A man accused of plotting attacks on Iran International journalists faced a prosecution challenge to his claim that he was deceiving the Revolutionary Guards, with prosecutors arguing he acted for money and help resolving his criminal case in Iran.
At Woolwich Crown Court on Monday, prosecutor Bill Emlyn Jones challenged contradictions between Mostafa Sepahvand’s testimony and his messages to a contact in Iran, accusing him of being a “skilled liar.”
Sepahvand later acknowledged that a proposed £150,000 payment was conditional on harming a journalist, but maintained that he had demanded the sum to deter the IRGC and never intended to carry out an attack.
Sepahvand, 41, is on trial alongside Farhad Javadi Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain’s National Security Act.
Prosecutors allege they gathered information for Iranian intelligence to prepare for serious violence against at least one target, with Sepahvand expected to carry out an attack. The alleged targets included Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
Jones put it to Sepahvand that either his messages to Mostafa Ghorbani or his account to the jury was untrue. Following the prosecutor’s accusation that he was a skilled liar, Sepahvand shouted in English: “I never did this.” The court then took a break.
When the hearing resumed, his defense barrister, Tyrone Smith, asked him to confirm that the £150,000 discussed in his messages related to causing harm to a journalist. Sepahvand answered yes.
Smith revisited a March 20, 2025, voice message in which Sepahvand discussed the payment, locating a target and carrying out the task when the money was ready.
Asked whether he believed the money would ever be paid, Sepahvand said no. He maintained that his demands were intended to scare off the IRGC.
“I never wanted to harm anyone,” he told the court, saying he had been deceiving the group throughout because he hated it. Asked whether he had ever seen or harmed any of the journalists, he answered no.
Earlier questioning examined Sepahvand’s repeated attempts to reach Ghorbani in late December 2024 and January 2025.
Sepahvand said he was anxious about his criminal case in Iran and wanted Ghorbani and another contact, Amin, to enlist the help of a man referred to as “Haji.”
He said Amin had told him the case had been stopped or canceled, but that this was a lie.
A translated Iranian judicial document examined in court indicated that Sepahvand’s sister appeared on his behalf on January 7, 2025, to appeal convictions dating from 2014 for 32 burglary offenses. The appeal was unsuccessful, although the judge altered the sentence.
Sepahvand said his sister appealed again and that he also pleaded guilty. He maintained that repeated calls to Ghorbani concerned efforts to resolve the case.
He attributed other exchanges about money to car trading, a bodywork workshop and loans that had to be repaid with interest.
During the defense questioning, Sepahvand reaffirmed that threats against his family had prompted his actions. Smith referred to his account that he had sought to appear cooperative without actually assisting a foreign intelligence service or intending to harm anyone.
Smith also asked whether Sepahvand’s solicitor had contacted counterterrorism police several times between July and December 2025 to say he had information to provide, and whether police had declined to speak to him until he pleaded guilty. Sepahvand answered yes.
He confirmed that he had asked his solicitor to pass on the name of Navid, a contact previously discussed during the trial.
Prosecutors reject Sepahvand’s claim that he acted under duress and deliberately performed the surveillance poorly.
According to the prosecution’s account of their defenses, Javadi Manesh and Noori accept visiting locations and taking photographs and videos but say they did not know they were assisting Iranian intelligence.
A billionaire donor to Britain’s Reform UK party was previously involved in a business venture with Astan Quds Razavi, a powerful Iranian religious foundation under the authority of the country’s supreme leader, the Guardian reported.
Hossein “Sasan” Ghandehari, an Iranian-born British businessman who has pledged millions of pounds to Reform UK, was the main investor behind a telecoms project in Iran between 2013 and 2016, according to a French arbitration ruling reviewed by the newspaper.
Ghandehari’s HP Trust ultimately owned Ori Group, which acquired a 49% stake in Omran Razavi International Co, a joint venture established to build and supply a fiber-optic network carrying telecommunications traffic across Iran.
Partnership with Astan Quds Razavi
The remaining 51% of the venture was owned by Astan Quds Razavi, or AQR, a multibillion-pound religious foundation based in Mashhad.
At the time, AQR was headed by Abbas Vaez Tabasi, who had been appointed by Islamic Republic founder Ruhollah Khomeini and remained in the post until his death in 2016.
