Mystery of pop-up Iran-linked ‘terror group’ that claimed responsibility for Golders Green attacks

On Wednesday, a few hours after the horrific knife attack on two British Jewish men in Golders Green, north London, a video appeared on Telegram, apparently from the group called Harakat Ashab al-Yamin al-Islamiya, making an unsubstantiated claim of responsibility.

It follows a string of arson attacks around Europe that have been claimed by the group, whose name translates as the Islamic Movement of the Companions of the Right. But unlike some of the previous claims that appeared to show footage taken by the perpetrators, Wednesday’s video used footage that was already in the public domain.

Experts think that Harakat Ashab al-Yamin al-Islamiya (HAYI), or people using their branding, are opportunistically claiming the terror attack that saw two men, aged 76 and 34, stabbed.

The Metropolitan Police has said that the suspect in the Golders Green attack is a 45-year-old British national who came to the UK from Somalia as a child, and who has a history of serious violence and mental health issues.

In the video claiming responsibility for the attack, posted after 3pm on three Telegram news channels connected to Iran-linked militant groups, HAYI said that the victims were “targeted by our lone wolves in the Golders Green area of London”.

It went on to encourage followers to “kill Zionists” and then “salutes” Cole Thomas Allen, the suspected gunman who appeared to target US President Donald Trump at the White House correspondents’ dinner in Washington DC last weekend. The claim video then called for people to kill Mr Trump.

Roger Macmillan, former director of security at media company Iran International, explained: “They’re saying he’s one of our lone wolves, the imagery is nothing new, it’s all publicly available. It’s not somebody else filming it.

“Also, if you look, normally there’s been a warning beforehand, saying something spectacular is going to happen, coming soon. But what happened here was the attack took place at around 11:20, then about around an hour later, we saw commentary appearing on the usual channels saying ‘watch this space, this has got the hallmarks of the Right Hand’.

“And then a few hours after that the video was released, seeming to claim responsibility. This seems to be an opportunistic one, we’ll call it a lone wolf, we’ll link it to Cole Thomas in the US.”

The group first emerged around 9 March, when a post on the social media network Telegram, reportedly from HAYI, announced the beginning of “military operations” against US and Israeli interests.

A Telegram channel purporting to represent the group claimed responsibility for an arson attack on four Jewish ambulances in Golders Green, northwest London, in March. More recently, they have claimed an arson attack on a building connected to the Jewish Futures charity in north London.

The origins of the group remain unclear, although experts have said that their branding is similar to that of the Islamic Revolutionary Guard Corps (IRGC) and its broader network.

Before it was deleted, the HAYI Telegram channel had also posted videos of four other arson attacks around Europe – and shared information about an attack in the Czech Republic attributed to another group called the Earthquake Faction.

Some of the videos had been circulating in channels affiliated with Iraqi pro-Iranian militia beforehand, according to a digital analysis by researchers at the International Centre for Counter-Terrorism. One of the claimed attacks – against an unspecified site in Greece on 11 March – is likely to be disinformation, researchers believe.

While security sources recognise HAYI’s modus operandi, they do not recognise their name and cautioned against a rush to attribute the attacks.

In CCTV footage of the ambulance attack in March, three individuals can be seen setting light to an ambulance in the early hours of Monday morning. The ambulances were run by the Jewish charity Hatzola and were parked in the car park of the Machzike Hadath Synagogue.

In posts to Telegram, HAYI claimed responsibility for the ambulance attack in a video that contained text in Hebrew, English and Arabic. The text did not refer to the ambulances but instead said the target was the synagogue, which was described as “one of the main bastions of support for Israel in Britain”.

The group also shared a “final warning” to EU citizens to “immediately distance yourselves from all American and Zionist interests”. One video apparently claimed an attack outside an American bank near the World Trade Centre in Amsterdam earlier last month; another claimed to show fires being lit outside a Jewish school in Amsterdam.

Another unverified video claimed to show an explosion outside a synagogue in Rotterdam. Five young men, three aged 19, one 18 and one 17, have been arrested in relation to this explosion. Dutch authorities have said that it is too early to say whether the incidents are linked.

French newspaper Le Monde reported that one of the suspects in an apparent bomb attack outside a US bank, also claimed by HAYI, in Paris, said he had been recruited via Snapchat with a promise of €600.

Analysis by Julian Lanches, junior research fellow at the International Centre for Counter-Terrorism, found no known references to HAYI before 9 March, when a post of the group was circulated in a Telegram channel seemingly affiliated with an Iraqi pro-Iranian militia group.

Mr Lanches wrote: “The suspicious dissemination patterns raise the question whether HAYI is a genuine terrorist group or merely serves as a facade for Iranian hybrid operations that enable plausible deniability.”

He also highlighted inconsistencies, such as unsophisticated linguistic errors in the claim videos and the logo featuring a sniper rifle instead of the more typical AK-style imagery.

Mr Lanches suggested it pointed less to the “direct execution of attacks by Iranian intelligence operatives” and more towards “locally recruited actors”.

Dr Hans-Jakob Schindler, senior director of the Counter Extremism Project, emphasised that HAYI was unlikely to be a new terror group. Referring to their claims of attacks across Europe, Dr Schindler said: “Whether the perpetrators are connected, or whether it’s a framework the IRGC is giving them, is up for discussion.”

Speaking after the ambulance attack in March, he said: “It’s much more powerful to say that a new terrorist group exists, but given they have claimed five attacks in four countries, it is unlikely that a new group would be able to set up that network within weeks. Posts like these create the impression that there is massive terror against Europe. These actors will post everything they can to insinuate that Europe has become very, very unsafe.”

Jason Brodsky, policy director at the United Against Nuclear Iran, said: “Harakat Ashab al-Yamin al-Islamiyya’s branding on videos includes logos that are adopted from the Islamic Revolutionary Guard Corps and its broader terror network.

“The IRGC has different options to choose from in activating these groups: it can activate sleeper cells in the United Kingdom, or it can employ transnational criminal syndicates to target Israeli interests, Jewish organisations, and the Iranian diaspora.”