Geo-politics

US Charges Three Iran-Backed Operatives Over RAF Fairford Terror Plot and Nearly 20 Attacks Across Europe and America

Abdul Mannan 5 minutes ago • 26 min read

A US Air Force B-1B Lancer bomber at RAF Fairford in Gloucestershire, England, in a file photograph from 26 October 2023. Photo: US Air Force / Airman 1st Class Emma Anderson (public domain). — A US Air Force B-1B Lancer at RAF Fairford, Gloucestershire, in a file photograph from 26 October 2023. The base's B-1 bombers were withdrawn days after the September plot was foiled. Photo: US Air Force / Airman 1st Class Emma Anderson (public domain).

Three men accused of working for Iran-backed terrorist groups have been charged in the United States over a plot to attack RAF Fairford, the British air base that housed American bombers used in the war against Iran, and over a campaign of nearly 20 attacks and attempted attacks on Jewish communities across Europe and the United States.

The eight-count superseding indictment was unsealed on Tuesday in Manhattan federal court, and it ties together two stories that had, until now, been told separately: the spring wave of arson and bombing attacks claimed in the name of a previously unknown group, and the strange night in late September when three white vans loaded with fuel were driven towards a Royal Air Force base in Gloucestershire and stopped at a roadblock.

According to the US Department of Justice, the three defendants are Mohammad Baqer Saad Dawood al-Saadi, a 32-year-old dual Iranian-Iraqi national; Mohsen Mohajeri, a 48-year-old Iranian national; and Mohammad Ali al-Hassani, a 35-year-old Iraqi national. Only al-Saadi is in American custody. He was arrested abroad in May, transferred to the United States, and has been held without bail in New York ever since. The other two men were, according to the indictment, in Iran at the time of the Fairford plot, and prosecutors have not disclosed their whereabouts.

The charges include conspiracy to provide material support to Kata’ib Hizballah and to Iran’s Islamic Revolutionary Guard Corps, both of which the United States has designated as foreign terrorist organisations, conspiracy to provide material support for acts of terrorism, and conspiracy to bomb a place of public use. Al-Saadi alone also faces a count of attempted acts of terrorism transcending national boundaries. The most serious counts carry a maximum sentence of life in prison. The material-support counts carry up to 20 years, and the terrorism-support counts up to 15 years.

Attorney General Todd Blanche said in a statement that anyone who plans a terrorist plot on a military base housing American service members will be prosecuted by the United States government. “The defendants listed in the indictment allegedly supported two foreign terrorist organizations, and al-Saadi allegedly coordinated with his co-defendants in the days leading up to the attempted terrorist plot,” Blanche said. “This Department of Justice will continue dismantling terrorist networks and protecting the American people from terrorist organizations.”

FBI Director Kash Patel said the indictment showed Iran’s determination to commit terrorist attacks in Europe and the United States, including one plot that was recently prevented at RAF Fairford. Jamie McDonald, the US Attorney for the Southern District of New York, said the defendants had “helped orchestrate a campaign of terror on behalf of terrorist organizations affiliated with Iran” that targeted Jewish communities in Europe and the United States, and the British military base housing American service members. “The threat presented by Iran and Iran-backed terrorist groups to America and our allies is not hypothetical — it is very real,” McDonald said.

The Justice Department stressed that a superseding indictment is merely an allegation, and that all three defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. That caution matters, because almost everything in the document is alleged rather than established, and the two men outside American custody have not had the chance to answer the charges in court. Al-Saadi pleaded not guilty in June to the earlier charges against him, and, according to the Associated Press, has described himself as a “prisoner of war”. His lawyers did not immediately respond to requests for comment on Tuesday about the new indictment.

The charges and the three men

At the centre of the indictment is al-Saadi, whom US prosecutors describe as a longtime operative of the IRGC and Kata’ib Hizballah, and, according to the Associated Press, a Kata’ib Hizballah commander. He was first charged in the Southern District of New York in May, accused of working with and on behalf of the IRGC and Kata’ib Hizballah, as well as other designated groups, for his involvement in planning and promoting approximately 18 terrorist attacks in Europe, and for attempting to bomb a synagogue in New York between March and April 2026.

