On a busy London street in broad daylight, a heavyset man walking down a sidewalk brandished a knife and started slashing two Jewish men near a bus station until local security and police tackled him to the ground. The attack happened on 29 April in the predominantly Jewish suburb of Golders Green — the same North London neighbourhood that saw the torching of four Jewish charity ambulances on 23 March. Harakat Ashab al-Yamin al-Islamiyya (HAYI), an ostensibly Iran-linked organisation that announced its presence online in March, has claimed these two incidents in addition to more than a dozen arson and sabotage attacks against Jewish, Israeli, or Western-affiliated institutions in Europe in what appears to be a retaliatory response to the United States-Israel war with Iran.
As of this publication date, HAYI has claimed 17 total incidents in the United Kingdom, Belgium, the Netherlands, France, Germany, Macedonia, and Greece, while British law enforcement officials have detained at least 28 people in connection with the London attacks alone. The attack on 29 April prompted the UK to raise its threat level to severe. Definitive verification of HAYI’s responsibility for each attack from law enforcement appears to be ongoing. British security officials have said they are investigating whether there is a connection between HAYI and the Islamic Revolutionary Guard Corps.
From available evidence, terrorist experts have intuited that HAYI may be a “fabricated front” and not an authentic terror sleeper cell that Iran-linked operatives have built to sow confusion and fear due to certain behavioural patterns, including the use of paid disposable agents to carry out acts of terror. This is notably a type of hybrid warfare tactic that muddies any connection between suspects on the ground and state-sponsored planners and/or operatives orchestrating these attacks.
It is not yet clear whether the Golders Green stabbing suspect was paid to carry out the attack, or whether HAYI falsely claimed responsibility as part of a disinformation effort. However, HAYI’s claim of responsibility, combined with its use of drones to threaten the Israeli Embassy in London in a separate incident in April, marks a clear escalation in tactics. Notably, before the Golders Green stabbing incident, HAYI-claimed tactics were limited to arson and sabotage of institutional buildings — essentially symbolic targets, and most importantly, nobody was injured.
This now apparent escalation in approach has also been coupled with a ratcheting of rhetoric in their propaganda. For example, in a recent online communique, the group singled out US President Donald Trump and his family for “retribution”, in contrast to the language of previous messages, which were more generalised (Figure 1). These incidents and online provocations throw into high relief the increasingly complicated security environment facing European law enforcement officials. Alongside HAYI-related threats, authorities are also dealing with pro-Russian operatives, transnational criminal organisations, and other disturbing incidents that have targeted Israeli or Jewish-linked sites that have not been claimed by HAYI — creating a confusing and fragmented threat landscape.
Figure 1. HAYI’s online threat to US President Donald Trump.
To further elucidate the nature of HAYI, this Insight provides an overview of the group and its claimed attacks to date, including the tactics and technologies it has employed, comparable hybrid warfare tactics used by other actors, and recommendations for policymakers and practitioners moving forward.
HAYI: Basic Facts and Attacks
In English, HAYI’s name translates to The Islamic Movement of the Companions of the Right, while the group has used at least two different types of logos in its public online addresses: one black-and-white and the other in colour. The logos — both characterised by a fist holding a rifle – appear to be directly inspired by Iran-connected groups such as Lebanon’s Hezbollah, which uses similar iconography. But unlike these groups, which use an AK or Kalashnikov in their public imagery, the HAYI logo uses a Dragunov rifle.
Figure 2. HAYI’s black and white logo.
Figure 3. HAYI’s colour logo.
The first HAYI-linked attack occurred at a synagogue in Liege, Belgium, on 9 March — the same day HAYI announced its presence in an online message (Figure 4). This first post did not claim the Liege incident. A few days later, on 11 March, the group claimed it was behind the attack by posting a video of the incident, with its message proliferating among pro-Iranian accounts on X and Telegram.
Figure 4. HAYI’s first online message on 9 March.
Other attacks followed swiftly in March: on the 13th, 14th and 15th in the Netherlands; the 23 March arson of four ambulances in London’s Golders Green neighbourhood; and an incident in Belgium that took place sometime in the overnight hours between 23 and 24 March. In addition, HAYI released a video claiming an 11 March attack in Greece, of which there appears to be no proof of its existence. A few experts believe this purported Greek event likely happened instead on 3 March in the Netherlands. The group also released a propaganda video warning that it was targeting a Bank of America in Paris; on 28 March, law enforcement foiled a teenager trying to light a bomb outside that same US bank.
April incidents included an attack against the Israel Center in Nijkerk, Netherlands, on 4 April; the targeting of an Israeli restaurant in Munich, Germany, on 10 April; and attacks against Macedonian Jewish institutions on 12 April — an incident also under investigation for possible links to the Sunni jihadist group the Islamic State, and one that was opportunistically claimed by HAYI for disinformation purposes. In London, two attacks took place on 15 April, targeting a synagogue and a Persian-language news channel, followed by drone threats against the Israeli Embassy on 16 April, the targeting of a Jewish educational organisation on 17 April, and the arson of a synagogue on 18 April. The month concluded with the Golders Green incident on 29 April. It is also important to note that, on 27 April, a memorial in the same neighbourhood dedicated to protesters killed by the Iranian regime was targeted in an arson attack, although that incident does not appear to have been claimed by HAYI.
