Rising Threats: Harakat Ashab al-Yamin al-Islamiyya and Iran's Hybrid Warfare in Europe

A newly emerged group, Harakat Ashab al-Yamin al-Islamiyya (HAYI), has claimed responsibility for a series of attacks targeting Jewish communities and American interests across Europe. These incidents include an arson attack on ambulances in the UK, an explosion outside a synagogue in Belgium, and a foiled bombing attempt at a Bank of America office in France. HAYI surfaced online in March 2026, shortly after the onset of hostilities between the United States, Israel, and Iran, raising questions about its authenticity and potential ties to Iranian state actors.

How Iran-Backed Proxy Networks and ‘Gig-Economy’ Terrorism Are Threatening Western Countries

Counterterrorism experts suggest that HAYI's operations resemble Russia's hybrid warfare tactics, where non-state actors are recruited for sabotage without full awareness of their affiliations. Thomas Renard from the International Centre for Counter-Terrorism noted that Iran has a history of employing hybrid warfare strategies, which allow for plausible deniability while utilizing intermediaries. Martha Turnbull from the European Centre of Excellence for Countering Hybrid Threats highlighted a significant increase in Iranian-linked threats to Europe, particularly against dissidents and Jewish targets.

CNN

In the Netherlands, HAYI claimed responsibility for an explosion outside a Rotterdam synagogue and an attack on a Jewish school in Amsterdam. Dutch authorities are investigating potential Iranian involvement, while French prosecutors are examining links between HAYI and a failed bombing plot in Paris. In the UK, the arson attack on Jewish community ambulances has been classified as a hate crime, with the UK Home Office emphasizing the seriousness of threats posed by Iranian proxies.

CNN

The recruitment methods employed by HAYI reflect a broader trend of utilizing social media platforms for operational purposes. Reports indicate that individuals involved in these attacks were offered small financial incentives, as low as £500, to carry out violent acts. This commodification of violence, particularly among economically vulnerable individuals, complicates law enforcement efforts and blurs the lines between criminality and political violence.

How Iran-Backed Proxy Networks and ‘Gig-Economy’ Terrorism Are Threatening Western Countries

While many analysts attribute these attacks to Iranian state influence, some dissenting voices argue that rising tensions between Jewish and Palestinian groups may also play a role. Political activist Babak Darbiki cautioned against hastily linking these incidents to Iranian state actions, suggesting that local dynamics could be equally significant. Additionally, legal expert Omid Shams posited that HAYI's activities might be connected to criminal networks in the Netherlands rather than direct state-sponsored terrorism.

Criminal Proxies or Sleeper Cells: Who are the Islamic Republic’s Thugs in the West?

The emergence of HAYI and its claimed attacks signal a concerning evolution in how terrorist operations are conceived and executed, reflecting a shift towards decentralized, deniable methods of violence. As the conflict in the Middle East continues, experts warn that the Iranian threat is likely to escalate, necessitating a reevaluation of counterterrorism strategies to address the complexities of hybrid warfare and the gig economy's influence on terrorism.

CNN

• “There are a lot of indications that this group is not genuine,” — Thomas Renard, Counterterrorism Expert

CNN

• “These attacks have shown the continued focus of the Iranian regime on dissidents, the Iranian diaspora, and, more recently, Jewish and Israeli targets,” — Martha Turnbull, Director, Hybrid CoE

CNN

• “this government takes the threat posed by the Iranian regime and those who do its bidding extremely seriously, and we have robust measures in place to counter any malign activity.” — UK Home Office Spokesperson

CNN

There are discrepancies regarding the extent of HAYI's operational capabilities and its direct ties to the Iranian government. Some experts assert that the group may simply be a façade for Iranian operations, while others suggest it could be a genuine grassroots movement. Further investigations are needed to clarify these connections and the motivations behind the attacks.

CNN