additional infrastructure behind Cloudflare, making its command-and-control systems harder to trace directly.
Iranian cyber activity under growing scrutiny
The findings come as US authorities and cybersecurity researchers continue to report Iranian-linked cyber activity targeting both dissidents and critical infrastructure.
In September, NBC News reported that Iranian hackers had recently targeted US water, telecommunications and energy systems, citing government and industry cyberthreat sources. Those attempts had not caused major disruption.
US prosecutors have also pursued cases against alleged Iranian hackers accused of working on behalf of state institutions.
Last month, Montenegro approved the extradition of Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over an alleged campaign targeting universities and research institutions for entities including the Revolutionary Guards.
US prosecutors say that broader campaign compromised thousands of academic accounts and resulted in the theft of more than 31 terabytes of data.
A man accused of plotting attacks on Iran International journalists told a London court on Thursday that his Iranian handlers had instructed him to break one journalist’s arms and legs and assault another to stop him from criticizing the Islamic Republic.
Mostafa Sepahvand told Woolwich Crown Court that he had been asked to attack Iran International journalists Kambiz Hosseini and Mojtaba Pourmohsen, as well as two other people, Alon Farago and Jonathan Turner.
Asked by prosecutor Emlyn Jones what those behind the alleged operation wanted him to do, Sepahvand replied: “To hit them.”
“They asked me to hit Jonathan and scare him off; they asked me to break Kambiz's arms and legs; they asked me to hit Pourmohsen to stop him writing about the regime,” he said.
Sepahvand, 41, is on trial alongside Farhad Javadi Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against people critical of Tehran.
Sepahvand acknowledges conducting surveillance but says he only appeared to cooperate because of threats against him and his family and never intended to hurt anyone. Instead, he says, he deliberately tried to frustrate the operation.
“I played them,” he has repeatedly told the court.
Prosecutors challenge his account
Cross-examining Sepahvand on Thursday, Jones directly challenged that defense, suggesting his claims that he had been deceiving the Revolutionary Guards were explanations invented after his arrest.
“What I am suggesting is that every time you said ‘I was playing the IRGC,’ you were lying,” Jones said.
“No, that was not the case,” Sepahvand replied.
The prosecution questioned Sepahvand about visits he made to addresses he had been given and photographs and videos taken during the alleged surveillance.
Sepahvand acknowledged going to an address associated with Pourmohsen and taking a photograph, but denied that he was preparing an attack.
“I go there, I get a picture, I go back home,” he said. “They ask me to hit them, I play them.”
Jones argued that Sepahvand's repeated visits, searches and complaints about inadequate information showed that he was carrying out groundwork for the alleged attacks rather than trying to sabotage them.
Sepahvand insisted that he deliberately told his contacts that addresses were wrong, exaggerated the difficulty and expense of finding the targets and repeatedly delayed carrying out their instructions.
He said that had he encountered the journalists, he would have warned them. “If I saw them I'd tell them that IRGC was after them and you have to escape,” he told the court.
£150,000 demand questioned
Jones also challenged Sepahvand over his repeated demands for money, including messages in which he said he would complete the job for £150,000.
Sepahvand said the demands were another delaying tactic because money was a “weak spot” for the people directing him.
“If I wanted to accept the money, I would have accepted £30,000,” he told the court, referring to a smaller payment discussed earlier in the alleged operation.
Jones questioned why Sepahvand would have been in a position to demand payment if, as he maintains, he had agreed to cooperate only because Iranian operatives were threatening him and his family.
Sepahvand said he had told them he would need a team and money to carry out the attacks but maintained that he never intended to do so.
“They wanted to force me and I didn't do it,” he said.
Sepahvand became increasingly agitated during the cross-examination, repeatedly raising the case of Navid Imami, a man he says was connected to the Iranian embassy in London and had supplied information about the targets.
The judge called a break after Sepahvand repeatedly interrupted Jones and later warned him that if he continued shouting or repeating his defense rather than answering questions, the jury could conclude that he did not have answers to the prosecution's case.
Sepahvand testified Wednesday that he had met Imami at the Iranian embassy in February 2025 while the alleged operation was under way.
He maintains that pressure on members of his family in Iran forced him to maintain contact with the people directing the operation and that his apparent cooperation was intended to protect others without carrying out the attacks.
The prosecution's cross-examination of Sepahvand is due to continue when the trial resumes Monday.
Germany’s financial regulator BaFin said on Thursday that Bank Saderat Iran’s Hamburg branch had lost its banking license and must be wound up. The branch, which operated in Hamburg and Frankfurt, is no longer allowed to conduct banking business.
BaFin revoked the license on November 5, 2025, citing persistent legal violations that the bank had failed to remedy. A 2023 special audit found serious shortcomings in its business organization, and the bank had been inactive for more than six months.
BaFin also cited sanctions against the institution, saying German banking law therefore presumes its managers to be unreliable, regardless of whether they personally engaged in misconduct.
BaFin orders branch wound up
BaFin ordered the wind-down on June 11, 2026. The liquidation order became final on July 15, according to the regulator. The bank later withdrew legal action against the measure on September 23, and a Hamburg court appointed Berlin-based FUW Treuhand Project Management GmbH as liquidator on September 30.
The withdrawal of the banking license had already become final on December 8, 2025.
The bank mainly handled and financed Iran-related exports, including payment services, letters of credit, lending, guarantees and investments. It had 13 employees and assets of €62.4 million at the end of 2025. Customer deposits total about €200,000.
