Inside Iran's Gulf Sleeper Network: Assassinations, Front Companies, and Iraq's Proxy Dilemma

The Six-Nation Joint Statement

On March 26, 2026, Saudi Arabia, the United Arab Emirates, Qatar, Kuwait, Bahrain, and Jordan issued a joint statement condemning Iranian attacks on their soil — both direct strikes and attacks carried out "through their proxies and armed factions they support in the region," according to The Guardian.

The statement cited UN Security Council Resolution 2817, adopted on March 11, 2026, which condemned Iran's "egregious attacks" against the Gulf states and Jordan during the 2026 Iran war, according to Wikipedia's documentation of the resolution. That resolution, sponsored by Bahrain and co-sponsored by 134 other countries, demanded the immediate cessation of attacks against residential areas and civilian infrastructure and called on Iran to halt support for proxy groups across the region, according to PassBlue.

The joint Arab statement specifically called on the Iraqi government to "take the necessary measures to immediately halt the attacks launched by factions, militias, and armed groups from Iraqi territory toward neighbouring countries, in order to preserve brotherly relations and avoid further escalation," according to a statement by Qatar's Ministry of Foreign Affairs cited by Al Jazeera.

The six countries also stated their security services were keeping a "watchful eye" on domestic plots, and condemned "the destabilising acts and activities targeting the security and stability of the region's countries, which are planned by sleeper cells loyal to Iran and terrorist organisations linked to Hezbollah," according to The National News.

Kuwait: Assassination Plots and Two Waves of Arrests

Kuwait has experienced the most dramatic domestic security incidents. On March 25, Kuwait's Ministry of Interior announced it had "thwarted a terrorist plot and dismantled a network" planning "to carry out assassination operations targeting symbols and leaders of the state, as well as recruiting individuals to undertake these tasks," according to The National News.

Six suspects confessed to espionage and terrorist activities, including training in "assassination skills," the ministry said. Five of those arrested were Kuwaiti citizens. The ministry also identified 14 additional suspects — including five Kuwaitis, two Iranians, and two Lebanese — as fugitives outside the country. Six suspects had their Kuwaiti citizenship revoked, according to The National News. The suspects allegedly received "advanced military training abroad" from Hezbollah members, which the ministry described as including "the use of weapons and explosives, surveillance techniques and assassination skills," according to The National News.

This followed an earlier operation: on March 16, Kuwaiti authorities arrested 16 people linked to Hezbollah on charges related to recruitment and attempts to destabilize the country, according to reporting compiled by Madhyamam Online.

Kuwait had also, in late March, sustained direct military strikes. The Institute for the Study of War (ISW) documented that Iran fired nine drones and 20 ballistic missiles targeting Kuwait on March 25. Kuwait's government separately confirmed that an Iranian attack damaged a service building at a power generation and water desalination plant on March 29, killing at least one person, according to CNBC's March 30 reporting.

UAE: A Commercial Front, Dismantled

On March 19, UAE security authorities announced they had dismantled what they described as a "terrorist network" funded and operated by Lebanon's Hezbollah and its backer Iran, arresting all members, according to Reuters.

The UAE state news agency said "the network had been operating within the country under a fictitious commercial cover and sought to infiltrate the national economy and carry out external schemes threatening the country's financial stability," according to Reuters and The Hindu. Gulf News additionally reported that the network was operating under the commercial cover to launder money and fund terrorism.

The UAE has not publicly disclosed the number of individuals arrested or the specific commercial activities the network used as cover.

Qatar: IRGC Cells in a Country That Tried to Prevent the War

Qatar's discovery of Iranian sleeper cells carries particular geopolitical weight. Qatar had spent weeks attempting to mediate between the U.S. and Iran before the war began on February 28. In early March, Qatar announced the arrest of two cells involving more than 10 people linked to the Iranian regime, according to The Guardian.

Al Jazeera, citing Qatar's state news agency QNA, reported that during interrogation the suspects "admitted their affiliation with the Iranian Revolutionary Guard and that they had been tasked with espionage missions and sabotage activities." Qatari authorities found "locations and coordinates of sensitive facilities and installations, as well as communication devices and technological equipment" in their possession, according to Al Jazeera's March 3 report.

Al Jazeera's analysis noted that the arrests revealed "that even Qatar, one of Iran's closest interlocutors in the Gulf and a country that had spent weeks trying to prevent this very war, had been infiltrated." Iran's direct military strikes targeted Qatar as well, with the Wikipedia timeline of the 2026 Iran war documenting that 13 Iranian missiles were intercepted over Qatar during the broader Gulf campaign.

