Skip to navigation

Threat reportAPTTL-2026-5786

Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime

highACTIVE

A superseding SDNY indictment unsealed in November 2026 adds IRGC operative Mohsen Mohajeri and Mohammed Ali al-Hassani to the terrorism case against alleged Kataib Hezbollah commander Mohammad al-Saadi. Prosecutors say the network, fronted by Harakat Ashab al-Yamin al-Islamiya (HAYI), claimed about 18 attacks and attempts across Europe in March-April 2026, with attackers directed and arson streamed live over FaceTime; the FBI recovered recordings from al-Saadi's seized iPhone. First disclosed .

Key facts

IdentifiersTL-2026-5786
Also known asHAYI attack campaign, Ashab al-Yamin attacks
SeverityHIGH
First disclosed
AttributionIRGC, Kataib Hezbollah (medium confidence)
Nation-state nexusIran
Malwaretelegram
MITRE ATT&CK techniquesT1573 Encrypted Channel, T1583.006 Acquire Infrastructure: Web Services, T1585.001 Establish Accounts: Social Media Accounts, T1591 Gather Victim Org Information
MotivationDESTRUCTION
Target sectorsreligious-community, finance, news - media, military, government administration
Target regionsEurope, North America
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5786 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5786 Web access to HAYI / Kataib Hezbollah attributed Telegram channels and Telegram/X handles

Flags proxy-logged requests to the Telegram channels (Alfaqaar, Safee al-Deen, Sabereen News) and the Telegram/X handles (@MOHAMMED_BAQER1993, @bakr81950) that TL-2026-5786 research attributes to the HAYI front and Mohammad al-Saadi. The threat has no malware or network IOCs, so this is a monitoring detection that tells defenders when hosts or staff touch HAYI distribution infrastructure. Visits can be legitimate (journalism, OSINT, community security), so treat a hit as a lead to triage and not as proof of compromise. The OSINT scan found no community-corroborated siblings, so the pattern list is limited to the published handles.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1102, T1071.001
  • Data sources: proxy:zscalernss-web, CommonSecurityLog (proxy CEF)
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval u=lower(url)
| where match(u, "alfaqaar|mohammed_baqer1993|bakr81950|bakr81590|sabereen|safee.{0,3}deen")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(action) as actions by user, cip
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where tolower(RequestURL) matches regex 'alfaqaar|mohammed_baqer1993|bakr81950|bakr81590|sabereen|safee.{0,3}deen'
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 20) by SourceUserName, SourceIP, DeviceVendor
| order by Hits desc

Sigma

title: TL-2026-5786 Web Access to HAYI Attributed Telegram and X Handles
id: 5b0c6a1e-3f7d-4c52-9a41-7d2e8b6f1a01
status: experimental
description: Detects proxy requests to Telegram channels and X or Telegram handles attributed to the HAYI front and Mohammad al-Saadi in TL-2026-5786. Monitoring lead only, legitimate research and journalism visits are expected.
references:
    - https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime
    - https://ctc.westpoint.edu/mohammad-baqer-al-saadi-profiling-an-irgc-and-iraqi-militia-operative/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains:
            - 'alfaqaar'
            - 'mohammed_baqer1993'
            - 'bakr81950'
            - 'bakr81590'
            - 'sabereen'
    condition: selection
falsepositives:
    - Journalists, researchers and community-security staff following HAYI channels
    - Threat-intelligence tooling that fetches channel pages
level: medium

Known false positives:

  • Journalists, academics and OSINT analysts who legitimately read HAYI-related channels
  • Community-security and law-enforcement liaison staff monitoring the channels

Tuning notes: Telegram channel slugs come from public reporting and may differ from the live URL, so refresh the pattern list when new channel names are published. Allowlist known research and security-team users. Zscaler NSS field names (url, user, cip) may need adjusting for other proxies.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5786 Non-browser process contacting Telegram services · unlock with TL Creds
  • TL-2026-5786 Large outbound uploads to Telegram, Snapchat or WhatsApp services · unlock with TL Creds
  • TL-2026-5786 Sustained FaceTime media sessions to Apple relay infrastructure · unlock with TL Creds
  • TL-2026-5786 Reconnaissance of organisation location, staff and event pages · unlock with TL Creds
  • TL-2026-5786 Access to SMS verification and virtual phone number services · unlock with TL Creds
  • TL-2026-5786 Telegram Bot API traffic with regular beacon-like timing · unlock with TL Creds
  • TL-2026-5786 Multi-platform social account signup burst from one user or host · unlock with TL Creds
  • TL-2026-5786 Sustained encrypted traffic to Telegram infrastructure ranges · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5786.

14 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is a kinetic terrorism and proxy-tasking case with cyber relevance limited to communications tradecraft and abuse of consumer platforms. It is not a software vulnerability or malware campaign: the sources list no CVEs, malware, C2 servers, or network IOCs. All criminal allegations are unproven.

