A mysterious new pro-Iran terror group has been linked to a series of recent attacks on Jewish communities and US financial institutions in the UK and Europe.
The only “catch”, said CNN, is that it “may be a mirage”.
Who are they and what have they claimed?
Harakat Ashab al-Yamin al-Islamia (HAYI), the Arabic name meaning “The Islamic Movement of the Companions of the Right(eous)”, first appeared online shortly after the US and Israel launched their war on Iran at the end of February.
On 9 March, HAYI posted on the encrypted messaging app Telegram that “military operations” against US and Israeli interests around the world had begun. Two weeks later, a Telegram channel claiming to represent the group made an unsubstantiated claim of responsibility for an arson attack on four Jewish ambulances in Golders Green, north London.
It then posted videos of four other arson attacks in Belgium, Greece and the Netherlands, as well as threatening a further attack against the Bank of America building in Paris, before the channel was deleted.
Who is behind the group?
Examining the group’s digital footprint, the International Centre for Counter-Terrorism found “no known references, neither online nor offline, to HAYI prior to 9 March”.
The Netherlands-based think tank highlighted “suspicious dissemination patterns” that were seemingly coordinated with the pro-Iranian online ecosystem. This raises the question “whether HAYI is a genuine terrorist group or merely serves as a façade for Iranian hybrid operations that enable plausible deniability”.
“This group is an Iranian creation,” Phillip Smyth, an analyst on the counterterrorism advisory board for Homeland Security Today, told The i Paper. “The scope of their actions, branding, and Iran’s own messages all demonstrate a clear link.”
For Western security experts, HAYI is “either a construct aligned with Iran’s Islamic Revolutionary Guard Corps (IRGC) or an opportunistic network operating within the broader pro-Iranian online ecosystem”, said Radio Free Europe.
Do the attacks follow a pattern?
UK security officials have previously warned of a “rise in ‘gig-economy’ Iranian spies offered cash for operations across Europe”, and have been “actively investigating Iran’s use of social media platforms” to create “sleeper cells with the potential to carry out violent attacks”, said The i Paper.
The spate of arson attacks since the start of the war in Iran are “similar in nature to Russia’s so-called hybrid operations in Europe”, in which people have been recruited online “to carry out sabotage attacks”, said CNN. These are often perpetrated “by non-Russian nationals for small amounts of money and without full knowledge of who the operations serve”.
The series of “low-intensity” incidents involving Jewish and US targets have so far carried “limited material damage but strong symbolic impact, disseminated and amplified through channels linked to the pro-Iranian ecosystem”, said Decode 39.
These “operational and propaganda dynamics point to a possible hybrid model of terrorism in Europe: simple actions, local perpetrators and maximum ambiguity”.