Armed attacks inside Iranian Kurdistan have increased since the ceasefire that ended the six-week war on 8 April 2026 and was formalised by the memorandum of understanding signed on 17 June. Before the ceasefire, most of the violence took the form of Iranian bombardment of Kurdish opposition camps in the Kurdistan Region of Iraq. Afterwards the pattern changed: the camps were struck less often, and the killing moved inside Iran, taking the form of ambushes on Islamic Revolutionary Guard Corps vehicles, shootings of men accused of working with the security services outside their own homes, and attacks on army positions in the border districts.

Two stretches of that shift have been documented in enough detail to count. Nine armed incidents occurred between 29 May and 1 July 2026, seven of them producing confirmed deaths. In the fortnight from 25 July to 8 August, eight further incidents plausibly connected to Kurdish armed networks occurred in Piranshahr, Baneh, Bukan, Mariwan, Mahabad, Sarvabad and Sanandaj, and every one of them killed someone. The fortnight opened with an attack on an IRGC vehicle in Piranshahr that killed Hamed Daeizadeh, and closed with the shooting of Salar Rangamiz outside his home in Sanandaj. In between came a disputed interception near Baneh in which Iranian police said four PJAK members were killed while Kurdish sources identified three of the dead as civilians from one family, the IRGC’s killing of Seyed Ahmad Esmaeili on the Bukan road, the unclaimed shooting of a local IRGC auxiliary in a Baneh village, an assault with munitions and rocket fire on an army position near Mariwan that killed a soldier, the killing of the IRGC-linked auxiliary Omar Dehqan near Mahabad, and the killing of another auxiliary at his home in Sarvabad.

The men described here as auxiliaries or collaborators are characterised that way by the organisations claiming the killings. Those accusations have not been independently adjudicated, and this article reports them as accusations.

Read as a set, the fortnight shows three things. None of the eight incidents has been credibly attributed to KDPI, Komala, PAK or Khabat, the parties that have historically defined Iranian Kurdish armed opposition. Several of the responsibility claims that were made came instead from organisational names with no located pre-2026 public record. And only one case, Piranshahr, carries a formal Kurdish armed-group claim that is both public and uncontested. Two killings, Omar Dehqan and Salar Rangamiz, drew competing organisational claims. Three operations produced no formal claim, though local sources attributed two of them, Mariwan and Sarvabad, to PJAK. In the remaining two, Iranian forces did the killing, and what is disputed is not who fired but whether those killed were connected to Kurdish armed groups at all.

Eight incidents therefore produced one clean answer to the question at issue here, which is not who fired in general but which Kurdish armed organisation, if any, was involved. That gap is not a reporting failure. It reflects a competition inside the Iranian Kurdish opposition over ownership of the escalation, and it cannot be read without knowing who the competitors are.

Two opposition structures: The Iranian Kurdish opposition is routinely listed as five or six parties, but structurally it consists of two different things.

The first is the traditional bloc: KDPI, Komala, PAK and Khabat. Whatever their internal splits, these parties share a broadly similar organisational form, ideology and social base, rooted in the region’s older nationalist and leftist traditions. They also share a predicament. Under the 2023 Iraq-Iran security agreement, Baghdad and Erbil disarmed their border positions and moved them into confined camps away from the frontier. Their physical access to Iran was cut, and their ability to demonstrate presence inside the country has since depended on networks that cannot be verified from outside.

The second is PJAK, the Iranian affiliate of the PKK. It is a different structure: a distinct social and power system that spread rapidly among Iranian Kurds after its creation, built on the PKK’s cadre model, experience, tools and weapons. Because it operates outside the control of the Kurdistan Regional Government, PJAK was not subjected to the relocation and disarmament measures implemented against the traditional parties under the 2023 agreement, and while they were being moved into camps, it kept and extended its own infrastructure along the border, including tunnelling in the Slemani-area border zone. Its positions run from Qandil through the Asos mountains into the Penjwen and Hawraman areas, within walking distance of Iranian territory. Between 2014 and 2025 it accounted for roughly 70 per cent of all attacks by Kurdish groups on Iranian forces and around 80 per cent of IRGC fatalities, against about 20 per cent of attacks for KDPI and marginal figures for the rest. Inside Iran it has built networks among Kurmanji speakers around Urmia, Khoy and Maku and among the Sorani-speaking left-leaning population of Sanandaj.

