Editor’s note, May 15, 2026: Since publication, a US criminal complaint has provided significant new evidence confirming the link between Ashab al-Yamin and Kata’ib Hezbollah; this piece has been updated to reflect it. ISD’s analysis had previously noted that Ashab al-Yamin’s online footprint suggested ties to Iranian-backed proxy networks in Iraq — the complaint provides further evidence of that connection, and specifically links the group to Kata’ib Hezbollah.

In an escalation of their attack claims, an emergent group claimed responsibility for the 29 April stabbing of two Jewish men in London, which authorities have declared a terrorist incident. The new group declared itself in March 2026 to claim a series of attacks in Europe and the UK. It seems likely that the group is a cover for Iran or one of its proxies: they have primarily targeted the Jewish community, but also Iranian dissident journalists. Until 29 April, most claims appeared to follow a ‘violence-as-a-service’ model of low-risk, high visibility attacks by financially motivated individuals recruited online. This Dispatch contextualises the campaign between hostile state hybrid warfare and Islamist extremism. 

Key findings    

• Under the banner of a previously unknown “Islamic Resistance” group dubbed Harakat Ashab al-Yamin al-Islamiya (The Islamic Movement of the Companions of the Right), a decentralised network of perpetrators has claimed at least 17 attacks over the past seven weeks targeting Jewish communities, Israeli diplomatic missions, financial institutions and Iranian dissident journalists across Europe. Ashab al-Yamin appeared on 9 March, almost 10 days into the conflict between Iran, Israel and the United States. Prior to this date the group had not been mentioned by other proxy groups or networks and did not have an online presence.  

• Ashab al-Yamin has escalated its attacks to violence against individuals. Prior to 29 April, none of the claimed attacks from the group resulted in any injuries or deaths. The 29 April stabbing of two Jewish men in London represents the first claim by the group that has resulted in injuries and represents a significant escalation in targeting people as opposed to buildings. The group claimed to have conducted the attack in response to an Israeli law passed in March that permitted the execution of Palestinian prisoners. The group also threatened US President Donald Trump while praising the White House Correspondents Dinner attacker. Unlike some of the previous claims by the group, the footage used in the video claim did not include footage from the vantage point of the attacker, or a statement, and was primarily reliant on CCTV footage and bystander video filmed during the incident.   

• The lack of any defined leadership and membership (besides opposition to a ‘Zionist-US alliance’) suggests that Ashab al-Yamin is a ‘ghost proxy’. Such front entities constitute a ‘group’ in name only and closely resemble strategies utilised in the past by Iranian proxy militias in Iraq, whose logo and symbolism the group appears to echo.  

• The promotion of attacks claimed by Ashab al-Yamin, as well as its pre-attack propaganda, has largely emerged from Iran’s Axis of Resistance digital ecosystem. Channels linked to Iran’s proxy militias in Iraq have been the primary vector for the sharing of videos, statements and other material produced by the group. While Ashab al-Yamin previously operated Telegram channels in its own name, these have been removed by the platform; threats of attacks, communiqués and post-attack videos now appear mainly within Iraqi Axis of Resistance propaganda channels on Telegram. 

• The operational footprint of Ashab al-Yamin appears to follow a pattern of Iran’s previous attacks and plots in Western contexts. Ashab al-Yamin-linked attacks appear to be rooted in engaging financially motivated individuals, disproportionately young people and criminals–including leveraging encrypted messaging applications–with recruitment often taking place through a local intermediary, such as a local criminal network. This pattern was previously seen in Iran-linked attacks targeting Sweden, the United Kingdom, the United States and Canada. 

• This ‘violence-as-a-service’ model bears a striking resemblance to recent Russian hybrid operations conducted in Europe. Authorities in the UK, and elsewhere in Europe, have indicated that some of the young people arrested in connection with the Ashab al-Yamin sabotage attacks were paid to conduct them and instructed via encrypted messaging platforms. These same tactics have been noted in Russian hybrid attacks, for example in the March 2024 arson attack on a London warehouse that was storing humanitarian aid supplies bound for Ukraine. These attacks are often coupled with information operations intended to put pressure on European countries, create fear among vulnerable communities, and undermine trust in democratic institutions 

• These trends speak to increasing hybridisation between state threats, violent extremism and criminal networks. The increasing representation of minors in arrests related to organised crime, violent extremism and hostile state hybrid warfare can be partly explained by shared vulnerability factors, as well as the adjacency of harmful online spaces which enable this range of threat actors to target and exploit them. Authorities currently treat these as separate issues requiring distinct policy responses, however, while the ultimate goals of the instigators may be different, the core recruitment mechanisms and attack logic have considerable overlap.  

Hostile state hybrid warfare or Islamist extremism?

