The rise of HAYI as a possible functional group that could be behind a wave of arson attacks in London is a new and highly multifaceted development in the changing security environment in Europe. In March 2026, the organization, which under its original name, was formally called Harakat Ashab al-Yamin al-Islamia, stated that it was responsible for a series of attacks against the Jewish community facilities throughout the city. The changes have increased pressure on the UK counter-terrorism agencies, especially considering the digital-first nature of operations by the group, and its potential in being part of the wider trans-national influence campaigns related to Iranian security apparatus.
What makes HAYI any different from the previous extremist organizations is that it is not only the choice of targets but also the hybrid character of its operations, which combines ideological messages and low-intensity violence organized. Law enforcement agencies are now weighing whether the group is an autonomous radical network or a fictitious proxy identity to cover up involvement at the state level.
The Digital Ecosystem and Operational Logic of HAYI
The mobilization of HAYI has a geographic footprint that signifies a change in the manner in which modern proxy-related organizations can operate in cities. It also uses encrypted communication systems in place like traditional hierarchical organizations, as well as adopting a rapid content dissemination after attacks, which produces a visibility-ambiguity cycle.
Encrypted communication and propaganda dissemination
The online activities of HAYI are mainly focused on coded message systems and the short-video sharing system. Following every so-called attack, the group issues statements, visual content, and ideological contextualization that aim to place the violence in a larger context of fighting back. This is in keeping with the current trend of decentralized militant communication in the form of militants seeking to be seen more than be felt.
These releases are too fast and regular to avoid an implication of a very disciplined structure, or coordinated external facilitation, as noted by security analysts. The wording tends to confuse the two points of political complaint and religious insignia, a characteristic that makes it difficult to categorize based on the conventional counter-terrorism models.
Decentralization or structured proxy identity
Among the key debates about the analysis of HAYI is the question of whether it is an actual grassroots formation or the floating label of proxy which is being used by various actors. Counter-terrorism briefs of 2025 present intelligence tests that suggest that similar naming patterns have been used in other European cities, such as isolated attacks in Rotterdam and smaller coordinated attacks in Southeast Europe.
This trend has prompted some observers to suggest that HAYI might be more of a reusable brand than an organization, with loosely affiliated members of the organization carrying out attacks. This would offer strategic flexibility which would enable external sponsors to remain ambiguous whilst putting pressure in specific environments.
Investigating Possible Iranian Security Links
Whether Iranians are involved or not is now a focal point of investigations that have been conducted by UK counter-terrorism teams. Although there is no publicly announced attribution, the specifics of the targets selection and operation structures have led to suspicions of the possible indirect state influence.
Target selection and strategic signaling
The selection of targets namely Jewish institutions and infrastructure that is culturally significant have attracted attention as they are consistent with larger geopolitical accounts. Among the targeted locations are community centers, and other institutions around the media which have at some point criticized the Iranian policies.
According to counter-terrorism officials, these targeting patterns tend to follow the pattern of message-driven violence, in which the goal is not to wreak mass destruction, but to create a psychological disturbance and send a symbolic message. Analysts have termed these actions as a mode of calculated intimidation and not indiscriminate extremism in internal testing revealed in security briefs in 2025.
Operational parallels with regional proxy networks
HAYI has demonstrated similarities in its methods and tactics as those of the Iranian-linked militia forces in the Middle East, which security experts have noted have similarities in terms of methodology. These are dependence on semi-autonomous cells, the use of indirect methods of attribution, and stratified network of communication that is meant to obfuscate command structures.
Although these similarities are not evidence that they are under direct control, they have led to increased worry among western intelligence community. The Islamic Revolutionary Guard Corps (IRGC), which is often mentioned in the context of proxy relationships in the region, has often been linked to the networks that do not act directly, but use intermediaries, which further supports the importance of analytical prudence in attribution.
The Challenge of Attribution in Hybrid Proxy Warfare
The contemporary proxy warfare is more and more driven by a domain where legal responsibility, cyber anonymity and ideological disintegration meet. HAYI represents this grey area and therefore the conventional models of counter-terrorism cannot work as well in creating clear lines of accountability.
Plausible deniability as a strategic advantage
Intentional development of ambiguity is one of the greatest threats that such groups of people as HAYI may present. With a decentralized identity structure the organization or group of actors under its name can act without revealing an apparent chain of command.
This uncertainty gives the prospective outside sponsors the opportunity to enjoy the results of the operation without being directly diplomatically or legally liable. Analysts refer to this as strategic opacities in which the uncertainty itself becomes a source of power, and makes it harder to respond to law enforcement as well as accountability mechanisms of other countries.
Legal and intelligence constraints in the UK context
British anti-terrorism systems are established mainly based on recognizable organizational patterns and trackable chain of operations. The problem of diffuse proxy identities as HAYI emerges poses evidentiary problems, especially in the case of local perpetrators, who seem to have no connection with larger players in the strategy.
Recent individual case-related arrests of arson have given tactical intelligence but are yet to create a conclusive connection with foreign intelligence organizations. This distance brings out one of the long-standing issues that are present in contemporary security settings, namely the fact that local enforcing agencies frequently have to work with the effects of transnational strategies without the complete intelligence picture.
Domestic Impact and Community Security Dynamics
In addition to strategic and geopolitical, there are tangible effects of the HAYI-related arsons on the impacted communities in London. The Jewish institutions have reported the most especially citing the following as; security concerns, diversion of resources and community apprehensions.
Security adaptations and institutional resilience
The attacks have led to an increase in physical security at the affected institutions, such as upgrading surveillance and organizing patrol, in collaboration with local law enforcement. Such actions are indicative of a larger trend of defensive normalization, in which community spaces have to take into account the aspects of security into daily functioning.
Much as these pressures may be, there are numerous institutions that operate without any hitch. Continuity, as one of the resilience forms, has been highlighted by the community leaders, indicating opposition to the targeted psychological impacts of the campaign. This strength, however, is costly in terms of money and operations that keeps increasing with every incident.
Social cohesion under pressure
The psychological dimension of the arson campaign extends beyond physical damage. Repeated incidents targeting culturally significant sites contribute to a climate of uncertainty, particularly in densely populated urban districts. Local authorities have increased community engagement efforts to mitigate fear and prevent social fragmentation.
However, the persistence of such incidents raises broader questions about the ability of urban security systems to respond effectively to hybrid threats that combine ideological messaging with low-intensity violence. The challenge is no longer solely about preventing attacks, but about preserving trust in public safety mechanisms.
The evolving HAYI case sits at the intersection of domestic security, international proxy competition, and digital-age anonymity. Whether the group ultimately proves to be a structured extension of a state-linked strategy or a decentralized network exploiting geopolitical narratives remains unresolved, but the operational pattern has already reshaped analytical thinking within counter-terrorism circles. As investigations continue, the central tension persists between attribution and ambiguity, a space where modern proxy warfare appears increasingly designed to operate. The broader question that now emerges is not only who directs such campaigns, but whether urban security frameworks in Europe are structurally prepared for adversaries who may never fully exist in a form that can be conclusively defined.