london —
A shadowy pro-Iranian group has claimed responsibility for a series of recent attacks on Jewish communities and US interests in Europe.
The incidents, posted by the group through social media accounts linked to pro-Iranian militias, include the arson of a Jewish community-run ambulance in the UK, the detonation of an explosive device in front of a synagogue in Belgium, and the failed attack on a Bank of America office in France.
The problem is that the group may be a mirage.
The group, which calls itself Harakat Ahab al-Yamin al-Islam (HAYI) and roughly translates from Arabic as “Right-wing Brotherhood Islamic Movement (eous),” only appeared online a month ago, shortly after the United States and Israel began their war against Iran.
According to an analysis by the International Center for Counter-Terrorism (ICCT), a think tank based in The Hague, “there are no known references to HAYI, either online or offline, before March 9, when the group’s posts were disseminated on Telegram channels.” Since then, the group’s claims and posts have been spread on Telegram and X Channel, which are affiliated with pro-Iranian militias and pro-Iranian media outlets.
“In terms of its digital footprint, it clearly has close ties to the pro-Iranian ecosystem online,” said Thomas Leonard, a counterterrorism expert and ICCT director. “The fact that these channels not only posted the video claims and reposted the video claims, but also posted them on their timelines suggests some kind of coordination.”
“There are many signs that this group is not genuine,” Leonard told CNN. “For now, we are still in the realm of speculation. However, there are strong indications that this could receive foreign support, with Iran topping the list of potential candidates.”
ICCT analysts believe that the group may be a facade for an Iranian-coordinated operation rather than a professional, independent terrorist organization, given the group’s logo and misspellings in Arabic in videos posted to its new Telegram account.
Counterterrorism experts say the attack is similar in nature to Russia’s so-called hybrid operations in Europe, where Russian authorities recruited people online to carry out sabotage operations. These attacks are often carried out by non-Russians for small sums of money without sufficient knowledge of who they are targeting.
“This is exactly the model that Russia has perfected over the past few years, and looking again, it appears that Iran is now following a similar pattern,” Leonard said, noting that Iran has long favored a hybrid warfare approach through support of other extremist groups.
He said this could be another example of Iran using layers of intermediaries to pursue plausible deniability. More information may emerge as police and counterterrorism authorities examine the devices of the arrested suspects.
“Over the past two years, the Iranian-related threat to Europe has increased significantly,” said Martha Turnbull, director of the European Center of Excellence for Hybrid Threats (Hybrid CoE), an organization dedicated to strengthening the security of Europe and NATO countries. She cited examples of failed invasions and assassination attempts in the Netherlands, Sweden and Spain.
Counter-terrorism expert Mr Turnbull said: “These attacks demonstrate the Iranian regime’s continued focus on the opposition, the Iranian diaspora and, more recently, Jewish and Israeli targets.” More broadly, she noted, hybrid threat actors, including Russia, China, and Iran, are “increasingly utilizing non-state actors and proxies.”
Whether the group is real or not, European authorities are taking the threat seriously, despite the US and Iran having a fragile ceasefire.
Belgium’s coordinating body for terrorist threat assessment said earlier this week that the country’s general terrorist threat level remained at a “severe” level, with “increased vigilance against Israeli and Jewish, US and Iranian interests.”
Belgium’s Threat Analysis and Coordination Agency told CNN that “Iran has already demonstrated in the past the ability to carry out operations directly or through proxies in Europe against Israeli, Jewish, American interests or opposition in exile.”
Since March 9, HAYI has claimed responsibility for attacks in four countries: the Netherlands, Belgium, France, and the United Kingdom.
In the Netherlands, the group claimed to be behind an explosion outside a synagogue in Rotterdam that damaged buildings, and an attack on a Jewish school in the capital Amsterdam that damaged the school’s exterior.
Following the Rotterdam bombing, Dutch Justice Minister David van Weel said the suspects were most likely conscripts and that authorities were investigating the possibility that Iran was involved. France’s anti-terrorist prosecutor’s office also said that the plot to ignite explosives in front of Bank of America’s Paris headquarters appeared to be linked to HAYI, but a link had not yet been definitively established.
In the UK, HAYI claimed responsibility for the arson attack on four ambulances belonging to a Jewish community charity in north London.
Asked about the HAYI threat in relation to anti-Semitic attacks, a Home Office spokesperson told CNN that they do not comment on specific intelligence matters, adding: “This government takes very seriously the threat posed by the Iranian regime and those who follow its orders, and we are taking strong measures to counter any malign activity.”
The European Union’s central crime intelligence agency Europol said there was “an increasing risk of small-scale, opportunistic attacks”. Europol added that one of the focuses of its monitoring is to detect early-stage conspiracies, including those by single actors.
Israel’s National Security Council has strengthened its travel warning to its citizens, citing a significant increase in the threat from Iran and its proxies to Israel and Jewish locations around the world.
However, not all attacks fit the same pattern.
On Tuesday, Turkish police stopped an armed attack near the Israeli consulate in Istanbul, leaving one gunman dead and two others injured in a gunfight with police. Justice Minister Aquin Gürek later linked the attack to ISIS, noting that authorities carried out a nationwide operation in which 198 ISIS-linked suspects were detained after the attack.
Other attacks targeting Israeli embassies and consulates date back to the Gaza war. Last year, a CNN investigation found that there were several attempted attacks on the Israeli embassy in Stockholm by Iranian-affiliated gangs, according to sources in the Swedish Security Service. At the time, the Iranian embassy in Stockholm told CNN that the Iranian government “categorically rejects any involvement in such actions.”
Since the war with Iran began, the United States has experienced multiple terrorist attacks that experts say appear to be the work of ideologically aligned lone-wolf attackers. Last month, the U.S. Department of Justice also seized several websites it said were used by Iran as part of operations targeting dissidents and Israelis, and to spread terrorist propaganda.
More broadly, experts warn that hybrid threat operations have “become the new normal” over the past year, as nation-states sponsoring attacks pursue plausible deniability and low-cost tactics.
“As the conflict in the Middle East continues, the Iranian threat is likely to increase as the regime seeks to silence its critics and launch so-called ‘retaliatory’ attacks against Israeli and American targets,” Hybrid CoE’s Turnbull said.
CNN’s Jack Guy, Tal Shalev and Tim Lister contributed to this report.