Tactics and Technologies
HAYI has been distributing messages and videos on online platforms such as X and Telegram; in the latter, pro-Iran news and Iraqi Shia militia-affiliated accounts have been boosting HAYI propaganda. A pro-Iranian Telegram news channel appears to have been among the first to publicise the Golders Green stabbing attack, correctly suggesting that it could be linked to HAYI. The account later posted a HAYI video that claimed responsibility for the knife attack.
Figure 5. Pro-Iran news account on X publicising a HAYI-claimed attack in Macedonia on 12 April.
Figure 6. Pro-Iran news account on Telegram with a post about the 15 March attack in the Netherlands, along with replies by supporters.
Many of the HAYI videos that have proliferated on X and Telegram appear grainy and amateurish, which may be by design. The videos use distinctly unsophisticated techniques, such as crude graphics and satellite imagery. Analysis of the background music has been linked back to pro-Iranian regime supporters and Iraqi Shia militia groups. HAYI is also apparently using AI translation for their textual propaganda, which results in a few instances of unusual phrasing.
Figure 7. Screenshot from a video of the Liege, Belgium arson attack on 9 March.
One notable video centres on the Israeli Embassy in London. In that video, two masked individuals in white hazmat suits pose in a room as the camera pans to two drones, one resting on a backpack and the other on the floor; emblazoned on top of the two drones are stickers with the distinctive HAYI logo in colour. The video then shows a drone travelling through a park, while claiming that the drones are ferrying “radioactive and dangerous carcinogenic materials.” Investigators had found possibly connected items nearby in Kensington Park, but thankfully, tests revealed they were non-hazardous.
The use of drones — albeit in a limited way — represents a relatively new terror vector by jihadists operating in the West that law enforcement should be aware of. Previously, drones possibly deployed by Russian-linked operatives have mysteriously appeared at European military sites and other infrastructure, and Iran-linked proxy groups have used drones in military operations against Israel in Lebanon. While this does not make drone use by non-state actors exactly new, the fact that an astroturfed Iran proxy group is threatening to use drones in Europe should be a cause of concern; it adds another complicating wrinkle to these incidents.
The use of disposable agents is another HAYI tactic, which was seen in the foiled bombing of the Bank of America in Paris, where a 17-year-old youth was arrested during an attempt to ignite an improvised explosive device. He claimed to have been recruited over social media. In another example, a teenage suspect apprehended in connection with a 23 March arson incident in Antwerp, Belgium — later claimed by HAYI — was paid money to stage the incident, according to The New York Times. This hybrid tactic adds a layer of deniable plausibility and increased confusion, as also seen in the case of the teenager who was arrested in connection with the 18 April arson attack of a London synagogue; he told investigators that he didn’t know it was a synagogue. The hiring of people to carry out criminal or terroristic activities is also a known tactic used by Russian-linked operatives.
Some terrorism experts assess that the Golders Green stabbing suspect was probably inspired by HAYI and not necessarily recruited by the group, in particular because he was released from a psychiatric hospital in the days before the knife attack. Inspired attacks, along with incidents actually overseen by HAYI, add further complications to the threat landscape.
Conclusions and Recommendations
Shortly after the 29 April Golders Green attack, it was revealed that the suspect had been on law enforcement’s radar, having been previously imprisoned in 2008 for stabbing a police officer and a police dog. He was subsequently assigned to the country’s Prevent program, whose mission is to deradicalise and deter vulnerable people from terrorism. At the time of this Insight’s publication, it is not clear to what extent or for how long the attacker was involved in Prevent, or whether he was under surveillance before the attack. Regardless, this incident and others should prompt law enforcement and policy makers to do a top-down reassessment of current counter-terrorism initiatives and deradicalisation programs, while balancing concerns of potential human rights abuses and mass surveillance of innocent communities that come under target. Any new recommendations on policy and law enforcement tactics should take an evidence-based approach due to previous studies and investigations showing that the effectiveness of certain tactics, such as mass surveillance, yields a mixed bag, and at worst, they antagonise communities critical to tamping down the radicalisation of vulnerable members.
Technology solutions should include smarter, more targeted moderation of online platforms, using systems that can discern the context of online posts. Additional measures could include AI-powered behavioural analytics to identify users searching for extremist material and redirect them to counter-terrorism messaging, as well as smart regulatory technology (regtech) tools to combat terrorism financing.
In addition, policymakers, law enforcement, and businesses should consider deploying a tech layer with federated machine learning, in which different groups or devices help train an AI model while sensitive information remains local. Such an approach, using federated machine learning, may enhance information sharing among counter-terrorism organisations while keeping each group’s proprietary data under lock and key. This would be particularly useful in counter-terrorism finance regtech, behavioural analytics programs that balance concerns about security and health information subject to privacy laws, and in bridging any counterproductive fragmentation among intelligence agencies with overlapping or competing jurisdictions.
–
Sharon Adarlos is an independent journalist, writer and artist with an interest in crime, conflict, and militant movements. She has written for Al Jazeera, The Wall Street Journal, American Banker, Princeton University, and others. Previously as a criminal justice reporter, she covered homicides and breaking news in New Jersey and New York City.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.