The arrest by US authorities of an alleged Iraqi commander of an Iranian-backed militia group now accused of responsibility for 18 terrorist attacks in the UK, Europe and Canada since the beginning of the Iran war is an astonishing development – yet not the least bit surprising.

According to a complaint unsealed on Friday in a federal court in Manhattan, Mohammad Baqer Saad Dawood al-Saadi is allegedly responsible for organising – among other operations – a string of recent firebombings of banks and other targets in France, Belgium, Germany and the Netherlands, an arson attack against a synagogue and a shooting at the US consulate in Toronto in March, as well as – most recently – a wave of attacks on mainly Jewish targets in the UK including places of worship and charities.

Most notably perhaps, al-Saadi, 32, is accused of involvement in the stabbing of two Jewish men in north London in April.

The detailed complaint provides no details of the London attack but cites recorded conversations between al-Saadi and an FBI informant and an undercover FBI agent, in which he appeared to have referred to operations in Europe while trying to set up new attacks on Jewish targets in the US.

Al-Saadi also allegedly posted claims of responsibility for attacks on Snapchat and Telegram in the name of Harakat Ashab al-Yamin al-Islamia (HAYI), a supposed Islamist militant group, the complaint said. He was reportedly detained in Turkey, though the details are unclear.

In a development few observers anticipated, the individual allegedly responsible for a wave of frightening if nonlethal violence across a dozen countries is now in solitary confinement in a federal jail in Brooklyn.

That a senior official in an Islamist militia in Iraq – which was formed and supported by Iran’s Islamic Revolutionary Guard Corps (IRGC) – is the prime suspect is also no huge revelation for investigators and analysts. It has long been suspected that the IRGC – more specifically its Quds Force, which specialises in clandestine operations overseas – was responsible for the attacks that have caused concern and fear in recent weeks.

Iran has a long history of such unconventional operations, all designed to divert, distract and destabilise current or potential enemies. For decades, Tehran’s key tactic had been to work through loyal proxies overseas – or those the proxies themselves can recruit. This provides several layers of cover obscuring the original instigator of the violence.

One clue indicating IRGC involvement was that HAYI was unknown before the war in Iran, appearing for the first time in early March on social media channels associated with Iran-backed Islamist militia in Iraq. Its posts claiming responsibility or showing imagery of attacks were made so soon after each operation that it was clear their author was very close to whoever had organised them – possibly even the same individual. Some posts appeared before attacks, suggesting targets that were then hit.

Al-Saadi allegedly posted many under his own name, which would appear a flagrant breach of security “tradecraft”.

Another potential clue was the nature of the attacks, which was familiar to European security services, who have reported for several years that Iran has relied on criminal networks to recruit low-level “disposable” operatives motivated by the opportunity to earn relatively small amounts of money. Many appear to have a limited understanding of the nature of their target and no knowledge of their ultimate paymaster.

A former drug dealer detained in France in 2024 after conducting surveillance on a Jewish businessman’s home in Munich said he had been recruited via Snapchat by a former cellmate to help with a “fraud case” and paid €1,000 (£870).

In Paris in March, a 17-year-old arrested on suspicion of an abortive effort to bomb a Bank of America branch told police he had been recruited via a Snapchat group where he usually got commissions to deliver drugs.

A “Mr Big” had said he wanted to intimidate the unfaithful girlfriend of a friend and offered between €1,000 and €1,400 to the teenager and two other recruits if they ignited a firework in front of the woman’s home and filmed the scene, according to a police statement obtained by Le Monde.

In conversations in April with a man he took to be a senior figure in a Mexican cartel but was working for the FBI, the complaint said, al-Saadi offered $10,000 for attacks on a synagogue and Jewish community centres which he also wanted recorded. In an earlier conversation, he had described how things in Europe were “going well” and said he did not need help there.

Al-Saadi smiled throughout his initial court appearance but did not speak.

Through his lawyer, he called himself a political prisoner and a prisoner of war and said he was being persecuted by US authorities for his relationship with Qassem Suleimani, the former Revolutionary Guards leader who led the Quds Force and was killed in a US drone strike in Baghdad in 2020.

Al-Saadi may now find himself in the same position as many of those who were hired to commit attacks over recent months claimed by Hayi. They were recruited specifically to be deniable as well as disposable.

So far, there has been no reaction from Tehran to al-Saadi’s arrest or the allegations contained in the justice department’s complaint.

Al-Saadi was not required to enter a plea. He will remain in jail but could request bail.