# Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime

> A superseding SDNY indictment unsealed in November 2026 adds IRGC operative Mohsen Mohajeri and Mohammed Ali al-Hassani to the terrorism case against alleged Kataib Hezbollah commander Mohammad al-Saadi. Prosecutors say the network, fronted by Harakat Ashab al-Yamin al-Islamiya (HAYI), claimed about 18 attacks and attempts across Europe in March-April 2026, with attackers directed and arson streamed live over FaceTime; the FBI recovered recordings from al-Saadi's seized iPhone.

- **Published:** 2026-11-11T18:08:10Z
- **Last reviewed:** 2026-11-11T18:08:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5786
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5786.png
- **ID:** TL-2026-5786
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** IRGC (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 14

## Description

This is a kinetic terrorism and proxy-tasking case with cyber relevance limited to communications tradecraft and abuse of consumer platforms. It is not a software vulnerability or malware campaign: the sources list no CVEs, malware, C2 servers, or network IOCs. All criminal allegations are unproven.

According to The Record (11 Nov 2026), a superseding indictment unsealed in the Southern District of New York adds Mohsen Mohajeri (alleged IRGC operative) and Mohammed Ali al-Hassani (Iraqi national, formerly resident in Britain), both believed to be in Iran and at large, to the case against Mohammad Baqer al-Saadi, an alleged Kataib Hezbollah (KH) commander jailed in New York since May 2026. All three face terrorism charges carrying potential life sentences. Al-Saadi was detained in Turkey in early May 2026 and brought to the US on 15 May; the original complaint (15 May) and eight-count indictment (unsealed 28 May) describe him as a high-level KH member with close IRGC ties.

Public reporting describes HAYI (Harakat Ashab al-Yamin al-Islamiya) as a front brand for KH and the IRGC. Its first public statement appeared on the Alfaqaar Telegram channel on 9 March 2026; the FBI complaint says al-Saadi sent the same statement via Snapchat more than four hours earlier. The first confirmed attack was an IED outside a Liege synagogue on 9 March. HAYI claimed about 18 attacks and attempts across Europe (UK, Belgium, France, Netherlands, Greece, North Macedonia) plus two in Canada, targeting synagogues, Jewish community assets, US bank buildings, and Iran International-linked media premises. Other claims include arson on Hatzolah ambulances in north London (23 March), a Finchley Reform Synagogue arson and an attack on Volant Media/Iran International offices (15 April), and the 29 April Golders Green stabbing of two Jewish men. HAYI also claimed a drone attack with radioactive material against the Israeli Embassy in London; police found no hazardous material.

Tradecraft per the indictment as reported: attackers were recruited via social media from local criminal networks (including minors), paid, and tasked remotely. In April, an arson on a Jewish charity building in London was streamed over FaceTime and projected onto a screen bearing the militia's logo, with al-Hassani allegedly instructing the attacker ('light it'); the next day al-Hassani allegedly urged a synagogue attacker to 'light it up like a Christmas tree'. Al-Saadi's WhatsApp, Snapchat, Telegram, and X accounts were linked through a single phone number. Raw footage (for example from the Liege bombing) moved over Telegram and was reused for propaganda. In March al-Saadi asked Mohajeri about joint drone and missile attacks and was told to photograph and video them. In April al-Saadi paid an undercover officer about $3,000 in cryptocurrency (part of a reported $10,000 offer) for a planned Manhattan synagogue attack that never occurred.

The RAF Fairford plot: in August al-Hassani allegedly paid someone to film the base perimeter; in September associates bought vans, fuel barrels, and metal objects usable as shrapnel, and in late September al-Hassani allegedly phoned the drivers of three vans from Iran. At least two were turned back at a roadblock; no explosives were found; seven people were arrested and bailed. The FBI recovered FaceTime recordings, raw attack footage, and messages with a KH contact from al-Saadi's seized iPhone.

Attribution caveats: analysts disagree on whether HAYI is a true IRGC/KH construct or a facade/opportunistic network (RFE/RL, FDD); a teenage suspect in the Antwerp arson was reportedly paid to stage it (NYT via Egypt Independent). Defender relevance: monitor secondary Telegram distribution channels, rapid coordinated post-attack media output, and gig-style recruitment of proxies through social platforms.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1585.001 Establish Accounts: Social Media Accounts
- T1583.006 Acquire Infrastructure: Web Services
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5786 Web access to HAYI / Kataib Hezbollah attributed Telegram channels and Telegram/X handles** (`TL-2026-5786-SPL-001`)

