When NATO leaders gather in Ankara on 7–8 July 2026, the summit will inevitably be dominated by Ukraine, defence spending, alliance cohesion, and the Iran conflict. Türkiye’s hosting of the summit gives a strategic urgency to Iran’s expanding campaign of proxy, hybrid, and external operations against Western targets. The NATO summit is being held at the Beştepe Presidential Compound in Ankara places the meeting the hinge of Europe, the Middle East, the Black Sea, and the Caucasus.
Iran’s actions now touches several alliance concerns at once: missile and drone proliferation, Red Sea instability, threats to Gulf partners, plots in Europe and North America, and the use of criminal proxies for deniable violence. The case of Mohammad Baqer Saad Dawood al-Saadi, an alleged senior member of Kata’ib Hezbollah, should be understood in that wider context.
Al-Saadi was arrested in Türkiye, extradited to the United States and charged in May 2026 for terrorism-related offences connected to his work as an operative of Kata’ib Hezbollah and Iran’s Islamic Revolutionary Guard Corps (IRGC). The U.S. Department of Justice said the case involved nearly 20 plots across Europe and the United States.
The picture al-Saadi that emerges is not of a peripheral facilitator, but of a trusted militia insider with access to senior Iran-backed commanders. That distinction is crucial. Iran-backed operations often depend on ambiguity. Tehran and its partners rarely make attribution easy. They use front groups, cut-outs, online brands, and sympathetic militias to complicate legal and political responses. If al-Saadi is indeed a senior figure with trusted access across Kata’ib Hezbollah and IRGC-linked networks, then the allegations against him point to something more serious than freelance militancy or opportunistic antisemitic violence. They suggest a deliberate attempt to build external operational capacity through Iraqi proxy structures.
The DOJ allegations also indicate that al-Saadi had a role that combined terrorism, psychological warfare, and propaganda. U.S. authorities allege that al-Saadi was a leader within the broader movement tied to the IRGC including Kata’ib Hezbollah, Lebanese Hezbollah, and the Houthis, and that material on his phone allegedly showed him directing “psychological warfare” against the United States and Europe.
Kata’ib Hezbollah
Kata’ib Hezbollah has traditionally been understood as one of Iran’s most important Iraqi proxy militias. Its core role has been to pressure U.S. forces in Iraq, maintain Iranian influence within Iraqi politics, and serve as part of Tehran’s broader Axis of Resistance. It belongs to the ecosystem of Iraqi armed factions and is linked to the Popular Mobilization Forces.
What appears to be changing is the scale and geography of that role. Hamas, Lebanese Hezbollah and the Houthis often appeared more prominent in Iran’s deterrence strategy. However, they all have come under sustained military pressure, and Iraqi militias have subsequently become more useful to Tehran. Iraqi militias may no longer be content to serve as regional pressure instruments but seek to demonstrate that they can support Iran’s wartime strategy through long-range external operations in Europe and North America. For NATO, this is not only a Middle Eastern militia problem; it may become a Western homeland security problem.
HAYI: A Front, a Brand, or a Façade Group?
Harakat Ashab al-Yamin al-Islamiyya (HAYI), is central to the case. The FBI has characterized HAYI as a front for Kata’ib Hezbollah, an online brand used to partially conceal the real-world identity of Iranian-aligned attackers. That concept is important. HAYI does not need to function like a conventional terrorist organization with a clear hierarchy, training camps, membership system, or territorial base. Its utility lies in being disguised and digitally amplified. It can issue claims, circulate iconography, frame attacks ideologically, and create the impression of a new movement while shielding more established actors from direct responsibility.
HAYI blurs state-backed hybrid warfare and Islamist extremism for Iran in the UK, Europe, and North America by recruiting teenagers and petty criminals through intermediaries and social media, often for small payments. A state-backed or proxy-enabled network like HAYI can use local criminals, unstable individuals, or disposable recruits, task them online, pay them through cryptocurrency or intermediaries, and then amplify the result through propaganda.
The allegations against al-Saadi and HAYI include targeting Jewish institutions and financial institutions with the tactics being low-tech such as stabbings and arson. These are not necessarily designed to produce mass casualties in every case. Their strategic value lies in fear, disruption, symbolism, and media amplification.
Al-Saadi is accused of using FaceTime to direct attacks in real time from Iraq, including fire-bombings of Jewish sites in London, and that he used HAYI as a front while recruiting petty criminals globally and paying them in cryptocurrency. He was captured in Turkey while allegedly trying to enlist an undercover FBI agent posing as a cartel member.
The Ankara Summit
The Ankara NATO Summit will need to address Iran not only as a Middle Eastern military challenge, but as a hybrid threat actor operating across NATO member nations. The alliance needs to think about Iranian activity in the same integrated way it increasingly thinks about Russia. This means assessing state power, proxy networks, criminal outsourcing, cyber tools, propaganda, drones, missiles, and deniable violence working together.
Better intelligence is required to understand the fusion on Iranian proxy networks, especially where Iraqi militia structures overlap with organized crime, diaspora intimidation, antisemitic targeting, and online recruitment. In addition, governments need to harden soft targets beyond the obvious military or diplomatic sites. Western law enforcement also needs to treat low-level arson, vandalism, and assaults towards specific vulnerable targets as possible signs of a wider hybrid campaign, not automatically as isolated hate crimes or local criminality. The al-Saadi case shows that Iran may be experimenting with a new model: outsourced, deniable, low-cost attacks in Western societies, designed to produce psychological effect and strategic pressure.
