IC Operations & Tradecraft — 2026-11-15

DOJ Indicts Three in IRGC and MOIS-Directed Attack Network Targeting Jewish and US Sites Across Europe

BLUFArrest or extradition of Mohsen Mohajeri or Mohammad Ali al-Hassani to the US is very unlikely by the end of December 2026, leaving prosecutors to build their case around the sole defendant in custody while the two alleged operational directors remain fugitives.

The US Justice Department unsealed a superseding indictment in Manhattan federal court on November 10 charging Mohammad Baqer Saad Dawood al-Saadi, Mohsen Mohajeri, and Mohammad Ali al-Hassani with involvement in nearly 20 attacks and attempted attacks tied to the IRGC and Kataeb Hezbollah; only al-Saadi is in custody 12. The indictment alleges al-Hassani directed a London synagogue attacker by video call, and the defendants watched an April firebombing of a Jewish charity live on FaceTime, per Times of Israel 1. The Record also reported the FaceTime direction 3. ITV News, relayed by Iranwire, cited Western officials saying a seven-man network financed by the IRGC Quds Force and Iran's intelligence ministry enlisted local criminals, and that senior IRGC commanders approved the RAF Fairford plot 2. Iran denies involvement, and the allegations have not been tested in court; G7 foreign ministers cited grave concern over Iranian plots on November 9-10, and no public link has been confirmed between the Fairford and RAF Mildenhall incidents 4.

Analysis
We hold high confidence, based on a primary DOJ document that places both men outside US custody and the absence of any reported arrests or extradition proceedings. It is very unlikely that Mohsen Mohajeri or Mohammad Ali al-Hassani is arrested, taken into custody or extradited to the US between November 16 and December 31, 2026. Al-Hassani, who allegedly directed a London synagogue attacker by FaceTime, is the key defendant, yet neither man has a publicly identified location or detention in a cooperating state, leaving prosecutors with al-Saadi alone. The superseding indictment widens the May case by adding two co-defendants, the Fairford and New York synagogue plots, and live video direction of attackers. Independent corroboration of the network's wider structure is slimmer than the agreement suggests, because the DOJ release anchors the charges and the other outlets largely relay it or a single ITV investigation. The indictment may serve mainly to build signaling and sanctions pressure on Tehran and Baghdad, not to precede arrests. If neither man is taken, planners should treat the directing layer as still active and keep force protection at UK bases heightened.
5 sources
  1. US charges 3 Iran-backed operatives over attacks against Jews, plot targeting UK airbase - Times of Israel
  2. ITV Investigation Links Islamic Republic Intelligence Agencies to Wave of Attacks Across Europe
  3. Iran-backed network directed London attacks over FaceTime, US prosecutors say - The Record
  4. Seven-man Iran-linked network helped orchestrate wave of attacks across Europe - ITV - Iran International
  5. Three Iranian-Backed Operatives Indicted for Their Roles in Nearly 20 Terrorist Attacks and Attempted Attacks - US Department of Justice, Office of Public Affairs

View in full brief →

UNCLASSIFIED // OPEN SOURCE