Listen to the article
By Andre Pienaar
A pattern has taken shape on the streets of north-west London that British counter-terrorism policing can no longer describe as opportunistic antisemitism. In the space of roughly five weeks, synagogues, Jewish charities, a Jewish emergency medical service, Iranian dissident media, and the perimeter of the Israeli Embassy have all been struck, reconnoitred or threatened. Every significant attack has been claimed by the same previously unheard-of group: Harakat Ashab al-Yamin al-Islamia, the “Islamic Movement of the Companions of the Right”, abbreviated as HAYI. British officials now openly treat it as a line of inquiry into Iranian state sponsorship.
HAYI did not exist before 09 March
HAYI first appeared on Telegram on 09 March, shortly after the opening US-Israeli kinetic phase against Iran and within weeks of Europol warning that Jewish and American-linked sites across Europe faced an elevated threat. It announced itself by claiming an IED that detonated outside a synagogue in Liège, France. In the fortnight that followed, it claimed further attacks in Rotterdam, Amsterdam, Antwerp, Paris and Athens, an inaugural footprint that would be remarkable for any genuinely new Islamist formation to achieve without leaving a single pre-history breadcrumb in the intelligence record.
European counter-terrorism researchers have since dissected HAYI’s digital tradecraft and found it conspicuously thin. Its Arabic logo misspells its own name. Its visual branding draws on a Soviet Dragunov sniper rifle rather than the AK-47 iconography standard to Iranian-aligned Shia proxies. Its Telegram administrator, when approached by CBS News, wrote in American-inflected English and then deleted the account once pressed on structure and funding.
The attribution to Iran as the state sponsor of HAYI is visible in HAYI’s digital footprint. The “proof-of-crime” videos are pushed first through a consistent cluster of Telegram channels tied to pro-Iranian Iraqi Shia militias, including Asaib Ahl al-Haq, whose ties to the IRGC Quds Force are a matter of public record, and only then amplified through the broader “Axis of Resistance” network. The Wall Street Journal has reported that counter-terrorist authorities suspect HAYI is, in effect, a fictitious group created by Iran to take credit for attacks orchestrated by the IRGC. The Foundation for Defense of Democracies reached a similar conclusion, arguing that Tehran is not operating a coherent organisation at all but rather recruiting disposable criminals and young men through social media and assigning their acts to a purely online brand created to take credit for expendable assets.
This is the Islamic Revolutionary Guard Corps’ preferred late-stage tradecraft: outsourced sabotage conducted by what Metropolitan Police Deputy Assistant Commissioner Vicki Evans has described as “recruiting violence as a service”. It is the same template used in the Iran-directed murder plots and arson operations that MI5 Director General Ken McCallum disclosed last October, when he confirmed that the Service and police had disrupted more than twenty potentially lethal Iran-backed operations in the United Kingdom over the preceding year.
The attacks in London
What follows is the public record of HAYI-claimed or HAYI-associated operations against targets in London to date. It is almost certainly incomplete. Several operations were disrupted before execution, and the Metropolitan Police has not detailed every line of inquiry.
July–August 2025 — Hostile surveillance, multiple sites
Over a five-week window, Iranian intelligence tasked two men resident in London, Nematollah Shahsavani, a 40-year-old dual British-Iranian national, and Alireza Farasati, a 22-year-old Iranian national, to conduct hostile reconnaissance of targets linked to the Jewish community. Devices later seized by police contained a target list that, according to the prosecution at Westminster Magistrates’ Court, included the Israeli Embassy in Kensington, the Israeli consulate, Bevis Marks Synagogue (the oldest in the United Kingdom), a Jewish community centre, and the Community Security Trust. Shahsavani had travelled to Iran in April 2025 and was stopped under Schedule 7 counter-terrorism powers on return. The two men were arrested on 06 March 2026 and charged in March 2026 under the National Security Act 2023.
23 March — Golders Green
In the early hours, four ambulances belonging to Hatzola, the volunteer-led Jewish emergency medical service, were destroyed by arson in a car park near a Golders Green synagogue. CCTV captured three hooded individuals pouring accelerant onto the vehicles before the onboard medical oxygen cylinders exploded. HAYI claimed the attack on Telegram, circulating a video that included a map of the vehicles’ parking location. Two British nationals, aged 45 and 47, were arrested on 24 March on suspicion of arson with intent to endanger life; both were later bailed. A further three suspects were taken into custody on 01 April.
15 April (early hours) — Finchley Reform Synagogue
A petrol-bomb-style device was used in an attempted arson against the synagogue. The attack failed to cause serious damage. Counter-terrorism policing opened an investigation. HAYI claimed responsibility.
15 April (approximately 8:30 pm) — Iran International, Park Royal
A burning object was thrown towards the offices of the Farsi-language satellite broadcaster Iran International, long a target of Iranian regime threats for its critical coverage of Tehran. The object landed in a car park without causing injury. HAYI claimed the attack, linking its London campaign explicitly to the regime’s parallel war against dissident media.
17 April (approximately 10:30 pm) — Hendon
A man was filmed placing a bag of incendiary bottles against the ground-floor shopfront of the former premises of Jewish Futures, an educational charity with cultural and educational links to Israel. The charity had vacated the site, but residential flats sat directly above. The bottles failed to fully ignite and the attacker fled. Again, HAYI claimed responsibility via Telegram.