The new indictment, assigned to US District Judge Colleen McMahon, folds the Fairford plot into that earlier case and adds Mohajeri and al-Hassani as co-defendants. Mohajeri is described by the Justice Department as an Iranian national and an IRGC operative who coordinated with al-Saadi and al-Hassani to carry out attacks with the IRGC’s backing. Al-Hassani, originally from Iraq, is described as the man who used his contacts and criminal associates to carry out terrorist attacks in the United Kingdom, and as the organiser of the Fairford plot itself.

The three men are accused of conspiring to commit terrorist attacks in Europe and the United States on behalf of an Iran-aligned network that included the IRGC and Kata’ib Hizballah. The Justice Department says the network carried out its European attacks in the name of a purportedly new terrorist group with the pseudonym Harakat Ashab al-Yamin al-Islamiya, known by the acronym HAYI, which prosecutors describe as a front for Kata’ib Hizballah and other designated organisations.

Of the 18 attacks in the spring of 2026 for which HAYI claimed responsibility in Europe, seven took place in the United Kingdom, more than in any other European country, according to the indictment. The attacks involved arsons and explosives, and in one instance a near-fatal stabbing in London of two Jewish men, including a dual US-British citizen. The indictment says al-Saadi, Mohajeri and al-Hassani were personally involved in planning many of the attacks, and that al-Saadi and Mohajeri helped create and publish online propaganda videos of them.

The scale of the alleged campaign is what makes this indictment different from an ordinary terrorism prosecution. It does not describe a single cell or a single failed attack. It describes, in the prosecutors’ account, a network operating across several countries, claiming responsibility for its work under a invented name, filming its attacks, and continuing to operate even after its alleged ringleader was arrested and locked up in New York.

The Fairford plot, step by step

The Fairford plot, as alleged in the indictment, was prepared over several weeks in August and September, and it was aimed at a base that had become one of the most sensitive targets in Britain. RAF Fairford, about 100 miles west of London in Gloucestershire, has been used by American bombers for decades in conflicts across the Middle East. During the war with Iran, which began in late February 2026, it hosted B-1 and B-52 bombers flying to the Middle East after the British government approved its use for defensive strikes against Iran. In July, the IRGC declared that Fairford, and any base used to launch attacks on Iran, was a legitimate target.

According to the indictment, al-Hassani directed and paid associates in the United Kingdom to conduct preparatory steps and arrange logistics for the plot in August. On 22 August, he paid one individual, identified only as Individual-1, to perform pre-operational surveillance of RAF Fairford’s perimeter, and he subsequently received videos of the area surrounding the base. In later communications with al-Hassani, Individual-1 referred to him as “Ali”.

In September, al-Hassani also tasked and paid several individuals to help him prepare the plot, including by procuring vans and barrels of fuel, researching the purchase of chemical accelerants, including large quantities of potassium chloride, and purchasing metallic objects that could be used as explosive shrapnel. At his urging, those individuals commissioned custom decals that they affixed to the vans to create the appearance that they were used by a fuel delivery business and a swimming pool supply business.

On 26 September, al-Hassani allegedly tasked individuals to drive three vans, some of which were later determined to contain barrels of fuel, to the RAF Fairford base. That day, he was in frequent communication with the van drivers, helping to coordinate their movements and directing them where to drive. At least two of the three vans, while en route to the perimeter of the base, encountered a security roadblock and were not allowed to proceed on their intended route. Al-Hassani communicated with the drivers and occupants of the vans both before and after they encountered the checkpoint.

In the early morning hours of 27 September, law enforcement authorities in the United Kingdom recovered the three white vans, to which the fuel delivery business logos had been affixed, and arrested the occupants. Five men were detained after midnight on suspected explosives and terrorism offences after the three suspicious vans were spotted travelling towards the base. A sixth suspect, a British-Iranian dual national, was arrested several days later. All the men were released on bail.

