US prosecutors unseal charges against three men in Iran-backed network that directed 18 claimed attacks across Europe over FaceTime
US prosecutors charged three men in an Iran-backed network accused of directing arson, a stabbing and plots across Europe for the IRGC, including London attacks streamed over FaceTime. The indictment shows attackers were guided remotely and recorded for propaganda, linking encrypted consumer calls to kinetic violence. It matters because communities, military-linked sites and financial buildings were exposed, and detection becomes harder when violence is coordinated through private platforms.
A superseding indictment unsealed Tuesday charges Mohammad al-Saadi, Mohsen Mohajeri and Mohammed Ali al-Hassani with terrorism offenses tied to an Iran-backed campaign across Europe. Prosecutors say the network directed arson against synagogues and Jewish sites in London, Belgium and the Netherlands, a stabbing in London, and attacks on U.S. bank buildings in Amsterdam and Paris. The alleged plot also targeted RAF Fairford, a British air base used by U.S. bombers, with vans and intended explosives while FaceTime calls relayed instructions. Mohajeri and al-Hassani are at large and believed to be in Iran.
The evidence trail includes images of suspects directing attacks from a room in Iraq, recordings of instructions and footage captured during assaults. Prosecutors say al-Saadi's iPhone, seized after his detention in Turkey in May, contained FaceTime recordings, raw attack footage and messages with a Kataib Hezbollah contact. In one April London arson, al-Hassani allegedly told the attacker to 'light one in your hand,' 'light it' and 'throw the fourth one,' as the scene was streamed over FaceTime. FaceTime is end-to-end encrypted, but investigators obtained recordings.
The indictment fits a pattern Western authorities call hybrid warfare: state-linked actors using proxies, social media and consumer apps to stage attacks and turn them into propaganda. HAYI, described as a front for Kataib Hezbollah and the IRGC, claimed about 18 attacks between March and April, days after U.S. and Israeli strikes on Iran. Police found no hazardous material after a claimed radioactive drone attack. Using FaceTime for command and control shifts encrypted platforms from covert communication into a live operational channel for violence.
The case puts Jewish communities, U.S. and British military-linked infrastructure, and European financial sites squarely in the crosshairs, while showing how remote direction can make small cells harder to detect before an attack. It also complicates the platform question: encryption protects users from interception, yet recordings and device seizures can still expose crimes after the fact. For threat intelligence, the operational lesson is that consumer video calls have become command-and-control for physical harm, not just messaging.
Jewish communities, U.S. and British military-linked sites and European financial buildings are exposed to remotely directed attacks, while law enforcement and tech platforms face harder detection questions when encrypted calls are used to coordinate violence.
Sources (1)
- [1]Original source(https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime)