The burning of Jewish volunteer ambulance vehicles in London, the attacks in the Netherlands and Belgium, and the attempted bombing of a Bank of America branch in Paris – all of these incidents are linked to a little-known pro-Iranian group, HAYI, and the exploitation of “expendable” young men as executioners.
HAYI is an abbreviation for Harakat Ashab al-Yamin al-Islamia, which means "Islamic Movement of the Companions of the Right or the Righteous."
Until March 2026, the group was little known and active, until it began claiming responsibility for attacks in the Netherlands and Belgium through a Telegram account.
"The Telegram channel was first created two years ago, but it was essentially inactive. It became active, meaning it started operating, in March of this year," Kacper Rekawek, a researcher at the International Center for Counter-Terrorism (ICCT), based in The Hague, told Radio Free Europe.
The European police agency, Europol, also warned of possible attacks on Jewish and American targets in Europe, after the United States and Israel launched a joint attack on Iran on February 28.
A little information about the group
Although very little is known about the group's leadership or structure, one important element is that videos of its attacks, when recorded and published, appear almost immediately on the channels of pro-Iranian Shiite militias in Iraq.
According to Rekawek, this suggests a certain level of coordination.
Even French Interior Minister Laurent Nunez assessed that the group may have ties to Iran, due to similarities with other attacks in Europe, for which pro-Iranian groups have claimed responsibility.
"Typically, Iranian intelligence services operate in this way: they use intermediaries, a chain of subcontractors, often common criminals, to carry out highly targeted actions against American interests, the Jewish community or individuals associated with the Iranian opposition," Nunez told the media.
British police said they were investigating whether the Iranian group was involved in the March 23 arson attack on a Jewish ambulance in London.
Three suspects have been charged in the attack. While the investigation is being led by counter-terrorism police, the case has not yet been classified as a terrorist act.
Young men recruited for Paris attack
French security forces thwarted an attack on a Bank of America branch in Paris on March 28 and arrested four people suspected of attempting to plant an explosive device, containing about 650 grams of explosive material.
Three minors and one adult face charges, while, according to investigations by the French police and prosecutor's office, the young people were recruited through social networks.
Prosecutors raised doubts about the existence of a wider, more organized network, although one of the accused stated that the attack was motivated by "personal reasons."
The special prosecutor's office for combating terrorism announced that the attempted attack could be linked to the HAYI group, which previously claimed responsibility for attacks in the Netherlands, Belgium and the United Kingdom.
It was also discovered that, a few days earlier, the group had released a propaganda video "targeting the French headquarters" of Bank of America, the prosecutor's office said in a statement.
However, this connection was not officially confirmed.
"The main modus operandi is bombing or arson attacks on Jewish or Israeli, and now American, targets across Europe. That's the, shall we say, 'offline' part. It seems they are using hired personnel, or young people, criminals, hooligans... whatever you call them... in Europe," says Rekawek.
He adds that, after the Paris case, it becomes clearer that "there is a controller, a system with several levels, a leader of a cell that operates under instructions."
"He's on the phone with someone – we don't know who it is – and he gets almost ready-made materials for the attack. So there's a certain degree of coordination, but also a multilayered organization," the researcher says.
"Expendable agents" according to the Russian model
Investigations in France showed that the suspects were paid between 500 and 1,400 euros to carry out the attack and that they were "disposable" operatives.
"We have fragmented knowledge about the participants. But it seems they are 'expendable agents', as in the case of Russian attacks in Europe. And yes, they should be paid more if they do more," says Rekawek.
A similar pattern has been seen in attacks linked to Russia. Perpetrators recruited there were used for sabotage and arson – something the European Union has also warned about.
Rekawek says the recruits may also be linked to organized crime.
"The soldiers on the ground come from this environment. So they can carry out attacks anywhere, but it seems that, at the moment, this is mainly concentrated in Belgium and the Netherlands. We will see if the United Kingdom and France continue in that direction, but technically it could happen anywhere," he estimates.
Claims of responsibility for the attacks do not come from a single source, but circulate through a wider network of pro-Iranian channels on Telegram – some of which are linked to HAYI and are quickly removed.
Possible links to Iranian intelligence
The first attack for which the group claimed responsibility was in Liege, Belgium, on March 9, when an explosion damaged a synagogue.
The group later shared short videos of the attack on Telegram and X channels, bearing its logo, and they were further distributed by other pro-Iranian accounts, notably pro-Iranian Iraqi Shiite militias, as well as pro-Iranian media outlets, an investigation by the International Counterterrorism Center found.
The HAYI group later claimed responsibility for attacks on a synagogue in Rotterdam on March 13, a Jewish school on March 14, and a shopping mall on March 16 in Amsterdam, as well as the attack in London on March 23.
"It's a kind of phantom organization, posing as something new, but it's essentially connected to existing Iraqi Shiite militias that have ties to Iran, and they may have been told to simply pose as something new, while in reality they are running the operation," Rekawek says.
Are the Western Balkans the focus of such activity?
Speaking in a broader context, Rekawek says that channels linked to pro-Iranian militias have in recent years expanded the narrative of the so-called "axis of resistance" - an informal network of states and actors, including Iran and Hezbollah - the Lebanese group that the US considers terrorist - that oppose Western influence.
Rekawek believes that the Western Balkans are not the focus of such activity at the moment.
"Now, this has to be seen through the prism of the Western Balkans, where all of these countries have, let's say, segments or governments that sympathize with what is called the 'axis of resistance', but also governments that are strongly against it and moving in the other direction," he says.
"Technically, and especially in the context of the US and Israeli war against Iran, this could mean that some of the US supporters could be targets of this phantom organization. But, at the same time, there are many other American targets, as well as Jewish or Israeli targets throughout Europe. Therefore, I am not sure that the Western Balkans are at the top of their priority list, but this could change," the researcher adds.
Europol warned in March that the conflict in the Middle East could lead to increased security threats in Europe, including the activities of pro-Iranian actors and intermediaries.
The organization warned at the time that their operations could include terrorist attacks, intimidation campaigns and terrorist financing, as well as cyberattacks, disinformation or online fraud./REL
