Security concerns are mounting across Europe as Jewish communities observe Passover and Christians celebrate Easter amid a wave of attacks targeting synagogues and Jewish institutions from Belgium to Britain.
The heightened vigilance stems from recent incidents that security analysts believe are connected to escalating tensions between the United States, Israel, and Iran. Since late February, what started as regional Middle Eastern conflicts has evolved into a complex web of threats involving extremist groups, Iranian-backed networks, and antisemitic violence targeting symbolic religious holidays.
The timing carries particular weight for Jewish communities, who remember the devastating 2002 Passover massacre at the Park Hotel in Netanya, where a Palestinian suicide bomber killed 30 people during a holiday celebration on March 27. That attack during one of Judaism’s most sacred observances created lasting concerns about vulnerability during religious gatherings.
This year’s calendar compounds those worries. Passover began at sunset on April 1 and continues through April 9, while Easter Sunday falls on April 5, following Good Friday on April 3. These dates create what experts call high-value targets due to large gatherings and symbolic significance that can amplify the psychological impact of even smaller-scale violence.
Daniele Garofalo, who specializes in counterterrorism and extremist groups, explained that holiday periods have always been a security concern, but current global conflicts have transformed the threat environment.
“The possibility of attacks against American, Israeli, and Jewish targets during festive periods is a variable that security services constantly monitor, regardless of specific crises. In the current context, any increase in risk would not automatically depend on a potential US ground maneuver, but rather on three concrete operational factors,” Garofalo told The Media Line.
Those factors, he explained, include political intent, operational capability, and available opportunities.
“First, there is the political and strategic willingness of Iran to activate instruments of indirect projection abroad. Tehran tends to operate through proxies and clandestine networks, avoiding direct attribution,” he noted.
“Second, there is the operational capability of affiliated or aligned actors, such as Hezbollah, which has historically demonstrated external planning capacity, particularly in contexts with lower protection or less robust security infrastructures,” he continued.
Garofalo identified the third element as opportunity levels—accessible targets, public gatherings, and symbolic timing such as holidays that maximize visibility and psychological impact.
While cautioning against overstating Hezbollah’s direct operational presence in Italy, Garofalo emphasized that Iran’s broader network still poses risks.
“Iranian networks operate transnationally, so if assets are activated in countries like Germany, France, or the Balkans, Italy automatically falls within the operational perimeter,” he said.
Garofalo noted that Hezbollah’s European presence has historically focused more on logistics and financing than operations, with Italian activities primarily involving fundraising, logistical support, and diaspora connections. “The real risk is indirect escalation, through Iran, proxies, and local actors rather than classic Hezbollah structures,” he commented.
Recent European incidents align with this assessment rather than following traditional mass-casualty terrorism patterns. On March 9, an explosion damaged a synagogue in Liège, which Belgian authorities classified as an antisemitic attack. March 13 saw an arson attack on a Rotterdam synagogue, leading to multiple arrests as Dutch prosecutors determined the incident had terrorist intent.
The following day brought an explosion at a Jewish school in Amsterdam, which the city’s mayor called deliberate. Belgium investigated additional arson in Antwerp, while London police are treating the burning of four Hatzola Northwest ambulances—belonging to a Jewish volunteer service—in Golders Green as an antisemitic hate crime.
Authorities have responded with visible security increases. Belgium deployed soldiers to protect Jewish institutions in Brussels, Antwerp, and Liège. British police and community security networks expanded patrols before Passover and added visible protection around Jewish sites. Italy’s annual intelligence assessment warned that Iran-related escalations are raising terrorist risks, particularly for Israeli, Jewish, and American interests.
Garofalo argued that the primary danger comes not from spectacular, centrally coordinated operations but from hybrid and indirect approaches.
“The real risk, as often happens, is more plausibly linked to opportunistic or low-complexity actions, the activation of sleeper cells already present, and the possible mobilization of radicalized individuals who are inspired rather than directly directed,” he noted.
He emphasized that current threats shouldn’t be understood solely through the lens of Islamic State-style attacks.
“This is a hybrid, state-linked, and indirect threat,” he said, explaining that European security services have recently raised alert levels for Iran-attributable activities, often through proxies or indirect networks. “European intelligence explicitly speaks of an evolution toward hybrid threats, meaning a combination of terrorism, criminality, and clandestine state operations,” he added.
Supporting this assessment is the emergence of Harakat Ashab al-Yamin al-Islamia, a previously unknown group claiming responsibility online for several European attacks on Jewish and Israeli-linked sites. The group had no detectable public presence before March, and analysts note its messaging first appeared through pro-Iran channels and networks connected to Hezbollah, the Islamic Revolutionary Guard Corps, and Iraqi Shiite armed groups rather than through independent propaganda systems.
