A group that did not exist online or anywhere else before March 9, 2026, has suddenly claimed responsibility for a string of low-tech arson and attempted bombings at synagogues and US banks across Belgium, the Netherlands, France, and the UK.
Mainstream outlets like FT and counter-terrorism analysts are rushing to label Harakat Ashab al-Yamin al-Islamia (HAYI, or "Ashab al-Yamin") as an Iranian intelligence "hybrid warfare" front. But a closer look raises serious red flags: the group's amateurish execution, suspiciously perfect timing amid the U.S.-Israeli war on Iran, and a pattern that seems tailor-made to stoke the antisemitism narrative and justify further crackdowns on Tehran and its proxies.
The first claim surfaced on March 9 via Telegram channels tied to Iraqi pro-Iranian militias. Two days later, HAYI took credit for firebombing a synagogue in Liège, Belgium. Subsequent claims included attacks on a Rotterdam synagogue (March 13), a Jewish school in Amsterdam (March 14), a site linked to Bank of New York Mellon in Amsterdam (March 16), Hatzola Jewish ambulances in London's Golders Green (March 23), and a foiled plot outside Bank of America in Paris (March 28). An attempted synagogue strike in Heemstede, Netherlands, was also stopped on March 20. Some other claims, including an alleged Greece attack - appear to be outright disinformation.
European police have rounded up suspects aged 14-23. In the Netherlands, at least 10 arrests. France charged four, including minors. In the UK, three young men (two Brits aged 19–20 and a 17-year-old dual national) were charged with the London ambulance arson, with a fourth arrest.
Orthodox Jewish communities in London and elsewhere have their own ambulances operated by Hatzola (also spelled Hatzolah or Hatzalah), a private volunteer-run, community-funded emergency medical service.
French prosecutors revealed one teen claimed he was recruited on Snapchat, offered €500–€1,000, and initially told the "bomb" was revenge on a cheating girlfriend - before being instructed to film it for the cause. Many suspects were released on bail.
The "group" that wasn't there yesterday
Researchers at the International Centre for Counter-Terrorism (ICCT) note HAYI had "no known references, neither online nor offline" before March 9. Its statements contain linguistic quirks, misspellings, and inconsistencies. Claims were amplified almost immediately by channels linked to IRGC-aligned militias—yet the operation relies on disposable online recruits for pocket-change jobs. Julian Lanchès at ICCT called it unusual and suggested an Iranian intelligence project for deniability.
Doubts regarding the authenticity of HAYI are, however, not only raised by the appearance of its Telegram channel and the likely falsely claimed attack in Greece, but also by inconsistencies within the claim material itself. For example, the videos contain noticeable linguistic errors. Further, the Arabic inscription beneath the group’s logo, which closely resembles the flag of Hezbollah and other pro-Axis groups, except for featuring a Soviet SVD sniper rifle instead of the more typical AK-style imagery, includes multiple mistakes, including the misspelling of the word “Islamic.”
Skeptics aren't buying it. The Grayzone's Wyatt Reed highlighted glaring questions: Why aren't these "Iranian" operatives hitting targets in countries most aggressively involved in the war on Iran? Why the focus on symbolic Jewish and U.S. bank sites with minimal actual damage and zero casualties? Why do some communiqués contain phrasing that reads like it was generated with odd Israeli terminology quirks (e.g., references to "the Land of Israel")? And why were multiple suspects quickly released on bail while the "terror campaign" narrative rolls on?
MintPress News investigative piece by David Miller goes further, arguing HAYI looks like a fabricated "fake Iranian terror group" invented precisely to accelerate efforts to proscribe the IRGC as a terrorist organization across Europe - long a goal of pro-Israel lobbying networks amid the Iran war.
Cui bono? The timing is impeccable
The wave of attacks kicked off right as U.S.-Israeli strikes on Iran intensified in late February 2026. Jewish communities were already on edge from post-October 7, 2023, tensions. UK groups like the Community Security Trust linked the London incident to rising antisemitism. Dutch officials openly probed "Iranian involvement." U.S. banks in Paris told staff to work from home. All of it feeds a story that Iran is exporting chaos.
Iran's London embassy flatly denied involvement, calling the claims "unfounded" and reaffirming non-interference. But in the current climate, denials are dismissed as standard procedure.
Online discourse is split - with some X posts and independent commentary (including from figures who faced backlash) have pointed to Mossad-style operations, citing historical precedents and the fact that the attacks generate maximum narrative value with minimum real risk. A UK mayor in Bath resigned after sharing posts suggesting the Hatzola ambulance arson was staged.
Even some mainstream analysts admit the group operates like a hastily assembled brand.
To analyse the activities of HAYI, we examined its digital footprint, including the first public mentions of the attacks online and the initial dissemination of the corresponding claim videos. This analysis was conducted using the OSINT tools XNetwork and TGStat, which were queried using Arabic-language keywords. In addition, an AI-based detection tool was employed, which indicated that all claim videos were likely genuine recordings.
There are no known references, neither online nor offline, to HAYI prior to 9 March, when a post of the group was circulated in a Telegram channel seemingly affiliated with the Iraqi pro-Iranian militia Liwa Zulfiqar. In this post, HAYI announced “the start of its military operations against US and Israeli interests around the world,” although it made no reference to the attack against the synagogue in Liège that occurred on the same day. This would suggest that HAYI is a new group, established for the purpose of this bombing campaign. -Julian Lanchès, ICCT
Recruitment teens via Snapchat and Telegram for one-off gigs isn't exactly what hardened jihadists do - is it?
Hybrid warfare... or hybrid narrative?
Pro-Iran voices and anti-war skeptics argue this fits a familiar playbook: manufacture or exaggerate a threat, amplify it through friendly think-tanks (some with clear ideological alignments), then use the panic to justify expanded surveillance, sanctions, military posture, and silencing dissent on Gaza or Iran policy. The low-body-count, property-only focus maximizes fear without crossing into "existential terror" that might backfire.
Whether HAYI is a sloppy Iranian cutout using disposable locals, a pure astroturf job, or something more orchestrated to serve specific agendas remains under investigation. Meanwhile the story has already succeeded in sowing anxiety, polarizing communities, and providing fresh ammunition for those pushing Europe deeper into the Iran conflict.