Since the beginning of the war in Iran, a pro-Iranian group, HAYI, has claimed bomb attacks in France and Europe. According to our information, intelligence services consider it to be a front for Tehran, acting partly autonomously despite the elimination of Iranian military leaders.
Night operations, homemade explosives, mobile phones… Will the judicial investigation into the thwarted bombing of the Bank of America on March 28 in Paris (8th arrondissement) ever reveal an Iranian connection? At this stage, no direct link has been proven with the Iranian regime. But according to our information, intelligence services strongly suspect Iran of being the mastermind.
From April 1, the national anti-terrorism prosecutor (PNAT) linked this attempted attack to a pro-Iranian group, Harakat Ashab Al-Yamin Al-Islamiya (HAYI). This group had released an amateur video on March 21 on a Telegram channel, directly threatening the bank. French counter-terrorism today sees HAYI as a front for Tehran operating from Europe.
Several attacks claimed in Europe
Suddenly appearing in March 2026, HAYI quickly showed aggressive and cross-border activism. On Telegram, they claim attacks with explosives against various Jewish, Israeli, or American targets in France, the Netherlands, and Belgium. On March 9, a bomb exploded outside a synagogue in Liège. On the 12th, it was a synagogue in Rotterdam, and on the 14th, a Jewish school in Amsterdam. Germany and North Macedonia were also targeted in April.
Some of these events were recorded. HAYI’s threatening videos, with locations shown on Google Maps using a blinking red target, contain distressing messages: “Leave before it’s too late. This is the final warning, leave the bank immediately,” for example, a message from March 21 targeting the Bank of America. Some videos show the explosions.
Caption: At the 19th second, a red target appears in the image with the bank in the background and this message in English: “L’emplacement ciblé”. © BFMTV.
The messages from HAYI bear logos similar to those of Hezbollah, Iraqi Shiite militias, and the Iranian Revolutionary Guards. By the end of March, French services had identified 10 likely attacks committed by this pro-Iranian group in Europe. There are now around fifteen. The latest claimed by HAYI: an attempted arson attack on the premises of the channel “Iran International” in London on April 15.
“Asymmetric response” from Tehran
This sudden increase in terrorist acts in Europe appears to be Tehran’s “asymmetric response” to the war, according to security sources contacted by BFMTV. The Iranian military command has been decimated by bombings, including that of the Iranian Ministry of Intelligence, responsible for violent missions abroad.
A green light has probably been given to their sleeper agents in Europe to carry out retaliatory actions without direct activation by Tehran, these sources analyze: “They have likely opened the floodgates to any type of action.”
“We also fear that individuals on our soil may radicalize, whether they are Shiite or Iraqi,” warns another source. The Ministry of the Interior considers an increasing Iranian threat as a given. This is partly due to the fact that France hosts former fighters of Iraqi Shiite militias on its soil. Fifteen people are particularly monitored for their alleged allegiance to Iranian networks or Lebanese Hezbollah.
Recruitment in the realm of petty crime
Iran operates clandestinely. Usually, the regime uses a network of intermediaries for its violent activities abroad to maintain “plausible deniability.” The Al-Quds Force – the elite unit of the Islamic Revolutionary Guard Corps – typically recruits individuals from petty crime backgrounds. Indeed, the four suspects apprehended in Paris in late March – three minors and one adult – indicted and imprisoned for “terrorist criminal association,” seem detached from Iranian intrigues.
According to judicial sources consulted by BFMTV, the three minors, with no criminal records, explained that on March 26 they were recruited by a “rebeu” they call “the Grand.”
The eldest of the group, Walik D., 21, known for drug trafficking, told the teenagers that he had received money from a third party to place a bomb at the foot of an ex-girlfriend’s apartment building. He promised to share part of the sum with them.
In the night of March 27 to 28, two of his recruits placed the powerful explosive device comprising a potent explosive and a gas canister in front of 51 rue la Boëtie, the headquarters of the Bank of America. The device “could have generated at the time of the explosion a large fireball several meters in diameter and spread a fire,” according to the national anti-terrorism prosecutor.
Norway, Netherlands…
The involvement of a foreign power has been more directly suspected in other attacks in Europe. On March 8, the U.S. Embassy in Oslo, Norway, was hit by a bomb. Three brothers of Iraqi-Norwegian origin, all Shiites, were arrested three days later. The youngest of the siblings confessed to placing the explosive device.
But the HAYI cell does not only handle explosives. Intelligence suspects their involvement in a shooting in the Netherlands as well. On March 19, just before 7 a.m., M.Z.S., a 36-year-old Iranian-born police officer, was targeted by gunfire in Schoonhoven (South Holland). “He was seriously injured,” reported the Dutch police, who are investigating a terrorist motive. The killers likely laid a trap for him.
This assassination attempt brought back memories of another, committed two and a half years earlier. On November 9, 2023, in Spain, Alego Vidal-Quadras, former Vice President of the European Parliament, was shot near his home in Madrid. The hitmen, from the underworld, are suspected to have been recruited by an Iranian cell based in the Netherlands, according to our information.
A month earlier, European intelligence services had detected the arrival of a commando from the Al-Quds Forces in Europe. Around the same time, a member of the DZ Mafia in Marseille was recruited to carry out arson attacks against Israeli-related companies in France.