AQR is one of Iran’s major bonyads, large quasi-public foundations with extensive economic interests. The United States sanctioned it in 2021, saying it controlled major parts of Iran’s economy and operated for the benefit of then-supreme leader Ali Khamenei and other senior officials.
Ghandehari’s lawyers told the Guardian that describing him simply as having worked with Iran would be misleading. They said the project was intended to expand access to information and promote political change, and that AQR was the only viable partner capable of enabling the project to proceed.
Venture collapsed in 2016
The joint venture ended around 2016 after Vaez Tabasi’s death and the appointment of a more hardline leadership at AQR, the Guardian reported.
AQR subsequently took full control of the project. Around the same period, project chairman Mohammed Reza Noory was imprisoned in Iran and later sentenced to 18 years.
Ghandehari’s lawyers said he himself was later targeted by Iran’s Supreme National Security Council with accusations that he had worked with hostile Western powers. They described those allegations as false.
Ghandehari has said he has not been to Iran for three decades and that his wealth has no connection to the country. His representatives also said family assets in Iran were confiscated in 2016.
Links to another Reform donor
The Guardian also reported that Ghandehari had business ties to another Reform UK donor, John Richard Simpson.
Ghandehari’s HP Trust had owned Orico General Trading LLC, a company contracted to supply telecommunications equipment from France’s Alcatel-Lucent and transport it from Dubai to Iran. After 2016, ownership of Orico was transferred to Simpson, who told the newspaper he had acquired the company to wind down its operations after the project ran into difficulties.
Simpson’s design firm, Interior Architecture Landscape, counts the Ghandehari family among its clients and donated £200,000 to Reform UK last year, according to the Guardian.
Farage has taken a hard line on Tehran
Ghandehari emerged as a major Reform donor this year, pledging to make regular contributions worth more than £1 million and donating £50,000 to party leader Nigel Farage for World Economic Forum passes.
Farage has taken a strongly critical position toward the Islamic Republic and has supported US pressure on Tehran.
The Guardian said Ghandehari’s past business relationship with AQR raises questions about the extent of his previous dealings with state-linked entities in Iran, although his lawyers said the project was approved by authorities in France and the United States and was intended to expand internet access rather than support the Iranian government.
An Iranian state-sponsored hacking group used command-and-control infrastructure hosted in the United States this year after a months-long pause in operations, according to cybersecurity firm Semperis.
The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.
Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.
Operations resumed after months-long pause
SecurityWeek, citing Semperis, reported that the group halted activity for about three months after the US-Israel war with Iran began on February 28.
Semperis said operations resumed on May 27, when the group deployed new infrastructure and restarted data theft. Within a week, one of its malware tools had extracted more than 1,800 files from a single victim, according to SecurityWeek.
Bar said the group’s victim count remained relatively small, which could indicate highly targeted operations or difficulty compromising new systems.
New infrastructure hidden among legitimate sites
Semperis said the group changed its hosting strategy after returning to activity, moving away from virtual private servers and instead using shared hosting in the United States.
The server identified in August was linked to Tornado, one of the group’s newer malware families, which can steal files through Telegram-based channels.
Bar said the use of US shared hosting was unusual for this particular group because it allowed the infrastructure to blend in with thousands of legitimate websites and other online services.
“This is the last place we expected to find Prince of Persia hiding,” he said.
Semperis also said the group later began building additional infrastructure behind Cloudflare, making its command-and-control systems harder to trace directly.
Iranian cyber activity under growing scrutiny
The findings come as US authorities and cybersecurity researchers continue to report Iranian-linked cyber activity targeting both dissidents and critical infrastructure.
In September, NBC News reported that Iranian hackers had recently targeted US water, telecommunications and energy systems, citing government and industry cyberthreat sources. Those attempts had not caused major disruption.
US prosecutors have also pursued cases against alleged Iranian hackers accused of working on behalf of state institutions.
Last month, Montenegro approved the extradition of Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over an alleged campaign targeting universities and research institutions for entities including the Revolutionary Guards.
US prosecutors say that broader campaign compromised thousands of academic accounts and resulted in the theft of more than 31 terabytes of data.
A man accused of plotting attacks on Iran International journalists told a London court on Thursday that his Iranian handlers had instructed him to break one journalist’s arms and legs and assault another to stop him from criticizing the Islamic Republic.
Mostafa Sepahvand told Woolwich Crown Court that he had been asked to attack Iran International journalists Kambiz Hosseini and Mojtaba Pourmohsen, as well as two other people, Alon Farago and Jonathan Turner.
