Entrenchment. In recent years, we have closely studied the composition of the civil and military entrenchment of the radical Shiite axis, led by Iran, in southern Syria. In this context, we have also published several in-depth reports on Hezbollah units operating in southern Syria, Shiite militias, the civil entrenchment of the Shiite axis, and local militias operating in cooperation with the Shiite axis.
Southern Syria — a platform for Shiite terror infrastructure. The Shiite axis viewed southern Syria as a highly strategic region, constituting a direct front line vis-à-vis Israel. Within this arena, Iran established a military-terror infrastructure directed toward Israel, employing Hezbollah (the Golan Portfolio Unit), various Shiite militias, and local militias. The operatives of the Golan Portfolio cell, as well as members of the local militias, were local Syrians—both Sunnis and Druze.
The Shiite axis uses the area of southern Syria as a platform for terror, both directly against the Israeli Golan Heights area and also indirectly, through Jordan, toward Judea and Samaria — mainly by means of smuggling high-quality and balance-disturbing weapons.
The Operating Units. Over the years, some of these cells and militia operatives were activated simultaneously by Hezbollah through the Golan Portfolio Unit, as well as by Unit 840 — the special operations unit of the Quds Force under the command of Azhar Bakri — and by Department 4000, the special operations division of the IRGC Intelligence Organization, until recently under the command of Jawad Ghaffari.
We are aware of at least two past incidents in which Unit 840, through local terror cells, succeeded in planting explosive devices near the border with Israel (in August and November 2020). Further attempts to execute terrorist operations did not materialize or failed to achieve their objectives.
The Potential. In the years preceding the fall of the Assad regime, we mapped dozens of areas and settlements in southern Syria in which dozens of terror cells operated under the direction of the Golan Portfolio Unit, and dozens of local militias that served de facto as mercenaries of the Shiite axis (See potential details in the appendix).
Even today, after the fall of the Assad regime, the Syrian locals — some of whom operated within those terror cells and some who were active in militias in the aforementioned areas and settlements (see main image) — currently constitute the potential upon which the Iranians and Hezbollah base their continued activity in southern Syria.
Through this potential, they are rebuilding their terror infrastructure and reinforcing their foothold in this region. The interest of the locals being operated is primarily financial, and less ideological, if at all.
The mission of some of the operatives is to collect intelligence and/or to actually carry out terror activity in the border area, and the mission of others is to assist in the transport and smuggling of weapons.
The Method of Operation. The Iranians and Hezbollah directly operate local cells from Iran and Lebanon or, alternatively, employ a local intermediary — a Syrian who serves as a liaison. In certain cases, the activation is even conducted covertly; that is, the local Syrian at the end point is unaware that he is, in fact, being operated by Iranian and/or Hezbollah entities.
Between July and September 2025, four Lebanese operatives were eliminated in Lebanon. Two of them belonged to Unit 840 and two to Hezbollah. These four operatives constituted a central element in both weapons smuggling from Iran through Syrian territory to Jordan and from there to the territory of Judea and Samaria, in weapons smuggling to Lebanon, and in directing terror cells within Syria to carry out activity against Israel from southern Syria.
One of the aforementioned four eliminated Lebanese operatives was Qassem Saleh al-Husseini, a senior Lebanese operative from Unit 840, who was responsible for operating one of the terror cells that was active in the area of the town of Rafiid in southern Syria — in the villages of Umm al-Louqas and Ein al-Basli — approximately two to three kilometers from the border fence with Israel.
On 2 July 2025, IDF forces arrested four Syrian locals who operated within this cell and intended to carry out terror activity against IDF forces. Al-Husseini employed a local Syrian intermediary named Hussain Mahmoud Ali Bakr (a former lieutenant colonel in Assad’s army), who maintained direct contact with the cell members.
Al-Husseini was also involved in the transport and smuggling of weapons into the territories of Judea and Samaria. Another eliminated Lebanese operative who was active in Unit 840 and involved in weapons smuggling is Muhammad Hassan Shaib. On October 8, it was published that a large, high-quality weapons shipment originating from Iran was seized by Israel. The shipment contained Kalimgor-type explosive devices, suicide drones, rockets and RPG launchers, grenades, pistols, rifles, and machine guns.
It is noteworthy that, even before the collapse of the Assad regime, on 3 November 2024, the IDF apprehended in the same area — near the town of Rafiid, adjacent to the village of Saida — an individual named Ali Suleiman al-A’tsi, who had been operated by Iran and was involved in intelligence collection on IDF forces within the buffer zone in preparation for future terrorist operations.
