Mystery of pop-up Iran-linked ‘terror group’ that claimed responsibility for Golders Green attacks

On Wednesday, a few hours after the horrific stabbing attack on two British Jewish men in Golders Green, north London, a video appeared on Telegram making a false claim of responsibility, apparently from the group called Harakat Ashab al-Yamin al-Islamiya.

This follows a series of arson attacks undertaken across Europe by the group, whose name translates as the Islamic Movement of the Right Companions. But contrary to some previous claims that appeared to show footage taken by the perpetrators, Wednesday’s video used footage that was already publicly available.

Experts believe that Harakat Ashab al-Yamin al-Islamiya (HAYI), or people using its brand, opportunistically claimed responsibility for the terrorist attack in which two men, aged 76 and 34, were stabbed.

The suspect in the Golders Green attack is a 45-year-old British national who came to the UK from Somalia as a child and has a history of serious violence and mental health problems, the Metropolitan Police said.

In a video claiming responsibility for the attack, posted after 3pm on three Telegram news channels linked to Iran-linked militant groups, HAYI said the victims were “targeted by our lone wolves in the Golders Green area of ​​London”.

He went on to encourage his followers to “kill Zionists” and then “saluted” Cole Thomas Allen, the suspected gunman who targeted US President Donald Trump, at a dinner attended by White House correspondents in Washington, D.C. last week. The impeachment video then called for people to kill Mr. Trump.

Roger Macmillan, former security director at media company Iran International, explained: “They say he’s one of our lone wolves, the footage is nothing new, it’s all in the public domain. It’s not someone else who filmed this.”

“Also, if you look, normally there was a warning beforehand saying something amazing was going to happen soon. But what happened here was that the attack happened around 11:20, then about an hour later we saw comments popping up on the usual channels saying ‘watch this area, it bears the markings of the Right Hand.’

“And a few hours after that, the video was released, appearing to claim responsibility. This seems like an opportunistic thing, we’re going to call him the lone wolf, we’re going to link him to Cole Thomas in the US.”

The group first emerged around March 9, with a post on HAYI’s social media network Telegram, in which it announced the start of “military operations” against US and Israeli interests.

A Telegram channel purporting to represent the group claimed responsibility for an arson attack on four Jewish ambulances in Golders Green, north-west London, in March. More recently, they alleged an arson attack on a building affiliated with the Jewish Futures charity in north London.

The group’s origins remain unclear, but experts say their brand is similar to the Islamic Revolutionary Guard Corps (IRGC) and its broader network.

Before being deleted, the HAYI Telegram channel also posted videos of four other arson attacks across Europe and shared information about an attack in the Czech Republic attributed to another group called the Earthquake Group.

Some of the videos previously circulated on channels linked to pro-Iran militias in Iraq, according to digital analysis by researchers at the International Counterterrorism Center. Researchers believe one of the alleged attacks on an unspecified site in Greece on March 11 was likely disinformation.

Security sources stated that while they recognized HAYI’s modus operandi, they did not recognize their names, and warned against the rush to refer to the attacks.

CCTV footage of the ambulance attack in March shows three men setting the ambulance on fire in the early hours of Monday morning. The ambulances were run by the Jewish charity Hatzola and were parked in the parking lot of the Machzike Hadath Synagogue.

In his Telegram posts, HAYI claimed responsibility for the ambulance attack with a video containing Hebrew, English and Arabic text. The text made no mention of ambulances, instead stating that the target was the synagogue, described as “one of Israel’s main bastions of support in the UK”.

The group also shared a “final warning” to EU citizens to “immediately distance themselves from all American and Zionist interests.” One video apparently claimed the attack took place outside an American bank near the World Trade Center in Amsterdam early last month; another claimed to show fires burning outside a Jewish school in Amsterdam.

Another unverified video allegedly showed an explosion outside a synagogue in Rotterdam. Five young people, three aged 19, one aged 18 and one aged 17, were arrested in connection with the explosion. Dutch officials said it was too early to say whether the incidents were related.

french newspaper Le Monde It was also reported that one of the suspects in the bomb attack carried out by HAYI in front of a US bank in Paris said that he was recruited via Snapchat with the promise of 600 euros.

Analysis by Julian Lanches, an assistant research fellow at the International Counterterrorism Center, found no known references to HAYI before March 9, when a post by the group appeared on a Telegram channel apparently linked to a pro-Iran militia group in Iraq.

“The suspicious proliferation patterns raise the question of whether HAYI is a bona fide terrorist group or merely serves as a front providing plausible deniability for Iran’s hybrid operations,” Mr. Lanches wrote.

He also highlighted inconsistencies in the claim videos, such as simple language errors and a logo featuring a sniper rifle instead of more typical AK-style imagery.

Mr. Lanches suggested that the attacks were less likely to be “directly carried out by Iranian intelligence officers” and more to “locally recruited actors.”

Countering Extremism Project senior director Dr. Hans-Jakob Schindler emphasized that HAYI is unlikely to be a new terrorist group. Addressing allegations of attacks across Europe, Dr Schindler said: “Whether the perpetrators are connected or whether this is a framework the IRGC has presented to them is open to debate.”

Speaking after the ambulance attack in March, he said: “It’s much more powerful to say that a new terrorist group exists, but given they have claimed five attacks in four countries, it is unlikely that a new group would be able to set up that network within weeks. Posts like these create the impression that there is massive terror against Europe. These actors will post everything they can to insinuate that Europe has become very, very unsafe.”

Jason Brodsky, policy director at United Against Nuclear Iran, said: “Harakat Ashab al-Yamin al-Islamiyya’s branding in the videos includes logos adapted from the Islamic Revolutionary Guard Corps and its broader terrorist network.

“The IRGC has different options to choose from when mobilizing these groups: it could activate sleeper cells in the UK or use transnational criminal organizations to target Israeli interests, Jewish organizations and the Iranian diaspora.”