Emergence and context. The emergence of Hayi coincides with a sequence of demonstrative acts targeting sites linked to Jewish communities in Western Europe. The incidents, recorded between 9 and 23 March 2026, display a profile combining low technical sophistication with high symbolic and psychological impact.
- At present, available information does not allow for definitive attribution to Iran. However, the pattern of claims—ranging from the digital dissemination ecosystem to operational precedents—makes indirect involvement or sponsorship by pro-Iranian networks plausible.
Event pattern. Since 9 March 2026, a clustered series of incidents has targeted sites and assets linked to Jewish or Israeli entities in Belgium, the Netherlands and the United Kingdom.
- The first known case involved an improvised explosive device outside a synagogue in Liège. In the following days, reported or claimed incidents included an arson attack against a synagogue in Rotterdam, an explosion outside a Jewish school in Amsterdam, another episode near a property in the World Trade Center area of Amsterdam, and the burning of vehicles belonging to a Jewish volunteer ambulance service in London.
- While damage has remained limited, the incidents share key features: nighttime execution, short temporal spacing, and immediate propaganda amplification. These elements indicate an intent centred on intimidation, psychological pressure and symbolic visibility rather than casualty maximisation.
Group profile. According to open-source information, Hayi shows no public footprint prior to 9 March 2026. The label appears abruptly alongside the first claims, suggesting either an ad hoc structure or a cover name designed to ensure plausible deniability.
- An additional element concerns the possible link between the name “Ashab al-Yamin” and circles connected to Harakat Ansar Allah al-Awfiya, as reconstructed in Israeli analytical reporting.
Dissemination and affiliation. The most analytically relevant aspect concerns the propagation chain of the claims. Hayi videos were initially distributed through a limited cluster of Arabic-language Telegram channels linked to pro-Iranian Iraqi Shia militias and aligned media outlets.
- These include environments close to Asaib Ahl al-Haq and Hezbollah, as well as actors within the broader “axis of resistance” media ecosystem.
- In several cases, the time gap between the physical attack and the first online dissemination was only a matter of minutes, consistent with near real-time information flows to amplification channels. This suggests a direct or mediated link between perpetrators and the propaganda network.
Attribution limits. Available sources also highlight contradictory elements. Analyses point to linguistic errors in Arabic materials, inconsistencies in logos and branding, and likely false claims relating to incidents in Greece and France.
- These anomalies do not invalidate the broader pattern but indicate that Hayi may function less as a structured organisation and more as an operational and communicative vector for hybrid activity. Errors, graphic inconsistencies and dubious claims may deliberately contribute to confusion and complicate linear attribution.
Operational model. From an operational standpoint, the attacks observed so far are simple, low-cost and replicable.
- Arson, small IEDs, sabotage and vandalism against highly recognisable targets generate effects disproportionate to the material damage inflicted, while remaining below escalation thresholds and preserving plausible deniability.
- The result is a combination of symbolic action, psychological deterrence and strategic messaging.
Use of local actors. A key element concerns the profile of perpetrators. In the Rotterdam synagogue case, Dutch authorities detained individuals aged 17 to 19 from Tilburg. This aligns with an increasingly recurrent model in Europe: reliance on local actors—young, low-skilled, easily replaceable—recruited at low cost, alongside lone actors radicalised online or individuals mobilised through intermediaries.
- This trend fits within a broader framework characterised by the virtualisation of radicalisation and recruitment, the rise of lone-actor attacks, the growing role of mental health vulnerabilities, and ideological hybridisation.
- Dynamics already observed in sabotage networks attributed to Russia, and particularly relevant in contexts such as Belgium and the Netherlands, where—according to Europol—criminal networks, trafficking and the use of improvised explosive devices are already well established.
The model. From a threat perspective, even in the absence of formal attribution, the model claimed by Hayi and potentially linked to Iranian networks is already visible. It consists of a sequence of demonstrative or intimidatory acts, low in complexity, targeting Jewish sites, with a strong propaganda component and clear strategic utility in generating fear, polarisation and pressure on affected communities.
- Sources converge in assessing that the immediate risk is an increase in demonstrative actions—vandalism, arson and sabotage.
- The observed events point to an evolution of the threat in Europe consistent with hybrid operations: ambiguous attribution, execution by local actors, support from transnational propaganda ecosystems, and concentration on targets with high identity value.
