TLP:CLEAR · Disclosure is not limited.

Iran's southeast insurgency claims remain unverified, 9 November 2026

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-09 15:15Z · Overall confidence: HIGH

BLUF

The supplied reporting does not substantiate the claim of 94 deaths and 33 wounded in Sistan-Baluchestan or establish a sustained escalation of attacks. Reports of incidents near Zahedan and in Parud, and the claim that Jaish al-Adl attacked the Zahedan courthouse, remain thin and contested.

Executive summary

The available incident reporting for Sistan-Baluchestan consists largely of low-reliability social-media claims. It describes two security personnel killed near Zahedan on 6 September, a Basij commander killed in Parud days later, and an armed attack on the Zahedan courthouse. The supplied claims provide no province-wide casualty tally, and reporting on Jaish al-Adl responsibility conflicts. Separate reporting says Iranian authorities are tightening domestic security controls, including action against gatherings in Tehran, but does not link those measures to Baloch armed groups.

Change from previous assessment

Initial assessment of this topic. Compared with the prior brief of 8 November 2026, the available incident claims still do not substantiate the 94 dead and 33 wounded figure or a sustained escalation, and the Jaish al-Adl attribution remains unresolved. New reporting adds detail on Iranian domestic security measures and Tehran crowd dispersals, but does not connect those developments to attacks in Sistan-Baluchestan.

Key judgments

1. The supplied record does not substantiate a toll of 94 dead and 33 wounded in Sistan-Baluchestan. Its southeast incident claims report two security personnel killed near Zahedan on 6 September and a Basij commander killed in Parud days later, but provide no province-wide casualty tally. (Confidence: low · ASSESSED)
   • I&W: An independently corroborated casualty tally or named list of victims for Sistan-Baluchestan is published and specifies whether it supports the 94 dead and 33 wounded figure. (0-14 days)
   • I&W: New reporting continues to provide only incident-level figures and no province-wide casualty accounting. (0-14 days)
2. The available reports do not establish a sustained escalation of attacks in Sistan-Baluchestan. They describe a small number of incidents, mainly in or near Zahedan and Parud, without an independently corroborated, dated incident series. (Confidence: low · ASSESSED)
   • I&W: Independent, dated reporting confirms multiple attacks by Baloch armed groups in more than one Sistan-Baluchestan location. (0-14 days)
   • I&W: No independently confirmed attacks are reported in Sistan-Baluchestan, and no dated incident series emerges. (1-3 months)
3. Jaish al-Adl responsibility for the Zahedan courthouse attack is unresolved. One social-media report attributes a responsibility claim to the group, while another says no group claimed the Zahedan incident; the supplied reporting does not establish whether the courthouse attack and the reported Zahedan clash were the same event. (Confidence: low · REPORTED)
   • I&W: Jaish al-Adl issues a verifiable responsibility claim that identifies the Zahedan courthouse attack and its date. (0-14 days)
   • I&W: Independent reporting establishes that the courthouse attack was a separate incident from the Zahedan clash, or confirms that no group claimed responsibility. (0-14 days)
4. Iranian authorities are tightening domestic security controls during the war, but the supplied reporting does not connect those measures to Baloch armed activity. Reporting describes the dispersal of gatherings on Iranshahr Street in Tehran on 30 October, as well as wider official concern about domestic control. (Confidence: medium · REPORTED)
   • I&W: Iranian authorities announce or carry out further closures, dispersals or detentions on Iranshahr Street, Sanai Street or other named Tehran streets. (0-14 days)
   • I&W: Tehran authorities publicly reverse or end the reported restrictions on gatherings and businesses, with no further reported closures or detentions. (0-14 days)

Outlook & scenarios

Sparse reporting, no verified surge (65%)

Likely, reporting over the next 1-3 months remains too fragmented to establish a sustained increase in attacks or a province-wide casualty toll. The Zahedan and Parud reports remain unconfirmed or are clarified as separate incidents.

