Subscribe now

The Russia-Ukraine War has become synonymous with drone warfare. Online, any mention of the Ukraine War will bring on an onslaught of comments around how cheap and easy-to-use drones have forever changed the nature of war. Regardless of whether the fundamentals of warfare have been changed by innovations in drones, a new skill set that is in high demand is being forged in the crucible of Ukraine’s east. In particular, skilled drone operators are in high demand, increasingly in the criminal underworld.

Both the Ukrainian and Russian militaries have trained thousands of drone operators, who have then gone on and become seasoned combat drone pilots. However, this is not just a story of soldiers serving their countries. With both Ukraine and Russia accepting foreign volunteers, there are now numerous trained, experienced drone operators who have left military service and gone on to lives outside of the conflict zone. Some of these combat veterans have chosen to use their skills in the service of criminal organizations. Yet others were originally sent to the front by criminal organizations in the first place, in order to gain the desired skills.

The combat drone operator skillset is in high demand with nonstate militant organizations, ranging from rebel groups to criminal syndicates. There is an increasing number of nonstate militant organizations that are using drones in attacks against both agents of the state as well as opposing nonstate actors. These organizations include the Marxist-Leninist National Liberation Army (ELN) in Colombia, the Jalisco New Generation Cartel (CJNG) in Mexico, and Chinland Defense Force rebel group in Myanmar, among others. Analysts are paying attention to the growing nonstate use of combat drones because of the asymmetric impacts that effective combat drone use can have on both states and other nonstate actors. As the nonstate use of combat drones increases, the market for skilled and seasoned drone operators will also continue to expand.

The Foreign Volunteer Pipeline

The Ukraine War has already attracted thousands of foreign fighters to both sides. Early in 2022, the Armed Forces of Ukraine (AFU) stood up its International Legion specifically to provide foreign volunteers an easy onramp to service in the Ukrainian military and attract more volunteers in the future. While the Ukrainian government does not release official figures, it is likely that at least 15,000 foreign fighters have served with the AFU. For the Russians, at least 27,000 foreign fighters have served in the Russian military in Ukraine since the start of the full-scale war, with the Russian government seeking to recruit an additional 18,500 foreigners to serve in 2026 alone.

In both the Ukrainian and Russian militaries, foreign fighters fill a number of roles, including many that have nothing to do with drone operation. However, with drones having become such a significant part of the order of battle in both countries’ militaries, a substantial number of the foreign fighters do become drone operators. In 2025 alone, Ukraine trained over 50,000 drone operators, and that same year, Russia had at least 80,000 soldiers serving in drone units.

In this hothouse of drone innovation, both technological and tactical, criminal and rebel groups have seen the opportunity to increase their capabilities by either sending existing members to serve in the Ukrainian or Russian militaries, recruiting returned fighters into their organizations, or otherwise to purchase the services of returned fighters on a mercenary basis. Currently, criminal organizations are pursuing all three paths of bringing skilled drone operators into their organizations, but some notable examples of criminal organizations sending existing members to Ukraine to gain desired skills include a Mexican national with likely connections to the Zetas crime syndicate and at least three former Revolutionary Armed Forces of Colombia (FARC) fighters, all of whom were rooted out of the AFU by the Security Service of Ukraine (SBU).

Ukraine War Veterans Bring Critical Skills to Criminal Organizations

Veterans of the Ukraine War can bring critical skills to criminal organizations. Effective drone operators are time-intensive and expensive to train, and bringing this knowledge in-house at an accelerated rate via previously trained and seasoned personnel is a high priority for criminal organizations, especially in Latin America. Some particular use cases that drug cartels in Latin America are interested in using drones for include smuggling narcotics across the US-Mexico border, conducting reconnaissance, and attacking rivals.

