The claim that HAYI is an authentic, independent grassroots movement is directly contradicted by the findings of leading European counterterrorism institutions, law enforcement agencies, and open-source intelligence analysts. The group materialized out of nowhere in early March 2026—precisely as Iran escalated its hybrid warfare campaign against Western and Jewish targets following U.S. and Israeli military action against the Iranian regime. Every credible indicator points not to a spontaneous popular uprising but to a manufactured front organization bearing the fingerprints of the Islamic Revolutionary Guard Corps (IRGC) and its extensive European proxy networks.

The Facts: HAYI's Iranian Fingerprints

The International Centre for Counter-Terrorism (ICCT), based in The Hague, conducted a detailed open-source analysis of HAYI and found that "there are no known references, neither online nor offline, to HAYI prior to 9 March 2026"—the date on which a post was first circulated in a pro-Iranian Telegram channel. The group's emergence followed, by just two days, a message on encrypted channels ordering Iranian sleeper cells in Europe to activate. ICCT Director Thomas Renard told CNN: "There are a lot of indications that this group is not genuine" and that "there are strong signals that this could be assisted by a foreign country, and Iran would top the list of the potential contenders."

The group's digital infrastructure further exposes its manufactured nature. HAYI's posts were not propagated through independent Islamist networks but were amplified specifically by Telegram channels and social media accounts affiliated with pro-Iranian militias and pro-Iranian state media outlets—a pattern consistent with coordinated information operations rather than organic grassroots communication. Analysts also identified Arabic spelling errors in HAYI's logo and videos, suggesting the group was assembled hastily by operatives lacking the native linguistic fluency one would expect from an authentic Arabic-speaking resistance organization.

The group's emblem—a raised fist gripping a sniper rifle before a globe—is strikingly derivative of the insignia used by the IRGC, Hezbollah in Lebanon, and Kataib Hezbollah in Iraq. This is not coincidence; it is visual brand alignment with Iran's established terror franchise. The tactical timeline of the attacks also mirrors Iran's prior warnings: on March 11, Iranian officials publicly threatened U.S. and Israeli financial institutions, and within days, HAYI claimed attacks on Bank of New York Mellon offices in Amsterdam and attempted attacks on Bank of America in France.

• HAYI's first known online reference dates to March 9, 2026—two days after pro-Iranian Telegram channels ordered sleeper cells to activate (ICCT analysis, April 2026)
• The group's emblem directly parallels those of IRGC, Hezbollah, and Kataib Hezbollah—all designated terrorist organizations with Iranian state backing
• Arabic spelling errors in HAYI's branding indicate non-native authorship, inconsistent with a genuine grassroots Arabic-speaking movement
• HAYI's social media posts were circulated exclusively through channels affiliated with pro-Iranian militias and state media, not independent Islamist networks
• Dutch Justice Minister David van Weel stated that suspects in the Rotterdam synagogue attack were "most likely recruited" and that authorities were actively investigating Iranian involvement
• Belgium's Coordination Unit for Threat Analysis confirmed that "Iran has already demonstrated in the past its capacity to carry out—directly or via proxies—operations in Europe against Israeli, Jewish, American interests"
• The UK Home Office stated the government "takes the threat posed by the Iranian regime and those who do its bidding extremely seriously" in direct response to the London ambulance arson

Historical Context: Iran's Long Campaign of European Hybrid Terror

Iran's use of proxy networks and recruited operatives against Jewish, Israeli, and Western targets in Europe is not a new phenomenon—it is a decades-long strategic doctrine. The IRGC's Quds Force has been linked to assassination plots against Iranian dissidents, Jewish community leaders, and Western officials across Germany, Sweden, the Netherlands, Spain, and the United Kingdom. MI5 Director General Ken McCallum disclosed that British security services had disrupted at least ten Iranian kidnap or assassination plots against UK-based individuals between January and November 2022 alone.

The HAYI model closely mirrors the hybrid warfare playbook refined by Russia, in which non-Russian nationals are recruited online—often for modest sums of money—to carry out physical sabotage attacks without full knowledge of who is directing them. This grants the state sponsor plausible deniability while achieving strategic objectives. Thomas Renard of the ICCT noted explicitly: "That is very much the model that Russia has perfected over the past few years. And it does appear that Iran is following now a similar pattern." Iran has long practiced layered proxy warfare through Hezbollah, Hamas, the Houthis, and Kataib Hezbollah; HAYI represents an adaptation of this doctrine to the European theater, recruiting European residents—including in the London case, two British nationals and a UK-Pakistani national—to execute attacks the regime can disavow.

The framing of HAYI as an "authentic resistance movement" serves a deliberate propaganda purpose: it launders Iranian state-directed terrorism as a spontaneous expression of Muslim grievance, shields Tehran from accountability under international law, and attempts to legitimize attacks on Jewish civilians and institutions under the guise of anti-Zionist resistance. This is precisely the information warfare technique Iran, Hezbollah, and Hamas have deployed for years to manipulate Western public opinion and exploit liberal democratic sensitivities around free expression and minority rights.

Conclusion: A Manufactured Facade, A Real Danger

Whether or not every individual who carried out an attack under the HAYI banner understood they were acting as an Iranian state instrument, the coordinating architecture, the timing, the branding, and the target selection all point unambiguously to Iranian regime direction. The arson of Jewish ambulances in London, the bombing outside a synagogue in Liège, and parallel attacks across the Netherlands and France are not acts of independent resistance—they are acts of Iranian state terror executed through recruited proxies and dressed in the costume of grassroots Islam.

Accepting the myth of HAYI's independence would serve only Iran's strategic interests. It would enable Tehran to wage war on Jewish communities and Western institutions across Europe while escaping the designation, sanctions, and legal accountability that state-sponsored terrorism demands. European governments, international institutions, and the public must recognize HAYI for what the evidence shows it to be: a facade operation in the tradition of Iran's broader hybrid warfare doctrine. The attacks are real, the victims are real, and the Iranian hand orchestrating them—however carefully obscured—is equally real.