Suspected Hamas Operative Arrested in Greece Over Alleged Plot to Attack Israeli Cruise Ship

On the night of June 6, 2026, Greek counter-terrorism officers arrested a 37-year-old Palestinian man in the seaside town of Agios Nikolaos on the island of Crete. He had been living there for nearly two years, working seasonally at a hotel — a hotel in a port town where Israeli cruise ships regularly dock [1][2]. Greek authorities accuse him of membership in Hamas and of planning a bomb attack against a Mano Maritime cruise ship scheduled to arrive in Crete on June 9, carrying Israeli tourists [3].

The arrest did not occur in isolation. It is connected to the detention of four Palestinians in Cyprus on terrorism-related charges, and it fits a pattern that European and Israeli intelligence officials have been warning about for more than two years: Hamas's expansion into external operations across Europe [4][5].

What Greek Authorities Found

Searches of the suspect's residences — one in Crete, another in central Athens — yielded what police described as the components of a bomb-making laboratory. Officers seized liquid dispensers, precision scales, chemical reagents, mobile phones, a laptop computer, data storage devices, and bank cards [1][6]. Authorities also said he had ordered additional materials online to prepare an explosive device [3].

Greek police charged him with involvement with Hamas, receiving training in explosives, terrorist-related travel, and planning terrorist acts [6]. According to the Media Line, the suspect acknowledged his Hamas affiliation and admitted maintaining contact with individuals recently detained in Cyprus [7].

Greek intelligence services assessed that the alleged plot had not progressed beyond the preparation phase — the bomb had not been assembled, and no attack was imminent at the time of arrest [1][2].

The Suspect's Background and Network

The man, originally from Gaza, had entered Greece and received political asylum, giving him legal residency [6]. His placement in Agios Nikolaos — a regular stop for Mano Maritime's Crown Iris cruise ship — may not have been coincidental. Investigators believe his seasonal hotel employment provided proximity to Israeli tourist targets [8].

According to Israeli and Greek media, the suspect underwent initial explosives training from Hamas while still living in Gaza. More recently, he traveled to Malaysia with one of the four individuals arrested in Cyprus, where both received additional training in bomb-making [3][9]. Greek police linked all five suspects to the same operational network, with the three individuals in Greece and Cyprus believed to have received joint training in explosive devices [2][8].

The route — from Gaza, through asylum in Greece, with a training trip to Malaysia — raises questions about whether Hamas has established logistics corridors that exploit EU open-border zones and asylum systems. Greek authorities have not publicly detailed how the suspect initially reached Greece or whether he transited other EU member states.

The Cyprus Connection

The arrest was triggered by intelligence shared between Cypriot and Greek security services. Two Palestinians had been arrested in Cyprus on terrorism charges, and information from those investigations led Greek intelligence to the Crete suspect [7][10]. The coordination between Greece's National Intelligence Service (EYP), the Greek Anti-Terrorist Service, and Cypriot counterparts was central to the operation [7].

Greece and Israel have built a track record of intelligence cooperation. In March 2023, a joint EYP-Mossad operation dismantled a planned attack against a synagogue and kosher restaurant in Athens, arresting two Pakistani nationals linked to Iranian intelligence [11]. In November 2024, Mossad agents traveled to Athens to investigate a bombing near the Israeli embassy [12]. Whether Mossad or Israeli intelligence directly contributed to the June 2026 arrest has not been officially confirmed, though Greek and Israeli security coordination on Hamas-related threats has been extensive [11][12].

Hamas's Turn Toward External Operations

The Greece arrest is the latest in a series of disrupted Hamas-linked plots across Europe since October 7, 2023. According to an analysis published by the Combating Terrorism Center at West Point, authored by Dr. Matthew Levitt, Hamas set contingency plans for European operations years before October 7 — including burying weapons caches in multiple countries [4].

Source: CTC Sentinel / Open-source reporting

Data as of Jun 7, 2026CSV

German federal prosecutors revealed that in April 2019, Hamas operative Ibrahim Elrassatmi received orders from the Qassam Brigades to establish arms depots across Europe. Caches containing handguns, Kalashnikov rifles, silencers, and ammunition were buried in Bulgaria near Plovdiv and in Denmark near Orbaek [4]. German authorities confirmed that in May 2023, Hamas activated these dormant caches "in preparation for the terrorist attack on Israel on October 7, 2023" [4].

In December 2023, German police arrested three suspects for procuring AK-47s and a Glock pistol intended for attacks on Israeli and Jewish institutions. Additional arrests followed in October 2025 — on the eve of Yom Kippur [4]. In Denmark, a 28-year-old citizen was indicted in May 2025 for conspiring to purchase DJI quadcopter drones for Hamas attacks in Denmark or Sweden, working with the European organized crime group Loyal to Familia [4][5].

In November 2025, Austria seized a weapons cache in Vienna connected to Muhammad Naim, the son of senior Hamas leader Bassem Naim [5]. The Mossad publicly disclosed it had assisted European security services in preventing multiple Hamas attacks across the continent [13].

Source: Open-source reporting compilation

Data as of Jun 7, 2026CSV

Germany has seen the highest concentration of disrupted plots, with at least six arrests or incidents, followed by Denmark and Cyprus with four each. The German Federal Intelligence Service (BND) assessed "that Hamas has deliberately established local operators in Europe over the course of many years" [5].

An Israeli intelligence official quoted in the CTC Sentinel analysis stated plainly: "External operations by Hamas are no longer something we can ignore" [4]. The Israeli National Security Council warned in September 2025 that "Hamas is expanding its own activities beyond the war in Gaza to establish terrorist infrastructure and carry out terrorist attacks against Jews and Israelis abroad" [4].

