Hezbollah
Hezbollah is a Lebanese militant and political organization founded in the early 1980s under the auspices of Iran’s Islamic Revolutionary Guard Corps (IRGC) and initially protected by Syria. The IRGC established a headquarters in Baalbek and trained local Shiite youth who formed Hezbollah’s core. The group evolved from a small Islamic militia into a powerful political party, social network, and military organization in Lebanon, while remaining part of Tehran’s proxy network; the IRGC Quds Force is described as maintaining relationships with proxy groups such as Hezbollah. The content attributes to Hezbollah early kidnappings and suicide bombings, including the 1983 bombings of US and French peacekeepers in Beirut that killed 241 US Marines and 58 French paratroopers. A US federal court in 2003 found Iran responsible for providing material support to Hezbollah for those bombings. Hezbollah also used social services, charity networks, and media operations including AlManar TV to build support and shape narratives of resistance and legitimacy. After Lebanon’s civil war, Syria allowed Hezbollah and Amal to retain their weapons despite disarmament requirements under the Taif Agreement. Hezbollah’s continued armed status, refusal to disarm after Israel’s 2000 withdrawal, and selective compliance with Lebanese state authority are described as undermining Lebanese sovereignty and contributing to sectarian polarization. The content describes Hezbollah as a transnational terrorist and militant actor with operational, logistical, and financial activity beyond Lebanon. Mentioned activities include surveillance of diplomatic targets in Bogotá, a failed bombing attempt in Bogotá linked to Hezbollah, ongoing cell activity and arrests in border regions such as Cúcuta, and a well-documented presence in the Tri-Border Area of Argentina, Brazil, and Paraguay for fundraising and logistical support. The group is also described as having involvement in criminal and financing networks, including international drug-trafficking activity referenced in connection with DEA Project Cassandra. Additional reporting in the content states that Spain, Germany, France, and the United Kingdom dismantled a Hezbollah drone smuggling ring in April 2025. Recent content also links Hezbollah to plots and networks in Gulf states. Lebanon’s Ministry of Foreign Affairs and Emigrants denounced Hezbollah’s involvement in a UAE terrorist plot, while the UAE’s State Security Apparatus said it dismantled a network funded and operated by Hezbollah and Iran that used a fake commercial enterprise as cover for money laundering, terrorism financing, and external operations. Kuwait separately announced in March that it had uncovered a terrorist group affiliated with Hezbollah and arrested 16 suspects; authorities said they seized firearms, ammunition, an assassination weapon, encrypted Morse communication devices, drones, maps, narcotics, cash, and terrorist flags and images. The content also states that Hezbollah has used cryptocurrency at increasing scale, alongside other Iran-linked proxies and designated terrorist organizations such as Hamas and the Houthis. Chainalysis reporting cited in the content states that Iran’s IRGC transacted more than $2 billion from sanctioned addresses and that Lebanese Hezbollah, Hamas, and the Houthis have used cryptocurrency at increasingly greater scale. Hezbollah is further described as active in regional conflict, including launching rockets and drones toward Israel and being part of the broader Iran-aligned “Axis of Resistance.” The content notes Hezbollah’s ability to conduct extraterritorial attacks outside Lebanon was almost certainly diminished in one assessment, but it remains identified as an Iranian proxy with military, propaganda, financing, and external operational capabilities. Known alias in the provided content: Hezbollah.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- LB
- US
- IR
Tradecraft
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an aligned entity producing statements and videos disseminated online in support of IRGC-linked propaganda ecosystems.
Conducting espionage, surveillance, failed terrorist plotting, money laundering, drug-trafficking collaboration, and logistical support activities across Latin America, especially in Colombia, Ecuador, Venezuela, and the Tri-Border Area.
Iran-backed Lebanese militant group involved in training proxies, weapons and drone smuggling, attacks on Israel, and maintaining trafficking and smuggling networks across Syria and Latin America.
Iran-aligned proxy group referenced as part of Tehran’s external operations network; its linked Telegram channels later shared HAYI claim videos, and the HAYI logo is described as resembling Hezbollah imagery.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.