The recent wave of attacks across Europe claimed by the elusive grouping Ashab al-Yamin al-Islamiya (The Islamic Movement of the Companions of the Right) has raised significant questions about how this activity should be understood, disrupted and prevented by authorities. Blurring the lines between state-backed hybrid warfare and Islamist extremism, the group warned that their campaign would target US and Israeli interests until they had “avenged every child in Gaza, Iran, Lebanon and the resistance nations”.  

To date, 14 of Ashab al-Yamin’s 17 claimed attacks have targeted the Jewish community, including visibly Jewish individuals, synagogues, a school and a charity ambulance service. Many of these attacks were amateurish or abortive attempts; some of the perpetrators claimed they did not know they were working on behalf of a state or targeting Jewish individuals. There was no indication of the Ashab al-Yamin ‘group’ existing in any meaningful way prior to the wave of attacks since March, suggesting it was created for the purpose of claiming them.

Official investigations so far suggest that the perpetrators were financially motivated, with UK counter-terrorism officials pointing to a common motivation of what “looks like quick and easy money”. Many of those arrested were young: three suspects in the foiled Paris attack are minors, with the main suspect claiming he was offered 600 euros by an unknown person on Snapchat.  

Ashab al-Yamin’s bombings and arsons primarily occurred late into the night when perpetrators could expect target locations to be unoccupied, differing from most attacks by Islamist extremist groups. A 20 April threat to US President Donald Trump and his family published by the group–which claimed without evidence that Ashab al-Yamin had nearly assassinated the President’s daughter Ivanka Trump–also included crass insults atypical of Islamist extremist groups. For example, they called the US president a “lover of fried chicken”. 

The age of the perpetrators also aligns with terrorist trends globally: the proportion of young people in terrorism arrests has increased dramatically in recent years. In the UK, minors aged 17 and under constituted nearly a fifth of terrorism-offence arrests in 2023–four times the proportion of a decade ago. In the EU, over 29 percent of terrorism-offence arrests in 2024 involved minors. This trend also aligns with the increased exploitation of minors as proxies in hostile state operations and by criminal networks, or even by individual criminals, a model often described as ‘violence-as-a-service’. Social media and messaging platforms facilitate this dynamic by providing hostile states, violent extremists and professional criminals with direct access to broad audiences of young people. 

Links to Iran and Axis of Resistance proxies

Ashab al-Yamin’s claims have been disseminated through outlets associated with the Iranian Axis of Resistance, particularly those linked to Iraqi proxy militias and channels associated with individual militia groups. Multiple Telegram channels which purported to be the group’s main communication outlets have emerged since the attacks began on 9 March but have since been removed by the platform.   

The group’s iconography (an arm raising a rifle) is a variant of imagery used by the Iranian Revolutionary Guard Corps (IRGC) and Iranian proxy groups such as Kata’ib Hezbollah (KH) and Lebanese Hezbollah. However, the rifle in Ashab al-Yamin’s iconography is different to the weapon in other Resistance Axis iconography, and the Arabic text included multiple mistakes such as the spelling of the word Islamic. The logo also changed twice in the group’s short history, suggesting a lack of standardised branding and use of AI.  

 

Iran and its allies have long used front groups to insulate themselves from responsibility and to make attribution more difficult. For example, Iran-backed Iraqi militias have used front group identities to claim drone and rocket attacks against targets within Iraq and neighboring states. These front groups range from non-existent ‘ghost proxies’ to existing groups adopting new names. Researchers have noted that Iran-backed proxy groups have created cut-outs in Iraq and have previously claimed attacks that did not take place.  

The KH-Ashab al-Yamin link has received significant law enforcement corroboration. A criminal complaint unsealed on May 15, 2026 alleges that Ashab al-Yamin operates as a front for KH. The complaint details how, in April, KH commander Mohammad Baqer Saad Dawood al-Saadi allegedly attempted to pay an undercover FBI agent posing as a Mexican cartel member to carry out bombings and/or arsons at a New York City synagogue and two additional locations in Los Angeles and Scottsdale, Arizona. In recorded conversations, al-Saadi reportedly made repeated references to at least 18 attacks carried out by Ashab al-Yamin in Europe, and stated that the group was also responsible for two attacks in Canada — including a March 10 shooting at the US Consulate in Toronto that had not previously been publicly linked to the group. The complaint represents the most direct confirmation to date of Iranian proxy involvement in the Ashab al-Yamin attack campaign.

 

Contextualising Ashab al-Yamin within recent Iranian and Russian hybrid warfare  

Ashab al-Yamin’s actions appear to combine the state-orchestrated violence-as-a-service model with antisemitic targeting and the invention of a ‘ghost proxy’ group identity as a means to claim responsibility for attacks. 

