In early March 2026, a previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) emerged online, quickly claiming responsibility for a series of attacks targeting Jewish institutions across Europe.
Within weeks, the group attributed itself to incidents in Belgium, the Netherlands, and the United Kingdom—including improvised explosive devices and coordinated arson attacks. Notably, these operations have been relatively low-tech but highly visible, designed to generate fear and media attention rather than mass casualties.
What makes HAYI particularly noteworthy is not just the attacks themselves, but the way the group appeared.
Unlike traditional militant organizations, HAYI has:
- No known operational history prior to March 2026
- A newly created digital presence, primarily on Telegram
- Messaging that is inconsistent in language, structure, and ideological depth
These characteristics have led analysts to question whether HAYI is a conventional organization at all.
Instead, early assessments suggest it may represent a new model of hybrid threat activity—one that blends elements of:
- Decentralized recruitment
- Online coordination
- Rapid brand creation for claims of responsibility
In this model, individuals or small cells may carry out attacks independently, while a centralized narrative framework claims and amplifies those actions to create the perception of a coordinated campaign.
Where this gets more interesting: attribution and intent
There is growing, though not yet definitive, indication that HAYI may not be an organic group at all.
Multiple analysts and officials have suggested that it could function as a proxy construct linked to Iran, designed to provide plausible deniability while enabling retaliatory actions abroad.
Recent reporting and intelligence signals show:
- Claims of responsibility circulating through pro-Iranian Telegram ecosystems
- Authorities investigating possible Iranian state links to specific attacks
- Officials warning that Iranian networks may be expanding operations into European civilian environments
At the same time, law enforcement remains appropriately cautious—public attribution has not been formally confirmed.
That said, the pattern is familiar.
A recognizable playbook
If HAYI is in fact a proxy or “ghost brand,” it would not be new—it would be an evolution.
Iran has long relied on layered proxy structures across the Middle East, including groups like Harakat Ansar Allah al-Awfiya and Ashab al-Kahf, which operate with varying degrees of separation from the state while advancing aligned objectives.
What appears different here is the speed and structure:
- Rapid creation of a brand with no legacy footprint
- Immediate use of digital platforms for amplification
- Potential reliance on loosely coordinated or remotely influenced actors
This starts to resemble tactics more commonly associated with Russian and Chinese hybrid operations, where:
- Narrative warfare and psychological impact are prioritized
- Attribution is deliberately obscured
- Real-world actions are blended with information operations
In other words, this is not just proxy warfare—it is proxy warfare fused with digital influence architecture.
Why this matters
If this model holds, it represents a meaningful shift:
The barrier to entry for coordinated geopolitical disruption is falling.
Groups no longer need years to build infrastructure, ideology, and hierarchy.
They can be stood up in days, activated in weeks, and amplified instantly.
More importantly, attribution becomes significantly harder.
Is this a terrorist group?
A state-directed operation?
A network of loosely coordinated actors?
Increasingly, the answer may be: all of the above.
Bottom line
Whether HAYI proves to be a durable entity or a temporary construct, its emergence highlights a broader evolution in how asymmetric threats are deployed.
Not everything that looks like a “group” is a group.
And in this environment, the most effective actors may not be the most powerful—but the most ambiguous.