The 2023 agreement therefore did not weaken the Iranian Kurdish armed opposition evenly. It shifted the balance of sustained cross-border access sharply toward the one organisation outside the deal.

The wartime plan and the market for relevance: The war gave that imbalance political consequences.

When the conflict began in February 2026, a plan pushed by Israel and initially accepted by the United States envisaged Iranian Kurdish groups crossing from Iraqi Kurdistan to open a ground front, triggering an uprising in the Kurdish areas that would spread and, coordinated with opposition networks elsewhere, bring down the government. The plan collapsed within weeks. Turkey pressed Washington to abandon it, the American commitment was shallow from the start, and the groups at its centre proved weaker than they had claimed: divided, penetrated, and fielding far fewer fighters than their own presentations suggested.

Two details of that episode shape what has happened since. The first is who was in it. The plan was built around the traditional bloc, and Israeli media reporting, most recently in Haaretz, has confirmed that PJAK was left out of the arming plan, out of concern for the Turkish reaction to equipping a PKK affiliate. The strongest Iranian Kurdish armed organisation was excluded from the plan, and the excluded organisation possessed by far the deepest surviving border infrastructure to execute it at scale. The second is who Iran punished. Since the war began, Iranian drones and missiles have struck the traditional parties’ camps hundreds of times. PJAK was conspicuously absent from the documented campaign, an asymmetry consistent with the same logic as the Israeli exclusion: PJAK sits inside the Turkish file as well as the Iranian one, and every side treats it differently as a result.

That asymmetry also feeds a much older dispute inside the opposition. The traditional parties and their activist supporters have long accused PJAK of collusion with Tehran: of maintaining understandings with the regime, spoiling the other parties’ initiatives, and operating as a Trojan horse inside the Kurdish cause. This article does not adjudicate that accusation. What matters here is that the audience which holds it read Iran’s targeting campaign, which repeatedly struck the traditional parties while leaving PJAK conspicuously absent from the documented record, as further evidence for the accusation, whatever the actual cause of the asymmetry.

The plan is dead, but the conditions that produced it are not. The ceasefire is fragile, the memorandum’s negotiating window is finite, and the possibility that the war resumes keeps external interest in Iranian opposition networks alive. There is a standing market for reliable Kurdish partners inside Iran, and every actor in this story knows it.

That market rewards evidence of current access, not size, history or programme, and the two blocs enter it from different positions. The asymmetry between them is one of degree, sustainability and infrastructure, not a division between fighting and marketing: KDPI has continued to insert armed personnel, and several post-ceasefire interceptions involved its teams. But the traditional parties, confined to camps and stripped of border access, increasingly have to compensate through presentation, claims and attribution for a physical disadvantage that PJAK can more readily answer with demonstrated operations. During the war, Reza Kaabi, the leader of one Komala faction, accused PJAK of quietly moving its fighters into Iran from Qandil and its other border positions without consulting the parties it was nominally coordinating with, and said he believed it had a plan to act alone. The post-ceasefire attacks, concentrated in districts opposite PJAK’s border infrastructure, began shortly afterwards.

The attribution contest that followed has two audiences. Internationally, the traditional bloc needs partners to believe it retains reach inside Iran. Domestically, it needs the new attacks not to be PJAK’s, because an escalation visibly conducted by PJAK would be difficult to reconcile with the accusation that PJAK works with the regime, and would reinforce the impression that the bloc’s own capability claims had been inflated. Attacks credited to new, unaffiliated names serve both needs at once. None of this proves that any specific actor fabricated any specific claim. It establishes the incentives under which the claims are being made.

The same market rewards information organisations. An outlet that consistently publishes casualty details before official channels and relays new formations’ statements first is advertising its own network as reliable and well sourced, and access to a new armed group is itself a credential. Media and human rights actors in this space therefore have their own interest in the emergence of new armed labels, independently of any hostility toward anyone.

