The U.S. accused three men of orchestrating attacks across Europe on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), including a London arson incident that was recorded for propaganda.

An indictment unsealed Tuesday says the broader campaign, targeting Jewish and American sites, included attacks on synagogues in Belgium, the Netherlands and London, and U.S. bank buildings in Amsterdam and Paris. It also included a stabbing in London that left two Jewish men seriously injured.

Prosecutors say the same network later plotted to attack RAF Fairford, a British air base used by U.S. bombers, with vans and what the plotters intended to be explosives. During the attack one suspect directed the vans toward the base by phone from Iran, while another, already jailed in New York, relayed coded instructions through calls with relatives.

The superseding indictment adds two defendants to a case against Mohammad al-Saadi, an alleged commander of the Iran-backed Iraqi militia Kataib Hezbollah who has been jailed in New York since May.

The additional defendants are Mohsen Mohajeri, whom prosecutors identify as an IRGC operative, and Mohammed Ali al-Hassani, an Iraqi who once lived in Britain. Both are at large and believed to be in Iran. All three face terrorism charges carrying potential life sentences.

Prosecutors say that recording the attempted attacks for propaganda was an essential part of the network’s operations. The indictment includes images of them directing attacks from a room in Iraq, as well as recordings of instructions given to the attackers.

During an arson attack on a Jewish charity's building in London in April, al-Hassani told the attacker to “light one in your hand,” “light it” and “throw the fourth one,” according to the indictment. The attack was streamed over FaceTime and projected onto a large screen with the militia’s logo. The IRGC operative filmed the proceedings and the men directing it.

Two days earlier, al-Hassani allegedly directed another arson attack on Iran International, a London-based media organization that has repeatedly faced attacks from the Iranian regime.

Again over a video call, al-Hassani told the attacker to get close to the gate and ensure he could see what was happening on camera. During another attack on a London synagogue the following day, he urged the attacker to “light it up like a Christmas tree.”

In March, when al-Saadi asked the IRGC operative Mohajeri about working with his militia on joint attacks involving drones and missiles, Mohajeri agreed and told him to “make sure to photograph a video and pictures.”

The attacks were claimed by a group calling itself Harakat Ashab al-Yamin al-Islamiya, or HAYI, which prosecutors describe as a front for Kataib Hezbollah and the IRGC. The group claimed about 18 attacks and attempted attacks across Europe between March and April, beginning days after the United States and Israel launched strikes on Iran.

HAYI also claimed that drones carrying radioactive material had targeted the Israeli Embassy in London, although police found no hazardous material after investigating the incident. Al-Saadi had received videos days earlier showing men in hazmat suits posing beside a drone that had been fitted with vials of an unspecified white powder.

Hybrid Theory

The new indictment gives the most detailed account yet of how the attacks were directed from afar — drawing on recordings, images and messages exchanged across several apps — and comes amid concerns over what Western authorities describe as “hybrid warfare” and “state-sponsored terrorism.”

Much of the evidence comes from al-Saadi's own iPhone, which FBI agents seized after he was first detained in Turkey in May. Prosecutors say it contained recordings of FaceTime calls, raw attack footage and messages with a Kataib Hezbollah contact.

FaceTime calls are end-to-end encrypted, meaning Apple cannot access their content while the calls are ongoing, however investigators were able to obtain recordings stored on al-Saadi’s seized phone.

The seizure of this evidence comes amid disputes over law enforcement access to encrypted data, particularly in Europe and the United Kingdom.

Apple is currently challenging a reported British demand for access to protected iCloud data, while the European Commission has outlined plans to explore technical options for lawful access to encrypted evidence.

Images in the new indictment show what prosecutors say are Mohajeri and al-Hassani planning attacks while sitting in front of a laptop displaying a map of London, as well as stills from videos of the men directing attacks live.

Earlier images of al-Saadi show him mingling with senior Iranian and militia commanders. These came from his phone and social media accounts, prosecutors said. The FBI linked his WhatsApp, Snapchat, Telegram and X accounts through a single phone number.

Earlier filings say al-Saadi received raw footage of a bombing of a synagogue in Liège, Belgium, through Telegram and used the app to send footage of an arson attack on Jewish volunteer ambulances in London to a contact saved in his phone as a China-based media company.

Prosecutors also say al-Saadi paid an undercover officer about $3,000 in cryptocurrency in April, which was related to a planned attack on a Manhattan synagogue. The nature of the transaction was not detailed, and no attack took place.

In August, al-Hassani allegedly paid someone to film the perimeter of the RAF Fairford airbase, which houses U.S. military aircraft and personnel. The following month, paid associates bought vans, barrels of fuel and metal objects that could serve as shrapnel, and researched buying chemicals, according to the indictment.

During the alleged attempted attack towards the end of that month, al-Hassani was described as being in frequent contact by phone with the drivers of three vans heading toward the base, directing their movements from Iran, prosecutors say. It is not clear whether he used normal voice calls or communicated via an app.

At least two of the vans were turned back at a security roadblock. British authorities recovered the vehicles in the early hours of the next morning and arrested their occupants. Police said at the time they found no explosives but seized petrol. Seven people were arrested and released on bail.

Apple, Snap, X and Meta, which owns WhatsApp, did not immediately respond to requests for comment. Al-Saadi's X account, which the FBI says had posted calls for revenge against Americans as early as 2020, remained online Wednesday.