Iraqi militant attack on Riyadh could signal a larger shift in Iran’s regional approach

[Notice: The Critical Threats Project frequently cites sources from foreign domains. All such links are identified with an asterisk (*) for the reader's awareness.]

Iran’s proxies in Iraq have joined an ongoing information and military campaign against Saudi Arabia that the al Houthi movement and Iran launched in late 2019. Iranian-backed Iraqi militias likely conducted a kamikaze drone attack into Saudi Arabia on January 23, 2021, for the second time in recent years. This attack could indicate a significant change in how the Iranian regime imposes pressure on its adversaries around the Persian Gulf. The potential expansion of Iraqi proxies’ ability and willingness to target foreign states in ostensibly deniable ways and in coordination with other components of the Axis of Resistance would pose a growing security challenge to the US and its regional partners.

 What happened?

 Saudi Arabia *announced that it intercepted and destroyed a “hostile air target” likely over Riyadh on January 23. The Saudi government did not provide additional details on who conducted the attack or from which direction it came. Saudi media reported that residents in central Riyadh heard the explosion overhead and *implied attribution for the attack to the Yemeni Houthis.

The Houthis likely did not conduct this attack. Their military spokesperson denied responsibility for any attacks on surrounding countries in the previous 24 hours—an unusual refutation from a group that has issued false claims of responsibility for attacks it did not commit. Saudi Arabia seeks to portray the al Houthis as terrorists. The Saudi government has strong incentives to blame the al Houthis for the attack, which the US Embassy in Riyadh said appeared to be targeting civilians. Its official silence on the question of responsibility for the attack therefore supports the assessment that the Houthis did not conduct it.

A previously unknown Shia militant group, Alwiya Waad al Haq (the Righteous Promise Brigades), claimed responsibility for the attack through Iraqi Shia extremist propaganda channels. A pro-Iran Iraqi Telegram channel claimed the group targeted al Yamamah Palace, the official residence of Saudi King Salman bin Abdulaziz, with a fixed-wing kamikaze drone. The statement blamed Saudi Arabia for supporting ISIS and indicated that Alwiya Waad al Haq may next attack the UAE unless Saudi Crown Prince Mohammed bin Salman and Emirati Crown Prince Mohammed bin Zayed “cease their crimes.”

Alwiya Waad al Haq indicated that the attack was part of the balanced deterrence campaign, which the Yemeni al Houthis launched in 2019 to attack high-value targets in Saudi Arabia such as critical oil infrastructure and defense assets. The al Houthis have framed their balanced deterrence attacks as a response to the Saudi-led coalition’s continued air campaign and blockade in Yemen and may have timed their previous attacks as retaliation for Saudi strikes that caused mass civilian casualties. Alwiya Waad al Haq stated that its drone attack was “the beginning of the transfer of balanced deterrence to the center of [Saudi Arabia] in revenge for the blood of the martyrs.” This attack came two days after ISIS—which Iran and its Iraqi proxies accuse Saudi Arabia of supporting—conducted a mass casualty attack in Baghdad.

Iran and the al Houthis have likely coordinated the balanced deterrence campaign to impose military pressure on Saudi Arabia. This campaign includes Iran’s drone and missile attack on Saudi Arabia’s Abqaiq crude-processing plant in September 2019, which originated in Iran but for which the al Houthis falsely claimed responsibility, likely to obfuscate Tehran’s direct responsibility for it. Iran has also likely furnished the al Houthis with advanced drone and missile technologies necessary to conduct long-range attacks into Saudi territory.

Who actually did it?

 Kataib Hezbollah, Iran’s most trusted proxy in Iraq, likely conducted the January 23 drone attack on Riyadh from Iraqi territory. Alwiya Waad al Haq is likely a front group to mask Kataib Hezbollah’s involvement. Historic patterns and trends, pro-Iran reporting, and proxy rhetoric support this assessment.

 Historic Patterns and Trends. The pattern of the ostensibly new group’s claim fits with a long-running Iranian-directed and Kataib Hezbollah-coordinated effort to obfuscate responsibility for proxy attacks targeting US and allied forces and contractors in Iraq. The Institute for the Study of War has tracked the announcements of over a dozen “shadow militia” groups, ostensibly new entities acting on behalf of Iran’s proxy network to achieve Iranian objectives in Iraq, since March 2020. These shadow militias are actually covers for certain attack types and propaganda efforts conducted by preexisting Iranian proxy organizations in Iraq. This obfuscation confuses the information space and makes it more difficult for Iran’s enemies to hold these groups accountable for their attacks. Three other shadow militias have identified themselves as explicitly anti-Saudi or anti-Baathist—a euphemism for Sunni among Iraqi Shia extremists.

This attack would likely not be Kataib Hezbollah’s first into Saudi Arabia. US intelligence indicated that an Iranian proxy militia in Iraq conducted a kamikaze drone attack on Saudi oil facilities in May 2019. Kataib Hezbollah likely possesses the most advanced drone capabilities of Iran’s Iraqi proxies.

