Lebanese security agencies have widened their investigation into a Syrian-Lebanese network dismantled in recent days, as new information emerges about its alleged sources of funding, military training and protection, and investigators seek to determine whether the group was preparing to carry out security operations inside Lebanon.

The investigation, which remains at an early stage, has increasingly focused on whether the network’s activities extended beyond Syria and whether Lebanon itself may have been among its intended operational arenas.

Five alleged members of the network — three Syrians and two Lebanese — have been arrested so far, according to judicial and security sources cited by Asharq Al-Awsat. The broader investigation has pointed to a cross-border network that allegedly moved fighters from Syria into Lebanon before transferring them to Beirut’s southern suburbs and later to the Bekaa for military training.

A judicial source told Asharq Al-Awsat that preliminary findings had strengthened evidence, according to the source, of the alleged involvement of Hezbollah-linked operatives in training members of the network and providing them with protection.

The source said investigators had also uncovered evidence that the Syrian detainees received regular financial assistance from an association linked to Hezbollah and based in Beirut’s southern suburbs.

Security forces found invoices belonging to the association among the Syrians’ possessions, the source said. The organization allegedly provided monthly financial assistance ranging from $200 to $500.

The same association was also suspected of paying the rent of former Syrian officer Manaf Ali Safi and two of his associates in Beirut’s southern suburbs after the fall of Bashar al-Assad’s government and their flight to Lebanon.

From Beirut’s Southern Suburbs to the Bekaa

According to preliminary findings, the group moved following the resumption of war in Syria on March 2, 2026.

The men initially left Beirut’s southern suburbs for the town of Tal Biri in the northern Akkar region, investigators found. They later returned to the southern suburbs before traveling to the Bekaa, where they are suspected of undergoing military training.

The judicial source said individuals suspected of links to Hezbollah used phones registered with Nepalese numbers to communicate through WhatsApp.

An analysis of the communications showed that the activity most often originated from Beirut’s southern suburbs and, on other occasions, from the Bekaa, the source said.

Geolocation data from the phones used by the Syrian suspects also showed their repeated presence in the southern suburbs, the Bekaa and Tal Biri, according to the investigation.

Earlier reports cited by Asharq Al-Awsat said members of the network had allegedly received military training from Hezbollah fighters and operatives under the direction of a man known as “Hajj Alaa.” The detainees were believed to be part of a wider network involving more than 50 former regime members and associates operating inside Syria, particularly in the coastal region.

Weapons, Explosives and a River Search

Meanwhile, Lebanese security agencies have begun cataloguing weapons and other material seized from the detainees.

According to the judicial source, the cache included machine guns, sniper rifles, detonators and explosive materials.

Investigators are also examining testimony from a member of Lebanon’s State Security agency who was arrested recently in connection with the case.

The officer reportedly told investigators that he had moved explosive devices from a house in Tal Biri before disposing of them in the Nahr al-Kabir river in northern Lebanon.

Authorities are now working to verify his account and locate and recover the explosives.

The investigation has already highlighted the importance of Tal Biri, near the Syrian border. Previous reports said the town served as a gathering point for fighters arriving from Syria before they were transferred deeper into Lebanon, pointing to what investigators believe may have been an organized route for moving both personnel and weapons across the border.

Syria Coordination Remains Possible

The possibility of coordinating with Syrian authorities remains open as the investigation develops.

The judicial source said that once Lebanese investigators complete the initial phase of their inquiry, any information identifying individuals inside Syria suspected of links to the network could be shared with Damascus so that Syrian authorities can take appropriate action.

The case comes at a particularly sensitive time in relations between Beirut and Damascus, as both governments seek to strengthen security and judicial coordination following the fall of Assad’s government.

But the most sensitive question for Lebanese investigators concerns the true scope of the network’s mission.

Was the group preparing exclusively for operations inside Syria, particularly in the country’s coastal region, or was it also planning attacks inside Lebanon?

“The information available so far indicates that Lebanon was among the arenas targeted by the group,” the judicial source said.

Investigators are still trying to determine the nature of the potential targets and whether the network had progressed beyond planning and reconnaissance to concrete operational preparations.

Earlier reports said the network’s alleged mission may have gone beyond preparations for a possible confrontation with Syrian forces and could have included attempts to sow unrest and security chaos inside Lebanon, carry out assassinations and conduct military or security operations along Syria’s coast. Investigators have cited the type of weapons seized as one factor raising concern about the group’s possible objectives.

A Broader Security Sweep

The dismantling of the network is unlikely to close the case.

Lebanese security agencies are expected to intensify surveillance and preventive operations targeting former officers and personnel from the Assad government who are currently living in Lebanon, according to the judicial source.

The concern, the source said, is that the presence of some former regime figures in Lebanon may not be limited to fleeing Syria or seeking refuge from possible prosecution.

Some may have retained security roles or operational objectives, investigators fear.

Security agencies are therefore treating the network as the starting point for a wider inquiry based on the possibility that the group uncovered may not be the only one operating on Lebanese territory.

Investigators are examining whether other networks linked to remnants of the former Assad government remain active in Lebanon, potentially using the country as a logistical base, transit point or operational arena.