TLP:CLEAR · Disclosure is not limited.

Southeastern Iran: Two Attacks Reported, Wider Casualty Total Unverified

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-04 13:49Z · Overall confidence: HIGH

BLUF

Reporting describes a 3 November killing of a police intelligence officer in Saravan and a 2 November attack on Fatemiyoun personnel at a school in Bir village. The supplied claims do not substantiate the headline figure of 94 dead and 33 wounded, and Jaish al-Adl responsibility remains unconfirmed.

Executive summary

The available reporting records two separate incidents in Sistan and Baluchestan province. Iranian police and other reporting identify the officer killed in Saravan as Hojjat Vafakarde, but the attacker is not established. Accounts of the Bir village attack describe gunmen targeting Fatemiyoun personnel at the Sofla School; casualty details are not independently settled, and the Jaish al-Adl attribution comes from Iranian state media. The reporting supplied here does not provide a province-wide casualty tally or establish a broader coordinated campaign.

Change from previous assessment

Since the 3 November prior brief, reporting adds a 2 November attack on Fatemiyoun personnel at the Sofla School in Bir village and provides the name and unit of the officer killed in Saravan on 3 November. The assessment that the 94-death and 33-injury figure is unsubstantiated remains unchanged. Jaish al-Adl responsibility remains unresolved, and the new Bir reporting does not establish a coordinated campaign.

Key judgments

1. Iranian police officer Hojjat Vafakarde was killed in Saravan on 3 November, but the perpetrator remains unconfirmed. Iranian police identified the officer, while Haalvsh described an unidentified gunman; Tasnim separately alleged involvement by a US- and Israel-linked group without naming it. (Confidence: medium · REPORTED)
   • I&W: A follow-up statement from Iranian police or Saravan County authorities names a suspect or organisation responsible for Vafakarde’s killing. (0-14 days)
   • I&W: Iranian police or a credible local report corrects the account of Vafakarde’s death or the location of the attack. (0-14 days)
2. Gunmen attacked Fatemiyoun personnel at the Sofla School in Bir village, Konarak County, on 2 November. Haalvsh reported two armed motorcyclists; a separate account reported at least seven Fatemiyoun members and one gunman killed, as well as several critically wounded, but the casualty details remain unsettled. (Confidence: medium · REPORTED)
   • I&W: A follow-up Haalvsh report or independently verified local imagery confirms the Sofla School location and identifies the Fatemiyoun casualties. (0-14 days)
   • I&W: Iranian authorities or Fatemiyoun representatives publish a casualty account that materially differs from the reported seven or more members and one gunman killed. (0-14 days)
3. The supplied claims do not substantiate the headline figure of 94 dead and 33 wounded across southeastern Iran. They describe the Saravan killing and the Bir village clash, but provide no province-wide tally or independently corroborated accounting for either headline figure. (Confidence: low · ASSESSED)
   • I&W: A published incident-by-incident casualty ledger identifies victims and injury status across Sistan and Baluchestan and independently supports totals of at least 94 dead and 33 wounded. (0-14 days)
   • I&W: Follow-up reporting limits the documented casualties to the Saravan and Bir incidents and provides no additional verified incidents or province-wide tally. (0-14 days)
4. It is unlikely that the available reporting establishes Jaish al-Adl responsibility for either incident. Tasnim attributed the Bir attackers to Jaish al-Adl, while Haalvsh described the attackers as unknown; a separate low-reliability social-media post attributes an ambush on a Basij officer in Saravan to Jaish al-Adl but does not establish that it was the attack that killed Vafakarde. (Confidence: low · ASSESSED)
   • I&W: Jaish al-Adl issues a statement claiming either attack and includes operational details that independent reporting verifies. (0-14 days)
   • I&W: A police investigation or independently corroborated account identifies a different perpetrator for either attack. (0-30 days)

Outlook & scenarios

Further isolated attacks in Sistan and Baluchestan (55%)

The most likely course is continued, discrete attacks on security personnel or Fatemiyoun positions, with responsibility and casualty reporting remaining contested. The supplied reporting establishes two incidents in Saravan and Konarak County, not a coordinated province-wide campaign.

