Young men and teenagers have allegedly been recruited on social media and paid to carry out a series of attacks on Jewish, Israeli, and American sites across seven European countries.
The scattered attacks, largely involving improvised fire bombs, have targeted synagogues in Britain, Belgium, the Netherlands and North Macedonia, as well as a Jewish school and US-linked bank in Amsterdam, and an Israeli restaurant in Munich.
Each attack has been claimed in videos released on encrypted messaging platform Telegram by a previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Hayi).
The group is believed to be using social media including Snapchat to recruit young men to carry out the attacks, following a recent pattern of unconventional warfare tactics used by Russia and Iran. In almost every case where arrests have been made, the suspects have included youths under the age of 18.
Antonio Giustozzi, senior research fellow at the Royal United Services Institute for Defence and Security Studies (Rusi), said he had spoken to contacts in the Islamic Revolutionary Guard Corps (IRGC) who denied a link, claiming that the group was a proxy for Hezbollah in Lebanon.
“These are people in the Quds force [the IRGC’s unconventional warfare arm]. They say it’s linked to Hezbollah. There had been no ceasefire in Lebanon so Hezbollah were still at war.
“They set up this front to do these attacks and claim them. They recruit people online that are vulnerable. They could be gangs or criminals. Of course those groups are not capable of complex attacks,” he said, adding that social media presents a “weakness” that can easily be exploited to recruit young men, whether they are ideologically aligned or not.
A report published last month by the Hague-based International Centre for Counter-Terrorism found that the channels circulating Hayi’s material were affiliated with Iran’s “axis of resistance” – a network of groups ranging from Hezbollah to Yemen’s Houthis and pro-Iranian Shia militias in Iraq.
“We are clearly aware of that group and the incidents across Europe and the claims that have been made on various different channels,” Vicki Evans, Britain’s senior national coordinator for counter-terrorism policing, said at a press conference on Thursday.
“We are working on our understanding of what that means, both in terms of the group themselves, and more broadly, what that means in the international context.”
The report said that while the authority of some of Hayi’s claimed attacks was in doubt, the near-immediate reporting of some of them on Telegram suggested that the channels “were informed of the incidents almost in real time, either directly by the perpetrators or via intermediaries”.
“The suspicious dissemination patterns raise the question of whether Hayi is a genuine terrorist group or merely serves as a façade for Iranian hybrid operations that enable plausible deniability,” the report concluded.
The attacks claimed by Hayi show no sign of stopping. In a video claiming responsibility for an arson attack in Amsterdam last month, the group claimed it wanted European countries to distance themselves “from all American and Zionist interests”, adding: “This is a final warning to all the peoples of the world.”
