A little-known Islamist group has claimed a string of attacks on Jewish sites and Western financial institutions across Europe since early March.
Calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) -- Arabic for the Islamic Movement of the Companions of the Righteous -- the group is believed to have links to Iran.
The working assessment among Western security services is that HAYI is either a construct aligned with Iran's Islamic Revolutionary Guards Corps (IRGC) or an opportunistic network operating within the broader pro-Iranian online ecosystem -- a distinction that, for now, investigators have not resolved.
HAYI's Telegram channel was established two years ago but remained dormant until March this year.
"It only became active, and began operating, in March this year," Kacper Rekawek, a researcher at the International Center for Counter-Terrorism (ICCT) in The Hague, told RFE/RL.
Its activation followed the initial US-Israeli strikes on Iran on February 28, after which Europol warned of an elevated risk of attacks in Europe targeting Jewish and American-linked sites.
The group's first confirmed attack was an improvised explosive detonated outside a synagogue in Liege, Belgium, on March 9.
In the weeks that followed, HAYI claimed responsibility for attacks in at least four countries: an explosion outside a synagogue in Rotterdam, damage to a Jewish school in Amsterdam, an arson targeting Jewish community ambulances in north London, and a foiled bombing outside a Bank of America branch in Paris.
On April 15, British counterterrorism police opened investigations into two further incidents in London that HAYI has also claimed: an attempted arson outside a Persian-language media organization in Park Royal and a petrol bomb attack on Finchley Reform Synagogue. None of the attacks caused casualties. All confirmed arrests have involved teenagers or young adults.
"The primary mode of operation essentially involves bomb attacks or arson attacks against various Jewish or Israeli targets, and now also American ones across Europe," Rekawek said.
"It appears they use hired personnel -- young people, criminals, hooligans, however you want to call them -- in Europe."
The Paris case offered the clearest window yet into the group's command structure.
French security services foiled the attack on March 28, arresting three minors and one adult accused of attempting to plant an explosive device. Investigators found the suspects had been recruited via social media.
Rekawek argued the case points to a layered organization.
"There is a controller, a multilayered system, a cell leader who is supposed to carry something out but is being guided. He is on the phone with someone -- we still don't know who -- and receives materials almost ready for the attack," he said.
Suspected Links To Iran
French Interior Minister Laurent Nunez has suggested the group may have links to Iran, describing a familiar operational pattern.
"Typically, Iranian intelligence services operate in this way: They use intermediaries, a chain of subcontractors, often ordinary criminals, to carry out highly targeted actions aimed at American interests, Jewish communities, or individuals linked to the Iranian opposition," he told reporters.
The group's claim videos follow a consistent pattern of short mobile-phone footage of each attack branded with HAYI's logo, date, and location in Arabic released almost immediately to Telegram channels affiliated with pro-Iranian, Shi'ite militias in Iraq and then amplified across other platforms.
According to ICCT analysis, the same four channels -- two linked to Iraqi militias including Asaib Ahl al-Haq, which maintains ties to the IRGC's Quds Force, and two pro-Iranian content aggregators with links to sanctioned pro-Russian networks -- anchor every dissemination cycle.
Counterterrorism experts have compared the model to Russian hybrid sabotage operations in Europe in which recruits are contacted online, paid small amounts, and carry out attacks without full knowledge of who is directing them.
Typos And Tenuous Ties
Yet several features of HAYI undercut the image of a professional armed organization.
Its logo misspells the Arabic word for "Islamic." Its imagery uses a Soviet SVD Dragunov rifle, atypical for Iran-backed groups, which standardly use AK-pattern iconography.
The administrator of its Telegram channel, when contacted by CBS News, communicated in American-inflected English and justified attacks using Christian and Jewish philosophical references with no mention of Islamic doctrine.
The group's statements have been issued in English, Arabic, and Hebrew -- but not Persian, the primary language of the Iranian state it purportedly serves.
No government has publicly established an evidentiary link between HAYI and the Iranian state, and Tehran has not admitted publicly to any ties to the group.
Vicki Evans, the United Kingdom's senior national coordinator for counterterrorism policing, said the group is "one of our many lines of inquiry" in connection with the April 15 London incidents, adding that authorities "remain open-minded at this stage."