According to European law enforcement agency Europol, violence-as-a-service attacks typically entail an instigator who finances and orders the crime from abroad, a recruiter who recruits over messaging apps or gaming/chat platforms, an enabler who arranges the logistics of the attack, and a perpetrator (usually an inexperienced minor or young person unconnected to the criminal network or instigator). In 2025, Europol launched a multinational taskforce to counter violence-as-a-service and warned that criminal networks, which had “industrialised” the recruitment of children represented the greatest threat to the EU.  

In cases of state-orchestrated violence-as-a-service attacks, recruits are often (but not always) young and motivated by financial incentive or thrill-seeking; some have prior involvement in low-level criminal activity. Sometimes, they record content for subsequent social media campaigns and as proof they have completed the mission. In part because recruits are untrained and ideologically uncommitted, their activities tend to be lower-risk, including espionage, nighttime arson or vandalism.  

Disproportionate representation of young people and children in arrests for this type of offence could indicate they are the intended targets of recruitment efforts. This is likely the result of several interlinked factors: younger users are more easily accessible on online platforms which facilitate ‘gig economy’ style hiring such as Telegram and Snapchat. They also tend to be more susceptible to ‘quick cash’ financial incentives and have a higher risk appetite. Some operations leverage criminal networks as recruiters. Once arrested, the proxies are abandoned and the states can deny any connection to the individuals and therefore responsibility for the attack. This fits with the strategy of plausible deniability adopted by Iran, as well as Russia.   

Iran’s History of Violence-as-a-service  

Since 2018, Iran has increasingly leaned on criminal networks to conduct violence-as-a-service attacks against Israeli and Jewish civilian targets in Europe. For example, gang members working on behalf of the Iranian regime recruited teenagers through social media to attack Israeli properties in Sweden. Iran also recruited proxies to map Jewish communities in the UK and Europe for future attacks. More broadly, Iranian hybrid warfare has targeted the UK through at least 20 Iran-linked plots involving potentially lethal actions between 2022 and 2024. 

In the course of its conflict with Israel after Hamas’ 7 October attacks and Israeli’s military response, Iran ‘phished’ for recruits on social media. These were mostly young men from across Israeli society, including minors, as well as several soldiers and reservists. They were tasked with escalating ‘missions’ in exchange for financial compensation, including espionage, vandalism and arson.  

Possible Russian Inspiration: IRGC eyes on Kremlin homework  

It seems likely that Ashab al-Yamin is an operation at least partly inspired by Russian tactics: the Kremlin is a pioneer of hybrid warfare tactics targeting Europe, particularly Ukraine, and a close ally to Iran. Furthermore, two of four Resistance Axis Telegram channels identified as primary sources for Ashab al-Yamin content were tied to sanctioned Russian networks.   

Ukrainian authorities say that over 1,100 Ukrainians have acted as Russian proxies engaging in activities such as sabotage, arson or bombings (i.e. state-orchestrated violence-as-a-service) since the full-scale invasion in 2022. Around one in five (240) of those accused were minors; most were financially motivated and around half were unemployed. A report released in December 2025 recorded at least 145 incidents of sabotage across Europe which officials had linked to Russian intelligence services, although recruits are sometimes unaware they are working for Russia.  These cases are clear precedents for the Ashab al-Yamin model, raising the possibility that Iran or its proxies took inspiration from Russia’s tried-and-tested hybrid playbook.  

 

Conclusion and recommendations  

The evidence suggests that Ashab al-Yamin’s attacks serve as an Iranian state or proxy-orchestrated violence-as-a-service campaign. The tactics used in the attacks bear similarities to previous Iranian asymmetric warfare operations as well as Russia’s hybrid war against European states and appear to be escalating based on their claiming of the 29 April stabbing attack. Meanwhile, the antisemitic targeting of Jewish communities fits with recent Iranian espionage operations across Europe.   

Europe can expect to face continued targeting in similar campaigns of evolving hybrid warfare from Iran and Russia. Young people are increasingly targeted for online recruitment as cheap and disposable proxies: a threat they face from both organised crime and violent extremists, as well as hostile states.  

There have been growing calls in the UK in the wake of recent attacks for the designation of the Iranian Revolutionary Guard Corps (IRGC) as a terrorist group. The EU’s recent proscription of the IRGC shows that while expanded investigative powers into Iran-linked hostile activities are important, they are only one narrow tool. Escalating hybrid warfare requires evidence-based countermeasures to protect local communities and vulnerable people who may be exploited as disposable proxies. Tailored rapid response and prevention mechanisms will be crucial for reinforcing democratic resilience.  

Currently, government departments and others treat state-orchestrated, criminal network and extremist violence-as-a-service as requiring separate policy responses. However, these activities exploit similar recruitment mechanisms, underlying vulnerabilities and gaps in online safety efforts, particularly endangering young people and minors. Enhanced cooperation across government departments focusing on both international and domestic  threats, social media platforms, law enforcement, and frontline prevention practitioners will be essential to a joined up responsive to this fast-developing threat.