TLP:CLEAR · Disclosure is not limited.

Southeastern Iran: Armed Incidents and Unverified Casualty Claims

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-10-24 09:11Z · Overall confidence: MEDIUM

BLUF

Sistan-Baluchestan likely experienced an unusually high level of armed incidents through 10 October, and a clash was reported in Khash on 21 October, but the available evidence does not establish a fresh surge during 23-24 October. Haal Vash reported 94 deaths and 33 wounded from incidents through 10 October, while figures attributed to official sources were 87 dead and 10 wounded; neither set is independently verified.

Executive summary

Haal Vash reported 63 armed incidents in Sistan-Baluchestan and Kerman between 31 March and 10 October, including 18 in the final 18 days of its monitoring period. ACLED was separately reported to have recorded about 70 confrontations in Sistan-Baluchestan through 8 October, its highest annual level in at least a decade. Both accounts have weak source provenance in the material reviewed. A clash was reported in Khash on 21 October, but Iranian police and Tasnim described gunmen opening fire, while Hal Vash described a security pursuit and disputed the circumstances and identity of the deceased. Reports of a shift towards attacks on police and intelligence headquarters, and of Jaish al-Adl involvement in the wider incident pattern, remain unverified.

Change from previous assessment

Since the 23 October brief, this update adds Haal Vash's account of 63 incidents through 10 October, including 18 in the final 18 days of its monitoring period, and a reported clash in Khash on 21 October with conflicting descriptions. It also gives claim-level support for the 33 wounded figure, but that figure remains unverified and is contradicted by the official figure of 10 wounded. The assessment remains that reporting does not establish a fresh surge during 23-24 October; confidence in casualty totals and Jaish al-Adl attribution remains low.

Key judgments

1. Sistan-Baluchestan likely experienced an unusually high armed-incident tempo through 10 October, but the supplied reporting does not establish a continuing surge during 23-24 October. Haal Vash reported 63 incidents in Sistan-Baluchestan and Kerman, with 18 in the final 18 days of its monitoring period; ACLED was separately reported to have recorded about 70 confrontations in Sistan-Baluchestan through 8 October. The source provenance is weak and the counts are not independently validated. (Confidence: low · ASSESSED)
   • I&W: Confirm: an independently sourced incident log records at least 10 verified armed incidents in Sistan-Baluchestan during a single 14-day period. (0-14 days)
   • I&W: Break: a checked 14-day incident log records fewer than three verified armed incidents in Sistan-Baluchestan and no verified attack on a police or intelligence site. (0-14 days)
2. The reported casualty totals remain unverified and materially disputed. Haal Vash attributed 94 deaths and 33 wounded to unofficial local sources, while figures it attributed to official data were 87 dead and 10 wounded; the material provides no independent casualty accounting. (Confidence: low · REPORTED)
   • I&W: Confirm the higher toll if an independently documented casualty accounting supports 94 deaths and 33 wounded for the incidents through 10 October. (0-30 days)
   • I&W: Break the higher toll if independently checked records support the official figures of 87 deaths and 10 wounded, or another reconciled total. (0-30 days)
3. An armed clash likely occurred in Khash on 21 October, but the reported circumstances and identity of the deceased remain contested. Iranian police and Tasnim said gunmen opened fire, one suspect was killed and two fled; Hal Vash described a security pursuit and gunfire targeting a car, and said the circumstances and identity remained disputed. The accounts have not been independently confirmed. (Confidence: low · REPORTED)
   • I&W: Confirm the competing accounts if independently verified video, medical records or witness reporting establishes the location, sequence of events and identity of the deceased. (0-14 days)
   • I&W: Break the reported clash account if independent evidence shows that no armed exchange occurred near the Sarhad gas station in Khash. (0-14 days)
4. A shift by armed groups in Sistan-Baluchestan towards attacks on police and intelligence headquarters remains unverified. The supplied account describes use of improvised explosive devices, rocket-propelled projectiles and medium weapons, but its source type is unknown and no independently corroborated attack on a named headquarters is provided. (Confidence: low · REPORTED)
   • I&W: Confirm the reported shift if an attack on a named police or intelligence headquarters in Sistan-Baluchestan is independently documented with its date, location and weapon evidence. (0-30 days)
   • I&W: Break the reported shift if a verified incident review finds no attacks on police or intelligence headquarters and places the documented incidents at patrols or border roads. (0-30 days)
5. The supplied reporting does not establish Jaish al-Adl's role in the 63 recorded incidents or the 21 October Khash clash. A low-reliability social-media report says Jaish al-Adl claimed a Zahedan courthouse attack, while the reported Popular Fighters Front link to Jaish al-Adl and smaller Baluch factions is also uncorroborated. (Confidence: low · ASSESSED)
   • I&W: Confirm a Jaish al-Adl role if the group issues a verifiable claim naming a specific incident and that claim is independently corroborated. (0-30 days)
   • I&W: Break the proposed operational link if a verified account identifies another actor or finds no evidence connecting Jaish al-Adl to the incidents. (0-30 days)

Outlook & scenarios

Intermittent armed incidents continue (60%)

The most likely course is continued intermittent armed incidents in Sistan-Baluchestan, with reports from Khash and other locations remaining uneven and aggregate totals disputed. Incident reporting alone is unlikely to establish Jaish al-Adl's command role or confirm the reported shift to attacks on police and intelligence headquarters.

