Arson attacks on Jewish targets may be linked to group recruiting teens on Snapchat

Young men and teenagers have allegedly been recruited on social media and paid to carry out a series of attacks on Jewish, Israeli and American sites across seven European countries.

Counter-terrorism detectives at Scotland Yard confirmed  that they were investigating a fifth attack in London since three Jewish ambulances were torched in March. The failed arson attack on a shopfront for Jewish Futures, an educational charity in Hendon, north-west London, occurred on Friday night.

The scattered attacks, largely involving improvised fire bombs, have targeted synagogues in Britain, Belgium, the Netherlands and North Macedonia, as well as a Jewish school and US-linked bank in Amsterdam, and an Israeli restaurant in Munich.

Each attack has been claimed in videos released on encrypted messaging platform Telegram by a previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Hayi).

The group is believed to be using social media including Snapchat to recruit young men to carry out the attacks, following a recent pattern of unconventional warfare tactics used by Russia and Iran. In almost every case where arrests have been made, the suspects have included youths under the age of 18.

Antonio Giustozzi, senior research fellow at the Royal United Services Institute for Defence and Security Studies (Rusi), said he had spoken to contacts in the Islamic Revolutionary Guard Corps (IRGC) who denied a link, claiming that the group was a proxy for Hezbollah in Lebanon.

“These are people in the Quds force [the IRGC’s unconventional warfare arm]. They say it’s linked to Hezbollah. There had been no ceasefire in Lebanon so Hezbollah were still at war.

“They set up this front to do these attacks and claim them. They recruit people online that are vulnerable. They could be gangs or criminals. Of course those groups are not capable of complex attacks,” he said, adding that social media presents a “weakness” that can easily be exploited to recruit young men, whether they are ideologically aligned or not.

The first attack claimed by Hayi, nine days after the US and Israel launched airstrikes on Iran in March, was an explosion at a synagogue in the Belgian city of Liège.

In the latest London attack, the Metropolitan police said a man approached a row of shops with a plastic bag later found to contain three bottles of fluid, which he set alight. “Minor damage was caused to the shopfront and no injuries were reported,” the Met said.

Earlier that day police officers in protective gear combed Kensington Gardens in London after the group said it had flown drones carrying radioactive and carcinogenic material towards the nearby Israeli embassy.

A video posted on Telegram described the attack as the “second phase of operations” and showed two people in white boiler suits with drones and jam jars containing an unidentified white substance.

The second part of the video appeared to show the drones being flown from Kensington Gardens towards the Israeli embassy, although the Met said the embassy itself had not been attacked. The incident was a departure from the group’s previous tactics, which have involved arson attacks and incendiary devices.

Dutch and French authorities say they have foiled two plots related to the group – a synagogue fire in Heemstede, 36 miles west of Amsterdam, and a planned arson attack on a Bank of America branch in Paris.

Counter-terrorism police have long warned of criminals being paid to act as “proxies” by hostile states, including Iran and Russia, and French media reported that one of the suspects for the foiled Bank of America attack claimed to have been recruited via Snapchat to carry out the operation for €600.

Hayi’s videos have been shared on Telegram by channels linked to Iranian proxies in the Middle East and pro-Iranian news aggregators, who have been celebrating the attacks.

A report published last month by the Hague-based International Centre for Counter-Terrorism found that the channels circulating Hayi’s material were affiliated with Iran’s “axis of resistance” – a network of groups ranging from Hezbollah to Yemen’s Houthis and pro-Iranian Shia militias in Iraq.

“We are clearly aware of that group and the incidents across Europe and the claims that have been made on various different channels,” Vicki Evans, Britain’s senior national coordinator for counter-terrorism policing, said at a press conference on Thursday.

“We are working on our understanding of what that means, both in terms of the group themselves, and more broadly, what that means in the international context.”

The report said that while the authority of some of Hayi’s claimed attacks was in doubt, the near-immediate reporting of some of them on Telegram suggested that the channels “were informed of the incidents almost in real time, either directly by the perpetrators or via intermediaries”.

“The suspicious dissemination patterns raise the question of whether Hayi is a genuine terrorist group or merely serves as a façade for Iranian hybrid operations that enable plausible deniability,” the report concluded.

The attacks claimed by Hayi show no sign of stopping. In a video claiming responsibility for an arson attack in Amsterdam last month, the group claimed it wanted European countries to distance themselves “from all American and Zionist interests”, adding: “This is a final warning to all the peoples of the world.”

Photograph by Alishia Abodunde/Getty Images