On 9 March, a post on the social media network Telegram, reportedly from a group called Harakat Ashab al-Yamin al-Islamiya (HAYI), announced the beginning of “military operations” against US and Israeli interests.
Then, on Monday, a Telegram channel purporting to represent the group – whose name translates as the Islamic Movement of the Companions of the Right – made an unsubstantiated claim of responsibility for an arson attack on four Jewish ambulances in Golders Green, northwest London.
By Tuesday, the channel – which had less than 200 subscribers – had been deleted. The origins of the group remain unclear, although experts have said that their branding is similar to that of the Islamic Revolutionary Guard Corps (IRGC) and its broader network.
Before the Telegram channel disappeared late on Monday night, it had posted videos of four other arson attacks around Europe – and shared information about an attack in the Czech Republic attributed to another group called the Earthquake Faction.
Some of the videos had been circulating in channels affiliated with Iraqi pro-Iranian militia beforehand, according to a digital analysis by researchers at the International Centre for Counter-Terrorism. One of the claimed attacks – against an unspecified site in Greece on 11 March – is likely to be disinformation, researchers believe.
While security sources recognise HAYI’s modus operandi, they do not recognise their name and cautioned against a rush to attribute the Golders Green attack. The Metropolitan Police have said that they are working to authenticate the claim of responsibility made by HAYI. It has not so far been designated as a terrorist incident.
In CCTV footage of the attack in London, three individuals can be seen setting light to an ambulance in the early hours of Monday morning. The ambulances were run by Jewish charity Hatzola and were parked in the car park of the Machzike Hadath Synagogue.
In posts to Telegram seen by The Independent, HAYI claimed responsibility for the ambulance attack in a video that contained text in Hebrew, English and Arabic. The text did not refer to the ambulances but instead said the target was the synagogue, which was described as “one of the main bastions of support for Israel in Britain”.
The group also shared a “final warning” to EU citizens to “immediately distance yourselves from all American and Zionist interests”. One video apparently claimed an attack outside an American bank near the World Trade Centre in Amsterdam earlier this month; another claimed to show fires being lit outside a Jewish school in Amsterdam.
The mayor of the Dutch capital said on 14 March that the explosion outside the school was a “deliberate attack against the Jewish community”.
Another unverified video claimed to show an explosion outside a synagogue in Rotterdam. Five young men, three aged 19, one 18 and one 17, have been arrested in relation to this explosion. Dutch authorities have said that it is too early to say whether the incidents are linked.
Russia, in particular, has pioneered the use of young recruits to carry out attacks in Europe in exchange for financial reward. But the chair of the UK’s Intelligence and Security Committee said on Tuesday that the Iranian regime were also using proxies for its attacks abroad.
Labour peer Kevan Jones said this made tracking the perpetrators harder for the police as what “you are dealing with here is not necessarily just organised crime groups, but also people who are just paid”.
“It is an approach which the Russians are using,” he said. “For example, the attack last year on the warehouse in east London, many of those individuals who are not directly linked to any organised crime groups, are just paid money.”
Earlier this year, two Swedish citizens, who were aged 16 and 18 at the time of their offences, were jailed for throwing grenades at Israel’s embassy in Denmark in October 2024.
The court ruled that the pair were part of a criminal network in Sweden, with prosecutors saying the organised criminals were acting as “the armed wing of a Middle Eastern terrorist organisation”.
The channel claiming to be HAYI also shared the apparent actions of a group called Earthquake Faction against a warehouse of an arms company in the Czech Republic. Czech authorities have launched an investigation into the fire and are treating it as a terror attack, according to local media.
Earthquake Faction have been issuing press releases about their apparent attack to UK journalists, claiming to be an “internationalist underground network that targets key sites critical to the Zionist entity”.
Analysis by Julian Lanches, junior research fellow at the International Centre for Counter-Terrorism (ICCT), found no known references to HAYI prior to 9 March, when a post of the group was circulated in a Telegram channel seemingly affiliated with an Iraqi pro-Iranian militia group.
Mr Lanches wrote: “The suspicious dissemination patterns raise the question whether HAYI is a genuine terrorist group or merely serves as a facade for Iranian hybrid operations that enable plausible deniability.”
He also highlighted inconsistencies, such as unsophisticated linguistic errors in the claim videos and the logo featuring a sniper rifle instead of the more typical AK-style imagery.
Mr Lanches suggested it pointed less to the “direct execution of attacks by Iranian intelligence operatives” and more towards “locally recruited actors”.
Roger Macmillan, former director of security at media company Iran International, said: “There is a lot of conjecture about the group at the moment. This is an organisation which really seems to have come to life after the joint US-Israeli attacks in Iran. It looks as though they’ve claimed responsibility for attacks across Europe, including Liege, Rotterdam and Amsterdam.
“In the first few days of their existence, it seemed to be other axis of resistance (Iran-linked) Telegram channels which were sharing the information. These attacks are there to instil fear. My gut feeling is that it is Iranian-backed.”
Dr Hans-Jacob Schindler, senior director of the Counter Extremism Project, emphasised that HAYI was unlikely to be a new terror group. Referring to their claims of attacks across Europe, Dr Schindler said: “Whether the perpetrators are connected, or whether it’s a framework the IRGC is giving them, is up for discussion.
“It’s much more powerful to say that a new terrorist group exists, but given they have claimed five attacks in four countries, it is unlikely that a new group would be able to set up that network within weeks. Posts like these create the impression that there is massive terror against Europe. These actors will post everything they can to insinuate that Europe has become very very unsafe.”
Jason Brodsky, policy director at the United Against Nuclear Iran, said: “Harakat Ashab al-Yamin al-Islamiyya’s branding on videos includes logos that are adopted from the Islamic Revolutionary Guard Corps (IRGC) and its broader terror network.
“The IRGC has different options to choose from in activating these groups: it can activate sleeper cells in the United Kingdom or it can employ transnational criminal syndicates to target Israeli interests, Jewish organisations, and the Iranian diaspora.”
