Crispin Smith is an associate at a Washington-based national security law group, focusing on Iraqi security, human rights, and law of armed conflict issues. He is a cofounder of the Militia Spotlight platform.
Top "resistance" groups sought to avoid embarrassing the Sudani government, but at least one propaganda channel gave away Iraqi involvement.
On March 23, a coalition base near Hasaka in northeast Syria was hit by a one-way attack drone, killing an American contractor, wounding another, and wounding five U.S. military personnel. The U.S. intelligence community assessed the drone “to be of Iranian origin,” and U.S. Central Command responded to the attack by striking what Defense Secretary Lloyd Austin called "infrastructure" and "facilities linked to Iran's Islamic Revolutionary Guard Corps" (IRGC).
On March 26, a group called Liwa al-Ghaliboun (Brigade of the Victors, or LAG) issued a statement on its newly created Telegram channel claiming responsibility for the attack: “We announce that the drone regiment of the Islamic Resistance, Liwa al-Ghaliboun, was able to target the Rmelan airport located in the Syrian Arab Republic, which is occupied by the American forces, with a drone, on the first Thursday of the blessed month of Ramadan at exactly 1pm Baghdad time, killing and wounding many U.S. soldiers” (Figure 1).
The group also posted a short video purportedly showing the March 23 attack. The footage shows an Iranian Qasef-2K drone being launched (Figure 2).
Is LAG an Iraqi Group?
As one blogger noted in 2017, the name Saraya al-Ghaliboun (Companies of Victors) has been used before by Iran-backed militias in Syria. One media report sought to portray the March 23 attack as the work of "a militia affiliated with the Iranian Revolutionary Guard and funded directly by it...Its members are mostly Iraqis and Syrians, and most of the faction's headquarters are located in Deir al-Zour, eastern Syria.”
Yet the Iraqi muqawama (resistance) factions themselves adopted two different narratives. The official narrative denied that the attack was undertaken by Iraqis.
Abu Ali al-Askari, the preeminent spokesman for Kataib Hezbollah (KH), denied his militia’s involvement, saying, “We confirm that KH has no part in the operation against the American occupation bases in Syria, nor were its bases bombed” (Figure 3). Similarly, Qais al-Khazali of Asaib Ahl al-Haq (AAH) stated that “the Iraqi [militia] factions had nothing to do with the bombing of American bases in Syria” (Figure 4).
These and other militia players are trying not to cause the so-called "muqawama government" of Prime Minister Mohammed Shia al-Sudani any problems. This helps explain their efforts to conceal the Iraqi role in the attack, as well as their apparent decision to operate against targets outside Iraq rather than inside.
Yet other Iraqi muqawama players usedsocial media to signal their supporters that the attackers were definitely Iraqi, and hinted that they deployed from Iraq for the operation. For instance, LAG's claim referenced the time of attack in Baghdad time, seemingly emphasizing the Iraqi connection.
Meanwhile, on March 26 at 15:23 Baghdad time, the Jihad Brothers Team—a Telegram channel affiliated with Harakat Hezbollah al-Nujaba (HaN)—posted images that appear to display the launch site subsequently shown in LAG’s March 26 video, which was posted at 23:28 Baghdad time. The HaN image displays two cans of Wild Tiger energy drink sitting at the site, each bearing the label “Made in Iraq.” The caption is a dialogue between a militiaman and his elder: “On the first day of Ramadan I sent this picture to my grandfather. He said, ‘My boy, why didn't you fast?’ I said, ‘Grandfather, there’s no blame on the traveler [who breaks his fast]’” (Figure 5). The implication of this dialogue is that the speaker need not fast because Islamic jurisprudence exempts a traveler journeying a certain distance from fasting that day. Taken together, the post implies that the drone operators came from Iraq (hence the drink labels) and traveled at least forty-five kilometers (the required distance to break the fast according to Shia jurisprudence).
A Pattern or Just a New Name?
LAG’s modus operandi looks similar to that of Tashkil al-Waritheen, another Iraqi facade group that claimed responsibility for a drone attack against al-Tanf garrison in Syria on January 21, then later attempted to attack a U.S. base in Kuwait. Both groups used Qasef-2K drones, which in Iraq are possessed only by a limited number of special operations units with direct links to the IRGC's Qods Force. Additionally, the launchers in both attacks are almost identical.
Further resemblance can be found in muqawama social media coverage of the January and March attacks. After each incident, militia channels were largely muted; the only militia Telegram account that posted exclusive information about both operations was HaN’s Jihad Brothers Team.
These pieces of evidence indicate that LAG and Tashkil al-Waritheen could be the same group, or that they are closely linked special operations units affiliated with HaN and working under direct IRGC Qods Force supervision using different facade banners. This is especially plausible because HaN leader Akram al-Kaabi endorsed Tashkil al-Waritheen in a televised speech in December 2021; perhaps the muqawama believed it had become too easy to link HaN and Tashkil al-Waritheen, hence the adoption of LAG as a new facade banner.