london —
The walls of the infirmary were charred black, and the door appeared to have been half melted by the flames. Ten days after what appeared to be a Molotov cocktail was thrown through a synagogue window in the middle of the night, the smell of smoke still gets stuck in the back of my throat.
Rabbi Yehuda Black said he was overcome with emotion when he returned the morning after the attack at the synagogue, which he called a “jewel,” with stained glass in the walls and a Star of David carved into the ceiling.
“It’s just the medical room. You can replace it, you can redecorate it,” he says. “But what could have happened is what’s really difficult.”
The Kenton United Synagogue in northwest London was one of a series of mostly Jewish properties set on fire in the British capital and other European cities over the past two months, including schools, businesses and volunteer-run ambulances.
A shadowy online group calling itself Harakat Ahab al-Yamin al-Islam (HAYI) (roughly translated from Arabic as “Right-wing Brotherhood Islamic Movement”) claims to be responsible for at least 17 incidents. The group only appeared online in March and claims to target “Zionist” interests.
CNN’s investigation found clear links between HAYI and Iranian-backed Shiite militias. It was also discovered that suspected Iranian operatives are using social media to recruit individuals to carry out surveillance and possible violence against sites associated with European Jewish communities.
CNN journalists posing as young London-based Telegram users discovered a channel openly promoting Iranian intelligence operations. One company posted in English and Hebrew that it was looking for “highly paid agents in a completely secure and professional environment with 24/7 monitoring and support.”
In an exchange of messages with CNN, the Telegram “VIPEmployment” account said it was considering “employing people who could harm Israeli interests or individuals.”
In another account linked to the channel, a user calling herself Sheena offered money in exchange for putting up posters in London criticizing US President Donald Trump and the US-Israel-Iran war, offering advice such as “You need to check and do it in a place where there are no surveillance cameras.”
The CNN team decided to end the conversation there, but no direct link between the account and the Iranian state or its proxies could be confirmed. But these messages show that with just a few clicks, social media users seeking secret income can potentially be drawn into paths that lead to violence and espionage.
Experts say such exchanges could form part of a multi-layered operational structure, with Iran’s Islamic Revolutionary Guards Corps (IRGC) eventually directing the operation.
“There’s a potential model where you have the Revolutionary Guards or an organization associated with the Revolutionary Guards at the top,” said Roger McMillan, former security chief for London-based Iranian opposition media outlet Iran International.
“There’s another layer of recruiting, and then you have unskilled, hired thugs.”
The conversation between CNN and Telegram’s VIPEmployment channel ended quickly, but other channels reportedly went into more depth.
Israeli authorities claim that a Telegram channel of the same name was used by Iran to recruit Israelis in exchange for money to spy on sensitive sites and individuals.
According to two separate indictments against Israelis accused of espionage, Telegram users connected to the “VIPEmployment” channel assigned the men an initial mission essentially similar to the one provided to CNN. Israeli men were asked to write derogatory slogans against Prime Minister Benjamin Netanyahu on pieces of paper and film themselves burning them.
Prosecutors allege that the suspects continued to carry out increasingly serious intelligence-gathering tasks in exchange for compensation at the request of Telegram representatives, an agent of Iranian intelligence.
A man is accused of secretly filming the inside of a hospital where former Prime Minister Naftali Bennett was being treated. The other person is said to have filmed the Shin Bet Internal Security Agency headquarters, multiple Israel Defense Forces (IDF) bases, and other sensitive locations before sending the footage to officials.
The second man was serving in the Israeli Defense Forces reservists when his handler asked him to assassinate a commander in exchange for about $33,000, according to the indictment. He did not accept the assignment.
Neither side has yet presented arguments, nor has their defense team filed.
Israel has faced an unprecedented wave of domestic espionage since 2023, with at least 60 Israelis facing charges of spying for Iran, a country official told CNN. Some of the scenes that prosecutors say were filmed by these suspected recruits have been targets of Iranian missile attacks on Israel over the past year.
In London, police said they were continuing to investigate the attack claimed by HAYI and were looking into whether Iran used criminal agents to carry out the attack.
“We are looking at whether this tactic of recruiting violence as a service is being used here in London,” said Assistant Commissioner Vicky Evans, the Metropolitan Police’s senior national co-ordinator for counter-terrorism policing.
