TLP:CLEAR · Disclosure is not limited.

Sistan-Balochistan: reported attack increase, casualty toll unverified

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-03 13:13Z · Overall confidence: HIGH

BLUF

A single think-tank account reports about 60 armed attacks in Sistan-Balochistan from March to October 2026, with roughly half in September and October. It also gives an unofficial estimate of around 100 Iranian security personnel killed or wounded, but does not substantiate the separate headline figure of 94 dead and 33 wounded or establish Jaish al-Adl responsibility for the latest Saravan shooting.

Executive summary

Reporting indicates a rise in Baloch armed activity in Sistan-Balochistan, including attacks reported beyond the traditionally active Sarbaz area in Zahedan, Khash and Iranshahr. The attack counts and casualty estimates come from one think-tank account and rely partly on unofficial figures. Separately, a police officer was reported shot dead in Saravan on 3 November; authorities alleged an unidentified group linked to the US and Israel was responsible, but no group claimed the attack. The supplied reporting does not establish that Jaish al-Adl carried it out.

Change from previous assessment

Since the 2 November brief, a think-tank account has added estimates of about 60 attacks from March to October, approximately 30 JMM operations since September and around 100 security personnel killed or wounded, as well as reported activity in Zahedan, Khash and Iranshahr. This adds a tentative trend judgment, but confidence remains low because the estimates come from one source and use unofficial figures. A police officer's reported killing in Saravan on 3 November is a new incident; the prior assessment that the 94-dead, 33-wounded tally is unsubstantiated and that Jaish al-Adl responsibility is unverified remains unchanged.

Key judgments

1. Baloch armed activity in Sistan-Balochistan likely increased in September and October 2026. One think-tank account estimates about 60 attacks from March to October, with roughly half in September and October, and attributes approximately 30 operations since September to the People's Fighters Front coalition, or JMM. The same account reports activity in Zahedan, Khash and Iranshahr beyond the traditionally active Sarbaz area. These figures come from one source, and the casualty estimate is explicitly unofficial, so confidence in the trend remains low. (Confidence: low · ASSESSED)
   • I&W: Confirm: independent incident tracking records a higher attack count in September and October than in March to August, or corroborates approximately 30 JMM operations since September. (0-30 days)
   • I&W: Break: an independently compiled incident record finds no rise in September and October, or shows that the reported total of about 60 attacks is not supported. (0-30 days)
2. The 3 November shooting in Saravan is reported, but the perpetrator is not established. One major-media account reports that unknown assailants shot and killed a police officer as he left his home; Iranian authorities attributed the attack to an unidentified group linked to the US and Israel, while reporting says no group claimed responsibility. The single-account reporting and unresolved attribution support medium confidence in the reported incident, not in the official allegation. (Confidence: medium · REPORTED)
   • I&W: Confirm the unresolved attribution is resolved if investigators or an authenticated group statement identify who carried out the Saravan shooting. (0-30 days)
   • I&W: Break the official allegation if Iranian authorities retract it or identify a perpetrator with no substantiated link to the alleged group. (0-30 days)
3. It is unlikely that the supplied reporting substantiates the headline figure of 94 dead and 33 wounded. The only consolidated estimate here is an unofficial figure of around 100 Iranian security personnel killed or wounded across approximately 30 JMM operations; it does not separate deaths from injuries or verify either headline number. Confidence is low because the estimate is single-source and unofficial. (Confidence: low · ASSESSED)
   • I&W: Confirm the headline toll if a named, independently corroborated casualty accounting separates deaths and injuries and reports 94 dead and 33 wounded for a defined period. (0-30 days)
   • I&W: Break the headline toll if a verified accounting gives materially different totals or shows that the reported estimate covers a different period or category. (0-30 days)
4. It is unlikely that current reporting supports attributing the Saravan shooting specifically to Jaish al-Adl or the JMM. Iranian authorities alleged an unidentified US and Israel-linked group was responsible, but no group claimed the attack; the reported killing of a suspected Jaish al-Adl member the previous day does not establish responsibility for the shooting. Confidence is low because the attribution rests on limited reporting and remains unresolved. (Confidence: low · ASSESSED)
   • I&W: Confirm a Jaish al-Adl or JMM link if an authenticated claim of responsibility matches independently verified details of the Saravan attack. (0-30 days)
   • I&W: Break the attribution if an investigation identifies a different perpetrator or a credible account rules out involvement by those groups. (0-3 months)

Outlook & scenarios

Uneven attacks continue across the province (55%)

The most likely outlook over the next 1-3 months is continued armed activity against Iranian security personnel and facilities, with attacks reported in Sarbaz and extending to Zahedan, Khash and Iranshahr. The pace and casualty toll remain difficult to verify independently.