The skills and knowledge that these war veterans bring include piloting skills, munition payloads, electronic warfare, drone countermeasures, and tactics. A typical introductory drone course has pilots undergoing five weeks of flight training before they’re ready to be sent to the front for further on-the-job training. It is at the front that pilots become truly skilled, accruing hundreds or thousands of flight hours in order to gain proficiency. However, beyond piloting, effective combat use of drones requires additional knowledge, including how to arm them for attack missions. Most armed drones in Ukraine are still using improvised payloads that require craft-modifying munitions using existing munitions such as mortar rounds and rocket-propelled grenades (RPG), a dangerous process where existing munitions are stripped and fuzed in the field. Further knowledge of radio theory, frequencies, and repeaters is critical for operating in environments with hostile electronic warfare and geographies that prevent simple line-of-sight flight. Finally, effectively using drones in combat requires distributed teams where the drone pilot is only a single actor in a larger mission, whether it’s reconnaissance, attack, or logistics, and the knowledge of how to conduct these operations, including what organization to use, is critical for mission success. Already, drones are being used extensively in various parts of Latin America, including for offensive drone attacks, including both FPV and dropper style attacks.

A Ticking Time-Bomb

It is not currently known how widespread the problem is, but with the Ukraine War showing no signs of stopping, there is the very real possibility that the flow of skilled drone operators from the frontlines in Eastern Europe to the black market will continue. Thousands of Latin Americans have already fought on Ukraine’s frontlines. While many have done so honorably, active gang members, cartel sicarios, and want-to-be mercenaries are among those who have fought. As ever-increasing numbers of combat drone operators return from the frontlines of Ukraine, criminal organizations will have an increasing number of potential recruits to select from. Importantly, governments, especially those south of the US-Mexico border, are not prepared to counter the growing drone threat. With this threat in mind, governments may soon begin following returning Ukraine War veterans, especially those with drone combat skills, more closely.

Subscribe now

Subscribe now

Since December 2025, the Islamic State (IS), its Khurasan affiliate (ISKP), and aligned pro-IS media outlets have been waging a coordinated propaganda campaign around the Bondi Beach attack in Sydney, in which a father and son opened fire on a Jewish Hanukkah gathering, killing and wounding approximately 15 people. The campaign repeatedly invokes the Israel-Palestine conflict, framing the attack as retaliation for Israeli actions in Gaza and positioning violence against Jewish civilians in the West as inseparable from the broader struggle over Jerusalem. Across four major publications spanning December 2025 through June 2026, the outlets have moved from an initial celebration of the attack to systematic operational incitement, theological argumentation, and direct calls to replicate attacks against Western targets. Running beneath and alongside the formal publications, and even praise given to the shooters in the IS spokesman’s latest audio address, IS supporter networks have amplified the campaign online, producing unofficial propaganda content, circulating attack footage set to nasheeds, and calling for more media producers to assist prospective attackers. The publications analyzed here are the Islamic State’s al-Naba newspaper (Issues 526 and 527), ISKP’s Khurasan Voice (Issue 48), and the Al-Iman Media Center’s article “Attacks in Australia.” Together, they constitute not a media echo chamber but a division of labor, with each outlet contributing a distinct layer of a unified radicalization architecture.

Al-Naba Issues 526 and 527: Celebration, Incitement, and Operational Doctrine

Al-Naba is the Islamic State’s primary Arabic-language weekly newspaper, and its two editorials responding to Bondi, “The Pride of Sydney” in Issue 526 (December 2025) and “The Season of Terror” in Issue 527 (December 2025), represent the backbone of the campaign. Issue 526 arrived within weeks of the attack; Issue 527 followed six months later, timed to another Western holiday season. Read together, they constitute something close to a campaign manual: the first establishes theological and organizational framing, the second converts that framing into explicit operational guidance.

Issue 526 opens not with celebration of Bondi specifically but with a broader declaration about the IS brand and its relationship to attacks it does not formally claim. The editorial preemptively dismisses the criticism that greets every IS-linked operation: that the group is fraudulent, its claims opportunistic, its attackers misguided, by treating such criticism as confirmation of the attackers’ authenticity:

No operation carried out by the Islamic State in the heart of the lands of the kuffar has ever escaped doubt, accusations, and betrayal: whether the Islamic State officially claimed it, implicitly praised it, or deliberately remained silent and left the enemy confused and hesitant; whether the attackers received direct guidance and support or were merely the product of its incitement and methodology; or whether the targets were murtaddin, Crusaders, or even the accursed Jews. All your heroics, O strangers, will never please the rabble and the mob.