Iraq: 454 Proxy Operations — and a Government That Can't Stop Them

The most significant military dimension of the proxy campaign runs through Iraq. Armed groups operating under the umbrella of the "Islamic Resistance in Iraq" — Iran-aligned militias that are legally distinct from the Iraqi government but operate on Iraqi soil — have been conducting sustained operations against Gulf targets since the war began.

Majed al-Qaisi, a retired Iraqi major-general, told Al Jazeera that the groups are launching between 21 and 31 operations daily against targets across the Gulf and Jordan. He noted that the groups had carried out more than 454 cumulative operations since the U.S.-Israel war on Iran began on February 28, according to Al Jazeera's March 30 report.

ISW's March 25 Special Report documented the direct Iranian military component in detail: Iran launched 7 drones at Saudi Arabia on March 22, 47 drones on March 23, 32 drones on March 24, and 6 drones on March 25. ISW separately recorded nine drones and 20 ballistic missiles targeting Kuwait on March 25. Targets across the broader campaign have included energy infrastructure, airports, military bases, diplomatic facilities, and residential areas in Saudi Arabia, the UAE, Kuwait, Bahrain, Iraq, and Syria, according to Long War Journal's March 20–23 update.

Faced with the joint Arab condemnation, Iraq's Ministry of Foreign Affairs responded on March 27, stating that the security of Arab countries is "an integral part" of Iraq's national security. Baghdad categorically rejected the use of its territory to target Gulf states or Jordan and said it is taking necessary measures "in accordance with the constitution and the law," according to Al Jazeera. The government expressed "full readiness" to receive any information or evidence regarding the attacks.

However, analysts cited by Al Jazeera cautioned that the statement was largely diplomatic rather than operational. Al-Qaisi observed that Baghdad's response appeared "aimed more at addressing diplomatic embarrassment than as a proactive security measure."

Iran's Strategic Logic: Proxy Over Direct

Khaled al-Jaber, director of the Middle East Council on Global Affairs in Doha, Qatar, told Al Jazeera that the shift from direct Iranian strikes to proxy attacks reflects deliberate strategy. "Iran is not withdrawing from the confrontation; rather, it is redistributing it through tools that are less politically costly," al-Jaber said. He explained that this approach allows Iran to strike from the shadows, keeps adversaries hesitant due to blurred lines of responsibility, and tests the limits of Gulf restraint by steadily raising the cost of their patience.

The logic is well-established in Iran's operational doctrine. For four decades, Iran has used proxy militias as a pillar of its foreign and security policy — from Hezbollah in Lebanon, to the Houthis in Yemen, to the Popular Mobilization Forces in Iraq. These relationships allow Iran to conduct operations while maintaining plausible deniability and complicating international legal responses. UN Security Council Resolution 2817 directly addressed this by calling on Iran to halt "support to proxy groups across the region," according to UNSCR.com — though resolutions carry no automatic enforcement mechanism.

What is notable about the 2026 campaign is its domestic dimension. Rather than limiting proxy operations to border regions or conflict zones, Iran appears to have activated networks embedded inside Gulf civil society — businesses, residents, and nationals — as instruments of espionage, sabotage, and assassination planning. The confessions and equipment seized in Qatar, Kuwait, and the UAE indicate coordination that predated the current war.

The Sovereignty Problem for Iraq

Ahmed Abdel Mohsen al-Mulaifi, a former Kuwaiti minister and member of parliament, argued in remarks cited by Al Jazeera that a state hosting armed groups operating outside the law cannot be considered fully sovereign. Iraq's position is structurally constrained: the Islamic Resistance in Iraq militias are deeply embedded in the country's political and security landscape, with ties to political parties, parliamentary representation, and, in some cases, formal integration into the Popular Mobilization Forces — Iraq's state-sanctioned umbrella security structure. Baghdad's ability to unilaterally shut down these operations is limited without risking domestic political confrontation.

The joint Arab statement's direct language holding Baghdad "responsible" for the cross-border attacks marks a significant escalation in Arab diplomatic pressure on Iraq — pressure that has no clear precedent in the post-2003 era. Whether Baghdad will take concrete action to curtail proxy operations, or whether the response remains primarily diplomatic, was unresolved as of March 30, 2026.