By Since the United States and Israel launched a joint attack against Iran on 28 February, Western security services, including Europol, have warned of an increased terrorist threat, particularly targeting Jewish and Israeli sites, due to the risk of retaliatory attacks in the form of Iranian state-backed terrorism.
Since 9 March, a series of attacks, primarily directed at Jewish sites, has unsettled Europe. The first incident occurred when an improvised explosive device (IED) was detonated in front of a synagogue in the Belgian city of Liège. Belgian Prime Minister Bart De Wever described it as “an attack on our values and our society.”
Since then, attacks have occurred in the Netherlands, and most recently on 23 March in London, when four cars belonging to a volunteer Jewish ambulance service were set on fire.
Is an Iranian Proxy Responsible for the Attacks?
A recent report from ICCT (International Centre for Counter-Terrorism) revealed that the incidents are likely part of coordinated hybrid operations that align with established Iranian practices, particularly the use of deniable networks, including criminal or loosely affiliated individuals, to conduct actions that remain below the threshold of direct state confrontation.
According to the analysis, the links to Tehran became clearer after the Liege attack when video footage was being circulated via pro-Iranian social media channels linked to Iran’s Revolutionary Guard Corps and the Lebanese Hezbollah movement. In the video, a militant group called Harakat Ashab al-Yamin al-Islamiyya (HAYI) claimed responsibility for the above-mentioned attacks.
The name “Harakat Ashab al-Yamin al Islamia” (“Islamic Movement of the Companions of the Right”) originates from Quranic terminology describing the righteous who receive their record in their right hand on Judgment Day.
Another analyst notes that the name was likely chosen for its dual theological meaning: in Sunni interpretation, it refers to the righteous believers, while in the Shiite interpretation, it can refer specifically to followers of Imam Ali.
Harakat Ashab al-Yamin al-Islamia first announced its existence in early March, after the U.S. and Israel launched the ongoing war on Iran.
The shadowy organisation has been using a Telegram group channel to publish a series of propaganda videos.
“The claim was disseminated via a video showing brief footage of the attack, branded with the group’s logo, and circulated on Telegram and X channels affiliated with groups of the axis of resistance, especially Iraqi pro-Iranian Shia militias, as well as pro-Iranian news outlets,” Julian Lanches, research fellow at the ICCT, noted.
Jewish Ambulances – Hatzola Trust, London N15. Source: Flickr.com
In general, Iran employs terrorist proxies (Hamas, Hezbollah, and others) to cause disruption and turmoil on its rivals’ land. In rare cases, Tehran employs criminal networks to achieve similar ends.
A prominent example of Iran using proxies to carry out attacks would be the bombing of the Jewish community center in Buenos Aires, Argentina, on 18 July 1994. 85 people were killed, and over 300 were wounded. In 2024, an Argentine court ruled that Iran directed the attack and that Hezbollah carried it out.
According to the information obtained by Euractiv, Belgian security agencies warn that the “axis of resistance” has succeeded in persuading more than 3,000 people in the country to convert to Shia Islam in recent years. With this network, Hezbollah can play a coordinating role within cultural institutions and affiliated mosques, extending the reach of Tehran’s proxy network well beyond the Middle East.
Investigators have also tracked the initial distribution of the attack footage to Hezbollah-affiliated Telegram channels, though they caution that this does not necessarily imply that the Lebanese organization was directly engaged in the planning of the operations.
HAYI is more likely a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network.
Acts carried out through proxies are “incredibly useful” for state sponsors of terror because they can be disruptive, but give the sponsoring regimes plausible deniability, enabling them to avoid escalation toward a conflict they may not be able to win, Neil Basu, a former head of U.K. Counterterrorism Policing, told CBS News.
The news outlet learned that posts on HAYI’s Telegram account have repeatedly cited Christian and Jewish philosophy to justify the group’s actions, but there have been no mentions of Islamic principles or teachings. The group’s claims have been published in English, Arabic and even Hebrew, but not in Persian, the primary language spoken in Iran.
The Islamic Movement of the Companions of the Right, has claimed an attack against a statement in the city of Rotterdam on Friday morning.
This is the third attack claimed by the group against Jewish institutions or sites in Europe this week.
—
There are reports of an arson… pic.twitter.com/EW8ut9RUoK— Joe Truzman (@JoeTruzman) March 13, 2026
Not Just Physical Attacks
These “low budget” propaganda clips circulating on social media platforms aimed “to generate psychological impact, media coverage, and an exaggerated sense of reach,” an analyst at Tech Against Terrorism, told CBS News.
Furthermore, inconsistencies in some of the claimed attacks warrant further attention. While geolocation analysis confirmed the authenticity of five attacks in Belgium, the Netherlands, and the UK, it suggests that the alleged attack in Greece is likely disinformation.
Greek authorities have announced they weren’t aware of any such incident, nor is there any corresponding coverage in the Greek press. Similarly, there is also no public evidence for the attack claims in Paris and Haarlem that were published by the same alleged HAYI channels.
Possible Cooperation with the Russians
The ICCT assessment indicates that the recent attacks linked to Ashab al-Yamin al-Islamiyya do not exhibit the signs of trained foreign operations. Instead, they mirror the employment of so-called “disposable agents,” a practice associated with disruption activities conducted by Russian intelligence agencies in Europe.
Also a common aspect of the recent and past hybrid incidents in Europe has been the involvement of intelligence agencies linked to Iran’s close partner, Russia, according to recent research by the The Royal United Services Institute for Defence and Security Studies (RUSI).
Evidence also shows that the implicated participants in the vandalism were young, male Ukrainian immigrants who acted under the temptation of quick money.
In the above-mentioned RUSI research paper, the data reveal that Russian security agencies increasingly rely on intermediaries, or “disposable agents”. Their intentions are simple: if such occurrences are seen merely as the actions of ordinary Ukrainians, this might feed anti-Ukrainian sentiment and weaken popular support for Kyiv — a deliberate aim of sabotage operations. This technique also undermines the administration of punishments commensurate to the strategic nature of the threat when compared with, for instance, acts of terrorism.
Another study of the ICCT states that Russian hybrid operations, for example, found that approximately a fifth of all identified perpetrators were under the age of 21.
As illustrated by a Tehran-orchestrated grenade attack against the Israeli embassy in Stockholm – in which the perpetrators were aged 16 and 18 – Iran uses the same recruitment tactics.
The strategic logic appears to be retaliatory but calibrated: demonstrating capability and intent in response to military pressure while avoiding escalation into overt conflict. Europe presents an attractive theater for such actions due to the availability of soft targets, the presence of Jewish and Israeli-linked institutions, and the potential to exploit existing societal tensions. The emergence of coordinated narratives and online amplification further reinforces the likelihood of an integrated approach combining kinetic and informational components.
The incidents should therefore be understood not merely as a sequence of attacks but as part of a broader pattern of hybrid activity that blends elements of terrorism, state influence, and psychological operations.
What Can the European Security Institutions Do to Address These Attacks?
The attacks can also be considered a signal from Tehran that it is both willing and capable of conducting operations in Europe, while maintaining a layer of plausible deniability that complicates a decisive European response.
The increasing threat presented by hostile state actors, most notably Russia and Iran, highlights the urgent need to modernize European intelligence models. The incidents, such as Russian-coordinated efforts to derail trains in Poland, as well as other foiled Iran-linked plots in Germany and the United Kingdom, reveal that these actors are both capable of, and willing to, cause mass casualties.
