Since the Iran conflict started, a mysterious terror group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has appeared practically overnight to claim several attacks against Jewish and American targets in Europe — including the torching of four Jewish charity ambulances in London and an attack at the Israel Center in Nijkerk, Netherlands — while law enforcement has detained up to 15 people in connection with these incidents.
In its released videos and statements, HAYI threatens America, Israel, and Europe while visually modeling itself after pro-Iranian Axis of Resistance groups. But unusual signatures in its public communiques and behavior indicate that HAYI is not an authentic, grassroots Axis group but is instead a fabricated front for a grey zone operation that relies on paid freelancers and/or volunteers to carry out acts of terror and sabotage abroad — a strategy first deployed by Russians and also used by Iran, according to security analysts interviewed for this article.
“Authorities, intelligence agencies, and experts are attempting to determine if this is a case of ‘disposable agents,’” said Colin P. Clarke, executive director of The Soufan Center, in an interview. “Given the rather amateurish nature of some of these attacks, it could be a simple ‘pay-for-play’ scheme where the Iranians are recruiting European youth online and paying nominal fees to conduct these attacks.”
This seems readily apparent in the most recent incident, which occurred in the early morning of March 28 in Paris when police caught a 17-year-old Senegal national attempting to set off an explosive at a Bank of America building. He told investigators he was hired and paid to perform this action via Snapchat. An additional four people were also detained in connection with this attempt. French authorities said HAYI is suspected to be behind this attack due to HAYI mentioning the target in a video posted on March 21.
Some online critics, a few connected to large disinformation networks, have accused pro-Israel agents of involvement due to these attacks only damaging property, occurring at odd hours of the morning and night, and without injuring anyone. Notably, HAYI statements contain errors and use certain phrases that are atypical for such a militant group. As of this article’s publication, the investigation into HAYI is still ongoing, and European law enforcement have released scant evidence that neither proves or disproves this controversial hypothesis; however, officials’ preliminary comments appear to align with analysts’ expert assessment that disposable agents are involved and that these incidents likely have a connection with pro-Iranian operatives.
Still, big questions loom over the organization’s authenticity, origin, and possible motivation. This report examines the publicly available information that HAYI has released thus far — with a special focus on the audio used in its propaganda videos — while also probing whether this “group” has any connection with pro-Iranian Shi’ite Islamists and/or the Islamic Revolutionary Guard Corps, which is known to facilitate attacks abroad. This report also examines the context of these incidents within the broader security landscape of Europe.
Companions of the Right
The full name of the group translates into The Islamic Movement of the Companions of the Right. “Right”, as translated from Arabic, is equivalent to the concept of justness or justice. The group’s logo closely resembles the insignia for Hamas, Hezbollah, and other Iran-aligned Axis of Resistance terror groups: an upright fist holding a firearm while superimposed over a globe. But while every Axis group has AK weapons in its logo, HAYI has a SVD sniper rifle from the Soviet Union in its fist, as pointed out by The Jerusalem Post, a possibly relevant discrepancy.
The first known HAYI-linked attack occurred on the morning of March 9, when unknown assailants bombed the facade of a synagogue in Liege, Belgium. On that same day, HAYI first announced its existence in a statement that circulated on X and Telegram. In addition to quoting Quranic verses, the statement reads “Badr 1 – Badr 2 – Fath 6 – Khaybar 14” — which appear to refer to early battles in Islamic history, such as the conquest of Mecca — with the numbers serving an unknown purpose. Curiously, the statement doesn’t reference the Liege attack at all. A few days later, on March 11, a video surfaced on pro-Iranian online networks showing the Liege attack, which the group then claimed credit for.
Since the March 9 arson, HAYI has claimed several subsequent attacks in Europe: a March 13 arson at a synagogue in Rotterdam, Netherlands that resulted in five people getting detained in connection with the incident; a March 14 attack against a Jewish school in Amsterdam; a March 16 bombing of an office building in Amsterdam; the March 23 torching of four ambulances in the London neighborhood of Golders Green that resulted in two men getting detained for questioning; and the arson attack of a car in Antwerp, Belgium sometime on March 23 and 24 that also saw two minors detained. On April 4, an explosive device was detonated at an Israel Center in the town of Nijkerk in the Netherlands, which HAYI quickly claimed.
