HAYI: Iran-Linked Hybrid Terror Network Claims Attacks on Jewish and US Targets Across Europe
EXECUTIVE SUMMARY
A group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has claimed responsibility for a series of attacks in the Netherlands, Belgium, France, and the United Kingdom since March 2026, including arson targeting Jewish ambulances, an explosion at a Belgian synagogue, and a foiled attack on a Bank of America office in Paris. HAYI has explicitly threatened to target US and Israeli interests worldwide. European intelligence and independent analysts have raised significant questions about whether HAYI is an organic militant group or an astroturfed Iranian hybrid operation.
ANALYSIS
HAYI emerged publicly in March 2026, days after the outbreak of the US-Israel war against Iran. Analysis by the International Centre for Counter-Terrorism identified several branding inconsistencies: the group's Arabic logo misspells the word Islamic, and its imagery features a Soviet SVD Dragunov sniper rifle rather than the AK-47 patterns standard among Iran-backed proxy networks. These anomalies have led analysts to assess HAYI as a possible facade or loosely coordinated brand adopted by disparate actors.
The Paris Bank of America attack involved three minors recruited via Snapchat and paid between 500 and 1,000 euros to carry out the operation, according to reporting. This gig-economy model of recruitment, where individuals with no ideological commitment are paid to carry out directed attacks, is a hallmark of both Iran-linked and IS-linked hybrid networks operating in Europe. HAYI has told CBS News it will target US and Israeli interests worldwide, an explicit threat that should be assessed in the context of the Iran war and the broader mobilization of Iran-linked proxy networks.
The threat to US commercial interests in Europe, illustrated by the foiled Bank of America attack, is directly relevant to US government and private sector security posture. FBI and law enforcement coordination with European counterparts on the HAYI network should be prioritized, particularly given the group's stated global ambitions and its demonstrated ability to recruit paid operatives with no prior connection to extremism. Whether HAYI is a genuine Iranian proxy, an opportunistic self-starting network, or a deliberate information operation, its operational model enables plausible deniability while still producing real-world attacks.
SOURCES
CBS News: Group threatens US and Israeli interests worldwide
FDD: Ashab al-Yamin: Terrorism With Semi-Plausible Deniability
War Noir (Telegram), April 7 2026