According to The Record (11 Nov 2026), a superseding indictment unsealed in the Southern District of New York adds Mohsen Mohajeri (alleged IRGC operative) and Mohammed Ali al-Hassani (Iraqi national, formerly resident in Britain), both believed to be in Iran and at large, to the case against Mohammad Baqer al-Saadi, an alleged Kataib Hezbollah (KH) commander jailed in New York since May 2026. All three face terrorism charges carrying potential life sentences. Al-Saadi was detained in Turkey in early May 2026 and brought to the US on 15 May; the original complaint (15 May) and eight-count indictment (unsealed 28 May) describe him as a high-level KH member with close IRGC ties.

Public reporting describes HAYI (Harakat Ashab al-Yamin al-Islamiya) as a front brand for KH and the IRGC. Its first public statement appeared on the Alfaqaar Telegram channel on 9 March 2026; the FBI complaint says al-Saadi sent the same statement via Snapchat more than four hours earlier. The first confirmed attack was an IED outside a Liege synagogue on 9 March. HAYI claimed about 18 attacks and attempts across Europe (UK, Belgium, France, Netherlands, Greece, North Macedonia) plus two in Canada, targeting synagogues, Jewish community assets, US bank buildings, and Iran International-linked media premises. Other claims include arson on Hatzolah ambulances in north London (23 March), a Finchley Reform Synagogue arson and an attack on Volant Media/Iran International offices (15 April), and the 29 April Golders Green stabbing of two Jewish men. HAYI also claimed a drone attack with radioactive material against the Israeli Embassy in London; police found no hazardous material.

Tradecraft per the indictment as reported: attackers were recruited via social media from local criminal networks (including minors), paid, and tasked remotely. In April, an arson on a Jewish charity building in London was streamed over FaceTime and projected onto a screen bearing the militia's logo, with al-Hassani allegedly instructing the attacker ('light it'); the next day al-Hassani allegedly urged a synagogue attacker to 'light it up like a Christmas tree'. Al-Saadi's WhatsApp, Snapchat, Telegram, and X accounts were linked through a single phone number. Raw footage (for example from the Liege bombing) moved over Telegram and was reused for propaganda. In March al-Saadi asked Mohajeri about joint drone and missile attacks and was told to photograph and video them. In April al-Saadi paid an undercover officer about $3,000 in cryptocurrency (part of a reported $10,000 offer) for a planned Manhattan synagogue attack that never occurred.

The RAF Fairford plot: in August al-Hassani allegedly paid someone to film the base perimeter; in September associates bought vans, fuel barrels, and metal objects usable as shrapnel, and in late September al-Hassani allegedly phoned the drivers of three vans from Iran. At least two were turned back at a roadblock; no explosives were found; seven people were arrested and bailed. The FBI recovered FaceTime recordings, raw attack footage, and messages with a KH contact from al-Saadi's seized iPhone.

Attribution caveats: analysts disagree on whether HAYI is a true IRGC/KH construct or a facade/opportunistic network (RFE/RL, FDD); a teenage suspect in the Antwerp arson was reportedly paid to stage it (NYT via Egypt Independent). Defender relevance: monitor secondary Telegram distribution channels, rapid coordinated post-attack media output, and gig-style recruitment of proxies through social platforms.

MITRE ATT&CK techniques by tactic:

Command and Control

T1573 Encrypted Channel

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1585.001 Establish Accounts: Social Media Accounts

Reconnaissance

T1591 Gather Victim Org Information

Remediation

Immediate actions

  • Report suspected HAYI recruitment approaches or threats to law enforcement (FBI, UK counter-terrorism police)
  • Heighten physical security and incident reporting at synagogues, Jewish community charities, US-linked financial buildings, and Iran International-linked media premises
  • Monitor HAYI-branded and secondary Telegram channels (Al Faqaar, Safee al-Deen, Sabereen News) for claims and threat indicators

Longer-term hardening

  • Track social-media recruitment of local proxies and minors for paid attacks
  • Share threat intelligence with community security organizations and law enforcement
  • Treat rapid coordinated post-attack media output as an indicator of upstream direction

Timeline

  • US-Israel-Iran military conflict begins; HAYI later becomes active after the strikes.
  • HAYI's first public statement appears on the Alfaqaar Telegram channel (FBI says al-Saadi sent it via Snapchat hours earlier); IED detonates outside a Liege, Belgium synagogue.
  • Arson destroys four Hatzolah Jewish charity ambulances in north London; claimed by HAYI.
  • Arson at Finchley Reform Synagogue and attack on Iran International-linked Volant Media offices in London claimed by HAYI.
  • London synagogue attack carried out while al-Saadi is on a live FaceTime call, per DarkOwl's reading of the video.
  • Two Jewish men stabbed in Golders Green, London; HAYI claims via Telegram about an hour later.
  • Al-Saadi, detained in Turkey in early May, is brought to the US; six-count criminal complaint unsealed in Manhattan.
  • Eight-count indictment against al-Saadi unsealed after grand jury action in New York.
  • Al-Hassani allegedly pays someone to film the perimeter of RAF Fairford (reported as 'August').
  • Al-Hassani allegedly phones drivers of three vans heading to RAF Fairford from Iran; at least two turned back (reported as 'late September'); seven arrested and bailed.
  • Superseding SDNY indictment unsealed adding Mohsen Mohajeri and Mohammed Ali al-Hassani (reported 11 Nov as unsealed 'Tuesday').

Sources cited

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats