Adversary Intelligence — 2026-06-05

Cipher Brief Analysis Argues NATO Must Apply CT Cooperation Model Against Russian GRU and Iranian Proxy Hybrid Threats

BLUFHAYI will very likely claim at least one additional European attack within 30 days of June 5, as fragmented national services lack the cross-border fusion architecture needed to disrupt a centrally coordinated proxy campaign.

A Cipher Brief analysis published June 2 argues NATO should apply its post-9/11 CT cooperation model to counter Russian GRU disposable-agent operations and Iran's HAYI proxy campaign in Europe 1. HAYI, which first announced itself on March 9, has claimed 17 attacks targeting Jewish communities, Israeli missions, and Iranian dissident journalists across seven European countries 23. Britain raised its national threat level to severe after HAYI claimed an April 29 stabbing of two Jewish men in London's Golders Green neighborhood, where British security officials have said they are investigating possible IRGC links 2. A US criminal complaint unsealed May 15 alleges HAYI is a Kataib Hezbollah front, with a recorded KH commander referencing 18 European attacks and attempting to hire an undercover FBI agent to bomb synagogues in New York, Los Angeles, and Scottsdale 3.

Analysis
HAYI will very likely claim at least one additional attack on European soil within 30 days of June 5. The campaign has averaged multiple claims per week since March 9, and a recorded KH commander's reference to 18 European attacks alongside FBI-documented active planning signals no operational pause. Moderate confidence rests on confirmed law enforcement linkage to Kataib Hezbollah; the main uncertainty is whether the May 15 US criminal complaint alters KH's near-term European tempo. The KH attribution may reflect a single FBI sting aggregating uncoordinated actors under a fabricated brand, rather than a directed network. Sourcing is wholly from Western CT research outlets with no primary law enforcement documentation, limiting independent verification. Without cross-border intelligence fusion, European interior ministers face an architecture gap that forecloses disruption and allows the operational network to reconstitute under a new brand.

3 sources

From Terror Networks to Hybrid Threats: A Partner Approach to a Growing Threat - The Cipher Brief
Harakat Ashab al-Yamin al-Islamia: New Hybrid Group Threatens and Confounds European Security Landscape - GNET Research
Islamic Movement of the Companions of the Right: The 'gig-economy' proxy group attacking Europe - Institute for Strategic Dialogue