Harakat Ashab al-Yamin al-Islamia

HAYI's Telegram was established in 2024 but remained dormant, and had just 200 followers in March 2026^[1][2]

It emerged more publicly in early March 2026, following US-Israeli strikes on Iran on February 28, after which Europol warned of elevated risk of attacks in Europe targeting Jewish and US-linked sites.^[2] It became known through videos posted on the Telegram channels of Iran-allied militant groups. It claims to be a Khomeneist group, in that it embraces the beliefs of Ruhollah Khomeini, the first supreme leader of Iran. Its name refers to the depiction of Judgement Day in Islam, where the people of the right hand will go to Paradise. The group's logo, with a hand holding a rifle against a globe, invokes similar logos of Iran-backed Shia militias in Lebanon and Iraq.^[3] The organization claims operations by distributing "proof-of-crime" videos via Telegram channels.^[4][5]

HAYI has taken credit for attacks across Europe that have targeted Jewish schools, synagogues and charities, as well as American, Israeli and Iranian opposition establishments. The attacks have generally utilized arson, explosive devices and chemicals, with the incidents taking place at night and with buildings as targets. HAYI has claimed responsibility for some incidents, while other incidents were successfully foiled by authorities. These include the following:

• On March 9, a makeshift bomb was used to target a synagogue in Liège, Belgium, causing material damage but no injuries.^[6] Prime Minister Bart De Wever described it as "an attack on our values and our society", while Interior Minister Bernard Quintin called it a "despicable antisemitic act".^[7]
• On March 13, an arson attack targeted a synagogue in Rotterdam, Netherlands. Dutch police subsequently arrested five suspects, aged 17–19, from Tilburg, whom prosecutors alleged acted with "terrorist intent".^[8][9] Justice Minister David van Weel said the possibility that Iran was involved in the attack was being investigated.^[9]
• On March 14, an bomb exploded outside a Jewish school in Amsterdam, Netherlands.^[6] Prime Minister Rob Jetten called the incidents "shocking and unacceptable", adding that "these cowardly acts have an impact on the entire Jewish community in the Netherlands".^[10]
• On March 16, an improvised explosive device was detonated at the Atrium office complex in Amsterdam’s Zuidas business district. The explosion targeted a branch of the Bank of New York Mellon, resulting in property damage but no fatalities.^[4][11]
• On March 23, four ambulances belonging to the Jewish charity Hatzola were destroyed by arson in Golders Green, London. CCTV footage of the incident captured three hooded individuals pouring an accelerant onto the vehicles, which led to the explosion of onboard oxygen cylinders.^[12][13][14] Four people—Hamza Iqbal, 20, Rehan Khan, 19, Judex Atshatshi, 18, and an unnamed 17-year-old male—were charged with arson with intent to damage property and being reckless as to whether life would be endangered.^[15]
• On March 24, a car was set on fire in Antwerp's Jewish quarter in what Belgian authorities suspected was an antisemitic attack. Two underaged individuals were arrested in connection with the incident.^[16][17][18]
• On March 28, the French police foiled a bomb plot against a Bank of America office in Paris, France, as one suspect was attempting to light the explosive device. Four people were arrested, with the National Terrorism Prosecution Office [fr] saying it planned to charge them with criminal conspiracy to commit terrorist acts, as well as manufacturing an explosive device in connection with a terrorist enterprise.^[19]
• On April 15, the London Metropolitan Police opened investigations into two more London incidents claimed by HAYI: an attempted arson outside a Persian-language media organization in Park Royal and a petrol bomb attack on Finchley Reform Synagogue, with arrests the following day.^[2][20]
• On April 17, HAYI claimed it was planning an attack on the Israeli Embassy in London using "dangerous substances". Discarded items—including two jars containing a powdered substance—were discovered in Kensington Gardens near the embassy building, but no attack took place and no injuries or damage were reported.^[21] The items were found to not contain any harmful or hazardous substances.^[22] A 39-year-old man was arrested under the Terrorism Act for the incident.^[23]
• On April 17, a bag containing bottles of fluid was lit in the doorway of a building in Hendon, London formerly occupied by the charity Jewish Futures. The bottles failed to fully ignite and only caused minor scorch marks.^[24]
• On April 19, a bottle containing an accelerant was thrown through the window of Kenton United Synagogue, London, causing damage to the synagogue's medical room. Overnight, a 17-year-old boy and 19-year-old man were arrested for the attack.^[25]
• On April 29, 2 Jewish people—one in his 70s and one in his 30s—were stabbed and injured on Golders Green Road by a British national from Somalia.^[26][27] Harakat Ashab al-Yamin al-Islamia claimed responsibility for the attack an hour after it happened, putting out footage of the attack 40 munites later, but investigators said the claim was likely opportunistic.^[28][1][29] Tech Against Terrorism said that if the claim was genuine, it would signal "significant escalation”: “By claiming an incident involving physical casualties, HAYI is signalling willingness to associate its brand with direct violence, even if the group did not direct, enable, or have prior knowledge of the attack.”^[1]

