DOJ Indictment Sheds Light on HAYI’s Alleged Attack-and-Media Network
Summary
A DOJ indictment alleges that Kata’ib Hezbollah operative Mohammad Baqer al-Saadi coordinated HAYI attacks and propaganda. DarkOwl’s Telegram monitoring highlights how attack footage and messaging were distributed through affiliated channels.
Key points
- The indictment alleges Al-Saadi coordinated nearly 20 attacks and attempted attacks across Europe and North America in HAYI’s name.
- Prosecutors say he joined live video calls during attacks, recorded footage, and coordinated its release through Telegram channels.
- Al-Saadi reportedly described propaganda as psychological warfare and said he managed media, strategy, and military intelligence.
- DarkOwl’s monitoring identified Al Faqaar as an early distribution node and found Sabereen News branding in HAYI-affiliated video content.
- The article describes HAYI as an alleged front brand within a broader Iranian-aligned network, rather than a standalone group.
- The indictment alleges attempts to arrange attacks in the United States, including against a New York City synagogue; Al-Saadi was detained in Turkey.
Article Details
- Attack Vectors
- Alleged arson attacks, rudimentary bombings, stabbings, and a claimed drone operation.
- Prosecutors allege local recruits were coordinated in real time through FaceTime calls during attacks.
- Attack footage and propaganda were produced and disseminated through Telegram channels as part of the operations.
- Defensive Notes
- Monitor amplification and distribution channels associated with a threat brand, not only its primary channel, which may be removed or banned.
- Treat rapid media response and 'lone wolf' framing as potential indicators of coordinated activity rather than proof of independent action.
- Assess whether attack planning and propaganda distribution share a command structure.
People
Crispin SmithCo-authored a CTC Sentinel profile of Al-Saadi cited in the article.Guy FiennesAuthored an ISD Digital Dispatch cited in the article.KhameneiThe article reports Al-Saadi said he met Iran’s then-Supreme Leader approximately three days before the conflict with Iran began in February 2026.Michael KnightsCo-authored a CTC Sentinel profile of Al-Saadi cited in the article.Mohammad Baqer Saad Dawood Al-SaadiIndicted by the DOJ for alleged terrorism-related offenses; prosecutors allege he coordinated HAYI-linked attacks and their media amplification.Qassem SoleimaniThe article says Al-Saadi described himself as close to Soleimani and said he traveled with him.
Threat Actors
Harakat Ashab al-Yamin al-IslamiaAlso called HAYI in the article; prosecutors allege the group was a front associated with Kata’ib Hezbollah and other designated terrorist organizations.Iran’s Islamic Revolutionary Guard CorpsThe article describes Al-Saadi as an alleged senior operative of the IRGC and reports his activity within IRGC-aligned networks.Kata’ib HezbollahThe DOJ alleges Al-Saadi was a senior operative and that HAYI was a front of Kata’ib Hezbollah and other designated terrorist organizations.
Products
DarkOwl VisionAnalysis for this blog was conducted using DarkOwl Vision, through targeted tracking of Telegram channels associated with HAYI and the broader Iranian-aligned amplification network.FaceTimeAccording to prosecutors, Al-Saadi participated in live FaceTime calls with attackers while operations were underway, recorded those attacks, helped produce propaganda videos, and coordinated dissemination in parallelSnapchatThe authors document that Al-Saadi sent HAYI’s launch statement and associated iconography via his Snapchat account more than four hours before it circulated publicly, indicating, as they put it, “his advancedTelegramDarkOwl began monitoring HAYI’s Telegram footprint in April 2026.ZainCash€600 via Snapchat), real-time tactical coordination via video call, payments made via cryptocurrency and ZainCash, and propaganda production and distribution run through the same command structure as the attacks
Countries
CanadaTwo additional attacks in Canada are also alleged.Iranwith terrorism-related offenses for his alleged role as a senior operative of Kata’ib Hezbollah and Iran’s Islamic Revolutionary Guard Corps (IRGC).IraqSpotlight platform, he reportedly fought in Syria around 2016 in support of Assad’s forces and returned to Iraq to participate in operations against the Islamic State.SyriaMay 2026 by Crispin Smith and Michael Knights of the Militia Spotlight platform, he reportedly fought in Syria around 2016 in support of Assad’s forces and returned to Iraq to participate in operations against theTurkeyOn April 30, 2026, the day before his detention while traveling in Turkey, he called an individual in the United States and asked whether that person knew “someone who could ‘attack’ in the United States, including byUnited KingdomUnited StatesThe indictment covers nearly 20 attacks and attempted attacks across Europe and the United States, all carried out in the name of Harakat Ashab al-Yamin al-Islamia (HAYI), a group that first emerged publicly in March