Asked by prosecutor Emlyn Jones what those behind the alleged operation wanted him to do, Sepahvand replied: “To hit them.”
“They asked me to hit Jonathan and scare him off; they asked me to break Kambiz's arms and legs; they asked me to hit Pourmohsen to stop him writing about the regime,” he said.
Sepahvand, 41, is on trial alongside Farhad Javadi Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against people critical of Tehran.
Sepahvand acknowledges conducting surveillance but says he only appeared to cooperate because of threats against him and his family and never intended to hurt anyone. Instead, he says, he deliberately tried to frustrate the operation.
“I played them,” he has repeatedly told the court.
Prosecutors challenge his account
Cross-examining Sepahvand on Thursday, Jones directly challenged that defense, suggesting his claims that he had been deceiving the Revolutionary Guards were explanations invented after his arrest.
“What I am suggesting is that every time you said ‘I was playing the IRGC,’ you were lying,” Jones said.
“No, that was not the case,” Sepahvand replied.
The prosecution questioned Sepahvand about visits he made to addresses he had been given and photographs and videos taken during the alleged surveillance.
Sepahvand acknowledged going to an address associated with Pourmohsen and taking a photograph, but denied that he was preparing an attack.
“I go there, I get a picture, I go back home,” he said. “They ask me to hit them, I play them.”
Jones argued that Sepahvand's repeated visits, searches and complaints about inadequate information showed that he was carrying out groundwork for the alleged attacks rather than trying to sabotage them.
Sepahvand insisted that he deliberately told his contacts that addresses were wrong, exaggerated the difficulty and expense of finding the targets and repeatedly delayed carrying out their instructions.
He said that had he encountered the journalists, he would have warned them. “If I saw them I'd tell them that IRGC was after them and you have to escape,” he told the court.
£150,000 demand questioned
Jones also challenged Sepahvand over his repeated demands for money, including messages in which he said he would complete the job for £150,000.
Sepahvand said the demands were another delaying tactic because money was a “weak spot” for the people directing him.
“If I wanted to accept the money, I would have accepted £30,000,” he told the court, referring to a smaller payment discussed earlier in the alleged operation.
Jones questioned why Sepahvand would have been in a position to demand payment if, as he maintains, he had agreed to cooperate only because Iranian operatives were threatening him and his family.
Sepahvand said he had told them he would need a team and money to carry out the attacks but maintained that he never intended to do so.
“They wanted to force me and I didn't do it,” he said.
Sepahvand became increasingly agitated during the cross-examination, repeatedly raising the case of Navid Imami, a man he says was connected to the Iranian embassy in London and had supplied information about the targets.
The judge called a break after Sepahvand repeatedly interrupted Jones and later warned him that if he continued shouting or repeating his defense rather than answering questions, the jury could conclude that he did not have answers to the prosecution's case.
Sepahvand testified Wednesday that he had met Imami at the Iranian embassy in February 2025 while the alleged operation was under way.
He maintains that pressure on members of his family in Iran forced him to maintain contact with the people directing the operation and that his apparent cooperation was intended to protect others without carrying out the attacks.
The prosecution's cross-examination of Sepahvand is due to continue when the trial resumes Monday.
A man accused of plotting an attack on Iran International journalists told a London court Wednesday that he met an alleged Revolutionary Guards contact at the Iranian embassy while he was gathering information on the journalists.
Mostafa Sepahvand told Woolwich Crown Court that he visited the embassy on February 15, 2025, where he met a man he identified as Navid Emami.
Sepahvand said he told Emami that addresses provided for the journalists were incorrect but that he was still pursuing the matter. According to Sepahvand, Emami asked whether his co-defendant Farhad Javadi Manesh was working with him.
Later in his testimony, Sepahvand said Emami had supplied addresses to people he described as connected to the Revolutionary Guards. He also alleged that Emami had threatened him.
Sepahvand, 41, is on trial alongside Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain's National Security Act.
Prosecutors say the men gathered information for Iranian intelligence in preparation for serious violence against Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
Sepahvand accepts that he conducted surveillance but says he acted under duress and deliberately tried to undermine the operation.
The court was shown phone and vehicle location data placing Sepahvand near addresses linked to the alleged targets, as well as messages in which he passed Manesh information about Hosseini, including references to his dog and a blue Volkswagen Golf.
