An Iranian Terrorist Network in Canada?
HAYI attacks against US, Israeli, and Jewish targets in Europe and potentially Canada.
Hello, Insight Monitor subscribers. Today, we’re looking at the Iranian network responsible for a series of terrorist attacks in Europe. In a criminal complaint released last week, the US revealed that a Kata’ib Hizballah (KH) commander was directing the network, and also claimed responsibility for two attacks in Canada. In this Insight Monitor, we compare attack patterns, targets, and tactics in Canada and Europe to assess the validity of claims about Harakat Ashab al-Yamin al-Islamiya (HAYI) (or KH-directed) activity in Canada, understand the financing behind these networks, and consider Iranian strategic objectives in the context of criminal surrogates and terrorist activity.
Last week, the FBI released a criminal complaint against an alleged commander for Kata’ib Hizballah (KH), an Iranian proxy group financed and directed by Iran’s Islamic Revolutionary Guards Corps (IRGC). The complaint argues that Mohammad Baqer Saad Dawood Al-Saadi is a KH commander and, as part of his work for the group, directed Harakat Ashab al-Yamin al-Islamiya (HAYI).
HAYI has claimed responsibility for nearly twenty attacks in Europe since the start of the Iran-US-Israel conflict. The group first emerged in March 2026 and sought to portray itself as a Europe-based group, independent from KH; however, imagery and social media posts strongly suggested that it was in fact an IRGC-linked entity. That is not to say that the group is a proxy; in fact, I think it’s critical to make a distinction here. Iranian proxies (Hamas, Hizballah, KH, and the Houthis) are financed and directed by Iran and the IRGC. This does not mean that these groups only follow Iranian direction — in fact, they operate with varying levels of autonomy and financial control. But they are well-established groups with hierarchies, membership, and financial structures.
On the other hand, HAYI currently appears to be more of a recruitment network. The network identifies individuals who will commit acts of violence, vandalism, and terror for pay. This pattern of activity is very similar to how Iran contracts state-sponsored assassinations. In some cases, Iran uses criminal organizations to carry out attacks in areas where it has limited operational reach and capabilities. HAYI’s breadth of activity, but low-level tactics against soft targets, suggests activity more commensurate with a criminal surrogate than a full-fledged terrorist proxy group.
To understand how Iran chooses the type of threat actor to deploy, and its implications for Canada (and the broader HAYI network), keep reading:
