Loading threat actor…
Asaib Ahl al-Haq is an Iraqi pro-Iranian Shia militia that maintains close ties to the Quds Force of Iran’s Islamic Revolutionary Guard Corps. It is part of the broader IRGC-aligned proxy ecosystem and has been associated with dissemination and amplification of militant messaging linked to attacks against Israeli and Jewish interests. In the reporting examined here, a Telegram channel affiliated with Asaib Ahl al-Haq was identified as an early publisher of a claim of responsibility attributed to Harakat Ashab al-Yamin al-Islamia, a previously unknown entity assessed as likely serving a façade or deniability function rather than operating as a credible independent organization. Messaging on an Asaib Ahl al-Haq channel also referenced authorization for “silent cells” to take action, indicating support for covert or proxy-style operations. The available facts support Asaib Ahl al-Haq’s role in propaganda dissemination, coordination, and alignment with Iranian external operations networks rather than direct attribution for the physical attacks themselves. Its observed behavior in this context is consistent with reconnaissance and operational awareness through near-real-time claim dissemination, support to initial access by proxy actors, and post-exploitation information operations intended to publicize and magnify attacks. The group’s association with the Quds Force places it within a state-aligned militant architecture historically linked to overseas proxy activity and deniable operations. High-confidence evidence in this case does not establish direct execution by Asaib Ahl al-Haq of the attacks in Europe, but it does support its involvement in the media and facilitation layer surrounding pro-Iranian militant activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.