The organization Harakat Ashab al-Yamin al-Islamia (HAYI) has repeatedly made headlines since its appearance in March, claiming responsibility for several terrorist attacks against Jewish sites across Europe.
Yet while it appears that a new transnational jihadist threat has emerged, HAYI may be less of an established organization and more of a brand slapped on the same types of attacks orchestrated by the Islamic Republic of Iran for years.
HAYI emerged out of thin air in March, with little social-media and online infrastructure to its name. Yet the nascent terrorist movement was somehow able to establish cells across the continent immediately.
It has claimed responsibility for the Liege synagogue bombing on March 9, the Rotterdam synagogue arson on March 13, last Sunday’s Skopje Jewish center arson, last Friday’s Munich restaurant bombing, and a series of arson attacks in London.
Terrorist organizations claim responsibility for incidents all the time, when they actually may not have had a hand in the matter, such as when there is retroactive approval of a lone-wolf terrorist’s attacks. HAYI’s claims, however, come with videos of the events, graphics, and prepared statements, explaining their reasoning for targeting a site.
Such a reach is impressive for a supposedly new organization. Establishing cells should be expected to take time. Lone wolves conduct operations on behalf of ISIS all the time, but the jihadist group has spent years establishing its movement and inspiring followers. Encouraging random aspiring jihadists in Western countries to act in their name is unlikely when the organization is only weeks old.
It might be supposed that HAYI is a new organization created by the Iranian regime and is using its preexisting covert and intelligence infrastructure, with the fledgling group bearing the aesthetic hallmarks.
HAYI clearly emerged during the US-Israeli military operations against Iran, and in its statements, it cites the Western powers’ actions in Iran as a motive. Its propaganda videos are disseminated through Iran-affiliated “axis of resistance” Telegram channels, and its logo bears the standard Iranian proxy imagery of a fist clutching a rifle and the backdrop of a globe.
Yet there are differences that are peculiar, whether by design or amateurish sloppiness.
The HAYI logo is distinct in that it uses the silhouette of a Dragunov sniper rifle rather than a Kalashnikov rifle, and there have been rhetorical issues, such as referring to the “Land of Israel” in a statement claiming responsibility for the March 23 Golders Green ambulance arsons. Iranian proxies are usually much more particular in their messaging.
Unprofessional conduct can also be found in the operations themselves. There should be no diminishing of the dangerous intent involved in the attacks attributed to HAYI, but some of them appear to be carried out by those with little understanding of the means.
The two people arrested for Wednesday’s arson attempt against the Finchley Reform synagogue filled bottles with what was suspected to be gasoline and then threw a brick at them. When nothing happened, the suspects fled the scene.
IN SKOPJE, the perpetrators managed to create a fireball and charred the doors of the Jewish center, but they failed to create a sustained fire, pouring much of their accelerant on benches and the courtyard.
The Wednesday arson attack against the offices of Iran International in Wembley saw the perpetrators light a container on fire and throw it into the dissident news network’s parking lot, where it “immediately put itself out,” according to the Metropolitan Police.
The arson attack in Hendon on Friday was more successful, even though the three bottles containing accelerant failed to fully ignite. But the target wasn’t a Jewish site; although the sign of a Jewish NGO remained, the organization had moved premises.
These blunders indicate that those carrying out these attacks are not expert operatives nor lone wolves who have dedicated themselves to the study of terrorist manuals. Unlike many jihadis, they seem inclined not to get caught and martyred; instead, they flee at the first sign of difficulty.
Iran's connection to the group
The Metropolitan Police on Sunday said it was investigating whether the Iranian regime was employing petty criminals as proxies, a strategy of the Islamic Revolutionary Guard Corps (IRGC).
“We are considering whether this tactic is being used here in London – recruiting violence as a service,” Deputy Assistant Commissioner Vicki Evans said. “Individuals carrying out these crimes often have no allegiance to the cause and are taking quick cash for their crimes.
“To anyone even considering getting involved – my message to you would be this: The stakes are high, and it is absolutely not worth the risk for a small reward. Those tasking you will not be there when you are arrested and face court. You will be used once and thrown away without a second thought.”
Indeed, there is reason to believe, based on what is already publicly known about the perpetrators, that this suspicion is justified.
The Iranian regime has often employed criminal networks over the years to target Iranian dissidents, as well as Israelis and Jews.
In May 2024, Stockholm said the regime was using criminal networks. Sweden was joined that July by Albania, Austria, Belgium, Canada, Czechia, Denmark, Finland, France, Germany, the Netherlands, Spain, the United Kingdom, and the United States in condemning the threats posed by Iranian intelligence services in their countries.
“We are united in our opposition to the attempts of Iranian intelligence services to kill, kidnap, and harass people in Europe and North America in clear violation of our sovereignty,” the countries said in a joint statement. “These services are increasingly collaborating with international criminal organizations to target journalists, dissidents, Jewish citizens, and current and former officials in Europe and North America.”
Several days before the statement, the UK published an Intelligence and Security Committee report that said Iran was using proxy groups, including criminal networks, militant and terrorist organizations, and hacking groups, to provide it with a means of plausible deniability when attacking enemies.
TEHRAN HAS allegedly used the method at least 15 times since 2022 to attempt to murder or kidnap Jewish or Iranian dissident UK nationals or residents.
Oisin McGuiness, 21, and Nathan Dunn, 19 – at least, based on their names – do not appear to fit the typical demographic profile of jihadists or those who would bear umbrage with Iranian dissidents. But they, together with a 16-year-old Watford boy, attempted an arson attack against Iran International. The motive is still unknown, but based on the statements by the Met, at least some of the suspects are believed to be hired thugs, not radicals.
One criminal organization closely tied to Iranian operations is Foxtrot, which often employs young men, teenagers, and children to carry out attacks. A similar pattern has appeared among supposed HAYI operatives.
Dutch police originally arrested four teenagers, ranging in age from 14 to 17, and later a 20-year-old and a 23-year-old. Judex Atshatshi, 18, and a 17-year-old were among the four arrested for the Hatzola ambulance arsons.
Some of those involved in the incidents, such as the 17-year-old alleged Golders Green arsonist, are Pakistani nationals.
There has been a tendency for the Iranian regime to launder its involvement in attacks abroad by using third-country individuals, as noted in a November 2024 Director of National Intelligence’s Office document.
Many such incidents have involved Pakistani nationals, such as Asif Merchant’s 2024 plans to assassinate US President Donald Trump, the three people arrested in Greece in March 2023 for plotting attacks on a synagogue and kosher restaurant, and Haider Syed Mustafa‘s 2012 reconnaissance of Jewish targets in Germany and France.
The spate of arson and attacks in Europe, comparable to suspected Iran-backed attacks against Jewish sites in Australia in 2024, may therefore not be new in substance. In practice, they appear to follow the same playbook as past Iran-sponsored terrorist attacks.
This may be another case of the Islamic regime employing criminals, youths, and third-country individuals to impose its will abroad. The only difference may be that instead of there being a mystery about the origin of the attacks, Iran has shed some degree of plausible deniability in a time of conflict to make it clear to its enemies and European countries why the attacks are occurring.
It has done so by conducting its normal regimen of punishing attacks and political extortion under the banner of what appears to be an Iranian regime proxy group.
If this is the case, and HAYI is just a collection of local criminals and random miscreants hired for odd terrorism jobs, it is less of an organization and more of a brand.