At grid reference 18T WL 85070 06850 (40.7128°N, 74.0060°W) in the federal courthouse in Lower Manhattan on Friday afternoon, 32-year-old Iraqi national Mohammad Baqer Saad Dawood Al-Saadi was led into the courtroom in a black T-shirt, grey pants, and black sneakers. US Marshals removed his wrist cuffs at the defence table. His ankles remained shackled. According to NBC New York’s courtroom reporting, he smiled at the federal law enforcement personnel seated in the first few rows, and continued smiling for much of his initial appearance. He did not speak.

US Magistrate Judge Sarah Netburn ordered him held pending trial. The complaint unsealed against him names six counts including conspiracy to provide material support to a foreign terrorist organisation, conspiracy to provide material support for acts of terrorism, and conspiracy to bomb a place of public use. Acting Attorney General Todd Blanche confirmed the charges in the DOJ release, identifying Al-Saadi as a senior member of Kata’ib Hizballah and the IRGC’s external operations apparatus.

Defence counsel Andrew Dalack framed Al-Saadi as a political prisoner held in solitary confinement that, in his words, is emotionally distressing and inappropriate. Dalack stated his client was arrested in Turkey at the behest of US authorities, then handed over without an opportunity to contest the legality of his detention or transport. The judge replied that the segregation was most likely for Al-Saadi’s own safety given the nature of the charges.

From Baghdad, at grid reference 38S MB 39960 90150 (33.3152°N, 44.3661°E), Kataib Hezbollah has operated for two decades as one of the most consequential Iraqi Shia militias in the IRGC-QF proxy network. The DOJ complaint goes further than US officials have gone publicly to date by stating that Kataib Hezbollah operates under a pseudonym, Harakat Ashab al-Yamin al-Islamiya, abbreviated HAYI, and uses that brand to carry out attacks across Europe. CNN had been first to publish that link on 11 May; a parallel research note from GNET on the same day reached similar conclusions through different evidence.

The attacks the complaint attributes to Al-Saadi began on 9 March, the same day HAYI opened its first online channel, with explosives used against a synagogue in Liege. By 15 March three more incidents had occurred across the Netherlands. By the end of April, HAYI had claimed 17 incidents across the United Kingdom, Belgium, the Netherlands, France, Germany, Macedonia, and Greece. Targets included synagogues, Jewish schools, kosher restaurants, Israeli-owned businesses, an emergency-services depot in north London used by Jewish charity ambulances, and the offices of the London-based Iranian opposition outlet Iran International.

The operational signature is consistent. Disposable agents, often teenagers, are recruited on social media for cash. A 17-year-old was arrested in Paris attempting to ignite an improvised explosive device at a Bank of America building. A teenager paid to commit arson in Antwerp was detained in March. A youth charged with the 18 April London synagogue arson told investigators he did not know what the target was. GNET catalogued the model as “gig-economy terrorism” before the DOJ filing matched the same model to a named operational lead.

The Manhattan synagogue plot, anchored to the Southern District jurisdiction at 18T WL 85070 06850, opened on 1 April with a recorded call. Al-Saadi asked a contact, in the wording the complaint quotes, what the cost would be to carry out a bombing in the US. He framed the target as a Jewish temple or community centre. The contact connected him to an FBI undercover agent posing as an associate of a Mexican cartel willing to take the contract.

Al-Saadi sent the undercover a photograph and a map of the specific Manhattan synagogue. He provided two further target packages, one for a Jewish centre in Los Angeles and one for a Jewish institution in Scottsdale, Arizona. The complaint says he agreed to pay $10,000 in cryptocurrency and forwarded $3,000 as a down payment, on the condition that the attack be filmed. He demanded execution on 6 April. When it did not happen, he texted the undercover the next morning asking why.

In US Attorney Jay Clayton’s framing for the Southern District, Al-Saadi attempted to disrupt American society through intimidation and violence. The criminal complaint also notes Al-Saadi discussed using an improvised explosive device against the New York synagogue specifically. The complaint references propaganda images Al-Saadi posted to social media including a July 2020 X post showing the US Capitol in rubble with the faces of Iranian commanders killed in earlier US strikes overlaid on the image. The accompanying text, the complaint says, read: “our revenge for the martyred leaders is ongoing. No negotiations with the occupier.”

At grid reference 35T PF 41030 45520 (41.0082°N, 28.9784°E), the city centre cross-check reference for Istanbul, Al-Saadi was taken into custody by Turkish authorities earlier this week. The specific date and the exact location of arrest have not been disclosed by the DOJ or by Turkish officials. The reconstruction depends on two sources: defence attorney Andrew Dalack’s courtroom statement that his client was arrested in Turkey, and CNN’s flight-records tracking that placed a Justice Department extradition aircraft over Turkey this week, returning via Morocco, landing in the New York area late Thursday 14 May.

Turkish state involvement is the structurally significant element here. Ankara has historically managed its Iranian relationship with deliberate ambiguity, hosting Iranian Foreign Ministry visits, criticising Israeli strikes inside Iran, and conducting trade in volumes that have drawn US sanctions attention. Physically handing a senior Kataib Hezbollah operative to US custody, in the middle of a still-tense post-ceasefire window, is the strongest counter-Iran signal Turkish state architecture has produced in this conflict cycle. Whether it reflects a one-off concession to Washington or a recalibration of Ankara’s tolerance for IRGC-linked operations on Turkish soil will become visible only in the months ahead.

The arrival jurisdiction was Stewart International Airport in Newburgh, New York, at 18T XL 16760 64340 (41.5041°N, 74.1048°W). Stewart is regularly used by Justice Department aircraft for federal transfers, including extraditions, because of its FBO infrastructure and its proximity to the Southern District of New York without the public visibility of JFK or Newark. The complaint is unsealed in Manhattan the following day. The procedural choreography is unusually fast: arrest abroad, transfer overnight, charges public within 24 hours of US arrival.

The DOJ complaint includes photographs from Al-Saadi’s Snapchat account showing him standing alongside Qasem Soleimani, the IRGC-QF commander killed by a US drone strike at Baghdad International Airport in January 2020. The relationship is documented enough that the US Attorney’s Office included it in the charging package. Defence attorney Dalack used the same photograph to frame his client’s position: a political prisoner being prosecuted for a perceived connection to Soleimani. Both readings work from the same fact.

The complaint also names Al-Saadi as close to Esmail Qaani, Soleimani’s successor at the IRGC-QF, and to Akram Abbas al-Kabi, the secretary general of Harakat Hezbollah al-Nujaba, a separate Iranian-backed Iraqi militia. Al-Kabi has been the subject of a $10 million State Department Rewards for Justice bounty since 5 May. The structural read is that Al-Saadi sits inside a specific tier of the IRGC-QF Iraqi proxy network, with access to multiple militia frameworks, and a long-running operational involvement with Kataib Hezbollah dating to 2017 per the prosecutorial account.

What the complaint does not assert is direct IRGC-QF tasking of the European HAYI campaign. CBS reported British intelligence has been tracking the group and was aware of its plans to expand to US soil; those sources are not named. The Jerusalem Post analysis of HAYI’s publication patterns, published a week before the arrest, argued that HAYI claims were consistently first appearing on IRGC-linked Telegram channels in a way that would be impossible without direct upstream coordination. The DOJ filing stops short of that finding. It can be read as caution; it can be read as evidentiary discipline; it can be read as both.