Sepahvand said he asked Manesh to make a video of the car. On one occasion, he said, he travelled to an address specifically so his phone's GPS would show his Iranian contacts that he had been there.
He said he was trying to convince the Revolutionary Guards that he was cooperating while actually frustrating the alleged operation.
“I played them,” Sepahvand told the court.
Sepahvand also testified that £30,000 had been sent to a money exchange in Finchley after an address linked to Pourmohsen was raised, but said he did not collect it because he did not want to carry out the task.
Asked who had sent the money and what it was for, Sepahvand named a man called Ruhollah and said it was to “go after the journalists.” Asked which journalists, he said that had not been specified.
Sepahvand said he had initially asked for £150,000. When he denied telling his Iranian contacts that he would attack a journalist if they paid him, his barrister, Tyrone Smith, pointed him to an earlier message in which he appeared to say he would carry out the attack if paid.
Sepahvand said he had no choice but to make such claims because he believed the Revolutionary Guards were monitoring his communications and waiting for him to say he would not carry out the attack.
He said he had been under duress from the beginning, citing the arrest of an associate and his younger brother, a raid on his mother's home and pressure over a criminal case against him in Iran.
“I didn't want anyone to be hurt,” Sepahvand said toward the end of his testimony. “I wanted to protect everyone.”
The trial continues.
Iran is seeking to amplify unrest in France through online influence campaigns and alleged links to hard-left groups, The Times reported on Tuesday, citing researchers who accused Tehran and Moscow of exploiting student protests to weaken Western democracies.
The report also cited claims that President Emmanuel Macron blocked publication of a French government assessment of Iranian interference to avoid antagonizing Tehran.
The protests began last month over education funding and discrimination, before spreading and descending into violence in Paris and other cities. The Times said there was no evidence foreign powers initiated the movement.
French Foreign Minister Jean-Noël Barrot said last week that the demonstrations had been exploited by hostile narratives from Russia, China, Iran and the US MAGA movement, according to the newspaper.
France Culture separately cited police and intelligence sources alleging that foreign-backed bloggers and influencers had amplified the unrest. Officials or state-aligned media in the countries accused have rejected the allegations, The Times said.
Claims of infiltration and payments
David Colon, a historian at Sciences Po who studies disinformation, told The Times that Iran, Russia and Algeria were exacerbating tensions. He argued that Iran had been particularly effective because of its penetration of far-left groups.
Franco-Iranian journalist Emmanuel Razavi alleged that Iranian intelligence cultivated ties with those groups and encouraged them to promote the Palestinian cause. He linked the presence of Palestinian flags at protests to those efforts, although the flags themselves do not establish Iranian involvement.
Razavi also said Iranian agents were suspected of paying unemployed youths a few hundred euros to cause disorder in Paris. He said those allegedly paid represented only a small minority of participants in the October 17 unrest.
He further alleged that the Revolutionary Guards’ Quds Force operated troll farms and recruited influencers, including on Telegram. The report did not present documentary evidence substantiating his claims about payments or operational links.
Colon cited a Franco-Iranian influencer convicted of inciting terrorism who was now posting about French police violence, arguing that he understood how to maximize online visibility.
Report allegedly withheld
Citing French outlet La Lettre, The Times said Barrot received a government report describing Iranian disinformation campaigns and cyberattacks, including activity around the 2024 Paris Olympics and subsequent French protests.
Barrot wanted it published, but Macron refused while seeking to maintain diplomatic distance from both Tehran and Washington during the Iran war, according to the account.
La Lettre’s publicly accessible summary says the Élysée blocked disclosure of evidence compiled by French security bodies and ordered a restrained response to Tehran.
Previous influence campaigns
Iran International reported in October 2024 that Microsoft had identified an operation targeting Israel’s participation in the Paris Olympics by Cotton Sandstorm, a group Microsoft described as directed by the Revolutionary Guards.
Earlier that year, Iran International covered Microsoft’s findings that Iranian actors operated covert news websites targeting Americans across the political spectrum, including left-leaning Nio Thinker and conservative Savannah Time. Tehran denied interfering in US elections.
On October 9, Iran International reported OpenAI’s disclosure of an Iran-origin campaign using seven fictitious journalist identities to place nearly 100 articles in foreign outlets and generate hostile replies to Iran International posts.
OpenAI said the social media activity gained little traction and that it could not identify the organization behind the campaign. Those findings document separate influence efforts, rather than establish responsibility for the current French unrest.