What is HAYI, the little-known pro-Iranian group that says it is behind attacks in Europe?

A little-known pro-Iranian group, HAYI, has claimed responsibility for a series of attacks and incidents across Europe over the past month.

From the arson of a Jewish volunteer ambulance and several other incidents in London, attacks in the Netherlands and Belgium, to the attempted bombing of a Bank of America branch in Paris, all of these incidents have been linked to the group, and what they have in common is that the suspects are "one-time" perpetrators.

Although the group claims responsibility for the attacks, security services warn that its actual role remains unclear.

Police in London are investigating the latest attacks recorded on April 15, an attempted arson attack outside the premises of a Persian-language media organization and an attack on a synagogue in Finchley.

The HAYI group has claimed responsibility for all of these attacks on social media, but police say the investigation is continuing with all options open.

The group's activities began in March.

HAYI is an abbreviation for Harakat Ashab al-Yamin al-Islamia or “Islamic Movement of the Friends of the Right or the Righteous”.

Until March 2026, the group was little known and active, until they began claiming responsibility for attacks in the Netherlands and Belgium via Telegram accounts.

"The Telegram channel was first created two years ago, but it was basically inactive. And it became active, or rather, started operating in March of this year," Kacper Rekawek, a researcher at the International Center for Counter-Terrorism (ICCT), based in The Hague, told REL.

EUROPOL also warned of possible attacks on Jewish and American targets in Europe, after the United States and Israel launched a joint attack on Iran on February 28.

Little known

While little is known or determined about the group's leadership or structure, one important link is that videos of their attacks, when recorded and broadcast, appear almost immediately on the channels of pro-Iranian Shiite militias in Iraq.

According to Rekawek, this suggests a certain degree of coordination.

French Interior Minister Laurent Nunez also believes the group may have links to Iran, due to similarities to other attempted attacks in Europe, for which a pro-Iranian group has claimed responsibility.

"Typically, Iran's intelligence services operate in this way: they use intermediaries, a series of subcontractors, often common criminals, to carry out highly targeted actions targeting American interests, the interests of the Jewish community, or individuals associated with the Iranian opposition," Nunez told the media.

The HAYI group, according to ICCT findings, publishes claims of attacks through short videos describing incidents, most often recorded on a mobile phone, with the group’s logo and name, date, and location in Arabic. The content then spreads quickly through Telegram channels linked to pro-Iranian militias and then to other networks.

Incidents in London

Recent incidents on April 15 in London have drawn more attention to this group.

Police are investigating arson attacks outside the premises of a Persian-language media organisation in Park Royal, as well as outside a synagogue in Finchley.

Three people, including a minor, have been arrested on suspicion of arson with intent to endanger life in Park Royal. Police said a burning object was thrown towards the property, but it fell into the parking lot and the fire was quickly extinguished.

The investigation into this case is also being conducted by anti-terrorist police, although the incidents have not yet been classified as terrorism.

Authorities have also warned of the possibility that individuals have been persuaded or paid to act on behalf of foreign actors, the BBC reported.

Vicki Evans, senior national counter-terrorism coordinator, said they were aware of the HAYI group, as well as incidents across Europe.

"Of course, that's one side of our investigation, but there are others. We're keeping an open approach at this stage."

In the second attack on the Finchley Reform synagogue, two people, who were later arrested, threw two bottles filled with petrol towards the building.

Previously, on March 23, Jewish ambulance vehicles were set on fire in London, for which HAYI also claimed responsibility, and police say they are investigating the case and the three suspects in the attack.

Teenagers recruited for Paris attack

French security forces thwarted an attack on a Bank of America branch in Paris on March 28 and arrested four people suspected of attempting to plant an explosive device, which contained about 650 grams of explosive material.

Three minors and one adult face charges, and according to an investigation by French police and prosecutors, the young men were recruited via social media.

Prosecutors have identified the possibility of a wider and more organised network of participants, although one of the defendants said the attack was motivated by "personal reasons".

The Office of the Special Prosecutor for the Fight against Terrorism said the attempted attack could be linked to the HAYI group, which has previously claimed responsibility for attacks in the Netherlands, Belgium and the United Kingdom.

