France suspects a pro-Iranian group known as HAYI to be behind a foiled attack on Bank of America's Paris offices, its anti-terrorism prosecutor said on Wednesday, while stressing the link has not yet been formally established.

HAYI, which stands for Harakat Ashab al-Yamin al-Islamiyya, or Movement of the Companions of the Right Hand of Islam, had posted a video on social media on March 23 targeting Jewish interests and communities in France and Europe, the prosecutor's office said in a statement to Reuters.

It added the video specifically titled "Bank of America's Paris headquarters in the French capital's 8th district."

"In light of the aforementioned video targeting this US bank and the modus operandi observed in similar operations across several European countries, this attack... appears to be linked to the HAYI group, although this has not yet been formally established at this stage of the proceedings," the prosecutor's office said.

The group - unknown until a spate of attacks across Europe on US, Israeli, and Jewish targets for which it claimed responsibility - appears new.

A private security member stands next to a police van outside Bank of America’s Paris offices, after French anti-terrorism prosecutors opened an investigation into attempted destruction by fire or other dangerous means in Paris, France, March 30, 2026.
A private security member stands next to a police van outside Bank of America’s Paris offices, after French anti-terrorism prosecutors opened an investigation into attempted destruction by fire or other dangerous means in Paris, France, March 30, 2026. (credit: REUTERS/BENOIT TESSIER)

Iran uses paid criminal gangs, Western diplomat says

Security sources say it appears to be using a model previously linked to Iran to recruit criminal groups or petty criminals to carry out attacks.

“After the failed bomb plot by Iranian intelligence in Paris in 2018, the Iranians turned to paid criminal gangs to carry out incidents, so it is harder for it to be traced back to Tehran," a senior Western diplomat said.

"These operations target opponents and Jewish-linked elements. There have been a multitude of these across Europe. Our expectation is that Iran will now start to activate these networks,” the diplomat said.

No new threat has yet been identified by French authorities, but the scenario is plausible, two security sources told Reuters.

The Iranian embassy in France did not immediately respond to a request for comment and declined over the weekend to comment on French Interior Minister Laurent Nunez’s remarks pointing to Iran’s possible involvement.

 Suspects deny terrorist intent

The device used in the foiled March 28 attack, a five-liter petrol can taped to a large pyrotechnic charge, was found by forensic experts to contain a 650-gram active-material cylinder with a fuse, the prosecutor's office said. Paris police found it was the most powerful pyrotechnic device of its kind identified in France to date, it added.

Four suspects, three minors and one adult, were formally placed under investigation, the prosecutor's office said. A fifth person was released for lack of sufficient evidence.

Investigators established through CCTV footage, phone data, and police interviews that the adult had recruited the three teenagers between the nights of March 26 and 27, paying them between 500 and 1,000 euros ($580-$1,160) to plant the device, light it, and film the scene, the prosecutor's office said.

All four suspects denied terrorist intent, though the minors acknowledged knowing the target was not a residential building, it said.

French anti-terrorism prosecutors said they were working with counterparts in Belgium, Germany, and the Netherlands on what they called HAYI-linked attacks across Europe in March. 

Investigators' priority is now to identify the masterminds behind the attack, prosecutors said.