A shadowy, pro-Iran group has claimed responsibility for a spate of recent attacks on Jewish communities and American interests in Europe.
The incidents, which the group posted about via social media accounts affiliated with pro-Iranian militias, include an arson attack on Jewish community-run ambulances in the United Kingdom, an explosive device detonated in front of a synagogue in Belgium and a foiled attack on a Bank of America office in France.
The catch is that the group may be a mirage.
Calling itself Harakat Ashab al-Yamin al-Islamia (HAYI), roughly translated from Arabic as “The Islamic Movement of the Companions of the Right(eous),” the group only appeared online a month ago – shortly after the United States and Israel launched their war on Iran.
“There are no known references, neither online nor offline, to HAYI prior to 9 March, when a post of the group was circulated in a Telegram channel,” according to analysis by the International Centre for Counter-Terrorism (ICCT), a think tank based in The Hague. Since then, the group’s claims and posts have been circulated in Telegram and X channels affiliated with pro-Iranian militias and pro-Iranian news outlets.
“In terms of digital footprint, there is clearly a close proximity with the online pro-Iranian ecosystem,” said Thomas Renard, a counterterrorism expert and director of the ICCT. “It’s not just that these channels posted these video claims or reposted these video claims, but it’s also the fact that they did so on a timeline that indicates some kind of coordination.”
“There are a lot of indications that this group is not genuine,” Renard told CNN. “For now, we are still in the realm of speculation. But there are strong signals that this could be assisted by a foreign country, and Iran would top the list of the potential contenders.”
Errors in Arabic spellings in the group’s logo and in videos posted on their new Telegram account have also led ICCT analysts to believe it’s not a professional, independent terrorist organization, but potentially a facade for an operation coordinated by Iran.
Counterterrorism experts say the attacks are similar in nature to Russia’s so-called hybrid operations in Europe, in which Russian officials have recruited people online to carry out sabotage attacks. Those attacks are often carried out by non-Russian nationals for small amounts of money and without full knowledge of who the operations serve.
“That is very much the model that Russia has perfected over the past few years. And it does appear – again upon validation – that Iran is following now a similar pattern,” Renard said, noting that Iran has long been fond of using hybrid warfare approaches through its backing of other militant groups.
This could be another example of Iran pursuing plausible deniability by using layers of intermediaries, he said. More information is likely to come out as police and counterterrorism authorities comb through the devices of suspects who have been arrested.
“Over the past two years, the Iran-linked threat to Europe has grown significantly,” said Martha Turnbull, a director at the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), an organization dedicated to bolstering security in European and NATO countries. She cited examples of aggression and failed assassination attempts in the Netherlands, Sweden and Spain.
“These attacks have shown the continued focus of the Iranian regime on dissidents, the Iranian diaspora, and, more recently, Jewish and Israeli targets,” said Turnbull, an expert on counterterrorism. More broadly, she noted that hybrid threat actors, including Russia, China and Iran “are making increased use of non-state actors or proxies.”
Heightened terror threat
Whether the group is real or not, European authorities are taking the threat seriously, even as the United States and Iran have entered into a fragile ceasefire.
The coordinating body for assessing terror threats in Belgium said earlier this week that the level of general terror threat in the country remains at “serious” level, “with heightened vigilance for Israeli and Jewish, American and Iranian interests.”
“Iran has already demonstrated in the past its capacity to carry out – directly or via proxies – operations in Europe against Israeli, Jewish, American interests or against its opposition in exile,” Belgium’s Coordination Unit for Threat Analysis told CNN.
Since March 9, HAYI has claimed responsibility for attacks in four countries: the Netherlands, Belgium, France and the UK.
In the Netherlands, the group claimed it was behind an explosion outside a synagogue in Rotterdam that caused damage to the building, as well as an attack on a Jewish school in the capital Amsterdam, which damaged the outer wall of the school.
In the wake of the Rotterdam explosion, Dutch Justice Minister David van Weel said the suspects were most likely recruited and authorities were investigating the possibility that Iran was involved. French counterterrorism prosecutors also said the plot to ignite an explosive device outside the Paris headquarters of Bank of America appears to be linked to HAYI, but a firm link has not yet been established.
In the UK, HAYI claimed responsibility for the arson attack on four ambulances in north London that were owned by a Jewish community charity.
Asked about the threat of HAYI in connection to that antisemitic attack, a UK Home Office spokesperson told CNN that it doesn’t comment on specific intelligence matters, adding, “this government takes the threat posed by the Iranian regime and those who do its bidding extremely seriously, and we have robust measures in place to counter any malign activity.”
The European Union’s central criminal intelligence agency, Europol, said there is “a rising risk of small-scale, opportunistic attacks.” Europol added that one of the focal points of its monitoring is to detect early-stage plots, including those by lone actors.
Israel’s National Security Council has issued a heightened travel warning for its citizens, citing a significant rise in threats from Iran and its proxies against Israelis and Jewish sites around the world.
Not all attacks fit the same pattern, though.
On Tuesday, Turkish police stopped an armed attack near the Israeli consulate in Istanbul in which one gunman was killed and two injured during a shoot-out with police. Justice Minister Akın Gürlek later connected the terror incident to ISIS, noting that authorities conducted a nationwide operation to detain 198 ISIS-linked suspects following the attack.
Other attacks targeting Israeli embassies and consulates date back to the war in Gaza. Last year, a CNN investigation found that there were several attempted attacks on the Israeli embassy in Stockholm carried out by gangs acting on behalf of Iran, according to Swedish Security Service sources. At the time, the Iranian embassy in Stockholm told CNN that Tehran “firmly rejects any involvement in such actions.”
Since the war with Iran began, the US has experienced multiple terrorist attacks that experts have said appear to be the work of ideologically aligned lone wolf actors. Last month, the US Justice Department also seized several websites it says were used by Iran as part of operations targeting regime dissidents and Israeli persons, as well as spreading terrorist propaganda.
More broadly speaking, experts warn that hybrid threat operations “have become the new normal” over the last year, as states backing attacks pursue plausible deniability and low-cost tactics.
“As the conflict in the Middle East continues, the Iranian threat is likely to increase as the regime seeks to silence its critics and conduct so-called ‘revenge’ attacks on Israeli and American targets,” Hybrid CoE’s Turnbull said.
CNN’s Jack Guy, Tal Shalev and Tim Lister contributed to this report.