The rhetorical move here is deliberate. By folding all possible responses to an attack (claim, implicit praise, silence) into a single coherent IS strategy, the editorial makes the organization’s relationship to any given operation permanently unfalsifiable. It also pre-insulates future attackers against the community disapproval they will inevitably face. The editorial anticipates condemnation and frames it as spiritual noise.

The editorial’s treatment of the Bondi attack itself is brief but pointed. It presents the attack as the direct product of standing IS doctrine, years of consistent instruction to target Jewish and Christian holiday gatherings, and positions the attackers as men who obeyed where others equivocated:

Today, Jews bleed in the streets of Australia after the zealous answered the call and implemented the recommendations to target holidays and gatherings. They armed themselves with the prophetic method and proceeded without turning back, plunging bareheaded into Hanukkah and turning it into mourning. They did not listen to the voices of the rabble among impostors and fools who spared Jewish blood through methods of weakness and dilution.

The phrase “implemented the recommendations” is significant. IS is not claiming credit for directing the attack; it is claiming credit for the doctrine that shaped it. This is a meaningful distinction. It allows the organization to take organizational credit while maintaining plausible distance from operational involvement, and it signals to prospective attackers that inspiration from IS publications is itself sufficient to constitute membership in the IS project. The editorial makes this explicit when it describes IS’s recruitment model as methodical: the organization, it says, “recruits them methodically, fills them with morale, then throws them into the throat of its enemy, bleeding him and striking him fatally, leaving him unable to escape this nightmare.”

Read more

Subscribe now

In the spaces left uncovered by the collapse of the Syrian state order and the post-Assad political transition, jihadist violence has not disappeared: it has fragmented, adapted, and sectarianized. In this fluid and volatile context, Sarayah Ansar al-Sunnah, a Sunni militant group, represents one of the most emblematic examples of how ideologically rigid yet operationally light micro-insurrections can exert a disproportionate impact on local security and social cohesion.

While remaining a numerically limited player, Sarayah Ansar al-Sunnah has demonstrated a growing ability to combine targeted sectarian violence, structured propaganda, and takfir religious narratives functional to the radicalization and intimidation of minorities. Recent attacks against the Alawite community in Homs, accompanied by a coordinated and stylistically refined communication campaign, confirm that the group does not operate episodically, but according to a coherent logic of symbolic and sectarian escalation. The analytical importance of Sarayah Ansar al-Sunnah lies not so much in its military capabilities, but in its ideological and functional positioning within the Syrian jihadist ecosystem. The group is, in fact, placed in a grey area: formally independent but increasingly aligned, at the doctrinal, communicative, and operational levels, with the Islamic State’s models and vision. This “shadow” does not necessarily imply direct command or organizational fusion but rather suggests strategic convergence that warrants attention.

Developments observed between January and April 2026 confirm the persistence of these patterns, with no evidence of a shift toward higher-intensity operations but continued reliance on targeted sectarian violence and narrative amplification.

Analyzing Sarayah Ansar al-Sunnah, therefore, highlights the evolving nature of Syrian jihadism: less territorial, more cellular, less control-focused, and more sectarian destabilization — underscoring the need for the audience to stay alert to these shifts.

History, Genesis, and Operational Development: From the Birth to the Centrality of Homs

Sarayah Ansar al-Sunnah emerged publicly in early 2025. Still, its appearance was not a sudden event, but rather the result of an underground radicalization process that had matured over the final years of the Syrian conflict. The group was born in a context marked by the disillusionment of more intransigent jihadist sectors with the political and military pragmatism adopted by the de facto authorities in northwestern Syria. In particular, the post-Assad transition and the progressive institutionalization of power have created a fertile space for actors who reject any compromise and demand a purely punitive and sectarian reading of jihad.

