It took just over an hour after the horrific knife attack on two British Jewish people in Golders Green, north London, for an Iran-linked terror group, Harakat Ashab al-Yamin al-Islamia (HAYI), to make a claim of responsibility on a Telegram channel.

Counter-terror police are aware of the initial posting – a brief statement accompanied by the group’s logo – put online at 12.23pm and a follow-up 40 minutes later showing a violent attack at a bus stop.

However, as inquiries continue, the police are also aware that the 45-year-old man arrested in the street on suspicion of attempted murder has “a history of serious violence and mental health issues”, according to Met chief Mark Rowley.

Investigators add there is no initial evidence of Iranian state direction for the Golders Green attacks and that therefore the statements made by HAYI on social media are most likely to be opportunistic.

Nevertheless, claims of responsibility by HAYI, a new group, have become a feature of a spate of arson and attempted arson attacks targeting the Jewish community over the last month or so in north London.

Three men and a 17-year-old are awaiting trial accused of setting fire to four Jewish community ambulances, operated by the charity Hatzola, in Golders Green in the early hours of 23 March. The fire caused an estimated £1m in damage.

HAYI first appeared online on 9 March, as the US-Israel attack on Iran neared the end of its second week, with a post claiming it was “the start of its military operations against US and Israeli interests around the world”, according to the International Centre for Counter-Terrorism.

It has also claimed responsibility for attacks on Jewish sites in Europe, starting with an attack on a synagogue in Liège, Belgium on 9 March. An improvised explosive detonated at 4am, shattering windows, but causing no injuries.

Other claims followed elsewhere in Europe. One followed an arson attack on a synagogue in Rotterdam in the Netherlands on 13 March, in which four people were arrested; another came after an explosion outside a Jewish school in Amsterdam, a day later. No injuries were reported.

Investigators’ lead hypothesis is that there is a degree of Iranian state direction behind HAYI, and the search for evidence continues.

In the case of the Rotterdam and Jewish school attacks, the claims were made promptly after attacks that took place in the middle of the night, according to the International Centre for Counter-Terrorism. But other claims are considered to be disinformation or hoaxes.

Earlier this month, a short video posted by the group, featuring two individuals in hazmat suits, claimed that the Israeli embassy in London was to be targeted by two drones containing “radioactive and carcinogenic” materials.

Police responded by conducting a full search of the area, including nearby Kensington Gardens. They discovered two jars containing a powdered substance, but on inspection, their contents turned out to be nothing dangerous.

On the other hand, HAYI is not considered to exist in its own right. It began life as a simple channel on Telegram with a modest 200 followers in March, before disappearing later that month and reappearing under a different name.

Instead, the working assumption is that HAYI is a cutout, a front for an Iranian state agency, whether Iran’s Revolutionary Guards or the Ministry of Intelligence and Security, seeking to stoke fear in European Jewish communities.

What is different about the Golders Green incident is that, according to an analysis from Tech Against Terrorism, a specialist group, the claim “represents a significant escalation” in HAYI’s operational messaging.

“By claiming an incident involving physical casualties, HAYI is signalling willingness to associate its brand with direct violence, even if the group did not direct, enable, or have prior knowledge of the attack,” a report from the group concludes.