17 April — Israeli Embassy, Kensington
HAYI posted online that it had attacked the Embassy with drones carrying “radioactive and dangerous carcinogenic materials”. The Metropolitan Police responded by cordoning off Kensington Palace Gardens. Officers recovered, among other items, two jars containing powder. Laboratory examination confirmed no hazardous or harmful substances were present and no actual drone strike had taken place. The incident nevertheless consumed significant police and emergency response resources, precisely the cost-imposition effect the operation was designed to produce.
Night of 18–19 April — Kenton United Synagogue, Harrow
A bottle containing accelerant was thrown through a window of the synagogue shortly after midnight. An officer on a dedicated deterrence patrol, established in response to the preceding week’s attacks, spotted smoke inside and window damage. HAYI released a video purporting to show the attack and stated it had targeted Kenton because it regarded the synagogue as a centre of “Zionist influence” in the capital.
NBC News has reported that HAYI has claimed responsibility for at least eight arson attacks on Jewish locations in London alone. The police investigation covers additional linked inquiries that have not been publicly detailed.
Why this is Iranian state terror, not a hate-crime wave
The temptation, institutional in London, Brussels and The Hague, is to classify the campaign as sub-threshold: no fatalities, unsophisticated devices, and recruited teenagers and petty criminals rather than uniformed operatives. That framing misreads the strategic purpose. The campaign’s effectiveness does not depend on casualties. It depends on three effects that are already being achieved.
First, psychological terrorisation of a specific ethno-religious community. Lenin said the purpose of terrorism is to terrorise. The Chief Rabbi, Ephraim Mirvis, has warned publicly that a sustained campaign of violence and intimidation against UK Jewry is gathering momentum. The Community Security Trust has instructed every Jewish institution in the country to tighten security protocols. Hatzola’s vehicles, medical assets that save the lives of non-Jews every week, have been deliberately destroyed to signal that no Jewish institution, however apolitical its mission, is off-limits.
Second, suppression of Iranian dissident voices on British soil. The 15 April strike on Iran International sits alongside the 2022–2024 pattern of Iran-directed threats against its journalists that forced parts of the broadcaster’s operation to relocate. Folding the Iran International attack into the same HAYI brand as the synagogue arsons is, analytically, an admission: it tells us the same hand is assigning the targets.
Third, imposition of cost on the British state. Every cordon around Kensington Palace Gardens, every CBRN contingency activation for a hoax drone threat, and every deterrence patrol deployed to north-west London is a resource taken away from something else. This is asymmetric hybrid warfare executed at a fraction of what it costs the target to defend against.
The attribution picture is also clearer than the hedged language around HAYI suggests. British counter-terrorism has already charged two men under the National Security Act 2023 for Iran-directed surveillance of exactly the target set, the Embassy, Bevis Marks, the CST and a Jewish community centre, that is now being attacked. The arson cell’s claimed sponsor, HAYI, disseminates its material through the same IRGC-adjacent Iraqi militia channels that the regime has used for Quds Force influence operations for the best part of a decade. The tradecraft, foreign tasking, local criminal proxies and plausible deniability through a brand-new “jihadist” front, is a signature of the IRGC’s external operations directorate, not an Islamist splinter emerging spontaneously in week three of a war.
What should happen now
British policy has treated Iran as a hostile state actor on UK soil for several years. MI5, in its annual threat assessment, has designated Iran as the highest-level national security threat to the UK because of more than twenty foiled terrorist plots in a single year. The Government has stopped short of the two steps that would meaningfully raise the cost to Tehran.
The first is proscription of the Islamic Revolutionary Guard Corps in its entirety under the Terrorism Act 2000. Successive Home Secretaries have demurred, citing Foreign Office concerns about residual diplomatic engagement. Those concerns have not aged well. The IRGC is the demonstrable sponsor of the infrastructure now attacking British subjects in their synagogues and the medical charities that serve them. The case for proscription, already strong, is now unarguable.
The second is a public attribution of the HAYI campaign. The evidentiary threshold has been met in substance. Holding back on formal attribution in the hope of preserving diplomatic optionality sends precisely the opposite signal to Tehran: that the United Kingdom will absorb operations on its soil, against a minority community, and still decline to name the state responsible.
A third measure deserves serious consideration: designation of the specific Iraqi Shia militia Telegram channels through which HAYI claims are propagated, together with the sanctioned pro-Russian aggregators that amplify them, under the UK’s counter-terrorism financing and online-safety regimes. The dissemination infrastructure is the operational infrastructure. Shutting it off forces the sponsor either to build a new one in public view or to abandon the campaign.
A fourth urgent measure is for British police to assign additional security measures to the Jewish community across the country. An attack on a member of the community is an attack on Britain.
Britain’s Jewish community has lived with elevated threat levels for years, since long before 7 October 2023, and with greater intensity since. The threat is now directed, financed and advertised online by the IRGC. The question for Whitehall is not whether an Iranian proxy campaign of terror is under way on British streets. The question is what can be done urgently to protect the British people from this clear and present danger.
Andre Pienaar is the Founder and CEO of C5 Capital, a specialist global investment firm focused on national security. He previously established the Directorate of Special Operations (DSO), also known as the Scorpions, an elite law-enforcement and counter-terrorist unit, for Nelson Mandela. Andre serves on the Security Council of the World Jewish Congress, the oldest charity protecting Jewish communities around the world, led by Ambassador Ron Lauder.