Since the US-Israel strikes on Iran began on February 28, 2026, a wave of attacks linked to Iran-backed networks has struck European cities and Canadian targets — with at least 20 incidents attributed to a single Kata’ib Hizballah commander now facing trial in New York. European security services are operating at their highest alert levels since the 2016 terrorist attacks on Brussels and Paris, and intelligence agencies say the threat has not peaked.
When the first US aircraft crossed into Iranian airspace on February 28, 2026, the conflict that followed was understood primarily as a regional war: a military campaign targeting Iran’s nuclear and military infrastructure, fought by air forces operating over the Middle East, with consequences concentrated in the Strait of Hormuz, the Persian Gulf, and the adjacent countries that fell within Iranian missile range.
That framing missed something. The Iran war did not stay in the Middle East. Within weeks of the February 28 strikes, a pattern of violence began appearing in the streets of European cities that would, by the time of the first significant arrest in May, amount to at least 20 documented attacks and attempted attacks across Europe and North America — all attributed to an Iran-backed network, all explicitly framed as retaliation for the war, and all directed at Western and Jewish targets.
The Attack Pattern: What Happened Where
An Iraqi national carried out 20 reported terrorist attacks in Europe and Canada against US and Israeli interests, including the stabbing of a Jewish-American citizen, in retaliation for the war in Iran. Mohammad Baqer Saad Dawood Al-Saadi allegedly firebombed a Bank of New York Mellon building in Amsterdam, tried to detonate improvised explosives at the Bank of America building in Paris, coordinated an attack against Jewish institutions in the United States and stabbed two people in London.
The geographic spread of the attacks attributed to Al-Saadi’s network — Amsterdam, Paris, London, Germany, Canada — reflects the distribution of Iran-aligned diaspora networks across Western Europe and North America. These are not isolated individuals radicalised in the week after the strikes began. Al-Saadi himself has been connected to Kata’ib Hizballah and the IRGC since at least 2017, and has interacted with Qasem Soleimani, killed by a US drone in 2020.
What changed on February 28 was not the existence of the network. It was the activation of the network, under a specific operational mandate: retaliate against Western targets in countries supporting the US-Israel war.
The target selection was coherent. American-branded financial institutions — Bank of New York Mellon, Bank of America — chosen for their association with US economic power. Jewish individuals and community institutions — chosen for their association with Israel. US diplomatic interests, where accessible. The pattern is one of political violence directed at symbolic representations of the adversary rather than random terrorism.
The Foiled NYC Synagogue Plot
An Iraqi national accused of plotting at least 18 terror attacks in Europe in retaliation for the US and Israel’s war in Iran has been arrested and charged with supporting Iran-backed terrorist organisations. “This case puts into stark relief the global threats posed by the Iranian regime and its proxies like Kata’ib Hizballah — Foreign Terrorist Organisations that have repeatedly targeted Jewish communities across Europe and the United States since the war began.”
The New York element of the plot — a planned attack on a synagogue in New York City — was foiled before it could be executed. The arrest of Al-Saadi in May, and the unsealing of the criminal complaint, revealed the full scope of the network that had been operating across multiple countries simultaneously. The New York plot was, in the prosecution’s framing, the extension of the same campaign that had already struck European targets.
The fact that the network reached from Amsterdam to Paris to London to New York — and was apparently coordinated by a single commander — speaks to the sophistication of the Kata’ib Hizballah operational structure that Soleimani built and that his successors have maintained.
European Security Services: Highest Alert Since 2016
The 2016 coordinated terrorist attacks on Brussels — killing 32 people in the Zaventem airport and Maalbeek metro station bombings — and the 2015 Paris attacks that killed 130 people were the last moments at which European counter-terrorism services operated at their current level of mobilisation.
After the Iran war began, European security agencies raised threat levels across multiple countries. The combination of factors driving that elevated assessment includes: the specific intelligence about Iran-directed operational networks activated in retaliation for the war; the broader population of individuals who have been radicalised through social media channels by the conflict’s civilian casualty figures; and the precedent established by the Kata’ib Hizballah campaign documented in the Al-Saadi complaint.
