Profile: Liwa al-Ghaliboun (Brigade of the Victors)

Name: Liwa al-Ghaliboun (Brigade of the Victors, or LAG). The name refers to verse 56 of the Quranic chapter al-Maida: (“Whoever allies themselves with God, His Messenger, and fellow believers, then it is certainly the party of God that will be the victors [hom ul-ghaliboun].”

Open image

Type of movement: Kinetic direct-action cell. Directed by Iran's Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF). Uses Iraqi operatives as a facade to conceal Tehran's hand in IRGC-QF or proxy operations within or emanating from Iraqi and Syrian territory.

History and objectives:

• LAG’s Telegram channel was created on March 24, 2023, with an initial post at 23:50 Iraq time quoting verse 39 of the Quranic chapter al-Hajj: “Permission is given to those who fight because they were wronged. Allah has power to grant them victory."
• On March 26, 2023, at 01:29 Iraq time, the Telegram account posted a statement claiming responsibility for a major one-way attack drone strike on a U.S. base in Syria. The strike had taken place at approximately 13:38 local time on March 23, killing a U.S. contractor, wounding another contractor, and wounding five U.S. service members. According to a U.S. statement released the same day, “The [U.S.] intelligence community assess[ed] the UAV to be of Iranian origin.”
• LAG's Telegram statement went on to note that “the leadership of Liwa al-Ghaliboun is determined to launch more real attacks on American occupation forces” [emphasis added].
• Later that day, the group posted a short video showing the launch of a Qasef-2K drone, the same system that the IRGC-QF-directed group Tashkil al-Waritheen claimed to launch against a U.S. base in January 2023. Although the attending personnel are blurred out, at least three individuals dressed in dark clothing and wearing baseball caps are visible preparing the weapon for firing. The caption implies that the video depicts the March 23 attack drone.
• Wider muqawama (resistance) media had only limited engagement with the LAG account and its activities. Most of the top accounts did not draw attention to this new facade group, despite its claiming of a major successful attack. This reluctance may stem from the fact that top figures in both Kataib Hezbollah (Abu Ali al-Askari) and Asaib Ahl al-Haq (Qais al-Khazali) denied their groups’ involvement in the March 23 attack. The most significant engagement with the brand came from a major media account that Militia Spotlight has previously assessed to be linked to Harakat Hezbollah al-Nujaba (HaN)

Chain of command: Militia Spotlight assesses that the balance of probabilities points to Liwa al-Ghaliboun being a facade group affiliated with the IRGC-QF. The U.S. intelligence community assessed that the drone used in the attack claimed by LAG was “of Iranian origin." U.S. Central Command responded to the attack by striking what Defense Secretary Austin called "infrastructure" and "facilities linked to Iran's Islamic Revolutionary Guard Corps," and the fatalities in these U.S. strikes were members of "groups affiliated with" the IRGC." In this respect, LAG seems to serve a role similar to that of Tashkil al-Waritheen, or could be the same organization working under a different name.

Affiliate relationships:

• Harakat Hezbollah al-Nujaba. This is based on media engagement with this new brand name, its operating area (HaN has a history of being more active in Syria), and its choice of language in its statement. Some HaN-linked propagandists seemed determined to draw attention to LAG's Iraqi identity, even as other muqawama groups tried to distance Iraq from the March 23, 2023, attack in Syria that killed and wounded Americans.
• Lebanese Hezbollah. As shown above, LAG's logo is very similar to Hezbollah's and is unique in using the same verse as Hezbollah's flag, which could indicate special closeness or intentional misdirection.

Subordinate elements:

• LAG’s Telegram channel was created on March 24, 2023.