Security operations and retaliatory violence (25%)

Iranian security forces intensify operations after the Saravan killing and Bir clash, followed by further local attacks. This scenario gains support if authorities announce arrests, raids or additional clashes in Saravan or Konarak County.

Official attribution hardens without independent confirmation (15%)

Iranian authorities or state media repeat the Jaish al-Adl attribution, while independent reporting continues to describe perpetrators as unidentified. This would raise the risk of misattribution in public accounts without establishing the group’s role.

High-impact expansion beyond the reported locations (5%)

A coordinated attack on a high-value security site outside Saravan and Konarak County would indicate a wider campaign and prompt a stronger security response. The current claims do not establish such coordination; this remains a low-probability, high-impact wildcard.

Recommendations

1. Keep a dated incident ledger for Saravan and Bir village, separating confirmed deaths, reported injuries, and unverified casualty claims.
2. Do not circulate the figure of 94 dead and 33 wounded as established fact unless an incident-level tally is independently corroborated.
3. Attribute the Jaish al-Adl link to Tasnim when reporting it, and distinguish that allegation from the separate, low-reliability social-media claim about a Saravan Basij officer.
4. Prioritise follow-up reporting that verifies the Sofla School casualties and clarifies whether the Saravan killing was linked to an identified organisation.
5. Update the assessment if police releases, verifiable group statements, or independently corroborated local reporting establish responsibility or materially change the casualty count.

Confidence & uncertainty

Overall confidence is recorded as high in the supplied corroboration assessment. That headline rating does not indicate high confidence in the 94-death and 33-injury figure or in Jaish al-Adl attribution: the Saravan killing is reported by Iranian police and other outlets, while the Bir casualty details and responsibility claims remain less firmly corroborated. The principal uncertainty is the absence of an independently verified province-wide casualty tally.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Confirmed number, locations, dates, targets, and methods of attacks attributed to Baloch armed groups in Sistan-Baluchestan during the reporting period. Recommended collection: local media/social media
• [EEI 1.2 · PARTIAL] Verified Iranian military, Islamic Revolutionary Guard Corps, police, border-guard, and civilian fatalities and wounded associated with the attacks. Recommended collection: official statements/local reporting
• [EEI 1.3 · UNCOVERED] Evidence of coordinated or simultaneous attacks across multiple districts, including attacks on bases, checkpoints, patrols, government facilities, or transport routes. Recommended collection: local reporting/geospatial imagery
• [EEI 1.4 · UNCOVERED] Use of newly observed weapons, explosives, drones, ambush tactics, or improved command-and-control by the armed groups. Recommended collection: battlefield reporting/video analysis
• [EEI 2.1 · UNCOVERED] Deployment or redeployment of IRGC, army, police, border guards, special forces, armored vehicles, aircraft, or drones to Sistan-Baluchestan. Recommended collection: satellite imagery/local reporting
• [EEI 2.2 · PARTIAL] New checkpoints, curfews, internet or telecommunications disruptions, road closures, arrests, raids, executions, or other emergency security measures. Recommended collection: local media/social media
• [EEI 2.3 · UNCOVERED] Changes in Iranian control of border crossings, district administrative centers, highways, or key security installations. Recommended collection: geospatial imagery/local reporting
• [EEI 2.4 · UNCOVERED] Verified civilian displacement, civilian casualties, protests, sectarian incidents, or retaliatory violence following security-force operations. Recommended collection: humanitarian reporting/local sources
• [EEI 3.1 · UNCOVERED] Attacks or armed incidents spreading to new districts, major transport corridors, coastal areas, or provinces outside the current southeastern operating area. Recommended collection: incident databases/local reporting
• [EEI 3.2 · PARTIAL] Evidence of cross-border movement, staging areas, weapons transfers, training, or safe-haven activity involving Pakistan, Afghanistan, or other neighboring territory. Recommended collection: border reporting/satellite imagery
• [EEI 3.3 · PARTIAL] Public claims, intercepted communications, or captured equipment indicating material, financial, intelligence, or operational support from foreign governments or transnational militant networks. Recommended collection: official releases/open-source intelligence

Red cell review: CONCUR

TLP:CLEAR