Soufan Center brief frames post-war Iranian hybrid threat in Europe as IRGC-QF reliance on HAYI-style semi-deniable front networks

Analysis
The 48-72 hour tempo between physical attacks and HAYI claims is very likely an IRGC-QF operational art experiment: a fresh brand stood up to absorb attribution for pre-positioned incendiary cells in Western Europe while preserving deniability for parallel MOIS-directed assassination plotting. The dormant Telegram channel's reactivation synchronized with the post-ceasefire window and pro-Iranian dissemination chains (per RFE/RL), and the claim pattern, petrol-bomb imagery and semi-plausible drone assertions against the Israeli embassy, is consistent with a small state-directed cell laundering operational identity through a new label rather than freelance actors, though the group-identity narrative rests on a narrow evidence base of overlapping OSINT and UK charging records, with CNN's foreground skepticism on internal claim inconsistencies the sharpest available counter. HAYI may instead be an independent jihadist network exploiting IRGC-friendly distribution channels without formal state tasking, which would mean services are overstating the coordination signal. Independent validation almost certainly arrives within 3-6 months as European counterterrorism works back from the Iran International UK charges and the still-open London incidents; if the facade reading holds, additional attacks against Iranian-dissident and Israeli-linked targets in Germany and France are probable within weeks, scaled to the duration of the US-Iran nuclear negotiation window.