Western security services^[2] believe HAI may be a front group for the Islamic Revolutionary Guard Corps (IRGC), who outsource attacks to local 'thugs-for-hire' and use the group to create plausible deniability. In that regard, HAYI can be seen as an astroturfed brand rather than a grassroots organization.^[3][30] According to the [[International Center for Counter-Terrorism] (ICCT), four channels - "two linked to Iraqi militias including Asaib Ahl al-Haq, which maintains ties to the IRGC's Quds Force, and two pro-Iranian content aggregators with links to sanctioned pro-Russian networks" - anchor every dissemination cycle.^[2] The establishment of HAYI sits within a larger pattern of Iranian state-sponsored terrorism and hybrid warfare.^[3]

The individuals who carried out the attacks are described as potentially amateurs, disaffected teenagers and petty criminals, who have been recruited to conduct the acts for small fees.^[3][30][31] Arrests in London have largely been of minors, and in France have been three minors and one adult, all recruited via social media.^[2] A researcher at the ICCT said "There is a controller, a multilayered system, a cell leader who is supposed to carry something out but is being guided. He is on the phone with someone -- we still don't know who -- and receives materials almost ready for the attack".^[2] Despite the possibility that some of these perpatrators may not be acting based on the ideology of the IRGC, they still face severe prosecution under the National Security Act, according to terrorism expert Roger Macmillan.^[32]

The Israeli Ministry of Diaspora Affairs and Combating Antisemitism noted that the group's name shares nomenclature with an Iraqi militia previously designated as a terrorist organization by the United States. Israeli officials suggested that the timing of the group's activation may be linked to reports of the death of a high-ranking pro-Iranian militia leader in Iraq, raising the possibility that the European attacks were intended as retaliation.^[11][33]

Analysis by the International Centre for Counter-Terrorism (ICCT) and Tech Against Terrorism suggested that HAYI may be an "astroturfed" brand rather than an organic grassroots cell.^[5][34] According to the ICCT, the group's primary Telegram account was created in 2023 but remained dormant until the 2026 attacks, with claim videos often appearing there only after being disseminated by pro-Iranian channels. A second account, created on March 21, 2021, published a claim for the London attack before other channels, though it contained inconsistencies such as a misspelled Arabic name likely resulting from an incorrect English translation.^[5]

Experts have highlighted several "unsophisticated" errors that deviate from standard Islamist rhetoric. The group's Arabic logo misspells the word "Islamic" (al-Islamia), and its imagery features a Soviet SVD Dragunov sniper rifle instead of the AK-47 motifs standard among Iran-backed proxies.^[5][31][2]

In a series of messages with CBS News, the administrator of the HAYI Telegram channel, writing in American-inflected English, justified the attacks using Christian and Jewish philosophical references while omitting the Islamic nasheeds (chants) and theology typical of jihadist media. Analysts also noted a total absence of Persian in the group's communications, despite its alleged alignment with Tehran. Shortly after being questioned by journalists about the group's structure and funding, the Telegram administrator deleted their account.^[30]

According to The Wall Street Journal, European authorities suspect that HAYI is a fictitious group created by Iran to take credit for attacks orchestrated by Iranian intelligence, giving them plausible deniability and confusing investigators.^[35] Security sources speaking to The Guardian cautioned against a "rush to tie Iran" to the incidents, leaving open the possibility of localized attacks with no link to any organized group.^[36] No definitive tie to Iran has been established, and analysts suggest the group carries "hints of amateurism" that argue against direct execution by professional Iranian intelligence operatives.^[31] Dutch Justice Minister David van Weel stated that the teenagers arrested in Rotterdam were "most likely recruited", supporting the theory that an actor may be outsourcing sabotage to local criminals or "disaffected teenagers" to maintain "operational ambiguity".^[5][8]

In the United Kingdom, 26 individuals have been arrested for planning and conducting attacks linked to HAYI.^[23] Following a series of arrests, Deputy Assistant Commissioner Vicki Evans, senior national co-ordinator of Counter Terrorism Policing, said:^[23][37]

"We've made very clear that we will be relentless in our pursuit of anyone involved in carrying out or planning these arson attacks. My message to anyone even considering getting involved in this type of activity is this: the stakes are high and it is absolutely not worth the risk. When we identify you, we will seek to prosecute you. This will include considering offences under the National Security Act which comes with a significant sentence and lifetime restrictions. We will not rest until all those responsible for these acts are held to full account."

In response to the attacks, police resources were significantly stepped up in northwest London: additional uniformed and plainclothed officers have been placed in areas with Jewish populations, and extra stop and search powers have been introduced in Barnet. Additionally, armed response vehicles and Counter Terrorism Policing resources have been deployed to the area to support the increased local policing plan.^[38]