Iran-Backed Network Directed European Attacks Over FaceTime, US Prosecutors Allege
US prosecutors have indicted an Iran-backed network for a broad campaign targeting Jewish and American sites across Europe, allegedly directing attacks via FaceTime.
US prosecutors have unsealed an indictment against three men accused of orchestrating a wide-ranging campaign of attacks across Europe on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC). The indictment details a series of assaults targeting Jewish and American sites, including arson attacks on synagogues in Belgium, the Netherlands, and London, as well as attacks on U.S. bank buildings in Amsterdam and Paris. Notably, the network allegedly employed FaceTime for command and control, a tactic highlighted by prosecutors as an unusual vector for directing such operations.
The superseding indictment adds two defendants, Mohsen Mohajeri, identified as an IRGC operative, and Mohammed Ali al-Hassani, an Iraqi who formerly resided in Britain, to an existing case against Mohammad al-Saadi, an alleged commander of the Iran-backed Iraqi militia Kataib Hezbollah. Both Mohajeri and al-Hassani are believed to be in Iran and at large. All three defendants face terrorism charges that carry potential life sentences.
Prosecutors assert that recording the attacks for propaganda purposes was a central element of the network's strategy. The indictment includes evidence such as images of the men directing attacks from a room in Iraq and recordings of instructions provided to the attackers. During an arson attempt on a Jewish charity’s building in London in April, al-Hassani allegedly instructed an attacker via video call to "light one in your hand," "light it," and "throw the fourth one." This attack was reportedly streamed live over FaceTime and projected onto a large screen bearing the militia’s logo, with the IRGC operative filming the proceedings.
Further details reveal al-Hassani's alleged involvement in directing other attacks. Two days prior to the London charity incident, he is accused of directing an arson attack on Iran International, a London-based media organization frequently targeted by the Iranian regime. Over a video call, al-Hassani reportedly instructed the attacker to position themselves near the gate and ensure a clear view for the camera. The following day, during an attack on a London synagogue, he urged the attacker to "light it up like a Christmas tree."
The indictment also outlines a broader plot that included targeting RAF Fairford, a British air base utilized by U.S. bombers. Prosecutors claim the network plotted to attack the base using vans and explosives. During this alleged attempt, one suspect reportedly directed the vans toward the base via phone from Iran, while another, already detained in New York, relayed coded instructions through calls with relatives. In March, al-Saadi and Mohajeri allegedly discussed joint attacks involving drones and missiles, with Mohajeri agreeing and emphasizing the importance of documenting the operations with photos and videos.
The attacks were claimed by a group known as Harakat Ashab al-Yamin al-Islamiya (HAYI), which prosecutors describe as a front organization for Kataib Hezbollah and the IRGC. HAYI claimed responsibility for approximately 18 attacks and attempted attacks across Europe between March and April, commencing shortly after U.S. and Israeli strikes on Iran. The group also falsely claimed responsibility for drone attacks carrying radioactive material targeting the Israeli Embassy in London, though no hazardous materials were found by authorities.
Much of the evidence presented by prosecutors stems from Mohammad al-Saadi's iPhone, seized by FBI agents after his detention in Turkey. The phone reportedly contained recordings of FaceTime calls, raw footage of attacks, and messages exchanged with a Kataib Hezbollah contact. While FaceTime calls are end-to-end encrypted, investigators were able to access recordings stored on the seized device. This evidence collection comes amidst ongoing debates regarding law enforcement access to encrypted data, particularly in Europe and the United Kingdom.
The indictment provides an unprecedentedly detailed account of how these operations were directed remotely, utilizing recordings, images, and messages from various applications. This case underscores concerns among Western authorities regarding "hybrid warfare" and "state-sponsored terrorism," illustrating sophisticated methods employed by state-backed actors to conduct covert operations abroad.