What the police found that night has been a matter of public record for more than a month: petrol in three vans, but no improvised explosive devices. Dozens of homes near the base were evacuated, a major incident was declared, and an army bomb disposal team was deployed. A large cordon remained around the base for several days. What was not known until Tuesday was the account, now alleged by American prosecutors, of who ordered the vans to move, who paid for them, and how the operation was directed from abroad.

Coded messages from a New York jail cell

Perhaps the most striking allegation in the indictment is that al-Saadi continued to coordinate the network from inside a federal jail in New York. He was arrested abroad on or about 1 May, following the spring attacks, and transferred to the United States to face prosecution. For approximately four months after his arrest, there were no additional attacks attributable to al-Saadi, Mohajeri and al-Hassani, according to the Justice Department.

But the indictment alleges that, while in prison awaiting trial, al-Saadi used phone calls with his immediate family members in Iraq to pass coded messages to Mohajeri and al-Hassani in the days leading up to the Fairford plot. In June and July, he allegedly spoke with his mother and sister about Mohajeri, referring to him by various aliases, including “Abbas, Abu Daniel” and “Sayyid Abbas”. He also told his family members that he owed money to Mohajeri and directed them to pass along messages about “work”, a term he regularly used to describe terrorist activity, including on social media and in discussions with Mohajeri about partnering to conduct attacks.

On one of those calls, al-Saadi asked his sister, “What are they doing about all our old work?” and asked whether it had been cancelled or just put on pause. His sister responded that “it isn’t cancelled.” On or about 24 September, three days before the vans were driven towards Fairford, al-Saadi once again spoke with his family by phone. On the call, he allegedly inquired about how al-Hassani, whom he referred to as “Ali”, was doing. His family informed him that “Ali” had been transferred to the “International Section”. Al-Saadi then allegedly instructed his family to “give him [al-Hassani] money so we can do it.”

The Times reported in October that the authorities believed al-Saadi had continued to plot terrorism from behind bars, had directed money transfers worth more than $1 million, and had overseen the release of propaganda videos. Tuesday’s indictment gives that reporting a formal, prosecutorial shape, and it raises an uncomfortable question for the American prison system: how a man awaiting trial on terrorism charges, held without bail, was allegedly able to communicate with his network through family phone calls, and whether those communications were monitored, understood, or acted upon in time.

The Justice Department’s account does not say that the coded messages were intercepted in real time, or that American officials warned their British counterparts before the vans moved. It says only that the messages were passed, and that the plot went ahead. That silence is itself significant, and it is likely to be one of the first things examined when the case reaches court.

A spring campaign of nearly 20 attacks

To understand the Fairford plot, prosecutors say, it is necessary to understand what came before it. In March and April 2026, overlapping with the time that al-Saadi was in Iraq with Mohajeri and al-Hassani, planning the European attacks, al-Saadi also allegedly attempted to coordinate and carry out terrorist attacks in the United States, including by targeting a synagogue in Manhattan.

The indictment describes, in unusual detail, how the spring campaign was directed. On or about 6 April, Mohajeri and al-Hassani planned attacks while together in a room in Iraq with a map of London displayed on a computer screen. In a video of that meeting, al-Hassani told Mohajeri, “we need to get focused on London.” HAYI then claimed responsibility for six terrorist attacks that occurred in and around London starting approximately one week later.

On or about 17 April, al-Saadi, al-Hassani and Mohajeri allegedly directed an individual to carry out one of the European attacks in real time. They were in a room watching a FaceTime video with the individual who was carrying out the attack, which was projected onto a large screen against the background of the HAYI logo. Al-Hassani directed the perpetrator’s actions, including by instructing the individual on the other end of the call to execute the attack, and directing that individual to take a lighter and “light one in your hand”, “light it”, and “throw the fourth one”. Al-Saadi recorded the attack in real time, while Mohajeri recorded al-Hassani and al-Saadi in the room as they directed it.

The next day, on or about 18 April, al-Hassani participated in another video call with an individual carrying out an attack on a synagogue in London, with the HAYI logo projected on the background of his screen. During the video call, al-Hassani directed the individual to “light it up like a Christmas tree”. The person on the video then lit an improvised explosive device and threw it at the building.

