A series of coordinated attacks targeting Jewish communities and American interests across Europe has been claimed by a shadowy, pro-Iranian group, though security analysts warn the organization may be a carefully constructed facade. The group, which identifies itself as Harakat Ashab al-Yamin al-Islamia (HAYI), has emerged as a primary suspect in a wave of violence that has shaken several European capitals in the wake of escalating tensions between Iran, the United States, and Israel.
The shadowy, pro-Iranian group claims spate of attacks in Europe have spanned four countries, involving arson, explosives, and foiled plots. However, the sudden appearance of HAYI—whose name translates roughly from Arabic as “The Islamic Movement of the Companions of the Right(eous)”—has raised red flags among counterterrorism experts. The group’s digital footprint is almost non-existent prior to March 9, appearing online shortly after the outbreak of war involving the U.S. And Israel against Iran.
According to analysis by the International Centre for Counter-Terrorism (ICCT) in The Hague, there are no known references to HAYI, either online or offline, before its first post circulated in a Telegram channel on March 9. Since then, the group’s claims have been amplified through a network of X and Telegram channels closely tied to pro-Iranian militias and news outlets, suggesting a level of coordination that points toward state sponsorship rather than a grassroots militant movement.
The Anatomy of a ‘Mirage’ Group
For experts monitoring hybrid warfare, the hallmarks of HAYI are not those of a professional terrorist organization, but rather a “mirage” designed to provide Tehran with plausible deniability. Thomas Renard, director of the ICCT, noted that the group’s digital proximity to the pro-Iranian ecosystem is striking, particularly the timeline of its posts which suggests tight coordination with state-aligned actors.
Further evidence of the group’s artificial nature appears in the details. ICCT analysts have identified errors in Arabic spellings within the group’s logo and video captions—mistakes unlikely to be made by native speakers or a sophisticated independent militant cell. This leads analysts to believe HAYI is a front for operations coordinated directly by Iran.
This strategy mirrors “hybrid operations” previously perfected by Russia, where state officials recruit individuals online—often non-nationals—to carry out sabotage for small sums of money. These operatives frequently lack full knowledge of who they are serving, allowing the sponsoring state to distance itself from the crime. Martha Turnbull, a director at the European Centre of Excellence for Countering Hybrid Threats, noted that hybrid threat actors including Russia, China, and Iran are increasingly utilizing non-state actors or proxies to achieve their goals.
Timeline of Claimed Incidents
| Location | Target | Incident Type |
|---|---|---|
| United Kingdom | Jewish community ambulances | Arson attack in North London |
| Netherlands | Rotterdam Synagogue | Explosive device detonation |
| Netherlands | Jewish school in Amsterdam | Damage to outer wall |
| France | Bank of America office, Paris | Foiled explosive plot |
| Belgium | Synagogue | Explosive device detonation |
European Security Response and Heightened Vigilance
Despite the uncertainty surrounding HAYI’s legitimacy, European intelligence agencies are treating the threat as acute. In Belgium, the Coordination Unit for Threat Analysis has maintained the general terror threat level at “serious,” specifically urging heightened vigilance for American, Iranian, and Israeli and Jewish interests. The unit emphasized that Iran has a documented history of carrying out operations in Europe against dissidents and foreign interests, whether directly or through proxies.
In the Netherlands, the response has been swift. Following the Rotterdam synagogue explosion, Dutch Justice Minister David van Weel stated that the suspects involved were most likely recruited, and authorities are actively investigating Iranian involvement. In the UK, a Home Office spokesperson declined to comment on specific intelligence but affirmed that the government takes the threat posed by the Iranian regime and its affiliates “extremely seriously.”
The broader security landscape remains volatile. Europol has warned of a rising risk of “small-scale, opportunistic attacks,” focusing its monitoring on early-stage plots and lone actors. Similarly, Israel’s National Security Council has issued travel warnings for its citizens, citing a significant increase in threats from Iran and its proxies globally.
Distinguishing Proxies from Other Threats
While the HAYI-linked attacks follow a specific pattern of state-sponsored hybrid warfare, other incidents in Europe suggest a fragmented threat environment. For instance, a recent armed attack near the Israeli consulate in Istanbul was attributed by Turkish Justice Minister Akın Gürlek to ISIS, rather than Iranian proxies. This resulted in a nationwide operation to detain 198 ISIS-linked suspects.
The Iranian threat, however, is viewed as a distinct and growing challenge. Over the past two years, there has been a noted increase in aggression against the Iranian diaspora and dissidents in countries such as Spain and Sweden. A previous investigation into attempted attacks on the Israeli embassy in Stockholm pointed to gangs acting on behalf of Iran, though the Iranian embassy in Stockholm has firmly rejected such involvement.
In the United States, the Justice Department recently seized several websites allegedly used by Iran to target regime dissidents and spread terrorist propaganda. These actions, combined with the emergence of “lone wolf” actors ideologically aligned with the regime, suggest a multi-pronged approach to destabilization that extends far beyond the borders of the Middle East.
As the conflict in the Middle East persists, security experts expect the Iranian threat to increase. The regime continues to seek “revenge” attacks on American and Israeli targets while attempting to silence critics abroad through layers of intermediaries. The next critical phase of these investigations will likely depend on the forensic analysis of devices seized from arrested suspects in the Netherlands and France, which may finally provide a definitive link between the HAYI facade and the officials in Tehran.
We invite our readers to share this report and join the conversation in the comments regarding the rise of hybrid warfare in Europe.