Incident tempo is not sustained (25%)

An unlikely but plausible course is that independently checked reporting does not confirm a sustained rise after the elevated counts through 10 October. The Khash clash remains a reported incident with disputed details, while casualty figures and group attribution remain unresolved.

Attacks on security headquarters are confirmed (15%)

A low-probability, high-impact course is that independent evidence confirms repeated attacks by armed groups in Sistan-Baluchestan on named police or intelligence headquarters using improvised explosive devices or rocket-propelled projectiles. This would establish a wider target set than the currently corroborated incident record shows and would likely increase pressure on Iranian security forces in the province.

Recommendations

1. Maintain a dated incident register for Sistan-Baluchestan and Kerman. Record location, reported target, weapon, casualty figures, source type and whether each detail has independent confirmation.
2. Keep official casualty figures separate from unofficial local estimates. Seek a reconciled accounting for the 63 incidents reported through 10 October before using a single death or wounded total.
3. Prioritise independent verification of the 21 October Khash clash, including the location, sequence of events and identity of the deceased. Preserve the police and Hal Vash accounts as competing descriptions until checked.
4. Do not attribute the wider incident total or the Khash clash to Jaish al-Adl without incident-specific, independently corroborated evidence. Track any verifiable claims of responsibility separately from unverified coalition reporting.
5. Treat reports of attacks on police and intelligence headquarters as an escalation indicator only after a named site, date and weapon use are independently documented.

Confidence & uncertainty

The headline confidence is medium because Haal Vash, ACLED and reporting on the Khash incident provide some convergence that armed activity has occurred, but the source provenance for the aggregate incident counts is weak. The casualty totals conflict, the Khash accounts differ on the circumstances, and the material does not independently establish Jaish al-Adl's responsibility or the reported change in tactics.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Confirmed number, locations, dates, targets, and methods of attacks attributed to Baloch armed groups in Sistan-Baluchestan during the reporting period. Recommended collection: local media/social media
• [EEI 1.2 · PARTIAL] Verified Iranian military, Islamic Revolutionary Guard Corps, police, border-guard, and civilian fatalities and wounded associated with the attacks. Recommended collection: official statements/local reporting
• [EEI 1.3 · UNCOVERED] Evidence of coordinated or simultaneous attacks across multiple districts, including attacks on bases, checkpoints, patrols, government facilities, or transport routes. Recommended collection: local reporting/geospatial imagery
• [EEI 2.1 · PARTIAL] Deployment or redeployment of IRGC, army, police, border guards, special forces, armored vehicles, aircraft, or drones to Sistan-Baluchestan. Recommended collection: satellite imagery/local reporting
• [EEI 2.2 · PARTIAL] New checkpoints, curfews, internet or telecommunications disruptions, road closures, arrests, raids, executions, or other emergency security measures. Recommended collection: local media/social media
• [EEI 2.3 · UNCOVERED] Changes in Iranian control of border crossings, district administrative centers, highways, or key security installations. Recommended collection: geospatial imagery/local reporting
• [EEI 2.4 · UNCOVERED] Verified civilian displacement, civilian casualties, protests, sectarian incidents, or retaliatory violence following security-force operations. Recommended collection: humanitarian reporting/local sources
• [EEI 3.1 · UNCOVERED] Attacks or armed incidents spreading to new districts, major transport corridors, coastal areas, or provinces outside the current southeastern operating area. Recommended collection: incident databases/local reporting
• [EEI 3.2 · UNCOVERED] Evidence of cross-border movement, staging areas, weapons transfers, training, or safe-haven activity involving Pakistan, Afghanistan, or other neighboring territory. Recommended collection: border reporting/satellite imagery
• [EEI 3.3 · UNCOVERED] Public claims, intercepted communications, or captured equipment indicating material, financial, intelligence, or operational support from foreign governments or transnational militant networks. Recommended collection: official releases/open-source intelligence
• [EEI 3.4 · UNCOVERED] Security incidents affecting border crossings, energy infrastructure, ports, pipelines, telecommunications, or major commercial routes in southeastern Iran. Recommended collection: infrastructure reporting/remote sensing

Red cell review: CONCUR

TLP:CLEAR