The picture the indictment paints is of a network that treated terrorism as a production: attacks planned on camera, directed live over video calls, filmed, and then claimed under a invented brand name. The propaganda videos were not an afterthought. According to the Justice Department, making and publishing them was part of the operation, and al-Saadi and Mohajeri helped create them.

It is also a picture that fits a wider pattern in 2026. Jewish communities in Europe and the United States have been the target of a series of attacks this year, and the indictment explicitly frames the spring campaign as one aimed at Jewish targets. The near-fatal stabbing of two Jewish men in London, one of them a dual US-British citizen, is the most serious of the individual attacks described in the document, and it is the one that most clearly connects the European campaign to the American case: one of the victims was an American citizen.

What happened on the night of 26 and 27 September

The British side of the story has been unfolding in parallel, and it moved first. In the early hours of 27 September, Gloucestershire Police received a call about three suspicious vans travelling towards RAF Fairford at about 00:45 BST, after a local farmer reported seeing a group of men with several white vans behaving suspiciously near the site. Armed police and army bomb disposal experts evacuated nearby residents and searched the area. Police found petrol in the three vans but no explosives, and a large cordon remained around the base for several days.

British authorities linked the incident to Tehran, and Iran denied involvement. The arrests prompted the United States to withdraw its bombers from the base. The aircraft were redeployed to their home bases in the United States, and, according to reporting at the time, have not returned. President Donald Trump said the bombers were removed because of “some threats”. The withdrawal was itself a significant event: Fairford had been hosting the bombers that were central to American operations against Iran, and their sudden departure, days after the vans were found, was read in London and Washington as a sign of how seriously the threat was taken.

On 27 October, British prosecutors charged two men under the National Security Act 2023 in connection with the incident. Mohmed Abdulkarim, 24, and Nouman Essghir, 24, both British nationals and London residents, appeared at Westminster Magistrates’ Court on 27 October and are due at the Old Bailey on 20 November. Abdulkarim, a British-Iranian dual national, was charged with assisting a foreign intelligence service between 31 August and 28 September. Essghir was charged with entering a prohibited place for a purpose prejudicial to the United Kingdom on 22 August.

Prosecutor Louise Gray told the Westminster hearing that a man known only as “Ali”, believed by police to be abroad and acting for the Iranian state, ordered a group of men to drive vans loaded with petrol to the base, and that Abdulkarim allegedly arranged for five men to take the three vans. The men were told by phone, early on 27 September, to park the vans and walk away. Eight men have now been arrested as part of the investigation, six of whom remain on police bail. Laurence Taylor, the head of National Counter Terrorism Policing, defended the decision to release the suspects on bail, saying it had led investigators to crucial evidence.

The British and American cases now appear to be describing the same operation from opposite ends. The British prosecution alleges that “Ali”, acting for the Iranian state, ordered the vans. The American indictment names al-Hassani as the man who gave the orders, and says his associates in the United Kingdom called him “Ali”. Neither case has yet been tested at trial, and neither Abdulkarim nor Essghir has entered a plea, according to reporting on the British proceedings. Both men have the right to a fair trial, and the British charges, like the American ones, are allegations, not findings.

Prime Minister Andy Burnham has said the government believes Iran “played a part” in the incident at the base. Iran has denied involvement in the Fairford episode. That denial, and the question of how far up the Iranian state the alleged direction went, is likely to be one of the central disputes in both cases, and in the diplomacy around them.

Why Fairford mattered

RAF Fairford is not an ordinary air base. It is a forward operating location for the United States Air Force in Europe, and it has been used by American bombers during decades of conflicts in the Middle East. Its long runway, its hardened facilities, and its position in western England have made it the natural home for Bomber Task Force deployments, and for the aircraft that carry out long-range strikes.

During the war with Iran, that role became more visible and more dangerous. B-1 Lancers and B-52 Stratofortresses flew from Fairford to the Middle East, and the base became, in the words of the IRGC’s July statement, a legitimate target. The threat was not abstract. In the same period, American aircraft were withdrawn from a second British base, RAF Mildenhall, after new Iranian threats, and a senior US soldier was arrested in the United Kingdom last week on suspicion of spying for Russia, in a separate case that underlined how exposed British-based American forces have become.