European intelligence sharing has been intensified since February 28. The US FBI has been working with European partners on the Al-Saadi case, and the information shared through that cooperation has provided insights into the network that extend beyond Al-Saadi himself.
Counter-terrorism analysts note that the arrest of a network commander typically does not end the network’s operations — it may disrupt them temporarily while triggering succession processes that eventually restore operational capacity. The assessment that the threat has not peaked reflects this structural understanding: Al-Saadi is in custody, but the organisation he commanded continues to exist.
The IRGC’s Role: Deniable but Documented
Iran has not publicly claimed responsibility for the attacks attributed to Al-Saadi’s network. This is consistent with Iran’s longstanding operational approach to proxy violence: maintain deniable distance while providing the ideology, training, financing, and organisational infrastructure that enables attacks.
The man is suspected of being affiliated with the HAYI terrorist group, which has ties to the Iranian-backed Hezbollah. “This case puts into stark relief the global threats posed by the Iranian regime and its proxies like Kata’ib Hizballah — Foreign Terrorist Organisations that have repeatedly targeted Jewish communities across Europe and the United States since the war began,” prosecutors said.
The IRGC Quds Force — the unit responsible for Iran’s external operations and proxy relationships — has been designated a foreign terrorist organisation by the United States since April 2019. That designation gives US prosecutors significant tools to pursue individuals who knowingly support its operations, regardless of whether those individuals have ever been to Iran or met senior IRGC officials.
Al-Saadi’s documented interaction with Soleimani, captured in photographs on his own social media, is a direct evidentiary link between an alleged terrorist operative and the now-dead architect of Iran’s global proxy strategy.
The Diplomatic Dimension of Counter-Terrorism
There is a tension at the heart of the current situation that US officials have not fully resolved publicly. The US is simultaneously pursuing criminal charges against members of Iran-backed networks for attacks in European cities, and pursuing a diplomatic framework that would end the Iran war through a negotiated ceasefire and nuclear talks.
Those two tracks — prosecution and diplomacy — are not necessarily incompatible. But they create a complex dynamic: the criminal cases document and publicise Iranian state-linked terrorism in Western cities at precisely the moment the US is trying to construct a basis for diplomatic engagement with Tehran.
Iranian officials have argued, in the context of the ceasefire negotiations, that attacks on Western targets are a natural and expected consequence of a war that the US initiated. That framing — which Al-Saadi echoed in his “prisoner of war” declaration — is rejected entirely by US prosecutors. But it reflects Iran’s negotiating posture: any deal must account for the costs imposed by Iranian networks, implicitly treating the cessation of those attacks as a concession to be traded.
What the Threat Looks Like Going Forward
The consensus among European counter-terrorism agencies, as of June 2026, is that the threat from Iran-linked networks remains elevated and is unlikely to subside rapidly even if the US-Iran ceasefire is formalised and the Strait of Hormuz reopens.
The network that Al-Saadi commanded was built over years. It drew on ideological commitment, organisational infrastructure, and operational training that a ceasefire agreement does not dissolve. The individuals who participated in the Amsterdam firebombing, the Paris bomb attempt, and the London stabbings have not been all identified or arrested.
And the social-media-based radicalisation that generates individual actors inspired by but not connected to the organised network — a separate and harder-to-counter threat — remains active across European diaspora communities.
The Iran war began on February 28 with air strikes that were contained to one region. By June 3, its consequences had reached courtrooms in Manhattan, streets in Amsterdam, and the counter-terrorism databases of every major European security service. The war’s geographic perimeter is not the Middle East. It never was.
LoudFact.com is an independent global news and explainer platform. This report is based on reporting from the Associated Press, ABC News, NBC News, US News & World Report, The Washington Times, and Britannica as of June 1-3, 2026.
