Mohammad Baqer Saad Dawood al-Saadi, a 32-year-old Iraqi operative, is currently facing life in prison after a US federal court indictment linked him to a transnational campaign of terror across Europe and the UK. Investigations reveal al-Saadi utilized social media and Telegram to orchestrate attacks on Jewish targets, marking a shift toward “hybrid warfare” where disposable, low-level criminals are recruited for geopolitical agendas.
How Hybrid Warfare Uses Disposable Proxies
Security experts define the campaign orchestrated by al-Saadi as a modern iteration of hybrid warfare. According to Michael Knights of the strategic advisory company Horizon Engage, al-Saadi was recruited into a Shia militia in his early 20s following the 2003 US-led invasion of Iraq. His activities evolved from regional combat in Syria and Iraq to coordinating international logistics. US court documents indicate al-Saadi utilized a previously unknown organization, Harakat Ashab al-Yamin al-Islamia (HAYI), to claim responsibility for 18 attacks between early March and late April 2026. These attacks targeted Jewish schools and places of worship in Belgium, the Netherlands, and the UK. Legal experts, including Chantal Van den Bosch, observe that the organizers intentionally recruited minors and petty criminals, often offering as little as €300 to perform tasks they may not have fully understood.
Investigators believe that while al-Saadi managed the HAYI brand to create the illusion of a large militant group, he was often a singular operator. In one instance, he instructed a contact to claim responsibility for a stabbing in London that he had no actual role in orchestrating.
The Role of Digital Channels in Clandestine Operations
The campaign relied heavily on the disruptive power of digital platforms to bypass traditional security barriers. According to Julian Lanchès of the International Centre for Counter-Terrorism, the initial “permission” for these attacks was broadcast via Telegram and Snapchat in March 2026. Al-Saadi, who had deep ties to the Iranian Revolutionary Guard Corps (IRGC) and the late Qassem Soleimani, used these channels to maintain a presence in the shadows. Phillip Smyth, an independent analyst, notes that al-Saadi’s background in online information operations allowed him to manage propaganda networks effectively. By operating online, he could coordinate with disparate cells across Europe while maintaining a degree of separation from his handlers in Tehran.
What Happens to the Network After an Arrest?
Following al-Saadi’s detention in an Istanbul hotel, the wave of attacks ceased, suggesting the network was highly centralized around his specific digital reach. While US authorities have successfully apprehended him, the broader concern for security services remains the “disposable” nature of his recruits. Many of these individuals, now facing long prison sentences in the UK, France, and Belgium, were caught through the same digital trail that led to al-Saadi. Despite the arrest, the precedent set by using social media to turn petty criminals into tools of international conflict presents a significant challenge for Western security agencies moving forward.
When tracking modern security threats, look for the intersection of digital propaganda and localized crime. The “HAYI” case demonstrates how state-backed actors now leverage existing local criminal networks to achieve strategic goals with minimal direct risk to themselves.
Frequently Asked Questions
Who was the primary target of the HAYI attacks?
The campaign primarily targeted Jewish schools, synagogues, and other community sites across Europe, with a specific focus on the UK, according to US court documents.
Was al-Saadi acting alone?
While court documents suggest al-Saadi was the central figure behind the HAYI persona, he operated within a network of Shia militias and maintained connections with senior IRGC officials. He also utilized local recruits in various European countries to carry out the physical acts.
How were the recruits contacted?
Recruits were largely sourced via social media platforms, where they were offered small financial payments for tasks that were often criminal in nature, according to legal representatives like Chantal Van den Bosch.
Stay informed on the latest developments in global security and geopolitical trends. Subscribe to our newsletter for deep-dive analysis delivered to your inbox.