Flags proxy-logged requests to the Telegram channels (Alfaqaar, Safee al-Deen, Sabereen News) and the Telegram/X handles (@MOHAMMED_BAQER1993, @bakr81950) that TL-2026-5786 research attributes to the HAYI front and Mohammad al-Saadi. The threat has no malware or network IOCs, so this is a monitoring detection that tells defenders when hosts or staff touch HAYI distribution infrastructure. Visits can be legitimate (journalism, OSINT, community security), so treat a hit as a lead to triage and not as proof of compromise. The OSINT scan found no community-corroborated siblings, so the pattern list is limited to the published handles.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1102, T1071.001
- **Data sources:** proxy:zscalernss-web, CommonSecurityLog (proxy CEF)
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=proxy sourcetype="zscalernss-web" earliest=-24h
| eval u=lower(url)
| where match(u, "alfaqaar|mohammed_baqer1993|bakr81950|bakr81590|sabereen|safee.{0,3}deen")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(action) as actions by user, cip
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where tolower(RequestURL) matches regex 'alfaqaar|mohammed_baqer1993|bakr81950|bakr81590|sabereen|safee.{0,3}deen'
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 20) by SourceUserName, SourceIP, DeviceVendor
| order by Hits desc
```

### Sigma

```yaml
title: TL-2026-5786 Web Access to HAYI Attributed Telegram and X Handles
id: 5b0c6a1e-3f7d-4c52-9a41-7d2e8b6f1a01
status: experimental
description: Detects proxy requests to Telegram channels and X or Telegram handles attributed to the HAYI front and Mohammad al-Saadi in TL-2026-5786. Monitoring lead only, legitimate research and journalism visits are expected.
references:
    - https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime
    - https://ctc.westpoint.edu/mohammad-baqer-al-saadi-profiling-an-irgc-and-iraqi-militia-operative/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains:
            - 'alfaqaar'
            - 'mohammed_baqer1993'
            - 'bakr81950'
            - 'bakr81590'
            - 'sabereen'
    condition: selection
falsepositives:
    - Journalists, researchers and community-security staff following HAYI channels
    - Threat-intelligence tooling that fetches channel pages
level: medium
```

**Known false positives:**

- Journalists, academics and OSINT analysts who legitimately read HAYI-related channels
- Community-security and law-enforcement liaison staff monitoring the channels

**Tuning notes:** Telegram channel slugs come from public reporting and may differ from the live URL, so refresh the pattern list when new channel names are published. Allowlist known research and security-team users. Zscaler NSS field names (url, user, cip) may need adjusting for other proxies.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5786 Non-browser process contacting Telegram services (locked: unlock with TL Creds)
- TL-2026-5786 Large outbound uploads to Telegram, Snapchat or WhatsApp services (locked: unlock with TL Creds)
- TL-2026-5786 Sustained FaceTime media sessions to Apple relay infrastructure (locked: unlock with TL Creds)
- TL-2026-5786 Reconnaissance of organisation location, staff and event pages (locked: unlock with TL Creds)
- TL-2026-5786 Access to SMS verification and virtual phone number services (locked: unlock with TL Creds)
- TL-2026-5786 Telegram Bot API traffic with regular beacon-like timing (locked: unlock with TL Creds)
- TL-2026-5786 Multi-platform social account signup burst from one user or host (locked: unlock with TL Creds)
- TL-2026-5786 Sustained encrypted traffic to Telegram infrastructure ranges (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Iran-backed network directed London attacks over FaceTime, US prosecutors say](https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime)
- [The Attack Was the Message: The DOJ Indictment and the Operational Model Behind HAYI](https://www.darkowl.com/blog-content/the-doj-indictment-and-the-operational-model-behind-hayi/)
- [Mohammad Baqer al-Saadi: Profiling an IRGC and Iraqi Militia Operative (CTC Sentinel)](https://ctc.westpoint.edu/mohammad-baqer-al-saadi-profiling-an-irgc-and-iraqi-militia-operative/)
- [US charges alleged Iran-backed Kataib Hezbollah suspect - What we know (Al Jazeera)](https://www.aljazeera.com/news/2026/5/16/us-charges-alleged-iran-backed-%e2%81%a0kataib-hezbollah-suspect-what-we-know)
- [HAYI: Iran attacks on Jewish centers in Europe (RFE/RL)](https://www.rferl.org/a/hayi-iran-attacks-europe-jewish-centers/33734573.html)
- [U.S. Indicts Dual Iranian-Iraqi National Over Alleged Global Terror Network Linked to IRGC (Kurdistan24)](https://www.kurdistan24.net/en/story/916887/us-indicts-dual-iranian-iraqi-national-over-alleged-global-terror-network-linked-to-irgc)
- [Gig Economy Terrorism: Ashab Al-Yamin's Rise Brings New Terror Threat to Europe (MEF)](https://www.meforum.org/mef-online/gig-economy-terrorism-ashab-al-yamins-rise-brings-new-terror-threat-to-europe)
- [Two people stabbed in north London area of Golders Green (Euronews)](https://euronews.com/2026/04/29/two-people-stabbed-in-north-london-area-of-golders-green-jewish-groups-say)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5786