May 19, 2026

SHARE |

U.S. Arrest of Kataib Hezbollah Leader Signals a Shift in Iranian Proxy Model

(AP Photo/Hadi Mizban)

In a joint operation with Türkiye, the U.S. Federal Bureau of Investigation arrested and charged a key leader within the Iraq-based, Iran-backed militia, Kataib Hezbollah (KH), following his role in planning at least 18 attacks on American, Canadian, and European soil. The individual, Mohammad Baqer Saad Dawood al-Saadi, reportedly coordinated with several criminal syndicates on messaging platforms like Telegram and Snapchat, along with cryptocurrency payments, to plan attacks against American nationals, financial centers, and religious communities. Stabbings, shootings, and bombings carried out against an American citizen and Jewish men in London, the Bank of New York Mellon and a Jewish school in Amsterdam, the U.S. Consulate in Toronto, along with planned attacks against a Bank of America facility in France, a synagogue in New York City, and Jewish community centers in the UK, California, and Arizona have all been tied to al-Saadi. Federal prosecutors have concluded from the arrest that Harakat Ashab al-Yamin al-Islamia (HAYI), a newly recognized Iran-aligned group established in March 2026 that has been attributed to the European plots, is essentially a front for KH, according to the New York Times.

The arrest of al-Saadi coincides with a notable evolution in the tactics and behavior of Iran-backed proxy networks operating in the Middle East. Iranian proxy networks like Lebanese Hezbollah, Hamas, and the Houthis in Yemen, as well as KH and its offshoots, have traditionally focused on countering the U.S. and Israel within the region. KH primarily pressured a U.S. military withdrawal through strikes on American positions and building political pressure within Baghdad calling for the departure of troops. However, the sudden wave of Iranian-backed plots abroad illustrates both a new imperative and capability within KH. Indeed, traditional proxy operations conducted in the U.S. and Europe tended to rely on sleeper cells or more conventional forms of non-state activity. However, the capacity of these traditional proxy forces has been stretched, largely due to Israel’s prolonged conflict with Hezbollah, its campaign against Hamas, and operations — conducted in tandem with the United States — against Houthi attacks on Red Sea shipping lanes. These pressures have significantly degraded Hezbollah, Hamas, and the Houthis, creating space for the expansion and evolution of KH and increasing its utility to Iran, particularly because its capabilities have not been degraded to the same extent.

In a departure from KH’s usual model, it appears that the Iranian Revolutionary Guard Corps (IRGC), KH, and HAYI have sought out collaboration with established criminal syndicates abroad. Al-Saadi notably sought out a contact in a Mexican cartel network — a contact that later proved to be an informant for the FBI — as a mechanism to carry out simultaneous attacks on Jewish religious centers in New York City, Scottsdale, and Los Angeles. Analyst Roger Macmillan has noted that this represents a shift from reliance upon existing Iran-backed networks to external outsourcing, transferring thousands of dollars in cryptocurrency to contracted individuals from gangs, cartels, or lone wolves to both conduct and film arson attacks, bombings, and stabbings on behalf of the organization — a well-established practice in Russian hybrid warfare.

The wave of attacks and plots also illustrates another strategy used by Iran-backed militias amidst the U.S. war against Iran. By blurring the lines between organizational distinction — adopting new organizational names and contracting the attack’s execution to local criminal networks with few ties to Iran and its proxies — the organization establishes better resilience against accountability. The establishment of unknown, offshoot networks and the recruitment of local attackers represents a new phase in the IRGC’s strategy. This effort to maintain plausible deniability is most clearly reflected in KH’s denial to Iraqi media that al-Saadi's was a member of the group. It may also be intended to preserve plausible deniability if KH decided to stage a retaliation against U.S. or Turkish interests.

The evolution of Iranian influence operations in Europe and the U.S. — directly by the state, through its proxies, and through disposable agents — have seen an increased operational tempo since the start of the Iran War in February, marking a clear departure from Iran’s traditional proxy model. Aside from mediatized plots aimed at Jewish targets, Iran has engaged in tailored, multilingual, and multimedia influence operations, primarily on social media platforms. This week, Europol’s Internet Referral Unit, an agency aimed at restricting online content disseminated by violent extremists and terrorists, announced that an operation had taken down more than 14,000 posts that were attributable to the IRGC. According to Europol, the content “ranged from speeches blending religious martyrdom narratives with highly charged political messaging to AI-generated videos glorifying the IRGC and calls to avenge the Ayatollah Ali Khamenei.” Since the start of the Iran War, the IRGC has been highly effective in its influence operations targeting Western audiences, often blending domestic concerns around the economy and politics with strikes in the Middle East that resulted in civilian casualties. Some of these influence operations may be linked to mixed public opinion polls in Europe about the responsibility of the U.S. and Israel in the current Iran War.

The new IRGC strategy against the U.S. and Israel also extends into the Gulf. On Sunday, May 17, Saudi Arabia intercepted three drone strikes that was reportedly fired from Iraqi airspace, following a string of previous strikes against Gulf states conducted from Iraqi territory in April. While the Iraqi federal government has asserted its air defense system has not detected launches in its airspace against its Gulf neighbors, many countries have suspected the involvement of Iran-backed militia networks that operate under the umbrella of the Hashd al-Shaabi, otherwise known as the Popular Mobilization Forces (PMF), of which KH is a part of. Concurrent attacks against Gulf states, both directly through Iran’s military and indirectly through its proxies, represent an evolving strategy as Tehran seeks to mount pressure on its neighbors against the U.S.’ escalation against it.

Experts believe al-Saadi's arrest could also strengthen Washington’s case for pressuring Baghdad to rein in or disarm KH and other Iraqi Shia militias belonging to Iraq’s state-backed Popular Mobilization Forces (PMF), particularly as newly appointed Iraqi Prime Minister Ali al-Zaidi vowed in a speech late last week to “restrict weapons to the hands of the state,” referring to Iran-back militias operating in Iraq. The U.S. vetoed the reappointment of former prime minister Nouri al-Maliki for being too close to Iran, accepting al-Zaidi in his place, and are likely to use al-Saddi's arrest — along with his documented ties to the IRGC - Quds Force — to justify escalating demands on Baghdad. Norman Roule told POLITICO that “Washington will seek to convert [support for al-Zaidi] into leverage for building a political and security architecture that strengthens Iraq’s domestic political process against Iranian influence, while also holding Baghdad accountable of Iraqi militias.” However, translating that pressure into meaningful action will be extremely difficult and unlikely. Iran-backed militias remain deeply entrenched in Iraqi institutions, and groups such as KH are central to Tehran’s regional deterrence network. Any aggressive moves by al-Zaidi to dismantle or marginalize these organizations would risk backlash from powerful militia leaders and political blocs, while also threatening friction with Iran at a time when Tehran is relying on its proxy networks to maintain pressure on the U.S. and Israel.