The Fairford plot, if the allegations are proved, was an attempt to bring the war home to the base itself: not a missile or a drone, but three vans, filled with fuel, driven at a perimeter fence in the middle of the night, with the apparent aim of creating a fireball at the entrance to a base full of bombers and their crews. The fact that no explosives were found, and that the vans were stopped at a roadblock, does not diminish the intent alleged by prosecutors. It does, however, raise questions about the competence of the operation, and about whether the men in the vans knew what they were carrying, or what they were expected to do.

The American response to the September incident was immediate and visible: the bombers left. That decision, taken within days, was a measure of the risk as it was assessed at the time. The indictment now suggests that the risk was real, and that the people behind it were not a handful of local amateurs, but part of a network that had already carried out nearly 20 attacks across two continents.

The timing of the indictment also matters. It comes on the second day of trilateral peace talks between the United States, Russia and Ukraine in Abu Dhabi, and days after President Trump said the war with Iran was “militarily over” and “effectively over”, while keeping the naval blockade of Iranian ports in place. The indictment is a reminder that the conflict with Iran has not been confined to the battlefield or the negotiating table. It has, according to American prosecutors, been fought in the streets of London, in the suburbs of British air bases, and in the synagogues of Europe and America.

Analysis: Why It Matters

A plot directed from a prison cell

The single most important fact in this indictment is not the number of attacks, or the identity of the base, but the place from which the Fairford plot was allegedly coordinated. If the prosecutors’ account is correct, a man who had been arrested, extradited, charged, and locked up in New York without bail was still able to direct a terrorist operation in England, through coded messages passed in family phone calls. That is a failure of containment, and it is one that American officials will have to explain.

Prisons are supposed to break a network’s ability to communicate. In this case, the network appears to have adapted to the arrest rather than collapsing under it. The indictment says there were no attacks attributable to the three men for four months after al-Saadi’s arrest, which suggests the network did go quiet, or at least went careful. But it also says the planning resumed in August, and that al-Saadi was in contact with his co-defendants through his family in June and July, and again on 24 September, three days before the vans moved. The gap between arrest and resumption looks less like a network defeated than a network regrouping.

There is a wider lesson here for counter-terrorism. The modern terrorist network does not depend on a single leader being free. It depends on trust, on money, and on a shared purpose, and all three can survive an arrest. Al-Saadi’s family phone calls, if the allegations are proved, were the thread that held the network together. The question for the authorities is not only how those calls were used, but whether they were understood at the time, and what, if anything, was done about them before the vans were driven towards Fairford.

Terrorism as a production

The second striking feature of the indictment is the way the attacks were filmed, directed live, and claimed under a brand name. The FaceTime direction of an attack on 17 April, with the perpetrator’s video projected onto a large screen against the HAYI logo, and the direction of a synagogue attack the next day, with the instruction to “light it up like a Christmas tree”, describe a form of terrorism that is as much theatre as it is violence.

The invented group name matters. HAYI, Harakat Ashab al-Yamin al-Islamiya, did not exist as a known organisation before the spring of 2026. Prosecutors say it was a front for Kata’ib Hizballah and other designated groups. A front name serves two purposes: it gives the attacks a local, plausible identity, and it gives the real sponsors a layer of denial. It also gives the attacks a story, and a story is what makes a bombing into a message.

The propaganda videos served the same purpose. They were not souvenirs. They were the product. An attack that is filmed, directed live, and published under a brand name is designed to be seen, and to be feared, by people who were not its victims. That is the logic of terrorism in its oldest form, updated with a smartphone and a video call. The indictment’s detail about the filming is not colour. It is evidence of intent, and of organisation.

The war that followed the bombers home

The Fairford plot also changes the way the war with Iran should be understood. The war began in late February 2026 with strikes on Iran, and it has been fought, in the public mind, in the Gulf, in the Strait of Hormuz, and in the skies over the Middle East. The indictment says it was also fought in London, in the form of arson attacks on Jewish targets, and in Gloucestershire, in the form of three vans driven at an air base.

