The organization Harakat Ashab al-Yamin al-Islamia (HAYI) has repeatedly made headlines since its appearance in March, claiming responsibility for several terrorist attacks on Jewish sites across Europe. Yet while it appears that a new transnational jihadist threat has emerged, HAYI may be less of an established organization and more of a brand slapped on the same types of attacks orchestrated by the Iranian Islamic Regime for years.
HAYI emerged from thin air in March, with little social media or online infrastructure to its name. Yet the nascent terrorist movement was somehow able to establish cells across a continent immediately. It has claimed responsibility for the Liege synagogue bombing on March 9, the March 13 Rotterdam synagogue arson, last Sunday's Skopje Jewish center arson, last Friday's Munich restaurant bombing, and a series of arsons in London.
Terrorist organizations claim responsibility for incidents all the time when they may not actually have had a hand in the matter, such as when there is retroactive approval of a lone wolf terrorist's attacks. However, HAYI's claims include videos of the events, graphics, and prepared statements explaining its reasoning for targeting a site.
Such a reach is impressive for a supposedly new organization. Establishing cells should be expected to take time. Lone wolves conduct operations on behalf of ISIS all the time, but the jihadist group has spent years establishing its movement and inspiring followers. Encouraging random aspiring Jihadists in Western countries to act in their name is unlikely when the organization is only weeks old.
It might be supposed that HAYI is a new organization created by the Iranian regime and is using its preexisting covert and intelligence infrastructure, with the fledgling group bearing the aesthetic hallmarks. HAYI clearly emerged during the US-Israeli military operations against Iran, and in its statements, points to the Western powers' actions in Iran as a motive. Its propaganda videos are disseminated through Iranian-affiliated "Axis of Resistance" Telegram channels, and its logo bears the standard Iranian proxy imagery of a fist clutching a rifle to the backdrop of a globe.
Yet there are differences that are peculiar, be they by design or amateurish sloppiness. The HAYI logo is distinct in that it uses the silhouette of a Dragunov sniper rifle rather than a Kalashnikov rifle, and there have been rhetorical issues, such as referring to the "land of Israel" in a statement claiming responsibility for the March 23 Golders Green ambulance arsons. Iranian proxies are usually much more particular in their messaging.
Unprofessional conduct can also be found in the operations themselves. There should be no diminishing of the danger and intent involved in the attacks attributed to HAYI, but some of them appear to be carried out by those with little understanding of the means. The two people arrested for Wednesday's arson attempt against the Finchley Reform synagogue filled bottles with what was suspected to be petrol, and then threw a brick at them. When nothing happened, the suspects fled the scene. In Skopje, the perpetrators managed to create a fireball and charred the doors of the Jewish center, but they failed to create a sustained fire, pouring much of their accelerant on benches and the courtyard.
The Wednesday arson attack against the offices of Iran International in Wembley saw the perpetrators light a container on fire and throw it into the dissident news network's carpark, where, according to the Metropolitan Police, it "immediately put itself out." The Friday arson in Hendon was more successful, though the three bottles containing accelerant failed to fully ignite; the target wasn't a Jewish site, though the sign of a Jewish NGO remained, as the organization had moved premises.
These blunders indicate that those carrying out these attacks are not expert operatives nor lone wolves who have dedicated themselves to the study of terrorist manuals. Unlike many jihadis, they seem inclined not to get caught and martyred, instead fleeing at the first sign of difficulty.
Iran's connection to the group
The Metropolitan Police said on Sunday that it was exploring whether the Iranian Regime was employing petty criminals as proxies, a tried strategy of the Islamic Revolutionary Guard Corps (IRGC).
"We are considering whether this tactic is being used here in London - recruiting violence as a service. Individuals carrying out these crimes often have no allegiance to the cause and are taking quick cash for their crimes," Deputy Assistant Commissioner Vicki Evans warned in a statement. "To anyone even considering getting involved, my message to you would be this: the stakes are high, and it is absolutely not worth the risk for a small reward. Those tasked with you will not be there when you are arrested and face court. You will be used once and thrown away without a second thought."
Indeed, there is reason to believe, based on what is already publicly known about the perpetrators, that this suspicion is justified.
Iran has often employed criminal networks over the years to target Iranian dissidents, Israelis, and Jews. In May 2024, Stockholm announced that the Islamic regime was using criminal networks. Sweden was joined by Albania, Austria, Belgium, Canada, Czechia, Denmark, Finland, France, Germany, the Netherlands, Spain, the United Kingdom, and the United States in July to condemn Iranian intelligence service threats in their countries.
“We are united in our opposition to the attempts of Iranian intelligence services to kill, kidnap, and harass people in Europe and North America in clear violation of our sovereignty," the countries said in a joint statement. "These Services are increasingly collaborating with international criminal organizations to target journalists, dissidents, Jewish citizens, and current and former officials in Europe and North America."
Several days before the statement, the UK published an Intelligence and Security Committee report detailing that Iran used proxy groups, including criminal networks, militant and terrorist organizations, and hacking groups, to provide it with a means of plausible deniability when attacking enemies.
Tehran had allegedly used the method at least 15 times since 2022 to attempt to murder or kidnap Jewish or Iranian dissident UK nationals or residents.
Twenty-one-year-old Oisin McGuiness and 19-year-old Nathan Dunn, at least based on their names, do not sound like they fit the typical demographic profile of jihadists or those who would bear umbrage with Iranian dissidents, but they and a 16-year-old Watford boy attempted an arson attack on Iran International. The motive is still unknown, but based on the statements by the Met, at least some of the suspects are believed to be hired thugs, not radicals.
One criminal organization closely tied to Iranian operations is Foxtrot, which often employs young men, teenagers, and children to carry out attacks. A similar pattern has appeared among supposed HAYI operatives. Dutch police arrested four teenagers, ranging in age from 14 to 17, and later a 20-year-old and a 23-year-old. 18-year-old Judex Atshatshi and a 17-year-old were among the four arrested in connection with the Hatzola ambulance arsons.
Some of those involved in the incidents, like the 17-year-old alleged Golders Green arsonist, have been Pakistani nationals. There has been a tendency for the Iranian regime to launder its involvement in attacks abroad by using third-country individuals, as noted in a November 2024 Director of National Intelligence's Office document. Many such incidents have involved Pakistani nationals, such as Asif Merchant's 2024 plans to assassinate US President Donald Trump, the three people arrested in Greece in March 2023 for plotting attacks on a synagogue and kosher restaurant, and Haider Syed Mustafa's 2012 reconnaissance of Jewish targets in Germany and France.
The spate of arson and attacks in Europe, comparable to suspected Iran-backed attacks against Jewish sites in Australia in 2024, may therefore not be new in substance. In practice, they appear to follow the same playbook as past Iranian-sponsored terrorist attacks. This may be another case of the Islamic regime employing criminals, youths, and third-country individuals to impose its will abroad. The only difference may be that, instead of the origin of the attacks remaining shrouded in mystery, Iran has shed some of its plausible deniability in a time of conflict, making it clear to its enemies and European countries why the attacks are occurring. It has done so by conducting its normal regimen of punishing attacks and political extortion under the banner of what appears to be an Islamic Regime proxy group.
If this is the case, and HAYI is just a collection of local criminals and random miscreants hired for odd terrorism jobs, it is less of an organization and more of a brand.