A CNN investigation published today detailed how apparent Iran-linked networks allegedly recruit Europeans online for surveillance, arson attacks and other operations targeting Jewish and Israeli-linked sites across Europe.

According to the report, journalists posing as London-based Telegram users found channels openly advertising “high-paid agents” for covert activity. One account allegedly connected to the network told CNN it was looking to “hire anyone who can harm Israeli interests or individuals.”

The investigation centered on a group calling itself Harakat Ashab al-Yamin al-Islamia, or HAYI, which emerged online in March and has claimed responsibility for at least 17 attacks across Britain and Europe. The incidents included arson attacks targeting synagogues, Jewish neighborhoods, volunteer ambulances and businesses in London, Antwerp and other cities.

CNN reported that recruiters allegedly begin with smaller assignments, including hanging posters or filming minor acts of vandalism, before escalating to more serious surveillance or violent operations. Experts interviewed by CNN said the structure resembles a layered proxy system in which operatives connected to Iran’s IRGC recruit low-level criminals or financially desperate individuals to carry out attacks while shielding higher-ranking organizers.

The report also cited Israeli espionage cases in which suspects allegedly recruited through Telegram were accused of photographing military bases, filming sensitive facilities and carrying out intelligence-gathering missions for Iranian handlers. Israeli authorities say at least 60 Israelis have been indicted on allegations of spying for Iran since 2023.

British counterterrorism officials said investigators are examining whether Iran-linked groups are increasingly relying on “violence as a service” by paying recruits with little ideological connection to the cause. Security experts warned the attacks could become more dangerous as the networks expand operations across Europe.