Full Report
Explores Palestine Action’s post-designation global network, tactics, and targets, and evaluates key physical risks and mitigations for organizations.
Analysis Summary
# Threat Actor: Palestine Action
## Attribution & Identity
**Identification:** Palestine Action.
**Aliases and Associated Groups:** The group operates through a global network often consisting of pro-Palestinian activist groups sharing core operational profiles. They label their covert missions as "Palestine Action Underground."
**Founders (UK branch):** Huda Ammori and Richard Loxton-Barnard (Founded July 2020).
**Structure:** Likely lacks formal hierarchies, functioning as decentralized activist cells. The organization distinguishes between non-violent direct action elements and covert cells dedicated to militant direct action.
## Activity Summary
Palestine Action’s UK branch was designated as a terrorist organization in July 2025. In response, the group appears to have encouraged domestic violent extremists (DVEs) outside the UK to increase the scope and frequency of their operations (militant direct actions), while the UK core has reduced its operational tempo domestically to manage legal challenges to the designation. Since October 7, 2023, events related to the Israel-Hamas conflict have frequently preceded physical attacks linked to the network. Historically, the UK core conducted over 385 direct actions between July 2020 and March 2025. Costly operations have resulted in several million dollars in damages.
## Tactics, Techniques & Procedures
- Vandalizing the exterior of facilities using red paint or blunt instruments.
- Obstructing facilities using "human chains" or large objects.
- Sabotaging valuable assets inside the perimeter of a facility (often involving breaching secure perimeters for maximum cost impact).
- Promoting militant direct action among global network affiliates.
- Post-designation: UK cells may separate from the brand while international cells highlight their connection to Palestine Action for credibility.
## Targeting
**Sectors:**
- Defense contractors (Primary target, especially those supplying Israel’s government/military, such as Elbit Systems).
- Insurance agencies.
- Banks and financial entities.
- Shipping and logistics service providers.
- Government agencies (perceived relationship to Israel).
**Geography:**
- Western Europe
- North America
- Australia
**Victims:**
- Multinational companies supplying Israel/IDF.
- Israeli multinational defense contractor Elbit Systems, its partners, and subsidiaries.
## Tools & Infrastructure
* **Malware Families Used:** Not specified in the provided context (Focus is on physical direct action).
* **Infrastructure:** Not specified in the provided context (Focus is on physical direct action, not cyber infrastructure).
## Implications
The UK terrorism designation has likely caused Palestine Action's global network to broaden operations geographically beyond the UK, where affiliates have greater freedom of maneuver. The network is expected to escalate the frequency and scope of militant direct action operations, forming new groups globally. Future escalations are strongly correlated with volatility in the Israel-Hamas conflict or renewed Israeli military activity in Gaza.
## Mitigations
- Facilities of targeted sectors (defense, banking, insurance, shipping) in Western Europe, North America, and Australia face persistent physical threats.
- Organizations should limit voluntary publication of sensitive information regarding the functions, layout, location of critical infrastructure assets, or facility security measures beyond regulatory minimums.
- Expect increased militant direct action from global network cells unless the UK designation is rescinded or legal appeals are exhausted.