Sharon Adarlo, a conflict analyst and operations director at Militant Wire, said the group should be understood within the context of deniable hybrid tactics rather than as a conventional armed organization.
She confirmed that countries like Iran—and previously Russia—have developed hybrid tactics that fall short of kinetic warfare but constitute definite sabotage. Recently, they have recruited what she termed ‘disposable agents’ or volunteers, compensating them with fees often paid in cryptocurrency, and directing them to conduct sabotage operations including bombings, arson, espionage, and various low-level but disruptive attacks. “What we’re seeing now is that Iran appears to have adopted similar tactics,” Adarlo told The Media Line.
The operational structure appears designed to obscure the true directors of the violence.
“I think what they’ve done is try to put several steps between the disposable agents who carry out the attacks and whoever is actually directing them. That creates confusion, but it also gives Iran plausible deniability. It looks like it could be Iran, it could not be Iran, but at the same time it very much seems like it is,” she observed.
Attribution for these incidents remains incomplete. British, Belgian, and Dutch authorities are investigating the attacks and verifying the group’s claims, but no European government has publicly established direct Iranian command-and-control over the incidents. This gap between suspicion and evidence reflects hybrid warfare logic: sufficient violence to intimidate, enough ambiguity to complicate responses.
According to Adarlo, multiple indicators suggest an Iran-linked network.
“The reason why we think it’s Iran-linked—even though there are some weird or atypical signatures—is because the group models itself after Iran’s Axis of Resistance. You see it in their logo, in their use of Quranic references, and in their statements where they invoke early Islamic battles like the conquest of Mecca,” she said.
Adarlo noted that the content first surfaced on pro-Iran Telegram, Twitter, and other platform channels, quickly amplified by pro-Iranian networks and so-called news organizations that openly endorsed the attacks. Some channels distributing this content also associate with Iranian-backed Iraqi militias, suggesting possible Iraqi connections as well.
Adarlo dismissed suggestions that the phenomenon represents fabrication by anti-Iran actors.
“Some people online are saying this could be a false flag operation, that it might be Mossad or something like that. … I really don’t think that’s the case here. The fact that it was disseminated first in pro-Iranian channels, praised in Farsi and Arabic-speaking spaces, and only later dismissed in English-language discourse strongly suggests it’s not a false flag. I think it’s a manufactured front for an Iranian operation,” she asserted.
While Adarlo’s described methods differ from Sunni extremist organizations like ISIS, the current crisis timing means both threat streams are simultaneously active.
Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, said ISIS propagandists have framed the war as an opportunity to encourage Western attacks precisely because the conflict creates emotional volatility and perceptions that security services are overextended.
“Since the US-Israel versus Iran war began in late February, Islamic State propagandists have intensified their online messaging across social media and encrypted platforms, explicitly telling supporters not to rally behind Iran or US-backed governments but instead to carry out attacks against ‘near’ and ‘far’ enemies wherever they are,” he told The Media Line.
“The narrative frames the state-on-state conflict as a moment of strategic distraction, arguing that Western security services are focused on geopolitical escalation and therefore less able to monitor individuals moving from online radicalization to real-world action,” he added.
He said the online messaging deliberately targets opportunistic violence.
The propaganda emphasizes wartime grievances, graphic imagery, and revenge calls, he noted, while presenting mass protests and heightened political tensions as ideal conditions for supporters or small cells to mobilize. “The goal is not necessarily large, coordinated operations but rather opportunistic attacks by self-radicalized individuals who interpret the chaos as permission and encouragement to act,” he added.
Webber also highlighted a specific ISIS-linked New York case illustrating how online war-related incitement can translate into attempted violence in politically charged environments.
He said the attempted March 7 bombing in New York City occurred near the mayor’s official residence during an anti-Islam protest, where a homemade explosive device was thrown toward the crowd but failed to fully detonate and caused no injuries. Federal investigators later charged two suspects with offenses including aiding ISIS and attempting to carry out an explosive attack. The suspects had pledged ISIS support and expressed desires to carry out something larger than the Boston Marathon bombing.
“Officials described the plot as ISIS-inspired and said there was no evidence linking it to Iran, which shows how the broader security environment created by the war can still be exploited by other jihadist actors seeking to capitalize on tensions for their own ideological objectives,” Webber explained.
He said distinguishing between Sunni jihadi opportunism and Iran-linked hybrid intimidation is critical for understanding the evolving threat landscape.
Webber argued that two distinct but overlapping dynamics exist: ISIS is using the war to encourage decentralized jihadi violence, and Hakarat Ashab al-Yamin is leveraging the same geopolitical tension to amplify Iran-aligned messaging and psychological warfare. “In both cases, the online ecosystem functions as the connective tissue, enabling rapid dissemination, radicalization, and operational signaling across borders,” he concluded.