A further local attack clarifies attribution (25%)

Unlikely, a further attack in or near Zahedan or Parud receives independent confirmation and a credible responsibility claim. This would establish an additional incident, but would not by itself substantiate a province-wide escalation or the 94 dead and 33 wounded figure.

Coordinated, high-casualty escalation (10%)

Very unlikely, Baloch armed groups, including Jaish al-Adl, conduct coordinated attacks across multiple locations in Sistan-Baluchestan, producing a casualty toll that approaches the reported figure. This is a low-probability, high-impact wildcard; the supplied reporting does not currently demonstrate such a campaign.

Recommendations

1. Do not report 94 dead and 33 wounded as established. Label the figure unverified unless an independently corroborated tally or named casualty list emerges.
2. Maintain a dated incident log for Sistan-Baluchestan that records location, target, casualties, attribution and source quality. Keep the Zahedan courthouse report distinct from the reported 6 September clash unless evidence establishes they were the same event.
3. Seek independent confirmation of the Zahedan and Parud reports, and treat social-media responsibility claims as unverified until the group statement and incident details are authenticated.
4. Track reporting on Iranian domestic security controls separately from Baloch armed activity. Do not use Tehran crowd-control measures as evidence of insurgent escalation in Sistan-Baluchestan.

Confidence & uncertainty

Overall confidence is high for the narrow conclusion that the supplied record does not verify the claimed provincial toll or establish sustained escalation. The incident-level material is sparse and rests mainly on low-reliability social-media reporting, with no independent corroboration or province-wide accounting. Confidence in the individual attack reports and Jaish al-Adl attribution remains low. The better-sourced reporting on domestic security controls does not establish a link to Baloch armed activity.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Confirmed number, locations, dates, targets, and methods of attacks attributed to Baloch armed groups in Sistan-Baluchestan during the reporting period. Recommended collection: local media/social media
• [EEI 1.2 · PARTIAL] Verified Iranian military, Islamic Revolutionary Guard Corps, police, border-guard, and civilian fatalities and wounded associated with the attacks. Recommended collection: official statements/local reporting
• [EEI 1.3 · UNCOVERED] Evidence of coordinated or simultaneous attacks across multiple districts, including attacks on bases, checkpoints, patrols, government facilities, or transport routes. Recommended collection: local reporting/geospatial imagery
• [EEI 1.4 · UNCOVERED] Use of newly observed weapons, explosives, drones, ambush tactics, or improved command-and-control by the armed groups. Recommended collection: battlefield reporting/video analysis
• [EEI 2.1 · UNCOVERED] Deployment or redeployment of IRGC, army, police, border guards, special forces, armored vehicles, aircraft, or drones to Sistan-Baluchestan. Recommended collection: satellite imagery/local reporting
• [EEI 2.2 · UNCOVERED] New checkpoints, curfews, internet or telecommunications disruptions, road closures, arrests, raids, executions, or other emergency security measures. Recommended collection: local media/social media
• [EEI 2.3 · UNCOVERED] Changes in Iranian control of border crossings, district administrative centers, highways, or key security installations. Recommended collection: geospatial imagery/local reporting
• [EEI 2.4 · UNCOVERED] Verified civilian displacement, civilian casualties, protests, sectarian incidents, or retaliatory violence following security-force operations. Recommended collection: humanitarian reporting/local sources
• [EEI 3.1 · PARTIAL] Attacks or armed incidents spreading to new districts, major transport corridors, coastal areas, or provinces outside the current southeastern operating area. Recommended collection: incident databases/local reporting
• [EEI 3.2 · UNCOVERED] Evidence of cross-border movement, staging areas, weapons transfers, training, or safe-haven activity involving Pakistan, Afghanistan, or other neighboring territory. Recommended collection: border reporting/satellite imagery
• [EEI 3.3 · UNCOVERED] Public claims, intercepted communications, or captured equipment indicating material, financial, intelligence, or operational support from foreign governments or transnational militant networks. Recommended collection: official releases/open-source intelligence

Red cell review: CONCUR

TLP:CLEAR