Liwa Zulfiqar
Liwa Zulfiqar is described in the provided content as an Iraqi pro-Iranian militia. In the reporting analyzed, Telegram channels seemingly affiliated with Liwa Zulfiqar were among the earliest amplifiers of messaging from the previously unknown group Harakat Ashab al-Yamin al-Islamia (HAYI). On 9 March, a Telegram account assessed to appear linked to Liwa Zulfiqar circulated an early HAYI post announcing the start of “military operations against American and Israeli targets around the world.” The content links this dissemination pattern to a broader pro-Iranian online ecosystem involved in rapidly spreading HAYI claim messages related to low-casualty attacks against Jewish, Israeli, and U.S.-linked targets in Europe, including incidents in Belgium, the Netherlands, and the United Kingdom. The material does not directly attribute specific attacks to Liwa Zulfiqar itself, but places it within the network of pro-Iranian militia-linked channels that amplified HAYI messaging. No additional aliases or sub-groups for Liwa Zulfiqar are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇮🇱 Israel
Where they're from
Attributed origin per open-source reporting.
- IQ
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Iraqi pro-Iranian militia whose affiliated Telegram channel appears to have been among the first to circulate HAYI messaging announcing operations against US and Israeli interests worldwide.
A pro-Iranian militia in Iraq whose Telegram-linked messaging was used to disseminate an announcement about the start of military operations against American and Israeli targets worldwide, suggesting a role in amplifying or coordinating the campaign.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.