By Bojan Pancevski in Berlin and Max Colchester in London
Authorities are investigating Iran's suspected involvement in a string of terrorist attacks in Europe that have targeted Jewish sites in response to the war in the Middle East, security officials say.
They suspect Iranian agents recruited individuals online to carry out the assaults, and set up a bogus terror group to claim responsibility for attacks on Jewish schools, synagogues and companies linked to Israel.
A group called the Islamic Movement of the Righteous Companions has claimed to be behind most of the attacks on social media. European intelligence officials say the group wasn't on their radar before this month. Using a fictitious group gives Iran plausible deniability while amplifying confusion, said Julian Lanchès of the International Centre for Counter-Terrorism. "It's an effective model," he said. "We can likely expect more attacks."
Videos of these incidents were posted and amplified on pro-Iranian regime social-media channels and in at least one case an attack was announced in advance, according to investigators and counterterrorism experts. In a March 16 message, the group urged people in the European Union to distance themselves "immediately from all American and Zionist interests and everything connected to them."
Iran's security services have long recruited organized-crime figures and petty criminals to carry out attacks. Now officials suspect they are leveraging this network and branding the latest wave of attacks under a new banner, Harakat al-Ashab al-Yamin al-Islamia, to sow chaos in the Jewish community.
While officials haven't formally attributed the attacks to Iran, multiple governments suspect its involvement. The Islamic Revolutionary Guard Corps, the most powerful power broker in Iran, issued a statement after the U.S. and Israel killed Iran's Supreme Leader Ali Khamenei, saying that their adversaries "will no longer be safe anywhere in the world, not even in their own homes."
The apparent model mirrors tactics used by Russia, which has orchestrated sabotage attacks across Europe since invading Ukraine, often using unwitting recruits hired via social media.
Since the U.S. and Israel launched their campaign against Iran on Feb. 28, nearly a dozen attacks on Jewish sites have been carried out or attempted across Western Europe. Although no one has been killed, officials fear that it is only a matter of time.
On March 23, the group claimed responsibility for torching a car in the Jewish district of the Belgian city of Antwerp and ambulances belonging to a Jewish emergency service in London. Earlier this month, two synagogues and a Jewish school in Belgium and the Netherlands were firebombed, prompting Belgian authorities to deploy the army to protect Jewish sites.
Dutch authorities said on March 22 they had foiled an attack on a synagogue in Heemstede, where multiple explosive devices were discovered.
Belgian investigators are examining whether the incidents on their soil were directed by Iran and whether dormant cells were activated, federal prosecutor Ann Fransen said last week.
Meanwhile, British police arrested two men in connection with the destruction of the four ambulances. Officials haven't yet determined who conducted the attack but are investigating Iran's possible involvement.
The group first appeared in Telegram chats on March 9, when an explosion occurred near a synagogue in Liège, Belgium. Four days later, Molotov cocktails were thrown at a synagogue in Rotterdam and a Jewish school in Amsterdam. Four young men were arrested on suspicion of acting on behalf of Iran, Dutch authorities said.
Investigators believe Iranian operatives recruit proxies online and direct them to carry out attacks such as firebombings of Jewish sites and then claim them under the HAYI banner. Its logo resembles those used by the IRGC and Hezbollah. Two European security officials said it appeared hastily assembled with the help of AI -- an apparent attempt to present disparate actions as the work of a single organization.
Lanchès said the incidents were quickly amplified online by pro-Iranian networks. Indicators that the group may not be genuine include misspellings of the Arabic word for "Islamic" in its videos. The group also claimed responsibility for attacks that never happened, further muddying the water.
Some Israeli diplomats as well as employees of Jewish organizations in Europe have been working from home as part of a heightened security regime following the attacks. On March 25, Israel's government issued a terror warning to all citizens traveling abroad, listing the attacks in Europe and saying that Iran will "intensify its efforts to carry out attacks abroad against Israeli and Jewish targets."
Israel has been providing intelligence to its European partners to help prevent Iran-backed terrorist attacks since the start of the war, according to Israeli and European officials.
In recent years, the Quds Force -- the external arm of Iran's IRGC -- has recruited proxies among organized-crime groups and Shia Muslim communities in Europe, including motorcycle gangs and migrants from Afghanistan and Syria, officials said.
Over the past year, Iran has pre-positioned arms and ammunition for proxy cells in countries including Germany and Austria, as well as along migrant routes in the Balkans, several European and U.S. officials said. In recent raids, authorities arrested several Hamas and Hezbollah members, and in one case, operatives were found with an automatic rifle, eight pistols and more than 600 rounds of ammunition.
Some of these cells may have been activated following last month's strikes, two officials said.
Individuals linked to Iran -- including members of Palestinian and Lebanese militias, as well as European-born criminals and refugees from the Middle East -- have been arrested carrying addresses and photographs of Israeli targets and European Jews working with Israeli clients.
Iran-linked plots have also been foiled beyond Europe, pointing to a broader campaign. On March 6, authorities in Azerbaijan said they had disrupted an IRGC-linked conspiracy targeting a pipeline supplying oil to Israel, the Israeli Embassy, a Jewish community leader and a synagogue.
Days later, Qatar and the United Arab Emirates announced the arrest of Iranian-backed operatives plotting attacks.
Taken together, the incidents suggest a widening, multi-theater effort by Iranian-linked networks to target Israeli, Jewish and Western interests, according to U.S. and European officials.
Iranian-linked networks have long used Germany for fundraising, including collections from Shia-owned businesses, officials from the police and domestic intelligence agency BfV said.
On Wednesday, a Berlin court sentenced four Hamas members to prison for setting up the logistics, including arms depots, for attacks on Jews in Germany and neighboring countries.
Germany's strategic importance is underscored by its hosting of major U.S. installations, including Ramstein Air Base, a central node in operations against Iran.
Iran's ambassador to Berlin warned German officials that if Ramstein were used for attacks on Iran, it could be considered a legitimate target, according to two people familiar with the exchange. Iranian diplomats said the remark wasn't intended as a threat but as clarification of Iran's assessment.
Britain's MI5 intelligence service said it had tracked around 20 potentially lethal Iran-backed plots last year, most targeting Iranian dissidents, journalists and Jewish sites.
This month, two Iranian men were charged with conducting surveillance on behalf of Iranian intelligence services last year. Their alleged targets included Britain's oldest synagogue, as well as the Israeli Embassy and consulate in London.
Write to Bojan Pancevski at bojan.pancevski@wsj.com and Max Colchester at Max.Colchester@wsj.com
(END) Dow Jones Newswires
March 25, 2026 08:58 ET (12:58 GMT)
Copyright (c) 2026 Dow Jones & Company, Inc.
Comments