BAGHDAD, Iraq - Evidence gathered so far in ongoing Iraqi government investigations increasingly points to a small armed network operating outside established Iran-backed Shiite faction command structures as responsible for the attack on Saudi Arabia's East-West oil pipeline, Iraqi security officials familiar with the investigations’ progress told The New Region.

On Friday evening, Saudi Arabia’s Foreign Ministry said the East-West oil pipeline, a strategic crude oil route that carries more than seven million bpd from the kingdom's eastern oil fields to the Red Sea, had been attacked by drones launched from Iraqi territory. The attack caused injuries and limited damage to the pipeline.

Initial accusations pointed to the three Iran-backed Shiite armed factions operating under the banner of the Islamic Resistance in Iraq, which had previously threatened to attack Saudi Arabia in retaliation for late July airstrikes by US and Saudi aircrafts that killed 20 Popular Mobilization Forces (PMF) fighters and wounded 32 others.

The three factions which had agreed to halt military operation until September 30 under the first phase of a broader truce, denied any involvement in the pipeline attack, saying the attack was “an honor we do not claim,” and expressed their readiness to cooperate with the government investigation.

The Iraqi government subsequently launched an investigation to trace the planning, execution and logistical support behind the attack, including whether any of Iraq’s active armed factions were involved.

Initial intelligence gathered by investigators traced the drones’ launch site to the al-Tayeb border area, about 75 kilometers east of Amarah and close to Iraq’s frontier with Iran, prompting Prime Minister Ali al-Zaidi to order the closure of the Shib, Shalamcheh, and Mandali border crossings with Iran.

Zaidi also dismissed Maysan’s operations commander and provincial police chief and ordered the directors of security agencies in the province transferred to their headquarters pending investigation into the security breaches that allowed the operation to take place.

The investigation has since narrowed considerably, with evidence gathered by Iraqi security agencies leading investigators away from some of their initial assumptions. Investigators found no evidence that any of the key armed factions had carried out the attack as an organization or that their senior commanders had authorized the operation, Iraqi security officials involved in the investigation told The New Region.

The findings have instead increasingly pointed to the emergence of smaller cells and individual fighters operating beyond established faction command structures, leading investigators to conclude that one such group was behind the pipeline attack, officials said.

The investigators’ conclusion broadly aligns with findings previously reported by The New Region on Sunday, in which senior armed faction commanders identified a small armed network operating outside their control and linked to a senior Islamic Revolutionary Guard Corps (IRGC) officer as responsible for the attack.

ALSO RELATED: IRGC-led fringe factions behind recent attacks launched from Iraqi territory

“Information available so far strongly indicates that the operation was carried out by small, loosely organized groups operating without the coordination or authorization of known faction commanders,” a senior Iraqi security official briefed on the latest developments in the investigation told The New Region.

“But we also know that an operation of this magnitude could not have been carried out without a mastermind behind it.”

Tracing the evidence

Early intelligence identified al-Tayeb, a remote area in Maysan province along the Iranian border, as the launch site for the drones used in the attack. Iraqi investigators dispatched to the area subsequently found launch platforms and other traces of the operation about two kilometers from Iraq’s frontier with Iran, Iraqi security officials said.

The discovery gave investigators their first physical starting point in the search for those behind the operation, officials told The New Region.

“They took fingerprints, photographed the site and documented the evidence they found there,” one of the officials said.

Bordering Iran and long shaped by opposition movements, armed activity, and cross-border smuggling, Maysan occupies a distinctive place in Iraq’s security landscape, with its remote border areas serving for decades as routes for the movement of fighters, weapons, and illicit goods.

Four armed factions maintain an active presence in Maysan: the Badr Organization, one of Iraq’s oldest and largest Iran-backed Shiite factions, Asaib Ahl al-Haq, one of the country’s most powerful Iran-backed armed groups, Saraya al-Salam, the armed wing of influential Shiite cleric Muqtada al-Sadr, and Harakat Ansar Allah al-Awfiya, a smaller Iran-backed faction led by US-designated Haider al-Gharrawi.