This is the environment Khori Hiwa appeared in: an escalation unfolding disproportionately within the operational geography of the actor with the deepest surviving cross-border infrastructure, sidelined parties that need to appear relevant to two audiences at once, an outside market assessing who is worth engaging, and an information ecosystem with a stake in being close to whatever is newest. That is why claims over these killings become so intensely contested: in this market, the claim itself is the product.

Who is Khori Hiwa: Khori Hiwa, which translates as Sun of Hope and appears in some sources as Xori Hiva, is one of the new names in that contest. It has no established history, no known leadership, no publicly identified armed wing and no prior presence in Iranian Kurdish politics. Almost everything publicly known about it comes from its own Instagram account and from the Kurdish media and human rights organisations that have relayed its statements. It is examined in detail here not because it is established as the most important actor, but because its record, timestamped and publicly contested, makes the wider transformation observable in a way the established organisations’ activity does not.

It did not begin the escalation it now claims a share of. Its Instagram account was created in May 2026 and its first surviving public post dates from 24 June, weeks after the inside-Iran attacks had begun and after Kaabi’s complaint about PJAK’s infiltration. By then, targeted killings of alleged collaborators and claims by newly named local formations were already occurring: on 3 June a statement circulated under the name Patriotic Youth of Kurdistan claiming a targeted killing in Kamyaran. The practice of new labels claiming collaborator killings predates Khori Hiwa.

Its initial presentation was not that of an armed party. There was no announcement of a military command, no identified armed wing, no units, no leadership and no organisational structure of the kind the established parties maintain. The early material centred on activism, revolutionary youth and mobilisation, and the armed identity came afterwards. Later statements associated Khori Hiwa with shootings and targeted killings, usually through the formulation that its activists or fighters had acted together with the revolutionary youth of a particular city. That wording does not describe a centrally controlled military structure. It is equally consistent with local activists, clandestine contacts or pre-existing armed networks whose actions are then presented under the Khori Hiwa name.

It has claimed or discussed at least eight operations since June and now appears in Kurdish and international reporting as a newly established clandestine armed group. That description can be tested, because a group that carries out an attack knows about it before anyone else does, and that should show in the timestamps.

Testing the claims against the clock: The eight cases Khori Hiwa has claimed or discussed run from Paveh on 29 June to Sanandaj on 8 August. For each, the relevant question is what was already public when Khori Hiwa posted.

In five cases, the event was already known. Reporting derived from IRNA named Daniyal Nourian and tentatively mentioned PJAK more than sixty hours before Khori Hiwa branded the Mariwan event and alleged additional casualties; Hengaw’s own chronology dates Nourian’s death to a YRK clash on 10 June, roughly two weeks before the operation Khori Hiwa narrated. Local reporting on a Baneh checkpoint clash preceded Khori Hiwa by eight minutes, and in that case Khori Hiwa credited generic Kurdish opposition forces rather than itself. A Tasnim police release on the Mohsen Chehri killing preceded Khori Hiwa by more than three hours. A Kurdish account reported the Piranshahr killing nearly five hours before Khori Hiwa’s surviving post, which added aftermath footage and refers to an earlier post that no longer survives, so an exact first-claim timestamp cannot be recovered. And a Sanandaj channel reported the Rangamiz shooting almost two and a half hours before Khori Hiwa named him.

In the remaining three cases Khori Hiwa was first, and each is compromised in a different way. At Paveh it was the first located public source and supplied exact names of the dead and wounded that Hengaw later confirmed, the strongest indication in the record that it sometimes holds early and specific information. The Patriotic Youth of Kurdistan then claimed the same attack and accused parties with no connection to the operation of publishing it under their own name. At Mahabad, Khori Hiwa claimed the killing of Omar Dehqan and dated the operation to 5 August, after which YRK formally stated that its own forces had killed the same man in the same village on 8 August, a direct conflict of both actor and date. For the Nivan junction operation no independent contemporaneous report has been located, so being first proves nothing: the underlying event itself remains unvalidated.

