Loading threat actor…
Liwa Zulfiqar is an Iraqi pro-Iranian Shiite militia operating within the broader Iran-aligned militant ecosystem. It has been identified in connection with online dissemination activity supporting Harakat Ashab al-Yamin al-Islamia (HAYI), a previously unknown group that claimed a series of low-casualty attacks against Jewish, Israeli, and American-linked targets in Europe. An early HAYI message announcing the start of military operations against American and Israeli interests worldwide was circulated through a Telegram account assessed to be affiliated with Liwa Zulfiqar, placing the militia within the information and amplification chain surrounding those incidents. Available reporting supports Liwa Zulfiqar’s role as part of a pro-Iranian propaganda and coordination environment rather than directly proving operational execution of the attacks themselves. The broader campaign associated with HAYI featured rapid claim dissemination, messaging aligned with Iran-backed networks, and target selection focused on intimidation of Jewish communities and signaling against Israeli and U.S.-linked interests. This activity fits a hybrid warfare pattern characterized by deniable proxy messaging, psychological impact, and limited-damage attacks rather than mass-casualty terrorism. Liwa Zulfiqar is therefore best understood as an Iran-aligned Iraqi militia linked to the online ecosystem that promoted and amplified claims for attacks attributed to HAYI. High-confidence evidence in this record supports propaganda dissemination and association with pro-Iranian militant networks, but does not independently establish that Liwa Zulfiqar itself conducted the physical attacks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Iraqi pro-Iranian militia whose affiliated Telegram channel appears to have been among the first to circulate HAYI messaging announcing operations against US and Israeli interests worldwide.
A pro-Iranian militia in Iraq whose Telegram-linked messaging was used to disseminate an announcement about the start of military operations against American and Israeli targets worldwide, suggesting a role in amplifying or coordinating the campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.