HAYI / Kataib Hezbollah-IRGC campaign: Iran-backed network directed arsons, stabbing and RAF Fairford plot across Europe
Severity: high · Patch status: no-fix-needed · Since 2026-11-11
US prosecutors unsealed a superseding indictment (2026-11-11) alleging an Iran-backed network — Kataib Hezbollah commander Mohammad al-Saadi (jailed in New York), IRGC operative Mohsen Mohajeri and Mohammed Ali al-Hassani (both at large, believed in Iran) — directed attacks across Europe via FaceTime, Telegram, WhatsApp and other apps. A front group, HAYI, claimed ~18 attacks between March and April 2026, including arsons on a London Jewish charity, Iran International and synagogues in London, Belgium and the Netherlands, a London stabbing injuring two Jewish men, attacks on U.S. bank buildings in Amsterdam and Paris, and a September plot against RAF Fairford using vans and intended explosives. Attacks were recorded for propaganda. Evidence came largely from al-Saadi's seized iPhone. No technical fix applies; this is state-sponsored physical terrorism.
What to do
- Review physical security and CCTV coverage at Jewish community sites, media offices and US-linked facilities in Europe
- Treat video-call and messaging coordination as an attack indicator; preserve and share relevant communications evidence with law enforcement
- Harden perimeter controls and vehicle screening at airbases and high-risk facilities
- Coordinate with national counterterrorism police on HAYI claim monitoring and threat intelligence
- Assess staff safety procedures for journalists and organisations targeted by the Iranian regime
Sources
All live incidents on Threat Watch