That is a different kind of war, and it is one that the United States and Britain have been slow to name. The British government has said Iran “played a part” in the Fairford incident. The American indictment goes further, alleging that the plot was organised by an Iran-aligned network, directed by men in Iran, and coordinated by a man in an American jail. If that account is proved, then the war did not stay in the Middle East. It came to the home bases of the forces fighting it.

The withdrawal of the bombers from Fairford, and later of aircraft from Mildenhall, was the visible consequence. A base that exists to project power became, for a time, a liability, because the threat was not a missile that could be intercepted, but a van that could be driven to a fence. That is a vulnerability that no amount of air defence can fix, and it is one that every country hosting American forces will now be thinking about.

Allegation is not proof, and the distinction matters

It is worth pausing on what this indictment is not. It is not a conviction. It is not a finding of fact. It is a set of allegations, presented by prosecutors, that will now have to be tested in court. Two of the three defendants are not in custody, and have not had the opportunity to answer the charges. The third has pleaded not guilty to the earlier charges against him. The British defendants in the parallel case have not entered pleas. The presumption of innocence is not a formality here. It is the only thing standing between an allegation and a fact.

That distinction is particularly important because the indictment’s most dramatic claims, the coded messages from jail, the live direction of attacks, the $1 million in money transfers reported by The Times, rest on intercepted communications, on videos, and on the accounts of cooperating witnesses whose identities and credibility have not yet been tested. The Justice Department has presented a coherent narrative. A coherent narrative is not the same as a proved case, and the defence will have the opportunity to challenge every part of it.

There is also the question of Iran’s role. The indictment alleges that the network acted on behalf of an Iran-aligned network that included the IRGC and Kata’ib Hizballah. It does not, on the face of the public release, allege that the Iranian government ordered the Fairford plot, or that senior Iranian officials directed it. Iran has denied involvement. The distance between “Iran-aligned” and “ordered by Tehran” is a large one, and it is the distance on which the diplomatic consequences of this case will turn.

What the indictment does not say

Finally, it is worth noting what the indictment does not contain. It does not say how the coded messages from al-Saadi’s jail cell were discovered, or when. It does not say whether American officials warned their British counterparts before 26 September, or whether the British police acted on their own intelligence. It does not say how the vans were stopped, or who made the decision to set up the roadblock. It does not say whether the men in the vans knew what they were carrying, or whether they believed they were taking part in a terrorist attack.

Those silences are normal in an indictment, which is a charging document, not a history. But they are also the questions that will determine how this case is judged. If the messages were intercepted in real time and acted upon, then the system worked, and the vans were stopped because the plot was known. If they were discovered only afterwards, then the system failed, and the vans were stopped by luck, or by a farmer’s phone call, or by a roadblock that happened to be in the right place.

The difference between those two accounts is the difference between a counter-terrorism success and a near miss. The indictment, as written, does not tell us which it was. The trial, if it happens, may.

What to Watch Next

The Manhattan case: whether Mohajeri and al-Hassani are ever brought into American custody, and whether al-Saadi’s trial, before Judge Colleen McMahon, tests the coded-messages evidence in open court.
The Old Bailey: Abdulkarim and Essghir are due at the Old Bailey on 20 November, where the British case, and the prosecution’s account of “Ali”, will be tested for the first time.
Iran’s response: whether Tehran maintains its denial, and whether the indictment affects the diplomacy around the war, the blockade, and the Abu Dhabi talks.
The prison question: whether American officials explain how al-Saadi allegedly communicated with his network from jail, and whether prison communication rules for terrorism defendants are tightened.
The bombers: whether the United States returns B-1 and B-52 aircraft to RAF Fairford, or whether the base remains without its bombers, and what that means for American operations in the region.
The wider network: whether further indictments follow, in the United States or in Britain, against the associates in the United Kingdom who, according to prosecutors, procured the vans, the fuel, and the decals.

Sources