Shadowy Pro-Iranian Group HAYI Claims European Attacks But May Be IRGC Facade, Intelligence Analysts Assess
A previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has claimed responsibility for attacks against Jewish and American targets across the Netherlands, Belgium, France, and the UK since March 9, including arson on Jewish community ambulances, an explosive device at a Belgian synagogue, and a foiled attack on a Bank of America office in France. ICCT analysts identified errors in the Arabic spellings in the group's logo and Telegram postings, assessing it is likely not an independent organization but a facade for an operation coordinated by Iranian intelligence. Counterterrorism experts note the tactics closely mirror Russia's hybrid operations in Europe, where intelligence services recruit non-nationals online for sabotage operations.
ICCT's identification of Arabic spelling errors in HAYI's branding suggests a hastily constructed front organization rather than an organic militant group. The operational pattern, recruiting non-Iranian nationals online for low-sophistication attacks against Jewish and American targets, mirrors Russian hybrid operations in Europe and raises the possibility of shared tradecraft or direct GRU-IRGC collaboration on methodology. Attribution remains uncertain: the group could be an IRGC-QF cutout, a genuine sympathizer network with informal Iranian guidance, or a false flag designed to justify IRGC proscription in European jurisdictions.