It was also revealed that the group had "targeted the French headquarters" of Bank of America in a propaganda video a few days earlier, the prosecutor's office said.

However, the relationship has not yet been officially confirmed.

"The main modus operandi is basically bombings or arson attacks on various Jewish or Israeli, and now American, targets across Europe. That's, let's say, the offline part. It seems they're using hired personnel, meaning young people, criminals, hooligans, whatever you want to call them, in Europe," says Rekawek.

He adds that, after the attacks in Paris, it is becoming clearer that "there is a controller, that there is a multilayered system, that there is a cell leader who has to do something, but who is under control.

"He's on the phone with someone, we don't know who yet, and he's getting materials almost ready for the attack. So there's a certain degree of coordination, but also a multilayered organization," the researcher estimates.

'Consumer agents' modeled after Russian operations

An investigation in France showed that the suspects were allegedly paid between 500 and 1,400 euros to carry out the attacks and that they were "one-off" operatives.

"We have fragmented knowledge about the participants. But they seem to be 'unusable agents,' as in the case of Russian attacks in Europe. And yes, they should be paid more if they do more," says Rekawek.

A similar pattern has been seen in Russia-linked attacks, where locally recruited perpetrators were used for sabotage and arson, something the European Union has also warned about.

Rekawek says the recruits may also have been linked to organized crime.

"Their 'soldiers on the ground' come from that environment. So they can carry out attacks anywhere, but it seems to me that this is currently mainly concentrated in Belgium and the Netherlands. We'll see how far the UK and France will go in this sense, but technically it could be anywhere," Rekawek believes.

Claims of responsibility for the attacks do not come from a single source, but circulate through a wider network of pro-Iranian channels on Telegram, some of which are linked to HAYI, and are quickly removed.

Possible links to Iranian intelligence

The first attack for which the group claimed responsibility was carried out in Liege, Belgium, on March 9, when an explosion damaged a synagogue.

The group later shared short videos of the attack on Telegram and X channels, with the group's logo, and they were further distributed by other pro-Iranian accounts, particularly pro-Iranian Iraqi Shiite militias, as well as pro-Iranian media outlets, the ICCT investigation found.

The HAYI group later claimed responsibility for attacks on a synagogue in Rotterdam on March 13, a Jewish school on March 14, and a shopping mall on the 16th in Amsterdam.

"This is a kind of phantom organization, posing as something new, but it's essentially connected to Iraqi Shiite militias that have ties to Iran, and they may have simply been told to pose as something new, while in fact they are running the operation," says Rekawek.

The group, researchers say, has also falsely claimed responsibility for several incidents in EU countries, most likely with the aim of disinformation.

Is the Western Balkans the focus of this kind of action?

Speaking of the broader context, the ICCT states that channels linked to pro-Iranian militias have in recent years expanded the narrative of the so-called "axis of resistance," an informal network of states and actors, including Iran and Hezbollah, that oppose Western influence.

Regarding the Western Balkans, the US Embassy in Tirana warned in early April that Iran-linked groups could target US-linked entities or Iranian opposition elements in Albania, which Albanian authorities dismissed as "speculation".

In a statement, the embassy said that Iran-linked groups "may also target common places, such as tourist destinations, shopping malls, hotels, clubs and restaurants."

Rekawek believes that the Western Balkans are not a priority for the aforementioned group at the moment.

"Now this has to be seen through the prism of the Western Balkans, where all these countries have, let's say, parts or governments that are sympathetic to the governments of that supposed 'Axis resistance', but also governments that are strongly against it and that go in the other direction."

“Technically, especially in the context of the US-Israeli war against Iran, this could mean that some of the US representatives could be targeted by this phantom group, but at the same time there are many other US targets and many other Jewish or Israeli targets across Europe, so I’m not sure if the Western Balkans are at the top of their priority list, but that could change,” the researcher says.

EUROPOL warned in March that the conflict in the Middle East could lead to increased security threats in Europe, including the activities of pro-Iranian actors and intermediaries.

The organization warned at the time that their operations could include terrorist attacks, intimidation campaigns and terrorist financing, as well as cyberattacks, disinformation or online fraud.

The GeoPost