Loading threat actor…
Hezbollah is a Lebanese Shia Islamist militant and political organization founded in the early 1980s under the auspices of Iran’s Islamic Revolutionary Guard Corps and historically protected by Syria. It functions as both an armed proxy aligned with Iran and a domestic political and social movement in Lebanon. The group is widely known for insurgent, terrorist, and hybrid operations in Lebanon, Israel, and abroad, and for maintaining logistics, fundraising, procurement, and facilitation networks outside the Middle East, including in Latin America and parts of Europe. Hezbollah has conducted and supported attacks against Israeli military and civilian targets, including rocket and drone operations, and has demonstrated long-standing competence in battlefield adaptation and technical exploitation. It publicly stated that it intercepted analog video feeds from Israeli drones from at least the mid-1990s and used that intelligence to support the 1997 Ansariya ambush. More recently, it has employed FPV drones and other unmanned systems against Israeli forces and has been linked to drone procurement and smuggling activity in Europe. The organization has also been associated with surveillance of diplomatic and Jewish or Israeli-linked targets abroad, including reported activity in Colombia, and with covert infrastructure used for logistics, safe passage, and potential external operations in Latin America. Operationally, Hezbollah combines reconnaissance, clandestine logistics, recruitment, training, propaganda, and armed action. Reported activities include surveillance, targeted plotting, use of drones, encrypted communications, money laundering, terrorism financing, and exploitation of commercial cover. Authorities in Gulf states have attributed to Hezbollah-linked networks plans to undermine national security, infiltrate local economies, and support external operations. The group has also increasingly used cryptocurrency alongside more traditional illicit finance mechanisms. Hezbollah is closely tied to Iran, especially the IRGC-Quds Force, which supports proxy relationships, training, and external operations. It has also trained or advised other Iran-aligned groups, including the Houthis, and forms part of the broader so-called Axis of Resistance. Known aliases in the provided material are limited to Hezbollah itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Materially connected as part of IRGC-linked Latin American proxy infrastructure providing logistics and safe passage for potential operations.
Uses FPV drones against Israeli forces in Lebanon, including fiber-optic tethered drones designed to avoid electronic jamming.
Referenced as an aligned entity producing statements and videos disseminated online in support of IRGC-linked propaganda ecosystems.
Conducting espionage, surveillance, failed terrorist plotting, money laundering, drug-trafficking collaboration, and logistical support activities across Latin America, especially in Colombia, Ecuador, Venezuela, and the Tri-Border Area.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.