Blurring the lines between the physical world and the online one, the Iranian group known as the “Nakhsa Warriors” remains cloaked in mystery. Their identity and status are unclear. Are they a military force that carries out operations, an online group of like-minded individuals that share content, part of an Iranian disinformation campaign — or perhaps something else altogether? In the current technological landscape, it can often be difficult to ascertain the truth, but how do we determine the next major actor or emerging threat? The Nakhsa Warriors provide an interesting case study and may help to shed some light on this conundrum.
Who are the Nakhsa Warriors?
In Farsi, “Nakhsa” (نخسا) is an acronym that stands for “Spontaneous Forces of Islamic Lands.”
Also known as the “Nakhsa Special Forces,” they claim to be an Iranian Shi’a group active in both Syria and Iraq, and their social media posts suggest they are very real indeed. In a Feb. 1, 2020 post on Instagram, for example, they said they were positioned “on the Israeli border.” They have also posted photos showing their supposed members posing with other prominent, known Shi’a fighters, lending credibility to the idea that they are in fact an authentic group.
But what differentiates them from other Iranian proxies is their fairly open and extensive presence on social media, advertising their ideological and physical positions on open Instagram, Twitter, and Telegram accounts. This low operational security (OPSEC) is interesting. It’s not uncommon for militant groups to have social media accounts — even ones open to the public — but it is unusual for them to openly post their locations, allowing enemy forces to find their positions and impede their operations.
Nakhsa’s Instagram account avatar. Their handle is “nakhsa_special_force.”
Nakhsa’s Twitter account avatar. Their handle is “Nabjahadiii.”
Nakhsa’s Telegram account avatar. Their handle is also “nabjahadiii” on this platform.
According to their own description, posted in their debut Instagram post on Dec. 21, 2019, Nakhsa is a way of thinking. With a motto that translates from the Arabic as “Islamic Resistance Around the World,” the group calls for a global movement to spread and support Islam and unconditional obedience to Iran’s supreme leader, Ayatollah Ali Khamenei. Nakhsa first appeared in Tehran between 2009 and 2010 to combat the Green Movement, the internal protests and “anti-Islamic activity” in Iran related to the elections of the same year. They then expanded their operations to Syria and Iraq between 2011 and 2013.
Iranian proxy and militia groups have long been active in war-torn countries in the Middle East, taking advantage of existing violence and chaos to lend their support. Immediately after the U.S. assassination of Qassem Soleimani, the commander of the Islamic Revolutionary Guard Corps Quds Force, at the beginning of 2020 a brief proxy war between Iran and the U.S. erupted in Iraq, consisting of multiple missile and rocket attacks. But significant concerns remain that the situation may escalate again if these Iranian proxies expand their operations to avenge the death of Soleimani. Iran publicly vowed revenge, and the aforementioned missile and rocket attacks, which caused minimal injury and destruction, are unlikely to be the end of Iranian retaliation. The world should anticipate further physical, cyber, and/or hybrid attacks. Due to the cyber aspect of these potential attacks, monitoring Telegram is essential, as malicious cyber actors feel it is a safe platform for engaging in potentially nefarious digital activities, such as sharing malicious software and hacking tactics, techniques, and procedures (TTPs).
The Government of Iran (GoI) has not claimed or recognized any association with Nakhsa; instead, they’ve called them frauds and con artists. This is not unusual, however. The GoI often disowns or denies ties to a group that does in fact operate under its control. The Nakhsa Warriors require further analysis and research to verify their authenticity, especially considering their low OPSEC. The emergence of this group highlights the importance of monitoring Iranian proxies, their activity beyond Iranian borders, and their potential impact across the Middle East.
Foreign operations: Iraq and Syria
In this Jan. 9, 2020 Instagram post, purported Nakhsa fighters pose with Popular Mobilization Force (PMF) leader Abu Azrael, a.k.a. “The Archangel of Death.”
Iranian influence has spread throughout neighboring Iraq for years, increasing significantly over time. Abu Azrael and Iranian forces were active in combating ISIS’s presence in the country. One concern following Soleimani’s death is that ISIS could regain strength in Iraq or other countries, as Iranian proxies and forces are unable to be as dogged in the fight against the terrorist group.
Nakhsa has also boasted about their presence in Syria, claiming they were “on the Israeli border” in a Feb. 1, 2020 Instagram post, as mentioned earlier.
If true, this could ratchet up tension in the region and create major complications for Iran’s relationship with Russia, which continues to balance its ties with both Iran and Israel. Iranian operations on the Israeli border have been criticized by Russia, although it remains Iran’s ally and collaborator in Syria. In 2018, Russia helped negotiate a deal keeping Iranian proxies away from the Israel/Syria border in exchange for Israel stopping air raids against Iranian positions that did not directly threaten Israeli security. When both sides of the agreement were violated, Russia threatened Iran with a withdrawal of air support, and threatened Israel with providing air defense systems to Damascus to defend against Israeli air raids.
While it may not yet be clear exactly what they are, the Nakhsa Warriors remain an extremely interesting entity and one that global powers should continue to monitor and observe closely as their future actions could impact relationships across the Middle East. Their roles in combating ISIS, using social media to galvanize support, and changing the dynamics between both Iran and Iraq and Iran and Russia will be important as tensions flare worldwide.
Moving forward with hybrid threat groups
Hybrid groups like the Nakhsa Warriors are difficult to track, validate, and assess, but as mis- and disinformation continues to infiltrate daily life, finding ways to address this challenge will only become of increasing importance. Moreover, the use of proxy groups and the spread of false information are by no means unique to Iran — this issue arises everywhere and involves groups ranging from nation state actors and independent cyber criminals to cyber collectives. The problem continues to grow as false narratives and dangerous misinformation are spread via online platforms and social media about everything from major events like the Olympics to global elections and even the ongoing coronavirus pandemic.
While the GoI denies any affiliation with the Nakhsa Warriors, this is typical of a government reticent to openly communicate with the world and is in keeping with its previous actions. Despite internal evidence and the technical validation of leaked tools, for instance, the GoI has also issued no statement or claim regarding the infamous Iranian information leaker Lab Dookhtegan. However, Nakhsa's timeline, which has them starting their activities during the Green Movement in 2009, does line up, as does its history of posing with prominent figures such as Abu Azrael. The ambiguity about the group may even be the whole point. These blurred lines could be yet another way the Iranian government denies and misleads the public about its proxy activities. The group’s social media presence may be designed to redirect attention away from actual, acknowledged GoI proxies such as Hezbollah and their future operations — a red herring of sorts.
The case of the Nakhsa Warrior is just one example illustrating how difficult it can be to ascertain the truth in this time of technology, but doing so is essential if we are to determine which threats we should be focusing on. Are the Nakhsa Warriors more important or more serious of a threat than Kata'eb Hezbollah or the PMF? Why do they use social media the way they do? What are they trying to achieve? Any actor can make virtually any claim online today, and true or not, they can spread these claims prolifically, resulting in influence or damage. There are no easy answers to these problems, but it will require the greatest efforts, collaboration, and divergent thinking of scholars, experts, governments, businesses, and academic entities to mitigate them.
Steph Shample is a Non-Resident Scholar with the Middle East Institute's Cyber Program. The views expressed in this article are her own.
Photo by Rouzbeh Fouladi/NurPhoto via Getty Images
The Middle East Institute (MEI) is an independent, non-partisan, non-for-profit, educational organization. It does not engage in advocacy and its scholars’ opinions are their own. MEI welcomes financial donations, but retains sole editorial control over its work and its publications reflect only the authors’ views. For a listing of MEI donors, please click here.