There is no case in the record where Khori Hiwa demonstrably knew something before the public did and was not contradicted by somebody else. The record therefore establishes that Khori Hiwa can sometimes obtain early and specific information, but not that the information comes from those conducting the operations. Being first is evidence of access; it is not evidence of authorship.

Sanandaj, 8 August: The killing of Salar Rangamiz is the most completely reconstructable case. All times are UTC.

At 08:41, a Sanandaj channel reported that a masked person had shot a man in his car on Mardokh Street and escaped, naming no victim and no organisation. The post reads as independent local reporting rather than the reproduction of a militant statement. Telegram marks it as edited without exposing the edit time or the original text, so while the post existed almost two and a half hours before Khori Hiwa’s, not every currently visible detail can be proven to have been present from the start.

At 11:10, Khori Hiwa posted, naming Rangamiz and attributing the killing to its fighters acting with the revolutionary youth of Sanandaj. Instagram marks the caption as edited, but the claim is printed inside the uploaded image itself, so the attribution was present at upload. The image is a composite poster containing a cut-out portrait, a city background, the Khori Hiwa logo, rifle and blood graphics and text. It contains no scene photograph, no vehicle, no weapon, no attacker and no aftermath.

At 12:07, fifty-seven minutes later, ANF published a statement from the Teams of Revenge of the Martyrs of Kurdistan saying its teams had carried out the killing. ANF presented this as the publication of a group statement rather than independent reporting, and no recoverable public communiqué places the group’s claim before Khori Hiwa’s, though it may have circulated privately. At 12:58, Hengaw published, sourcing the event to a report it had received and attributing responsibility separately to Khori Hiwa’s statement, which independently supports the death and the location but not the authorship.

One further detail undercuts the assumption that naming the victim required inside knowledge. Rangamiz’s name, along with unverified allegations about collaboration and drug offences, had appeared in Kurdish opposition material as early as 2018. A name, a portrait and a hostile biography were already available to anyone with access to that material. Producing them within three hours of a reported shooting on a named street demonstrates attentiveness, not operational access.

Sanandaj establishes a limited set of points. The incident was probably circulating locally before Khori Hiwa posted. Khori Hiwa was not the first source for the occurrence, but it was the first verifiable public source to attach an identity and an organisational claim to it, and the rival claim came afterwards. Neither claimant published operational evidence with its claim; the bystander video that surfaced three days later is addressed below. The close timing and overlapping allegations are equally compatible with competing claims, deliberate co-branding, a shared local source, or one party reacting to the other, and chronology alone cannot separate those possibilities.

The attribution war goes public: Sanandaj is not an isolated case. Paveh produced an accusation of claim theft in the case where Khori Hiwa’s early knowledge is least in doubt. Mahabad produced a formal conflict with YRK over both the author and the date of the same killing. Mariwan shows recycling rather than competition, with a man killed in a 10 June clash appearing in a Khori Hiwa narrative of a purported 23 June operation. Four of Khori Hiwa’s operation-related posts materially overlap another attribution, and all four run against claims or attributions emerging from the PKK and PJAK orbit: the Patriotic Youth of Kurdistan at Paveh, YRK at Mariwan and Mahabad, and the Teams of Revenge of the Martyrs of Kurdistan at Sanandaj. Three are direct competing claims and the fourth is a chronology conflict. That is a pattern, and it means Khori Hiwa’s statements cannot be read the way a formal communiqué from an established armed organisation would be read.

The participants have now said so themselves, and begun producing material. On 11 August, the PKK-aligned Ofogh Guerrilla Telegram channel published footage it described as the moment Salar Rangamiz was killed, attributing the operation to the Teams of Revenge of the Martyrs of Kurdistan and stating that the video had been filmed by local residents and sent to the channel. It then announced a second video, of the Omar Dehqan killing, and framed the releases in terms that describe the dynamic reconstructed above. The dispute, it said, “is not simply a dispute over competing narratives” but concerns “defending the integrity of the struggle itself,” directed at “self-proclaimed actors using fabricated identities, hiding behind fake names and social-media pages, and trying to appropriate the struggle and suffering of fighters for themselves.” Credibility, it continued, “comes from presence and action, not from the noise of people who build a reputation for themselves only online,” and its answer would be “the facts.”

