WorldWideWatchers: AI-Powered OSINT & Global Threat Intelligence

1. BLUF (Bottom Line Up Front)

In early 2026, the Islamic Revolutionary Guard Corps (IRGC) Quds Force reportedly directed the proxy group Harakat Ashab al-Yamin al-Islamiya (HAYI) to conduct at least 17 attacks targeting Jewish communities, Iranian journalists, and U.S. interests across Europe, including Belgium, the Netherlands, and the UK. These attacks were publicly claimed by HAYI, marking a notable shift toward more overt proxy operations. The British government and allied intelligence agencies attribute orchestration to the Quds Force. Confidence in this assessment is moderate given reliance on a single source with no detected contradictions.

2. Key Judgments — IRGC Quds Force Proxy Attacks in Europe

1. The IRGC Quds Force directed HAYI to execute multiple violent attacks against Jewish, Iranian dissident, and U.S. targets in Europe in early 2026.
2. HAYI publicly claimed responsibility, indicating a tactical shift toward combining clandestine proxy attacks with overt intimidation messaging.
3. British authorities and allied intelligence agencies attribute operational orchestration to the IRGC Quds Force, though independent corroboration is limited.

3. Analysis of Competing Hypotheses (ACH)

ACH Assessment: Hypothesis A is currently best supported due to alignment between the proxy group’s public claims, British government attribution, and the consistent targeting pattern. The absence of contradictory information weakens alternative hypotheses but does not eliminate them, reflecting information gaps and reliance on a single source. No material contradictions were detected, but the limited source diversity constrains confidence.

4. Key Assumption Check (KAC)

• Critical Assumptions:
  • The single source (jns.org) accurately reflects intelligence assessments and attack details — if false, attribution and scale may be overstated.
  • HAYI’s public claims are genuine and not opportunistic or coerced — if false, the proxy’s role and IRGC involvement could be mischaracterized.
  • British government attribution is based on credible intelligence rather than political framing — if false, the narrative may reflect bias or strategic messaging.
• Information Gaps:
  • Independent verification from European intelligence and law enforcement agencies on attack attribution and operational links.
  • Technical forensic evidence from attack sites to confirm methods and signatures consistent with IRGC proxy operations.
  • Detailed organizational and command structure of HAYI to assess autonomy versus IRGC control.
• Bias & Deception Risks:
  • Single-source reliance introduces selection bias and potential framing bias aligned with source interests.
  • No detected conflicting narratives reduces immediate cry wolf risk but raises concern about echo chamber effects.
  • Potential adversary deception cannot be ruled out without multi-source corroboration.

5. Implications and Strategic Risks — Europe and Iranian Proxy Activity

This emerging pattern of overt proxy attacks in Europe signals a possible escalation in Iran’s asymmetric operations beyond traditional clandestine methods, potentially increasing regional security challenges and complicating counter-terrorism efforts. The public claims by HAYI may be designed to amplify intimidation and political messaging, affecting diaspora communities and diplomatic relations.

Political / Geopolitical — European Governments and Iran Relations

European states may face increased pressure to respond diplomatically and security-wise to Iran’s proxy activities, potentially straining Iran-Europe relations and impacting broader negotiations on nuclear and regional issues. Public attacks on diaspora and dissident groups could fuel domestic political debates on immigration, security, and foreign policy.

Security / Counter-Terrorism — European Law Enforcement and Intelligence

European security agencies will need to enhance monitoring of proxy groups like HAYI and their networks, improve inter-agency intelligence sharing, and prepare for potential escalation or retaliatory attacks. The shift to overt claims complicates attribution but may also provide new intelligence avenues.

Cyber / Information Space — Influence and Messaging Operations

The public claims by HAYI suggest a coordinated information strategy to amplify fear and signal capability, potentially accompanied by cyber or disinformation campaigns targeting Jewish, Iranian dissident, and Western audiences. Monitoring online narratives and social media channels linked to HAYI and IRGC proxies is critical.

Economic / Social — Diaspora Communities in Europe

Jewish communities, Iranian expatriates, and U.S. interests in Europe may experience heightened security risks and social tensions. This could lead to increased community security expenditures, potential migration shifts, and social polarization within host countries.

6. Recommendations and Outlook

• Immediate Actions (0–30 days): Enhance intelligence collection on HAYI’s activities and IRGC Quds Force operational footprints in Europe; increase security measures at vulnerable community sites; monitor public claims and related information operations.
• Medium-Term Posture (1–12 months): Foster intelligence sharing partnerships among European and allied agencies; develop counter-proxy operational doctrines; support community resilience initiatives; conduct forensic and HUMINT investigations to clarify command and control.
• Scenario Outlook:
  • Best: Proxy attacks remain limited and deterred by enhanced security cooperation.
  • Worst: Escalation into broader asymmetric campaign including cyber and kinetic attacks across Europe.
  • Most Likely: Continued episodic proxy attacks with public claims, sustaining a low-intensity but persistent threat environment.

7. Key Individuals and Entities

8. Thematic Tags

Counter-Terrorism, proxy warfare, Iran, IRGC Quds Force, European security, asymmetric threats, diaspora targeting