Pro-Iran Reporting. The Iraqi Shia extremist propaganda outlet that circulated the initial January 23 attack claim and additional details and threats, Sabereen News, is a pro-Iran Telegram news channel affiliated with Kataib Hezbollah and other Iraqi proxies. Sabereen regularly circulates attack claims under Kataib Hezbollah’s shadow militia brands. Sabereen News claimed that “pure Iraqi hands” conducted the attack and circulated a statement by Kataib Hezbollah’s de facto security spokesperson congratulating the attackers and encouraging more attacks. Iranian state media also reported Sabereen’s claims and *implicitly linked Kataib Hezbollah to the Riyadh attack.

Proxy Rhetoric. Kataib Hezbollah rhetorically prepared for this attack, which it claimed was retaliation for purported Saudi funding of ISIS. Kataib Hezbollah *blamed Saudi Arabia, the US, and Israel for the ISIS twin suicide bombing in Baghdad on January 21 that killed 32 civilians and promised revenge. Alwiya Waad al Haq implicitly blamed Saudi Arabia for the Baghdad attack in its initial claim. Sabereen News later explicitly described the attack in Riyadh as revenge for the ISIS attack, using an Arabic hashtag for the balanced deterrence campaign.

It is unlikely that Alwiya Waad al Haq falsely claimed responsibility for the drone attack to deflect blame from the al Houthis or that an Iraqi group other than Kataib Hezbollah carried out the attack. Saudi air defense systems can almost certainly identify the general origin of the attack, minimizing the utility of a false Iraqi claim if the objective is to pressure Riyadh on multiple fronts.

Iran likely provided coordination and technology for the Riyadh attack. Iran previously conducted the Houthi-claimed September 2019 attack on Abqaiq as part of the balanced deterrence campaign, indicating deep Iranian involvement with that effort. Iranian state media later promoted the connection between Saudi Arabia and the January 21 ISIS attack in Baghdad and portrayed the January 23 Riyadh attack as revenge.

Iran recently provided advanced kamikaze drone capabilities to the al Houthi movement and may have provided similar capabilities to Kataib Hezbollah. The Islamic Revolutionary Guards Corps has long provided surveillance drone capabilities to its Iraqi proxies and gave Kataib Hezbollah, but not other Iraqi proxy groups, ballistic missiles. Iranian provision of kamikaze drones to Kataib Hezbollah would be a natural and unsurprising development in that relationship.

 Iran likely sought to impose pressure on Saudi Arabia without involving the al Houthis, as the new US administration revisits the al Houthi designation as a Foreign Terrorist Organization (FTO). Iran and the al Houthi movement likely seek a repeal of that Trump-era designation as the Biden team faces pressures to avoid further humanitarian catastrophe in Yemen, which critics of Riyadh blame on Saudi policies. An attack on central Riyadh, with the accompanying likelihood of civilian casualties, is unequivocally a terrorist action that should nullify any effort to question the FTO designation should the Houthis prove responsible for it. Iran therefore likely enlisted its most trusted Iraqi proxy to pressure Saudi Arabia and other Gulf states on its behalf.

Implications

 The rhetorical solidarity and affiliated attacks of the al Houthi movement and Iran’s Iraqi proxies may foreshadow the debut of Iraqi militias as increasingly regional actors; that emergent threat must not be dismissed. The Iraqi proxy network already has access to Iran’s ballistic missile technology and likely other advanced weaponry. It already conducts attacks on US and allied forces in Iraq at Iran’s behest. Their domestic activities already destabilize Iraq and the region. The US and its partners must consider the additional complexities that they and the region will face if Iran’s extensive proxy network in Iraq continues to expand its willingness and ability to facilitate Iranian attacks against other states.

 Iran may leverage its Iraqi proxies to conduct additional attacks on regional adversaries, indicating a step change in Iraqi proxy capabilities and willingness to conduct attacks. Iraqi threats should not be disregarded. Sabereen news claimed that additional *explosions heard over Riyadh on January 26 were a second revenge attack for the second ISIS suicide bombing in Baghdad on January 21 and warned that “[one suicide bombing] in Baghdad = [one] drone in Riyadh.”

Saudi Arabia did not comment on the January 26 explosions. A second attack, if it actually occurred, would indicate a step change both in Iraqi proxy capabilities and in their willingness to use them in pursuit of Iran’s broader regional objectives. Additional attack claims by Iraqi proxy groups may follow civilian casualty ISIS attacks in Iraq, further confusing an already complex regional milieu of Iranian-Saudi competition.

The next Iranian proxy attack from Iraq may target the UAE. The original claim of the January 23 attack threatened “an ensuing attack on the hideouts of evil in Dubai.” Alwiya Waad al Haq subsequently issued a statement featuring a Quranic verse describing God’s punishment alongside an edited image of a drone attack on the Burj Khalifa in Dubai. The Houthis claimed three attacks on the UAE, including on Abu Dhabi and Dubai International airports in 2017 and 2018, each of which the UAE denied. Sabereen News issued a garbled English language statement on January 27 threatening another drone attack on Abu Dhabi airport “this time with an Iraqi touch.” The channel issued the statement on behalf of a different Iraqi shadow militia that is also likely a cover for Kataib Hezbollah, Saraya Alwiya ad-Dam (the Avengers of Blood Companies). Iraqi references to years-old Houthi attack claims indicates additional coordination between Iran, the al Houthis, and Kataib Hezbollah.