The releases matter on three levels. They are the most direct statement yet from inside the armed movement that it regards operations as being claimed by parties that did not conduct them, and they identify the accused in everything but name: entities with fake names and social media pages and no presence on the ground, a description that fits the cluster of 2026 labels of which Khori Hiwa is the most prominent. They move the contest from claims toward a different level of evidence, since no claimant in these disputes had previously produced footage purporting to show the killing itself. And the cases are chosen precisely: Rangamiz is the killing Khori Hiwa claimed within three hours of the first local report, and Dehqan is the case where Khori Hiwa’s claim collides with a formal YRK statement.

The evidential weight of the material has limits. By the channel’s own account, the Rangamiz video was filmed by bystanders and sent in, so it demonstrates access to local sources rather than proving which organisation’s gunman fired, the same limitation that applies to Khori Hiwa’s Piranshahr aftermath footage. As of publication, the Dehqan video had not appeared. What the releases establish even so is that the participants treat this as a fight over attribution, and that the side with the physical apparatus has chosen to respond with material the claim accounts have not produced.

The geography and branding of the disputes: Beneath the timestamps sits a structural question: who can operate in these places at all. Sustaining ambushes and targeted shootings across these areas requires local cells or contacts, access to weapons and communications, and networks through which operatives can move or withdraw.

The disputed cases fall in a consistent area. Paveh and Mariwan sit in the Hawraman corridor, directly opposite the Penjwen and Halabja districts where PJAK’s rear infrastructure and tunnels are concentrated. Sanandaj is where PJAK has documented urban networks. Mahabad, the subject of the footage announcement, sits in its northern operating zone. The cases where Khori Hiwa’s claims are most contested all fall inside the operational and social geography of the one Iranian Kurdish organisation with the demonstrated apparatus to work there.

The naming and branding of the competing labels sort along the same two-bloc divide. Every competing claim or attribution identified in these disputed cases emerges from the PKK and PJAK orbit: the Patriotic Youth of Kurdistan at Paveh, YRK at Mariwan and Mahabad, and the Teams of Revenge of the Martyrs of Kurdistan at Sanandaj. Their statements are published through PJAK and PKK-aligned channels, including ANF, the agency widely described as close to the PKK, and the Dehqan footage was announced through a PKK-aligned guerrilla channel. Their language draws heavily on that movement’s vocabulary of martyrdom, revenge and guerrilla struggle. Khori Hiwa is styled differently. Its logo and its more nationalist terminology draw on the visual and rhetorical idiom of the traditional parties, not the PKK’s. None of these signals establishes who runs any label, and imitation is always possible. But the sorting is consistent with the two-audience incentive described earlier: the claims disputing Khori Hiwa surface through the PKK orbit, while Khori Hiwa presents itself in the idiom of the bloc that needs the attacks not to be PJAK’s.

None of this identifies who carried out any particular attack. Capability is not evidence, an organisation with infrastructure can be credited with something it did not do, and local cells do operate outside established command structures. Khori Hiwa may have real people in some of these towns. But when an account of unknown structure and no demonstrated sustaining capacity claims a run of operations in the districts where the PKK-linked apparatus is strongest, and is contested there by that apparatus, the prior probability is not neutral, and any reading of these disputes has to carry that weight.

The information intermediaries: One further set of actors belongs in this picture. Figures connected to established Kurdish media and human rights networks, including Hengaw and the journalist Arsalan Yarahmadi, were among Khori Hiwa’s earliest public disseminators. Networks of that kind receive information rapidly from inside Iranian Kurdistan and routinely publish casualty details before official channels do. If a new brand’s operators overlap with such a network, they can obtain genuine early information from Sanandaj, Paveh or Mahabad without commanding anyone conducting operations, and publication order cannot test this: information supplied privately produces exactly the observed sequence, in which the brand posts first and the network reports afterwards.

