Loading threat actor…
Lashkar-e-Sarullah is a Shia militant outfit reported to have emerged in the Iran-Pakistan border region, particularly in the broader Balochistan theater. It has been described as part of a reemergence of Shia militancy in an environment shaped by sectarian conflict, cross-border insurgency, and competition among Baloch separatist groups, Sunni jihadist organizations, and Iran-aligned formations. Available reporting places the group within a landscape that includes Liwa Zainabiyoun and other Iran-linked Shia militant networks, but high-confidence public detail on Lashkar-e-Sarullah’s structure, leadership, operational history, and specific attack tradecraft remains limited. The group is associated with the sectarian and militant dynamics surrounding Pakistan’s Balochistan province and Iran’s Sistan and Baluchestan province, where Sunni extremist violence, anti-Shia militancy, and cross-border militant movement have intensified. Its emergence indicates an expansion of Shia armed mobilization in response to those pressures and to broader regional conflict involving Iran. Publicly available information does not currently support a precise assessment of its independent capabilities, target set, or command relationships beyond its characterization as a newly emerged Shia militant outfit in this borderland security environment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.