There was also the aborted attack at the Bank of America in Paris on March 28, with one person arrested, which investigators strongly suspect was a HAYI target because the group previously mentioned the location in a video. In addition, HAYI claimed an attack in Greece on March 11, but a report from the International Centre for Counter-Terrorism (ICCT) by analyst Julian Lanchès says it was most likely an attack in Rotterdam that happened on March 3.
Each of the incidents were commemorated with videos that HAYI quickly released after the attacks happened. The three exceptions to this pattern: one, the March 9 incident, whose footage was released two days later; two, the suspected Paris attempted bombing in which HAYI released a video targeting the location on March 21 — days before the actual attack on March 28 took place; and three, the so-called Greece attack, which HAYI claimed took place on March 11.
The quality of the propaganda videos that depict these incidents is amateurish: shaky camera work, poor video quality, and the usage of Google maps as visual props. The attacks at most caused minor damage, save for the ambulances in London, and caused zero injuries due to the fact they occurred at odd hours and almost all fell between Friday and Monday early morning hours.
Disposable Agents
The group exhibits certain traits that make it less likely to be an authentic Axis of Resistance group despite HAYI’s overt, conscious decision to emulate them. Two such examples are the amateur-looking videos (jihadist videos are typically slickly produced), the growing number of people getting caught, which suggests a lack of operational security, and that most of the arrested are young men who seemingly have no familial connection with Iran, such as the Senegal suspect of the suspected HAYI Paris attack.
Iran proxy expert and analyst Phillip Symth said in an interview with Militant Wire: “The low-level types you are describing fit a pattern for Iranian recruitment of individuals to launch low-level attacks for them in Europe,” said Iran proxy expert and analyst Phillip Symth in an interview with Militant Wire. “They’re going to criminal groups/gangs, younger true believers, and anyone else they can snag. What they’re doing is roping in their attacks (note how they videotape this stuff and send it in) into an overarching front group structure. Higher likelihood a good number of attackers don’t even know that’s how their attacks are being branded.”
This is shown in the case of the possible HAYI-linked Bank of America, Paris incident: the Senegal suspect, who has a drug record, was paid 600 Euros to ignite a homemade explosive, five liters of an unknown liquid fuel with an ignition charge made of a firecracker with 650 grams of explosive powder.
“The low-sophistication modus operandi also matches HAYI’s pattern of using minors and young men for attacks on Jewish and Western targets across Europe since early March 2026,” said Adrian Shtun, associate fellow at International Centre for Counter-Terrorism (ICCT).
Hiring freelancers is a type of grey or hybrid warfare tactic that Russian-linked operatives have done in the past, and which Iran has deployed as well. Iranian officials have been known to hire freelancers, including ones involved with criminal organizations, to carry out acts of terror abroad, such as an unexploded grenade found at an Israeli embassy in Sweden in 2024, which had been linked to gangs. Iran contracts freelancers and criminal organizations in order to maintain plausible deniability from these incidents and cause confusion.
Another clue that dispels the idea that this is an authentic Axis group: HAYI had zero digital footprint prior to March 9, atypical behavior by terror groups, which usually make a big announcement and establish dedicated online channels for their cause before initiating operations. Another clue is that a Telegram channel that styles itself as an official HAYI account only became active this month, even though it was registered back in 2023. This account, which remains active, could not be authenticated.
CBS News got in contact with the anonymous administrator named Asad-Allah of a HAYI Telegram channel, which was advertised on a QR code at the end of one of the HAYI-branded videos, and this suspect raised the Gaza occupation and the war in Iran as justification for its actions while using American English in texts — a relevant detail.
Another unusual feature of this group is its use of AI. Middle East Eye journalists ran HAYI statements through AI detection software and determined that at least one HAYI statement was AI-generated; one block of text was translated into English, Arabic, and Hebrew, and had unusual phrasing for a Shia Muslim terror group to use, such as terms like the “Land of Israel” and “the Gaza war” being mentioned in English. Use of AI may explain why the HAYI logo uses a different rifle in its logo versus an AK and why the word “Islamia” is misspelled in at least one HAYI communique.
Audio Findings
Another atypical signature about HAYI communiques is the group’s use of audio in their videos. Jihadist terror groups have typically used nasheeds as background music, but HAYI uses instrumental music.
For the video depicting the March 14 arson attack of a synagogue in Amsterdam, HAYI used a snippet that was traced to this YouTube clip with the below thumbnail.
