Mystery of ‘terror group’ who claimed responsibility for Golders Green ambulance attack

On March 9, a post on the social media network Telegram, reportedly from a group called Harakat Ashab al-Yamin al-Islamiya (HAYI), announced the beginning of “military operations” against US and Israeli interests.

Then on Monday, a Telegram channel claiming to represent the group whose name translates as Islamic Movement of the Right Companions falsely claimed responsibility for an arson attack on four Jewish ambulances in Golders Green, north-west London.

On Tuesday, the channel with fewer than 200 subscribers was deleted. The group’s origins remain unclear, but experts say their brand is similar to the Islamic Revolutionary Guard Corps (IRGC) and its broader network.

Before disappearing late Monday night, the Telegram channel had posted videos of four other arson attacks across Europe and shared information about an attack in the Czech Republic attributed to another group called the Earthquake Group.

Some of the videos previously circulated on channels linked to pro-Iran militias in Iraq, according to digital analysis by researchers at the International Counterterrorism Center. Researchers believe one of the alleged attacks on an unspecified site in Greece on March 11 was likely disinformation.

While security sources recognize HAYI’s modus operandi, they do not recognize their names and warn against rushing to attribute them to the Golders Green attack. The Metropolitan Police said they were working to verify HAYI’s claim of responsibility. So far it has not been identified as a terrorist incident.

CCTV footage of the attack in London shows three men setting fire to an ambulance in the early hours of Monday morning. The ambulances were run by the Jewish charity Hatzola and were parked in the parking lot of the Machzike Hadath Synagogue.

In Telegram posts seen by IndependentHAYI claimed responsibility for the ambulance attack with a video containing texts in Hebrew, English and Arabic. The text made no mention of ambulances, instead stating that the target was the synagogue, described as “one of Israel’s main bastions of support in the UK”.

The group also shared a “final warning” to EU citizens to “immediately distance themselves from all American and Zionist interests.” A video apparently claimed the attack took place outside an American bank near the World Trade Center in Amsterdam earlier this month; another claimed to show fires burning outside a Jewish school in Amsterdam.

The mayor of the Dutch capital said the explosion outside the school on March 14 was “a deliberate attack on the Jewish community.”

Another unverified video allegedly showed an explosion outside a synagogue in Rotterdam. Five young people, three aged 19, one aged 18 and one aged 17, were arrested in connection with the explosion. Dutch officials said it was too early to say whether the incidents were related.

Russia, in particular, has pioneered the use of young fighters to launch attacks in Europe in exchange for financial reward. But the Iranian regime also uses proxies for its attacks abroad, the chairman of Britain’s Intelligence and Security Committee said on Tuesday.

Labour’s Kevan Jones said this made it harder for police to track down perpetrators because “you’re not just dealing with organized crime groups here, you’re also dealing with people who are just getting paid”.

“This is an approach the Russians use,” he said. “For example, in the attack on a warehouse in east London last year, many of the people who were not directly linked to any organized crime group were simply paid money.”

Earlier this year, two Swedish citizens, aged 16 and 18 at the time of their crimes, were jailed for throwing a grenade at the Israeli embassy in Denmark in October 2024.

The court ruled the pair were part of a criminal network in Sweden, with prosecutors saying the organized criminals acted as the “armed wing of a Middle Eastern terrorist organisation”.

The channel, which claimed to be HAYI, also shared the apparent actions of a group called Earthquake Group against the warehouse of an arms company in the Czech Republic. According to local media reports, Czech authorities have launched an investigation into the fire and are treating the incident as a terrorist attack.

Earthquake Group issues public statements about their open attacks on UK journalists and claims that they are “an internationalist underground network targeting key areas critical to the Zionist entity”.

Analysis by Julian Lanches, an assistant research fellow at the International Center for Counterterrorism (ICCT), found no known references to HAYI before March 9, when a post by the group appeared on a Telegram channel apparently linked to a pro-Iran militia group in Iraq.

“The suspicious proliferation patterns raise the question of whether HAYI is a bona fide terrorist group or merely serves as a front providing plausible deniability for Iran’s hybrid operations,” Mr. Lanches wrote.

He also highlighted inconsistencies in the claim videos, such as simple language errors and a logo featuring a sniper rifle instead of more typical AK-style imagery.

Mr. Lanches suggested that the attacks were less likely to be “directly carried out by Iranian intelligence officers” and more to “locally recruited actors.”

Roger Macmillan, former security director at media company Iran International, said: “There’s a lot of conjecture at the moment about the group. It’s an organization that really came to life after joint US-Israeli attacks on Iran. They appear to have claimed responsibility for attacks across Europe, including in Liege, Rotterdam and Amsterdam.”

“Other resistance axes that shared information in the first few days of their existence appeared to be (Iran-linked) Telegram channels. These attacks exist to instill fear. My gut feeling is that they are Iran-backed.”

Senior director of the Counter-Extremism Project, Dr. Hans-Jacob Schindler emphasized that HAYI is unlikely to be a new terrorist group. Referring to the allegations of attacks across Europe, Dr. Schindler said: “Whether the perpetrators are connected or whether this is a framework provided to them by the Revolutionary Guard is open to debate.

“It is much stronger to say that a new terrorist organization exists, but given that they have claimed five attacks in four countries, it is unlikely that a new group will establish this network within a few weeks. Posts like this create the impression that there is massive terrorism against Europe. These actors will do their best to imply that Europe has become very, very unsafe.”

Jason Brodsky, policy director at United Against Nuclear Iran, said: “Harakat Ashab al-Yamin al-Islamiyya’s branding in the videos includes logos adapted from the Islamic Revolutionary Guard Corps (IRGC) and its broader terrorist network.

“The IRGC has different options to choose from when mobilizing these groups: it could activate sleeper cells in the UK or use transnational criminal organizations to target Israeli interests, Jewish organizations and the Iranian diaspora.”