Mano Maritime: A Visible Target

The alleged target — a Mano Maritime cruise ship — carries particular significance. Mano Maritime, founded by Haifa-born Moshe Mano, operates the Crown Iris, a vessel with capacity for approximately 2,000 passengers that regularly sails Mediterranean routes popular with Israeli tourists [14][15].

The Crown Iris has been at the center of several high-profile incidents. In June 2025, the ship was deployed to evacuate Israelis from Cyprus during the Israel-Iran conflict, operating under Israeli Navy escort [14]. In July 2025, pro-Palestinian protesters at the port of Agios Nikolaos — the same town where the suspect was arrested — unfurled Palestinian flags and chanted as Crown Iris passengers disembarked [16]. In August, anti-Israel rioters at Syros forced the ship to depart early [17]. In November 2025, violent clashes erupted at Crete's Souda port, with police deploying tear gas as protesters attacked Israeli passengers [18].

The repeated targeting of Mano Maritime ships by protesters — and now an alleged bomb plot — illustrates the vessel's visibility as an Israeli-associated soft target in the eastern Mediterranean.

Detailed information about armed security personnel aboard Israeli cruise ships is not publicly available. However, the Crown Iris has operated under Israeli Navy protection during conflict periods, and Israeli defense authorities must approve departures based on security assessments [14]. Post-October 7 security upgrades for Israeli commercial vessels have not been publicly detailed.

The Legal Framework: Terrorism, Piracy, or Act of War?

Had the alleged plot succeeded, a bomb attack against a civilian cruise ship in Greek territorial waters would have raised difficult jurisdictional questions.

Under the United Nations Convention on the Law of the Sea (UNCLOS), piracy is narrowly defined as illegal acts of violence committed on the high seas for private ends, requiring a two-ship scenario [19]. A politically motivated bombing of a cruise ship in port would not meet this definition.

The 1985 Achille Lauro hijacking — when Palestine Liberation Front members seized an Italian cruise ship and killed American passenger Leon Klinghoffer — exposed this gap. The incident prompted the International Maritime Organization to adopt the 1988 Convention for the Suppression of Unlawful Acts against the Safety of Maritime Navigation (SUA Convention), which criminalizes terrorist acts against ships regardless of the piracy definition [19][20]. Greece is a party to the SUA Convention.

In Greek territorial waters, Greek criminal law would apply. Under EU and Greek law, Hamas is a designated terrorist organization, and the suspect faces charges under Greek counter-terrorism statutes that incorporate EU Directive 2017/541, which criminalizes terrorist travel, training, and material support [21]. An attack would most likely be prosecuted as a terrorist act under Greek jurisdiction, with potential involvement of the flag state if the ship were registered elsewhere.

Whether such an attack would constitute an act of war is a separate question. Hamas is a non-state actor; international law traditionally reserves "act of war" designations for state-on-state conflict. However, the October 7 attack — which Israel treated as a casus belli — has blurred these distinctions in practice.

The Case for Skepticism

Not all terrorism arrests lead to convictions, and Greece's legal system includes protections for defendants that merit consideration.

Greek counter-terrorism law, rooted in Law 774/1978 and subsequently amended, has drawn scrutiny. When the law was first enacted, opposition leader Andreas Papandreou criticized it for suppressing civil liberties [21]. The law has been updated to incorporate EU directives, but the evidentiary threshold for terrorism-related charges — particularly "membership" in a designated organization — has been debated by legal scholars in the Greek and European context.

The suspect was granted political asylum in Greece, raising questions about how an individual assessed as warranting international protection was simultaneously under surveillance for Hamas ties. Greek authorities have not publicly addressed this tension.

The assessment that the plot "had not progressed beyond the preparation phase" is relevant to the strength of the prosecution. Possessing laboratory equipment and chemical reagents is not, in itself, proof of a specific attack plan. Greek prosecutors will need to demonstrate intent and concrete steps toward executing an attack, not merely possession of dual-use materials.

Greece's historically complex position — maintaining strong defense ties with Israel while also cultivating relationships with Arab states and hosting a significant population of Palestinian asylum seekers — adds political dimension to the case. Whether these charges will hold up under judicial scrutiny remains an open question.

What This Case Signals

The Greece arrest, taken together with the Cyprus detentions and the broader pattern documented across Germany, Denmark, Austria, and elsewhere, represents what the CTC Sentinel analysis calls a strategic inflection point. Hamas, its military infrastructure in Gaza severely degraded after more than two years of war, appears to be directing operational capacity outward [4].

The targets have shifted from military objectives to soft civilian targets — cruise ships, synagogues, kosher restaurants, tourist infrastructure. The operatives are not battle-hardened fighters infiltrating from conflict zones but individuals with legal residency, asylum status, and ordinary employment, positioned in proximity to Israeli civilian life abroad [4][8].

European security services face the challenge of monitoring these networks across open-border zones while preserving the asylum systems and civil liberties that define the EU's legal framework. The Greece case demonstrates both the capability of intelligence cooperation — the plot was disrupted before an attack could materialize — and the scale of the threat that cooperation is attempting to address.

The Crown Iris is scheduled to continue its Mediterranean routes. The suspect is expected to appear before a Greek prosecutor. And the broader question — whether Hamas has permanently shifted toward international operations or whether these plots represent the desperate acts of an organization under existential military pressure — remains unanswered by the available evidence.