Security pressure contains the reported increase (20%)

An unlikely outcome is that arrests and security operations constrain attacks, leaving the reported activity concentrated in Saravan and the traditionally active Sarbaz area. The current reporting does not establish that the broader geographic pattern will persist.

JMM coordination broadens the campaign (20%)

An unlikely scenario is that JMM coordination sustains attacks across more districts and against additional IRGC, police and border-guard personnel or facilities. A continuing rise in independently verified incidents across Zahedan, Khash and Iranshahr would support this outlook.

Wildcard: coordinated attacks cause a sharp rise in security casualties (5%)

A very unlikely but high-impact wildcard is a coordinated operation against several security positions in a short period, causing a sharp rise in casualties and a broader security response. The supplied reporting does not establish that the groups have this level of coordination or capability.

Recommendations

1. Maintain a district-level incident log for Sarbaz, Saravan, Zahedan, Khash and Iranshahr. Record the date, target, casualties, alleged perpetrator and source for each incident.
2. Keep killed and wounded figures separate. Do not use the 94 dead and 33 wounded headline tally as an established total without named cases and independent corroboration.
3. Track official statements and authenticated claims of responsibility for the Saravan shooting separately. Do not treat the killing of a suspected Jaish al-Adl member as evidence that Jaish al-Adl carried out the shooting.
4. Compare any new JMM or Jaish al-Adl claims with independently reported incident details and Iranian official accounts before assessing responsibility or operational reach.

Confidence & uncertainty

The requested high run-level rating reflects corroboration across the broader supplied event set and should not be read as high confidence in every insurgency-specific judgment. For Sistan-Balochistan, the attack trend and combined casualty estimate rely on one think-tank account, with the casualty figures described as unofficial. The Saravan shooting is reported, but its perpetrators and any link to Jaish al-Adl or the JMM remain unverified.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Confirmed number, locations, dates, targets, and methods of attacks attributed to Baloch armed groups in Sistan-Baluchestan during the reporting period. Recommended collection: local media/social media
• [EEI 1.2 · PARTIAL] Verified Iranian military, Islamic Revolutionary Guard Corps, police, border-guard, and civilian fatalities and wounded associated with the attacks. Recommended collection: official statements/local reporting
• [EEI 1.3 · PARTIAL] Evidence of coordinated or simultaneous attacks across multiple districts, including attacks on bases, checkpoints, patrols, government facilities, or transport routes. Recommended collection: local reporting/geospatial imagery
• [EEI 1.4 · UNCOVERED] Use of newly observed weapons, explosives, drones, ambush tactics, or improved command-and-control by the armed groups. Recommended collection: battlefield reporting/video analysis
• [EEI 2.1 · PARTIAL] Deployment or redeployment of IRGC, army, police, border guards, special forces, armored vehicles, aircraft, or drones to Sistan-Baluchestan. Recommended collection: satellite imagery/local reporting
• [EEI 2.2 · UNCOVERED] New checkpoints, curfews, internet or telecommunications disruptions, road closures, arrests, raids, executions, or other emergency security measures. Recommended collection: local media/social media
• [EEI 2.3 · UNCOVERED] Changes in Iranian control of border crossings, district administrative centers, highways, or key security installations. Recommended collection: geospatial imagery/local reporting
• [EEI 2.4 · UNCOVERED] Verified civilian displacement, civilian casualties, protests, sectarian incidents, or retaliatory violence following security-force operations. Recommended collection: humanitarian reporting/local sources
• [EEI 3.1 · PARTIAL] Attacks or armed incidents spreading to new districts, major transport corridors, coastal areas, or provinces outside the current southeastern operating area. Recommended collection: incident databases/local reporting
• [EEI 3.2 · PARTIAL] Evidence of cross-border movement, staging areas, weapons transfers, training, or safe-haven activity involving Pakistan, Afghanistan, or other neighboring territory. Recommended collection: border reporting/satellite imagery
• [EEI 3.3 · UNCOVERED] Public claims, intercepted communications, or captured equipment indicating material, financial, intelligence, or operational support from foreign governments or transnational militant networks. Recommended collection: official releases/open-source intelligence

Red cell review: CONCUR

TLP:CLEAR