An Iranian Terrorist Network in Canada?
HAYI attacks against US, Israeli, and Jewish targets in Europe and potentially Canada.
Hello, Insight Monitor subscribers. Today, we’re looking at the Iranian network responsible for a series of terrorist attacks in Europe. In a criminal complaint released last week, the US revealed that a Kata’ib Hizballah (KH) commander was directing the network, and also claimed responsibility for two attacks in Canada. In this Insight Monitor, we compare attack patterns, targets, and tactics in Canada and Europe to assess the validity of claims about Harakat Ashab al-Yamin al-Islamiya (HAYI) (or KH-directed) activity in Canada, understand the financing behind these networks, and consider Iranian strategic objectives in the context of criminal surrogates and terrorist activity.
Last week, the FBI released a criminal complaint1 against an alleged commander for Kata’ib Hizballah (KH), an Iranian proxy group financed and directed by Iran’s Islamic Revolutionary Guards Corps (IRGC). The complaint argues that Mohammad Baqer Saad Dawood Al-Saadi is a KH commander and, as part of his work for the group, directed Harakat Ashab al-Yamin al-Islamiya (HAYI).
HAYI has claimed responsibility for nearly twenty attacks in Europe since the start of the Iran-US-Israel conflict. The group first emerged in March 2026 and sought to portray itself as a Europe-based group, independent from KH; however, imagery and social media posts strongly suggested that it was in fact an IRGC-linked entity. That is not to say that the group is a proxy; in fact, I think it’s critical to make a distinction here. Iranian proxies (Hamas, Hizballah, KH, and the Houthis) are financed and directed by Iran and the IRGC. This does not mean that these groups only follow Iranian direction — in fact, they operate with varying levels of autonomy and financial control. But they are well-established groups with hierarchies, membership, and financial structures.
On the other hand, HAYI currently appears to be more of a recruitment network. The network identifies individuals who will commit acts of violence, vandalism, and terror for pay. This pattern of activity is very similar to how Iran contracts state-sponsored assassinations. In some cases, Iran uses criminal organizations to carry out attacks in areas where it has limited operational reach and capabilities. HAYI’s breadth of activity, but low-level tactics against soft targets, suggests activity more commensurate with a criminal surrogate than a full-fledged terrorist proxy group.
To understand how Iran chooses the type of threat actor to deploy, and its implications for Canada (and the broader HAYI network), keep reading:
Hello, Insight Monitor subscribers. Today, we’re looking at the Iranian network responsible for a series of terrorist attacks in Europe. In a criminal complaint released last week, the US revealed that a Kata’ib Hizballah (KH) commander was directing the network, and also claimed responsibility for two attacks in Canada. In this Insight Monitor, we compare attack patterns, targets, and tactics in Canada and Europe to assess the validity of claims about Harakat Ashab al-Yamin al-Islamiya (HAYI) (or KH-directed) activity in Canada, understand the financing behind these networks, and consider Iranian strategic objectives in the context of criminal surrogates and terrorist activity.
Last week, the FBI released a criminal complaint1 against an alleged commander for Kata’ib Hizballah (KH), an Iranian proxy group financed and directed by Iran’s Islamic Revolutionary Guards Corps (IRGC). The complaint argues that Mohammad Baqer Saad Dawood Al-Saadi is a KH commander and, as part of his work for the group, directed Harakat Ashab al-Yamin al-Islamiya (HAYI).
HAYI has claimed responsibility for nearly twenty attacks in Europe since the start of the Iran-US-Israel conflict. The group first emerged in March 2026 and sought to portray itself as a Europe-based group, independent from KH; however, imagery and social media posts strongly suggested that it was in fact an IRGC-linked entity. That is not to say that the group is a proxy; in fact, I think it’s critical to make a distinction here. Iranian proxies (Hamas, Hizballah, KH, and the Houthis) are financed and directed by Iran and the IRGC. This does not mean that these groups only follow Iranian direction — in fact, they operate with varying levels of autonomy and financial control. But they are well-established groups with hierarchies, membership, and financial structures.
On the other hand, HAYI currently appears to be more of a recruitment network. The network identifies individuals who will commit acts of violence, vandalism, and terror for pay. This pattern of activity is very similar to how Iran contracts state-sponsored assassinations. In some cases, Iran uses criminal organizations to carry out attacks in areas where it has limited operational reach and capabilities. HAYI’s breadth of activity, but low-level tactics against soft targets, suggests activity more commensurate with a criminal surrogate than a full-fledged terrorist proxy group.