Deposits remain subject to sanctions restrictions
BaFin said there is currently no deposit compensation event, meaning Germany’s deposit guarantee system has not been triggered. Access to funds is restricted under EU sanctions, however, and the liquidator can make payments only with authorization from the Bundesbank’s Financial Sanctions Service Center.
BaFin said the existing deposits would instead be dealt with as part of the liquidation of the branch.
Iranian banks remain under scrutiny in Germany
The decision comes as Iranian banks operating in Germany face heightened scrutiny under renewed EU sanctions and increased US pressure on Tehran’s overseas financial network.
Bank Melli Iran’s Hamburg branch remains open despite being covered by EU sanctions, Germany’s Foreign Ministry told Iran International in August.
The ministry said at the time that the sanctions applied to Bank Melli and its German branch, but did not say whether Berlin was considering closing the operation.
The issue gained attention after US Treasury Secretary Scott Bessent launched “Operation Economic Outcast” and called for every Bank Melli branch abroad to be shut. Germany said it remained in contact with Washington and other partners over further measures against Iran but gave no indication that a decision had been made on Bank Melli’s Hamburg branch.
Bank Melli and Bank Saderat are separate institutions, and BaFin’s action against Bank Saderat was based on German banking-law requirements as well as the sanctions applying to the bank.
A man accused of plotting an attack on Iran International journalists told a London court Wednesday that he met an alleged Revolutionary Guards contact at the Iranian embassy while he was gathering information on the journalists.
Mostafa Sepahvand told Woolwich Crown Court that he visited the embassy on February 15, 2025, where he met a man he identified as Navid Emami.
Sepahvand said he told Emami that addresses provided for the journalists were incorrect but that he was still pursuing the matter. According to Sepahvand, Emami asked whether his co-defendant Farhad Javadi Manesh was working with him.
Later in his testimony, Sepahvand said Emami had supplied addresses to people he described as connected to the Revolutionary Guards. He also alleged that Emami had threatened him.
Sepahvand, 41, is on trial alongside Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
Sepahvand accepts that he conducted surveillance but says he acted under duress and deliberately tried to undermine the operation.
The court was shown phone and vehicle location data placing Sepahvand near addresses linked to the alleged targets, as well as messages in which he passed Manesh information about Hosseini, including references to his dog and a blue Volkswagen Golf.
Sepahvand said he asked Manesh to make a video of the car. On one occasion, he said, he travelled to an address specifically so his phone's GPS would show his Iranian contacts that he had been there.
He said he was trying to convince the Revolutionary Guards that he was cooperating while actually frustrating the alleged operation.
“I played them,” Sepahvand told the court.
Sepahvand also testified that £30,000 had been sent to a money exchange in Finchley after an address linked to Pourmohsen was raised, but said he did not collect it because he did not want to carry out the task.
Asked who had sent the money and what it was for, Sepahvand named a man called Ruhollah and said it was to “go after the journalists.” Asked which journalists, he said that had not been specified.
Sepahvand said he had initially asked for £150,000. When he denied telling his Iranian contacts that he would attack a journalist if they paid him, his barrister, Tyrone Smith, pointed him to an earlier message in which he appeared to say he would carry out the attack if paid.
Sepahvand said he had no choice but to make such claims because he believed the Revolutionary Guards were monitoring his communications and waiting for him to say he would not carry out the attack.
He said he had been under duress from the beginning, citing the arrest of an associate and his younger brother, a raid on his mother's home and pressure over a criminal case against him in Iran.
“I didn't want anyone to be hurt,” Sepahvand said toward the end of his testimony. “I wanted to protect everyone.”
The trial continues.
Israel has barred a United Airlines pilot of Iranian descent from serving on flights to the country over unverified social media allegations that he supported Iran's government, the Revolutionary Guards and Hezbollah, Ynet reported Wednesday.
Israel's Diaspora Affairs and Combating Antisemitism Ministry alerted security and transportation officials on October 19 to allegations circulating on X about the pilot, Sina Amjadian, according to a ministry letter obtained by Ynet.
The letter included two posts from X. One alleged that Amjadian, who was said to have previously worked for flydubai, had shared content supporting Iran's government, including a video in which he purportedly kissed and saluted its emblem.
The other alleged that he had expressed support for the Islamic Revolutionary Guard Corps and Hezbollah and called on United Airlines to investigate his conduct.
Ynet said it could not independently verify the allegations and that the material submitted to Israeli authorities did not include original statements or social media posts by Amjadian.
The allegations nevertheless prompted a security review and a decision to prohibit Amjadian from serving as a crew member on flights to Israel, senior Transportation Ministry officials told Ynet.
The Diaspora Affairs Ministry said the warning followed an attempted attack aboard a flydubai flight bound for Israel in late September, during which a co-pilot attacked the captain and attempted to seize control of the aircraft.
The incident prompted Israel's National Command and Control Center for Combating Antisemitism to expand its monitoring to people who might pose a threat to aviation security, according to the ministry.
It said the allegations concerning Amjadian warranted security scrutiny because of the responsibilities of an international airline pilot and the potential risks to passengers and crew.
Transportation Ministry officials told Ynet that the ministry did not independently monitor social media or gather intelligence but coordinated with security agencies when information raised aviation safety concerns.
They said preventing a pilot from operating flights to Israel was separate from denying the individual entry to the country, which falls under the authority of border control officials.
Ynet said it remained unclear whether Amjadian had previously flown to Israel, had been scheduled to operate a flight to Ben Gurion Airport or was qualified to fly aircraft used by United Airlines on its Israel routes.
There was no indication that any flight had been canceled or prevented from reaching Israel because of the restriction.