From the earliest claims, Sarayah Ansar al-Sunnah presents itself as a decentralized clandestine network, lacking defined territorial control but capable of operating continuously through autonomous cells. This structural choice is not accidental: it allows the group to survive in a highly repressive environment, reducing exposure to counterterrorism operations and making it more difficult to attribute and neutralize its operational capabilities. The rhetoric adopted from the beginning is unequivocal: the group defines itself as an instrument of “justice” against apostates, religious minorities, and alleged collaborators of the old state apparatus. Operationally, the first phase of Sarayah Ansar al-Sunnah’s activity is characterized by low-intensity, high-frequency attacks, predominantly in rural and peripheral areas of Hama, Latakia, and Homs. These involve targeted assassinations, seizures, arson, and acts of intimidation against civilians belonging to Alawite communities and, to a lesser extent, against former members of the security forces.

These operations have a dual function: on the one hand, they consolidate the group’s reputation as a determined sectarian actor; on the other hand, they fuel a narrative of impunity and moral control over the territory, even in the absence of a visible and stable armed presence. As the months pass, Sarayah Ansar al-Sunnah shows a progressive qualitative evolution. The use of improvised explosive devices, initially sporadic, becomes more structured, signaling an accumulation of technical expertise and better logistical organization. In parallel, the group expands its scope of action, demonstrating the ability to strike even in urban settings and in areas formally under government control. This operational leap is accompanied by a growing sophistication of its propaganda, which begins to follow narrative and graphic patterns attributable to the transnational jihadist ecosystem. Within this framework, Homs takes a central role in the group’s strategy. The city and its province represent an ideal environment: a geographical crossroads, an area historically marked by sectarian fractures and, above all, a space characterized by large grey security zones. It is therefore not surprising that Homs has become the main theatre of Sarayah Ansar al-Sunnah’s most significant operations, culminating in the most recent attacks against Alawite targets. In particular, the December 2025 attack by the group represents a turning point. The use of an explosive device within an Alawite place of worship, the immediate claim, and the subsequent multi-layered communication campaign indicate full operational and narrative maturity. The group doesn’t just strike, it constructs a story, pre-emptively defends its religious legitimacy, and places it within a framework of future threat. The violence is not presented as an isolated event, but as part of a campaign destined to intensify.

Taken together, the evolution of Sarayah Ansar al-Sunnah shows the typical trajectory of a contemporary jihadist micro-insurgency: emergence in dissident environments, consolidation through targeted sectarian violence, progressive technical and communicative sophistication, and concentration of operations in symbolically and strategically relevant areas. Homs is not just an operational target, but the laboratory through which the group attempts to demonstrate its relevance and project itself as a credible jihadist actor in the new Syrian landscape.

Recent monitoring in early 2026 indicates that central Syria, particularly Homs and adjacent areas, remains the primary operational environment, with activity characterized by intermittent, recurrent low-signature attacks.

Propaganda and strategic communication

In the case of Sarayah Ansar al-Sunnah, propaganda is not just an accessory but a core element that enhances its operational reach, and emphasizing the importance of the audience monitoring its narrative strategies closely.

Telegram represents the central axis of this ecosystem. The group has gradually abandoned a fragmented, opportunistic dissemination of content to stabilize itself on a network of official and semi-official channels, each with a distinct function: operational demand, ideological dissemination, and doctrinal consolidation. This segmentation allows the group to target different audiences — militants, sympathizers, and external observers — without overlapping communication levels. Stylistically, Sarayah Ansar al-Sunnah’s propaganda shows a clear evolution. The first communiques were essential, sometimes rudimentary. As the months passed, however, the group adopted standardized visual formats, detailed infographics, maps, casualty counts, and structured post-attack narratives. The goal is not only to inform but also to impose an interpretative framework for the event: define the target, justify action, neutralize criticism in advance, and project future threats. The deliberate use of sectarian language as a political tool is particularly relevant. The constant semantic redefinition of objectives, for example, the denial of the “Islamic” nature of the affected Alawite places of worship, is not accidental, but part of a defensive and offensive communication strategy at the same time. Defensive, because it aims to shield the group from accusations of excess or deviation; offensive, because it normalizes violence against specific communities, transforming it into a legitimate religious act. Propaganda is not limited to claims. A recurring element is the publication of names, photographs, and accusations against alleged collaborators of the old regime or members of minorities, creating a sort of “digital proscription list.” This approach has a strong, intimidating effect. It suggests that Sarayah Ansar al-Sunnah also serves as a platform for incitement and indirect coordination, rather than as a rigidly centralized organization.