To understand how Iran chooses the type of threat actor to deploy, and its implications for Canada (and the broader HAYI network), keep reading:
A Strategic Actor-Selection Model
States make choices about what kind of actors they deploy for state-sponsored assassinations, transnational repression, grey zone tactics, etc. They choose actors in concert with strategic choices about how to achieve their objectives, balancing and weighing the characteristics of five types of actors against their strategic interests and desired outcomes (illustrated in Table 1). These actors are: state security services, which includes intelligence services and military assets; proxies, such as terrorist or other non-state militant groups; criminal surrogates such as organized crimes groups; contractors, such as criminals hired for a specific task; and autonomous actors who are inspired by state propaganda or information operations to take action on their own (which is very similar to the lone actor concept in terrorism).
The characteristics that states weigh in their choice model of covert actors are numerous. Autonomy of the organization ranges from low (a direct relationship with the state) to high, where the relationship with the state is limited to influence operations or propaganda and no direction is given (as with autonomous actors). States also choose actors based on financial incentives: state services and proxies receive the most direct financing, while criminal surrogates and contractors tend to receive one-time payments, either directly or through brokers, and autonomous actors receive no financial compensation.
The type of relationship is also important: state security services and proxies have long-term, direct relationships with the state, while criminal surrogates have a medium-term relationship (often facilitated by intelligence services), and contractors have a one-time relationship (although successful contractors might have subsequent engagements from the state). The reliability of the actor also varies, with most actors having a high level of reliability (they can get the job done), but contractors introduce uncertainty. The predictability of outcomes also varies, with criminal surrogates and contractors introducing uncertainty due to their autonomous nature.
Capabilities also play a role: for state security services and proxies, their general capabilities are high, but in some cases, the specific capabilities of criminal surrogates or contractors, while less developed than those of the former assets, provide the necessary flexibility for transnational repression and assassinations. Finally, the outcome of the activity varies by actor: state security services and proxies are usually reserved for strategic outcomes and hardened targets, while criminal surrogates and contractors fill the gap to hit tactical targets and softer targets, although in some instances, criminal surrogates might have the capability and access to hit a hardened target more successfully than state security services.2
HAYI’s Criminal Surrogacy
Between March and May 2026, HAYI is believed to have carried out 18 attacks in Europe. These primarily targeted American assets or Jewish people and institutions. The attacks occurred across Europe, including in the UK, the Netherlands, France, Belgium, Germany, and Macedonia. The attacks used simple tactics, primarily explosives, pyrotechnic devices, arson, and in two separate cases, drones and bladed weapons.
In several cases, the individuals suspected of perpetrating the attacks have been caught. While little is known about them, they currently appear to fit the typology of Iranian “disposable assets”: individuals recruited to carry out attacks for pay but with little or no training, operational capabilities, intelligence access, or other skills. Their main attribute appears to be a willingness to conduct attacks against these targets for a small fee.
Iran’s use of the HAYI network to recruit, conduct attacks, and claim responsibility suggests several things. Firstly, it suggests that Iranian proxy groups either cannot or will not operate in Europe. These groups have significantly more operational capabilities than the attacks conducted by HAYI demonstrate, and Iran would almost certainly prefer to have higher-intensity attacks occurring in Europe in retaliation for the current war. However, these proxy groups might find it difficult to operate in Europe due to counterterrorism pressure. They might also choose not to conduct operations in Europe in order to preserve capabilities for the future, avoid compromising existing networks, and avoid closer counterterrorism scrutiny. The proxy groups (or their Iranian leadership) might also be seeking to avoid expanding the conflict. It is plausible that widespread attacks attributable to Iranian proxies could result in counterterrorism strikes or draw European partners into the war. This might well be something that Iran and its proxies are seeking to avoid while still engaging in destabilization and terrorist activities.
Secondly, HAYI’s activities suggest that Iran maintains an interest in targeting its enemies outside of the immediate area of conflict despite constraints. At the onset of the conflict, many counterterrorism experts suggested that Iran would deploy its proxy groups to conduct attacks. HAYI operations likely demonstrate ongoing interest, although with constrained capability or interest.
Thirdly, HAYI’s activities likely have a domestic audience, attempting to illustrate to the Iranian population (as well as Iranian proxies) an interest in destabilizing and terrorizing Europe and striking US, Israeli, and Jewish interests. These attacks allow Iran to engage in destabilization activities, appear to target its enemies abroad, while also preventing the escalation of the conflict that might occur through large-scale, spectacular terrorist attacks.
Regardless of why Iran is choosing to conduct attacks using HAYI as a criminal surrogate, there is strategic logic present. The question is: is that logic also present in Canada, and if so, why so few attacks and no claims of responsibility?
HAYI in Canada?
The allegations in the criminal complaint suggest that the HAYI network was behind two attacks in Canada. These allegations are based on comments al-Saadi made to an undercover operative (which are by no means indicative of certain HAYI involvement). It is worth considering whether HAYI was likely behind these attacks, and whether Canada’s recent spate of antisemitic attacks was part of a coordinated terrorist campaign by an Iranian criminal surrogate.