First word in the above image has in Arabic موسيقى or “musiqaa” — which means “Music.” Second line of text in the image has in Arabic أولي البأس or “uwli albas” — which means “Those of Might/Valor” — as in those “people of strength/courage” or “the fierce ones.” Another stronger translation is “Men of Might.” This appears to reference Quranic passages Surah Al-Isra’ (17:5) and Surah Al-Fath (48:16). Combined, the text roughly means: “Music of Brave Men” or “ Music of Warriors.”
Caption for the video mentions the Arabic words الإعلام الحربي or al’iielam alharbiu, which means “War Media” or “Military Media,” the music’s publisher. The listed composers are labeled as M Kallas and T Charife. Another significant finding is that the music was first released on September 17, 2024 — the same day as the pager attack against Hezbollah in Lebanon, suggesting this audio has a Hezbollah connection. A search of this clip on TikTok turns up accounts that promote the Iranian regime, Shia Islam, and the Popular Mobilization Front in Iraq.
In another video, the March 16 bombing of an Amsterdam central business building, HAYI used the background music directly lifted from a concert by the Tehran Symphonic Orchestra, specifically the Symphony of the Epic of Khorramshahr by composer Majid Entezami, which commemorates the liberation of the city Khorramshahr from Iraqi occupation during the Iran-Iraq War. Specifically, the video lifts a snippet from the third movement, which is entitled, Preparation for War. HAYI repeated the use of this music in a few other videos, including the one claiming the attack on the Israel Center in the Netherlands.
Who’s Behind HAYI?
A report from the International Centre for Counter-Terrorism points out that four large Telegram accounts — two Iraqi Shia militia-affiliated and the other two being pro-Iranian news — would first share the HAYI videos and statements claiming credit for these attacks, and then a broader network of pro-Iranian influencers would amplify the content’s reach. The pro-Iranian news accounts also shared posts from pro-Russian accounts that have been sanctioned — suggesting a connection or alliance. In addition, one of the Iraqi Shia militia Telegram accounts promotes a militia group that is known to have close ties with IRGC’s Quds Force.
Because of this Iraqi Shia connection and how the videos were first shared before gaining a wider audience, Lucas Webber, co-founder of Militant Wire, said that HAYI and its activities are likely connected with Iraqi Shia militias, who collaborate with the IRGC.
“[L]ooks less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network and experimenting with low-cost, high-visibility operations in Europe,” he told CBS News.
Online critics of Israel have seized the same discrepancies that analysts have pointed out, and that must mean pro-Israeli agents could be involved. The fact that it was networks associated with Iraqi Shia militants that first shared HAYI propaganda goes against this controversial notion. In addition, the curious musical choices may point towards a connection with Iraqi Shia militia groups.
The amateurish nature of the operation has also been seized by anti-Israeli critics as a possible sign of a false flag, but this could be a function of unprofessional saboteurs making clumsy mistakes and use of AI, prone to hallucinations, to generate content and translate text.
In another possible connection with HAYI, ICCT report points out that an unknown person had posted a message on March 7 to a pro-Iranian Iraqi Shia Telegram account that called for “all silent cells” to activate, which a HAYI statement on the Liege attack later referenced.
Europe at Risk
Though these attacks have injured no one, they highlight the risk that Jewish communities (along with American-linked organizations) are facing from Iran-connected terror groups: “[T]he most elevated and complex threat environment the Jewish community and this country has seen in modern history,” according to Kerry Sleeper, the Chief of Threat Management and Information Sharing for the Secure Community Network, a Jewish security organization based in Chicago, in a statement to the Jewish Telegraphic Agency.
These incidents come as Europe deals with a complicated threat environment, amplified by the war in the Middle East. Besides any pro-Iranian or Shi’ite Islam extremist agents, European investigators are also dealing with Sunni jihadists, Russian hybrid attacks, and other ideologically motivated violent extremists from across the spectrum (far-left, far-right, anti-government, etc.), said Clarke.
Case in point, law enforcement recently detained two suspected Iranian spies who were found attempting to infiltrate a nuclear submarine base in Scotland. In addition, the Netherlands saw Mohamed (Mohi) Shafiei, a local police officer and outspoken Iranian dissident, get shot by unknown assailants; Dutch authorities are investigating whether he may have been targeted by pro-Iranian operatives.
As for HAYI, their efforts have followed a regular pattern: attack targets at night or in the morning and avoid casualties. But that may not be the case as the Iran conflict drags on further.
“[T]hings may change, and they may start targeting people, too, during the day, when it’s busy,” said Joe Truzman, senior research analyst and editor at the Foundation for Defense of Democracies, told Fox News Digital.
 | A guest post by
|