What the public record supports is limited. No charter, personnel overlap, shared administration or command link between Hengaw and Khori Hiwa has been located, and amplification is not administration. The stronger claim, that this amounts to a coordinated effort to displace PJAK and YRK from the record, is contradicted by the record itself: Hengaw names PJAK and YRK openly and repeatedly, including where no formal claim exists, and YRK’s own claims have not been suppressed. The analytic point is narrower. Well-connected information networks are one plausible source of a new brand’s early details, they have ordinary professional reasons to be close to new formations, and their existence means that early information, on its own, is weak evidence of operational involvement.

What Khori Hiwa appears to be: Two simple explanations fail against the record. Khori Hiwa is not a fabricated account with no access to events inside Iran: the Paveh casualty details were specific and later confirmed, and the Piranshahr aftermath footage indicates a real source somewhere. Nor does it have the characteristics of a conventional armed organisation. Its initial identity was activist rather than military, its structure is opaque, it has never published evidence of conducting an operation, it has no known rear base or logistical depth in a conflict where those determine who can act, and it was reacting to public information in most of the cases where its timing can be checked.

What fits the record is a public-facing claim brand or loose aggregator operating inside a fragmented escalation, capable of receiving genuine information from local contacts and potentially from sympathetic journalists or activists, while in other cases appearing to relabel, or standing accused of appropriating, operations conducted by someone else. That model accounts for the occasional specific detail and for the recurring disputes over who acted. It also places the activist origins in context: Khori Hiwa may not be a hidden military organisation that later revealed itself, but an activist network that took on an operational and attribution function as the escalation developed and the value of appearing operationally relevant rose.

Placed back inside the wider structure, the pattern is coherent. A foreign-backed plan built around the traditional parties collapsed partly because their strength was inflated. The organisation excluded from that plan holds the deepest surviving cross-border infrastructure, stands accused by a rival Kurdish leader of moving fighters into Iran, and claims operations under its own name. The other actors, and the new labels and information channels around them, are competing for a share of an escalation that was already under way, because being seen as present inside Iran is worth more than it has been in decades, and because an escalation owned publicly by PJAK would undercut the traditional bloc’s standing accusation that PJAK collaborates with the regime. The branding of the new labels tracks that division: the names contesting Khori Hiwa’s claims carry the PKK’s idiom, and Khori Hiwa carries the traditional parties’. The PKK orbit has begun answering with video, material the claim accounts have not produced, though its first release, filmed by bystanders, demonstrates access rather than authorship.

What remains unproven should be stated as plainly as what is established. Whether Khori Hiwa is deliberately taking credit from PJAK and YRK is unproven: Paveh strongly suggests unauthorised appropriation, Mahabad is a direct conflict that the promised footage may resolve, and Sanandaj could be co-branding. Whether people in the Hengaw ecosystem feed it information is open and cannot be resolved from public data. That Hengaw controls the account, that Khori Hiwa is a front for any established party, or that any of this is a coordinated operation against PJAK all remain unestablished.

What can be said is that counting attacks is no longer sufficient. An information and attribution campaign is developing alongside the violence, with its own participants and incentives, and it is being fought hardest by the actors with the least capacity to fight the physical one. Khori Hiwa matters less as a possible new Kurdish armed party than as the case that makes the transformation visible: the collapse of the wartime plan, the survival of the market it created, the concentration of cross-border capability in the one excluded organisation, and the traditional bloc’s need to deny that organisation credit have together made attribution the principal battlefield of the structurally weaker side. Weaker here means weaker in cross-border armed capacity, not in political standing or social base, where the traditional parties retain assets PJAK does not. In an environment where seven of eight incidents in a fortnight lack an uncontested Kurdish armed-group attribution, attribution now carries much of the political value that operations once produced.

Two questions connect the pattern and should set the next stage of this investigation: who had access to Khori Hiwa before its public launch, and whether the same information networks appear upstream of both its early claims and the organisations that later dispute them.