There is a mysterious pro-Iranian cell that has been striking in Europe since the start of the Israeli-US offensive against the ayatollahs. Or, rather, multiple cells, responsible for a series of attacks against Jewish targets in Europe, starting on March 9. Attacks that caused no victims, but present elements compatible with an operation supported by Tehran as part of its hybrid warfare strategy. This is the conclusion of an analysis by the International Center for Counter-Terrorism (ICCT), according to which, despite the absence of definitive proof, the dynamics of the episodes, the online claims and the profile of the possible perpetrators point towards an activity attributable to the pro-Iranian ecosystem.
After the February 28 attack, several Western security services, including Europol, had reported an increased terrorist risk in Europe, particularly against Jewish and Israeli sites, and fears of retaliation in the form of Iranian state-sponsored terrorism. According to the ICCT, these fears are being confirmed. The first episode dates back to the night of March 9, when a homemade bomb exploded in front of a synagogue in Liège, Belgium, without causing casualties and with limited damage. In the following weeks, other attacks followed in the Netherlands and, yesterday, in London, where four vehicles of a Jewish volunteer ambulance service were set on fire.
The claims were attributed to a previously unknown group, Harakat Ashab al-Yamin al-Islamia, shortened to Hayi, which translates as “Islamic Movement of the Company of the Righteous”. The name appeared for the first time after the Liège attack in a video broadcast on Telegram and on
In the following days Hayi claimed responsibility for other attacks: against a synagogue in Rotterdam on March 13, against a Jewish school in Amsterdam on March 14, against a shopping center also in Amsterdam on March 16 and finally yesterday’s episode in the United Kingdom.
The acronym has also been attributed to attacks in Greece, France and the Netherlands for which, the ICCT observes, no public evidence has emerged and which could constitute disinformation.
The fingerprint of the claims
The study especially highlights the so-called digital footprint of claims. Before March 9th there were no known traces of Hayi either online or offline. The first mention appears in a Telegram channel apparently linked to the Iraqi Shiite militia Liwa Zulfiqar, which announced the start of “military operations against US and Israeli interests around the world”.
Two days later, the first claim of responsibility for the Liège attack was published, according to the ICCT, by a channel affiliated with Asaib Ahl al-Haq, an Iraqi group believed to be close to the Quds Force of the Iranian Revolutionary Guards.
Since then, a constant pattern has been repeated: four Telegram channels in Arabic, each with hundreds of thousands of followers, anticipate or spread the news of the attacks and the related videos claiming responsibility almost in real time. Two of these channels are linked to pro-Iranian Shiite militias, while the other two present themselves as news outlets but function above all as amplifiers of pro-Iran content and also show links to already sanctioned pro-Russian networks.
Typically one of the channels reports the incident with a short message and, a few minutes later, the same or another of the four publishes the video signed by Hayi. The material is then relaunched on X and then by a wider network of pro-Iranian influencers, until it also reaches channels close to the Yemeni Houthis and Hezbollah.
For the IVVT, the speed with which these channels had access to footage and information, in some cases in the middle of the night and close to the action, suggests that they were informed almost in real time by the perpetrators or intermediaries. In the case of the attack on the Rotterdam synagogue, which occurred around 3.40am, the first online report appeared at 3.57am and the video claim appeared around 4.19am. For the attack against the Jewish school in Amsterdam, the temporal proximity between the fact and the first mentions was even closer.
However, doubts remain about the authenticity of Hayi as an autonomous terrorist organization
The Telegram channels that present themselves as its official organs are little followed, appearing only to coincide with the latest episodes and present inconsistencies, including linguistic errors in Arabic and even in the name of the group. Even some videos claiming responsibility appear unsophisticated. Furthermore, an alleged action in Greece claimed by the acronym, according to the geolocalization conducted by the researchers, would actually show an explosion that occurred in Rotterdam on March 3. For this reason, the ICCT believes it is plausible that Hayi is more of a cover theme than a structured entity.
The analysis places these episodes in the broader framework of Iranian external operations in Europe
Since 1979, 218 Iranian operations abroad have been recorded, including assassinations, kidnappings, intimidation and surveillance, of which 102 on the European continent. More than half of these would occur from 2021 onwards. According to Britain’s MI5, over 20 Iran-linked plots were foiled in the UK in 2025 alone. Recent cases have also been reported in Germany, the Netherlands and Sweden.
Another element considered significant is the profile of the possible material authors
In the only case in which suspects were identified, the attack on the synagogue in Rotterdam, they would be five young people from Tilburg between 17 and 19 years old. According to the ICCT, this follows a model already seen in Russian hybrid operations: the recruitment of local subjects, often young and with no apparent ideological connection, employed as “disposable agents” for modest salaries. A mechanism that also lends itself to a growing intertwining of terrorism, intelligence and common crime, favored in Belgium and the Netherlands by the presence of deep-rooted criminal networks and the widespread use of homemade bombs.
For the ICCT, the series of attacks in Belgium, the Netherlands and the United Kingdom seems destined above all to produce intimidation, confusion and psychological impact in European Jewish communities, rather than to cause massacres. But precisely this combination of low operational intensity, propaganda, ambiguity and local recruitment represents, according to researchers, one of the most insidious forms of the contemporary hybrid threat