Certainly, Canada is no stranger to antisemitic attacks. According to data from Statistics Canada (which is compiled from police reports from across the country), there was an 82% increase in hate crimes against Jewish people and institutions, from 527 incidents in 2022 to 959 incidents in 2023. By 2023, there was a 4% decrease, but many incidents still occurred in 2024 (920). As such, it is entirely plausible that these attacks were part of the broader patchwork of antisemitic hate crimes that occur in Canada on a semi-regular basis.
However, according to the complaint, al-Saadi was attempting to recruit someone to conduct attacks in the US. Al-Saadi reportedly told another subject of investigation that his network was responsible for two attacks in Canada (the March 10 shooting at the US consulate in Toronto and an attack at a synagogue).
Interestingly, there were no public claims of responsibility for these attacks from the HAYI network. Previous network attacks in Europe had been followed closely by claims of responsibility and videos disseminated on their social media channels. So were these attacks actually carried out by HAYI? And were any other Canadian attacks carried out by this network?
Since the start of the war, there have been a series of attacks in Toronto. This includes a 6 March synagogue attack,3 a 7 March synagogue attack,4 the 10 March US Consulate attack,5 a 3 April attack against a Jewish-owned business,6 and two attacks on 30 April against the Jewish community and a synagogue using imitation firearms.7 These attacks all fit within the general timeframe of HAYI activity in Europe and mirror the simplicity of the attacks there, as well as patterns in target selection. In Canada, firearms or imitation firearms were used, while in Europe, attacks were primarily arson or explosive attacks. In both cases, attacks were primarily directed against soft targets using readily available weapons and likely required limited planning, preparation, and financing.
However, these similarities are far from sufficient to establish certainty about who is responsible for the attacks in Canada. There are three equally plausible alternatives to consider. The first is that this is, in fact, HAYI-directed activity, and it simply hasn’t been claimed as such. The second is that this activity is grassroots hate crimes, but that al-Saadi has decided to take credit for at least two of the attacks to make his network appear more international than it is. The third is that this is Iran-directed activity, but the regime is conducting a type of A/B testing: in Europe, by taking credit for the attacks and establishing a “terrorist group”, while in Canada, making the attacks appear random and grassroots. The regime could be exploring which option meets its strategic objectives more effectively
The Money
The complaint sheds some interesting light on the financing of terrorist activity. In the complaint, al-Saadi talks about being able to make payments for the attacks by using third parties (‘our guys’) in Europe and in Canada. This is likely a reference to individuals operating either as money service businesses or simply as payment facilitators for HAYI / Iranian proxies. Al-Saadi also offered $10,000 for the attacks. This is higher than payments that have been seen in other conflict zones with “disposable assets” (Russians often pay as little as a few hundred Euros for sabotage or vandalism activities in Europe); however, in this particular case, al-Saadi was trying to recruit a Mexican cartel member (who was, in fact, an undercover operative), so the price might have been higher for a more experienced and capable operative. The undercover requested payment in cryptocurrency, which was instructive in demonstrating HAYI and al-Saadi cryptocurrency payment capabilities, and suggests payment modalities that might have been used in Europe. (This is certainly no surprise, given Iran’s extensive cryptocurrency capability that I have documented at length in this newsletter).
Ultimately, it is impossible to conclude, based on this information, whether the attacks in Canada were HAYI or al-Saadi-directed attacks. However, law enforcement and intelligence agencies would be well served to give serious consideration to whether an Iran-directed criminal surrogate network is operating in Canada, and, if so, how its operatives are being paid. While it remains possible that hate crime activity directed at the Jewish community is grassroots (there has certainly been enough of it historically to justify this hypothesis), an Iran-directed network operating in Canada would demonstrate significant Iranian capability and interest in destabilization and terrorist operations in this country.
Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!
© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.
After this article was published, the criminal complaint was removed. The NYTimes archived it here: https://www.nytimes.com/interactive/2026/05/15/nyregion/al-saadi-complaint.html
This was adapted from a forthcoming research manuscript developed for the SOC-ACE research programme. “Criminal Hands, State Ends: State Sponsored Assassinations using Organized Crime”, date TBC.
Toronto Police Service, “Suspect Charged in Toronto and Vaughan Synagogue Shootings,” accessed May 19, 2026, https://www.tps.ca/media-centre/news-releases/65853/.
Toronto Police Service, “Suspect Charged in Toronto and Vaughan Synagogue Shootings.”
CBC, “Police Recover Suspect Vehicle in U.S. Consulate Shooting,” CBC News, March 12, 2026, https://www.cbc.ca/news/canada/toronto/us-consulate-shooting-update-9.7126654.
Toronto Police Service, “Arrest in Shots Fired at Restaurant,” accessed May 19, 2026, https://www.tps.ca/media-centre/stories/arrest-in-shots-fired-at-restaurant/.
CBC, “Man, 18, Charged in Suspected Hate-Motivated Assaults against Toronto Jewish Community.”