Investigators quickly ruled out Asaib Ahl al-Haq and Saraya al-Salam, concluding that neither was involved in the type of operations under examination in the area, officials told The New Region.

The attention then narrowed to Badr and Ansar Allah al-Awfiya, the two armed factions with strongest presence in and around al-Tayeb, where influence is largely divided between the two groups and local tribes, officials said.

Within Badr, investigators focused on a small group commanded by Abu Muntadhar al-Muhammadawi, a senior Badr figure whose group operates independently and outside the control of Badr leader Hadi al-Amiri. Investigators subsequently found no evidence linking Muhammadawi’s group to the attack, officials said.

Attention then shifted to Gharrawi and Ansar Allah al-Awfiya. Investigators began digging into the group’s local network and examining its members, activities and connections in and around al-Tayeb, officials said.

The fingerprints and other evidence collected from the launch site played a key role in narrowing the search.

As investigators examined Gharrawi's network more closely, they identified a four-member cell that they concluded had carried out the operation, officials told The New Region.

The cell consisted of a technician, a drone operator, a driver, and a lookout responsible for monitoring the surrounding routes during the operation, officials told The New Region.

“We are almost certain that this cell, which is affiliated with Gharrawi’s group, was the one that carried out the attack,” one of the officials said.

“But what we have so far suggests that Gharrawi himself had nothing to do with the operation.”

The hidden hand

The emerging picture left investigators with a broader question over the command behind the operation. The suspected perpetrators were Iraqi and affiliated with an established armed faction, yet the evidence gathered so far suggested they had acted without the involvement of their own faction commander, officials told The New Region.

Questions over a possible Iranian role, however, had been part of the investigation from the beginning. While the Iraqi government publicly condemned the attack and announced an investigation without assigning responsibility, initial assessments by security agencies centered on two possibilities: that the operation had been carried out by an Iran-backed armed group in Iraq, or that Iranian weapons or equipment had been used.

Those assessments prompted the Office of the Commander-in-Chief of the Armed Forces to contact the Iranian side over the attack. Iranian officials denied any involvement, saying Tehran had neither ordered the operation nor had anything to do with it, officials said.

Tensions increased after investigators traced the launch site to al-Tayeb, near the Iranian border, prompting Zaidi to order the closure of three of the border crossings with Iran. Iranian officials were angered by the move and sought explanations through their political and armed-faction allies in Iraq, while twice failing to respond to attempts by the Commander-in-Chief’s office to contact them directly, one of the officials told The New Region.

As the investigation progressed, however, investigators found no evidence that drones, weapons, or other equipment had been transferred from Iran into Iraq specifically for the operation. The attack had been launched from Iraqi territory and the emerging trail was centered on Iraqi armed actors, officials said.

The dynamic changed after Zaidi’s office sent the Iranian side images from the launch site and some of the initial evidence gathered by investigators. Iranian representatives subsequently attended a security meeting at the Prime Minister’s Office, followed by another meeting at the PMF headquarters, where Iraqi officials shared further details of the investigation.

Officials did not disclose the full details of what was presented during the meetings or what prompted the shift in Tehran’s position. But after reviewing the Iraqi findings, Iranian officials offered to participate in the investigation. Zaidi accepted the offer.

Iranian officials said Tehran would send a senior-level investigative committee including officers from the Iranian military, the IRGC and intelligence services, as well as technical specialists, to join the Iraqi investigation, officials told The New Region.

They also offered to examine the launch platforms and review available satellite data related to the operation, officials said.

For the Iranians, identifying who had ordered the attack had become more than a matter of establishing responsibility.

Fighters affiliated with an Iran-aligned Iraqi faction carried out a significant regional operation using Iranian weaponry, without the authorization of their own faction leadership and outside the existing Iranian channels dealing with Iraqi armed factions.

That raised a more consequential question over the purpose of the attack, whose interests it was intended to serve and, ultimately, who stood behind it.

“The Iranians began to suspect that there had been a breach and wanted to know who had given the order to carry out the operation,” one of the officials told The New Region.

“They believe there are two possibilities: either the operation was carried out for political maneuvering, or there was an intelligence breach.”

“Both possibilities remain equally plausible.”