Legal papers, expert investigations and social media posts tell story of how a 32-year-old Iraqi appeared to run ‘proxy’ campaign
On Monday, a slightly dishevelled Iraqi man, shackled and dressed in beige prison overalls, was ushered into a Manhattan courtroom.
Mohammad Baqer Saad Dawood al-Saadi, 32, pleaded not guilty to a series of terrorism-related offences, then gestured toward the judge and prosecutors. “I’m a prisoner of war. I’m not a threat,” he told them. “Children and women are being killed by your rockets.”
Then, al-Saadi, who faces life behind bars, was led away.
The brief hearing was the latest chapter in an extraordinary story that appears far from over. It involves: two powers at war; one of the most high-profile terrorist campaigns in Europe and the UK for many years; a new form of warfare to which western security services have yet to find an answer; teenage petty criminals caught up in geopolitics; Islamist militia in Iraq; and, inevitably for 2026, the disruptive power of social media.
The man who brought it all together, investigators say, was al-Saadi.
The story begins a week after the joint US-Israeli offensive that started the war with Iran when, in the dead of night, someone posted a series of messages on Telegram and Snapchat that appeared to send secret instructions to terrorist networks in Europe.
Calling on the “Shadow Soldiers”, the messages gave “permission to all silent cells for work” and included a code of three letters and nine numbers apparently indicating specific teams or individuals.
Fifty-two hours later, a makeshift bomb exploded outside a synagogue in Liège, Belgium. Then came attacks on a synagogue in Rotterdam and a Jewish school in Amsterdam, where a bomb also targeted a branch of the Bank of New York Mellon. Finally, the violence crossed the Channel. On 23 March, CCTV cameras captured three people setting light to four ambulances belonging to a Jewish charity in north London.
In all, 18 such attacks were launched between early March and the end of April. Most targeted Jewish schools or places of worship, with the UK a particular focus. No one died but the campaign caused great fear in a community already suffering heightened levels of hostility and violence. It also triggered much concern among public and security officials.
Responsibility for many of the attacks was claimed within hours, sometimes minutes, by a previously unknown organisation: Harakat Ashab al-Yamin al-Islamia (HAYI). This prompted a wave of media speculation about a new militant Islamist group targeting Europe, with some invoking the example of Islamic State or even al-Qaida.
In fact, court documents show HAYI was one man: al-Saadi, who ran the attacks from an office in Baghdad.
Michael Knights, an expert in Iraqi militia at Horizon Engage, a strategic advisory company based in New York, said al-Saadi had been recruited in his early 20s into a Shia militia created by Tehran after the US-led invasion of Iraq in 2003. Al-Saadi was deployed to Syria when Shia militia forces were sent by Iran to bolster the regime of Bashar al-Assad. There, he often exaggerated his combat experience.
Al-Saadi also took part in the fight against Islamic State in Iraq alongside his militia comrades. Though his exact role is unclear, social media posts suggest his activities included assassination, abduction and possibly sourcing and distributing weapons.
But what is evident is that this brash and ambitious young man had excellent connections with very senior Iranian officials, particularly within the Iranian Revolutionary Guard Corps (IRGC), the paramilitary wing of the radical clerical regime that took power in Tehran in 1979.
Al-Saadi’s mentor appears to have been Qassem Soleimani, an almost mythical figure in the world of Shia militant movements who founded and led the IRGC’s Quds Force, which handles overseas operations. According to one investigator, al-Saadi was with Soleimani when he was hit by a US drone strike in Iraq in 2020 and cradled the body of his dying mentor. Enemies dismissed al-Saadi as Soleimani’s “brat”.
Over the following years, al-Saadi travelled extensively, posting selfies in Paris and Malaysia, and possibly visiting Austria. Knights said he was involved in procurement networks, sourcing drones and components across Europe and beyond.
Stamps in al-Saadi’s Iraqi “government service” passport reveal a trip in August 2023 to Spain. A 12-month Italian visa, which would have granted access to the whole Schengen zone, was granted that year but later cancelled. Al-Saadi posted online that he had been refused entry to Italy when travelling with a government delegation – a suggestion that at least some EU security officials knew about his activities.