On 11 September 2025, Syrian Internal Security forces arrested a local terror cell that, according to reports, was operated by Hezbollah. The cell was apprehended in the area of the villages Sa’sa and Quneitra in southern Syria. During the arrest, 19 Grad rockets, rocket launchers, and additional ammunition were seized. According to various reports, the cell members underwent training by Hezbollah in Lebanese territory.
One of the four eliminated Lebanese operatives mentioned above was Hussam Qassem Gharab, a Hezbollah operative who was killed on 5 August 2025 in the Brital area in the Beqaa Valley. Gharab operated from Lebanese territory in directing terror cells in Syria that planned to launch rockets toward the Israeli Golan Heights.
In conclusion, It is evident that, despite the changes that have occurred in southern Syria with the rise of the al-Shara’ regime, the potential terror infrastructure built by Iran — through Hezbollah and its local partners — during the past decade remains significant and is even being renewed. Integrated activation networks of Hezbollah (formerly the Golan Portfolio Unit), Unit 840 of the Quds Force, and Department 4000 of the IRGC Intelligence Organization have succeeded in leaving behind a flexible operational infrastructure that relies on local Syrian elements.
This infrastructure, driven mainly by economic rather than ideological motivations, enables Iran and Hezbollah to continue consolidating their foothold in southern Syria and maintaining a persistent threat along Israel’s border And to preserve the ability to smuggle weapons (“oxygen pipeline”) into the territories of Judea and Samaria. Mapping the arenas, identifying the operators, and analyzing the operational patterns indicate a consistent effort to rebuild a mechanism capable of activating local cells on short notice and with minimal direct exposure of the Iranian and Lebanese operators.
Appendix – The potential of Iran and Hezbollah’s terrorist infrastructure in southern Syria – mapping of localities:
Daraa City- Prior to the fall of the Assad regime, the activity of the Golan portfolio and a local militia was known.
Kahil-The Golan portfolio and local militia
Sayda – The Golan portfolio and local militia
Ghasm – The Golan portfolio and local militia
Al Musayfirah – The Golan portfolio and local militia
Al-Harak – The Golan portfolio and local militia
Muiayhah Al Gharbiyah – The Golan portfolio and local militia
Busra al-Harir – The Golan portfolio and local militia
Masih – The Golan portfolio and local militia
Izra – The Golan portfolio and local militia
Hush Hamed – The Golan portfolio and local militia
Arna – The Golan portfolio
Hadar – The Golan portfolio and local militia
Khan Arnabah – The Golan portfolio and local militia
Town of al-Ba’ath – The Golan portfolio and local militia
Jabata al-Kashbesh – The Golan portfolio and local militia
Alhariya – The Golan portfolio
Ophenia – The Golan portfolio
Al-Hamidiyah – The Golan portfolio
Al-Qahtanya – The Golan portfolio
Ein Alnuria- The Golan portfolio
Ruwayhinah- The Golan portfolio
Brica- The Golan portfolio
Bir Ajam- The Golan portfolio
Alisha- The Golan portfolio
Kudnah- The Golan portfolio
Sida Al-hanot- The Golan portfolio
Al Rafid- The Golan portfolio and local militia
Rhadir el Boustane- The Golan portfolio and local militia
Sasa- The Golan portfolio
Kanaker – The Golan portfolio
Inkhil – Local militia
Jbab- Local militia
Jamlah- Local militia
Ash Shajarah- Local militia
Tafas- Local militia
Baiyt Irah- Local militia
Muzayrib – Local militia
Tal Shihab – Local militia
Kharab al-Shahm- Local militia
Ibb – Local militia
Busra- Local militia
Jabah – Local militia
Eastern Ghariyah- Local militia
As Suwayda- Local militia
One Response
Dear Tal,
Great work! Your factual reporting of terrorist activities clarifies the need to end all the funding as well as the terrorist command and control in all the ring of fire countries yet destabilized by jihaddist death cult caliphate empire delusions. Funding from Qatar, Turkey, Iran and everywhere else including Europe and the USA must be tracked and ended. The traumatized, abused and terrorized populations must be liberated from their oppressors. We must apply justice to eliminate all the evil oppressors: both those who fund terror and those who practice terror. Jihaddist public executions must be stopped now.