“The people who commit these crimes often have no loyalty to the cause and are simply making money for their crimes,” she says.
British Prime Minister Keir Starmer said on Tuesday that authorities were investigating whether “foreign countries” were behind some of the incidents. “Our message to Iran and any other country that may seek to incite violence, hatred and division is that we will not tolerate it.”
The 17-year-old from north-west London pleaded guilty last month to a charge of arson endangering life at a Kenton synagogue and is due to appear in court again in June. In his court statement, he said he did not know the building was a synagogue and that he had “no hatred towards Jews.”
HAYI also claimed responsibility for the nighttime torching of a car in a Jewish-majority district of Antwerp in March. Chantal van den Bosch, a lawyer for one of the two suspects in the case, told CNN that her 17-year-old client was promised money and simply used as “cannon fodder.” His parents told the juvenile court that he was being “used” and had no intention of dividing the community. She claimed he had no ideological motives.
Belgian prosecutors announced in March that the two men were being investigated on suspicion of arson and participating in the activities of a terrorist organization, but did not provide details of the case.
Posts claiming both attacks first appeared on social media channels, with experts linking them to Iraqi Shiite groups. Two days before HAYI claimed its first attack (in Liège, Belgium in March), one of the channels teased a mention of the group’s name: “Ashab al-Yamin, coming soon…” Administrators of a Telegram channel associated with the Iranian-backed group in Iraq admitted in a message with CNN that their superiors had been in direct contact with HAYI.
A source close to the Iraqi militia Kataib Hezbollah told CNN that some HAYI members are Iraqi and that there are ties between the two groups. Kataib Hezbollah, like other Iranian-linked groups in the region, operates under direct or indirect command of the Revolutionary Guards.
Analysts interviewed by CNN said HAYI was likely acting as a front line for the Revolutionary Guards.
“Part of the appeal of this operation is that they don’t have to rely on a core network that is ideologically loyal and directly tracks them,” said Philip Smith, an expert who focuses on Shi’ite militias.
“This provides a façade of what is really happening in Europe, where Iran can both claim responsibility and deny it.” Smith added that this type of hybrid warfare, employing “disposable” personnel for criminal and surveillance operations, was pioneered by Iran’s ally Russia.
The Iranian embassy in London denied any link or involvement in the London attacks, saying in a statement: “Such baseless accusations against the Islamic Republic of Iran lack credible evidence, serve narrow political objectives, mislead public opinion and appear to distract from the true root causes of terrorism and violent extremism.”
Even before this latest series of attacks, Britain’s domestic intelligence agency, MI5, had warned of a growing threat from Iran. It said it had thwarted more than 20 potentially deadly Iranian-backed plots in the UK in the year to October 2025.
Alicia Kearns, the opposition Conservative party’s shadow minister for national security and integrity, told CNN: “There is no question that there is an increase in the activity of people who support or are associated with the Revolutionary Guards.”
“They’re going to hire anyone they can,” she said. “Are you a bored person, are you looking for a job…or are you a full-time criminal?”
This is not the first time Iran has been accused of using existing criminal networks in Europe to carry out violence or espionage. In Sweden, gangs known as Foxtrot and Loomba are believed to have planned the attack on the Israeli embassy on Iranian instructions.
Most of the attacks that HAYI has claimed so far have been carried out in an amateurish manner and have not resulted in any injuries or major damage, but analysts are concerned that the attacks could escalate.
Mr Hay praised the actions of “our lone wolves” after two Jewish men were stabbed on the street in the Golders Green area of north-west London on April 29, but experts question whether the group actually directed it.
Smith said HAYI is currently operating in a “first wave” situation, noting that similar actions by Iranian proxies in the Middle East tend to increase violence.
At Kenton’s synagogue, Rabbi Black says they can only continue operating with additional safety measures in place, as many Jewish communities across the UK are doing.
The synagogue already has panic alarms, surveillance cameras and reinforced doors installed. Service times and event details listed online are password protected.
A video posted by HAYI singled out Black, calling him an “important tool” of Zionism.
He said the attacks in London and elsewhere were “clearly anti-Semitic”. “That has to stop.”