“He was definitely known in Europe. If the FBI had enough info to get him, then others did too,” said a legal source with close knowledge of the US investigation.
Images also show al-Saadi at an official Iranian government stand at a major arms fair in Moscow, possibly in 2024.
Phillip Smyth, an independent US-based analyst specialising in Iraqi Shia militia, said: “In Moscow, he could have been learning about clandestine operations. In Europe, he could have been sorting out just the logistics of that kind of activity … meeting the [Iranian] diplomats in post in Paris for example and arranging secret means of communication or whatever.”
When back in Iraq, al-Saadi was involved in online “information operations”, another key component of what security experts call “hybrid warfare”, as pioneered by Russia. He helped manage a network of Telegram channels pumping out propaganda for the Iran-run Shia militia. He was also very active on his own social media accounts, usually in his own name.
“He’s in his 30s, in the Middle East, and so he’s living his life online … but you can operate in and out of the shadows and that can be very effective,” Smyth said.
When war with the US and Israel came, some analysts believe al-Saadi was given clear instructions by IRGC handlers in Tehran. He had travelled there in late January and met Ayatollah Ali Khamenei, the then supreme leader. Others suggest he was kept at arm’s length to maintain “plausible deniability” for Iran of what was to follow.
Both fit a broader pattern of Iran using proxies to carry out strategic tasks overseas that its own security services are unwilling or unable to execute themselves. Historically, this has included terrorism against Jewish and Israeli targets around the world.
US court documents, interviews with lawyers, independent investigations by experts and media reports have allowed the “proxy” campaign that followed to be reconstructed in detail.
Researchers said the trigger message on 7 March was posted on “very active” Telegram channels associated with Iran-backed militia in Iraq, as well as Snapchat.
“Al-Saadi was not running those channels and was not alone,” said Julian Lanchès, of the International Centre for Counter-Terrorism in The Hague, which tracked the posts.
Soon, claims of responsibility for attacks were arriving from HAYI, sometimes within minutes and accompanied by images.
According to the US indictment, images on al-Saadi’s mobile phone taken on 18 April during an arson attack on a synagogue in north-west London show him and three or four other men on a video call, which is projected on to a large screen against the background of the HAYI logo. In the video, one of the men, in English, tells someone to take and throw a lighter.
Eleven days later – when two Jewish men were stabbed in north London – al-Saadi instructed a contact in a Shia militia group in Iraq to “post it in the news[,] important”. Very soon afterwards, a HAYI claim appeared on Telegram, despite, investigators believe, al-Saadi having nothing to do with the attack. Hours later, al-Saadi told his contact: “If God grants us success tonight, there will be a shooting at a restaurant.”
This attack, potentially a significant escalation, never happened. Within hours, al-Saadi was detained in a hotel in Istanbul by Turkish security services. Just before disappearing into an underground prison, he managed to post a short video calling on his family to “remain steadfast”.
Two weeks later, he was flown to the US where authorities said he had been seeking help with attacks on Jewish communities there and had discussed targeting Donald Trump’s elder daughter, Ivanka. Al-Saadi had been unaware that his primary interlocutor in the US, a supposed Mexican drugs cartel member, was an FBI agent.
There have been no new attacks since the arrest of al-Saadi. Analysts believe Tehran will see the effort as a significant success and will be worried about what their detained operative might say, but not his loss.
Al-Saadi was not the only “disposable agent”. In the UK, France and Belgium there are dozens facing lengthy prison terms. Many are minors, often with a history of involvement in drugs as couriers or in other low-level roles. A significant number were recruited on social media, where they were offered as little as €300 for completing what appeared straightforward if illegal tasks. Some seem to have had little idea of the nature of their targets – or the consequences of getting caught.
Chantal Van den Bosch, a lawyer representing a 17-year-old arrested for the firebombing of a car on the edge of a Jewish neighbourhood in Antwerp in March, said her client and an alleged accomplice thought the attack was related to crime and drugs.
“Whoever gave them the job knew they would be arrested within 15 minutes – they are being used. They are completely replaceable,” she said last week. “It is just a way of destabilising a community. It’s very easy to divide people.”