In short, the group’s strategic communication aims not so much to claim control of the territory, but to control the narrative. It is in this symbolic space that Sarayah Ansar al-Sunnah attempts to compensate for its limited military capacity, presenting itself as a coherent, ideologically pure, and inevitable actor.

Ties and convergences with the Islamic State

The relationship between Sarayah Ansar al-Sunnah and the Islamic State cannot be read in the classical terms of formal affiliation. There is, at present, no public evidence of a direct command, official bay’a, or organizational merger. However, limiting this observation would mean losing sight of the most relevant dynamic: functional and ideological convergence.

On a doctrinal level, the affinities are evident. The vision of takfir, the rejection of any political authority not based on a radical interpretation of Sharia law, and the centrality of sectarian violence as a tool for social purification are elements that fully overlap with the ideological matrix of the Islamic State. Sarayah Ansar al-Sunnah does not simply share these principles: it explicitly reaffirms them in its own texts and religious production.

Even more significant is the convergence at the communicative and organizational levels. The adoption of propaganda models within the Islamic State’s media ecosystem, from the structure of infographics to the language of claims, suggests not only imitation but also recognition of a canon. In jihadist circles, this type of imitation is not neutral: it signals belonging to a very specific tradition and worldview. The same applies to the operational organization. The autonomous cell structure, the emphasis on small groups, the rhetoric of “lone wolves”, and the ability to strike without a visible chain of command mirror models already tested by the Islamic State in Syria in recent years. Sarayah Ansar al-Sunnah appears to move along the same route, adapting it to a smaller scale and a more fragmented context. Particularly indicative is the group’s ambiguous posture towards the Islamic State. The statements in which Sarayah Ansar al-Sunnah states that it is not currently cooperating with IS, while explicitly leaving open the possibility of doing so in the future, are not simple rhetorical formulas. These are calibrated messages - intended for a wider audience: they reassure about formal autonomy but signal ideological compatibility and strategic availability.

In terms of intelligence, this positioning makes Sarayah Ansar al-Sunnah a potential convergence asset. In a scenario of strengthening the Islamic State or further deteriorating security in central Syria, groups like SAS could act as local multipliers, facilitating recruitment, logistics, and social penetration without the need for direct deployment of IS cadres.

In conclusion, the relationship between Sarayah Ansar al-Sunnah and the Islamic State should not be read as a hierarchical relationship, but as a relationship of shadow and reflection. SAS operates in the space vacated by IS, takes up its languages and models, and helps keep alive a jihadist ecosystem that, although fragmented, remains deeply interconnected. No new evidence as of May 2026 indicates formal affiliation with the Islamic State, although ideological and operational convergence remains consistent.

Conclusion: Patterns, Threat Assessment, and Intelligence Outlook. Why Sarayah Ansar al-Sunnah Matters

Sarayah Ansar al-Sunnah’s overall analysis clearly shows that the group cannot be reduced to a mere acronym or to an ephemeral phenomenon linked to the volatility of the post-Assad period. In contrast, Sarayah Ansar al-Sunnah embodies a mature form of jihadist micro-insurgency, designed to operate persistently in an environment characterized by political fragmentation, security vacuums, and unresolved sectarian rifts. The group’s operating patterns are consistent and repetitive. Sarayah Ansar al-Sunnah favors attacks with low tactical complexity but high symbolic value, focusing on carefully selected sectarian targets. The areas of operation, particularly Homs and central Syria, are not random, but respond to a precise geographical and political logic: transition zones, with discontinuous state control, crisscrossed by communal tensions and historically used by jihadist networks as spaces for maneuver and refuge. Another recurring element is the absence of indiscriminate military escalation. The group avoids operations that would require prolonged exposure or a heavy logistical structure, preferring to strike and dissolve quickly. This choice reflects an operational rationality, not a weakness: Sarayah Ansar al-Sunnah does not aim at territorial control, but at the normalization of sectarian violence as a political tool. In this sense, every attack is conceived as a message, rather than a military action in the strict sense.

From a threat perspective, the group does not, at present, pose an existential danger to the survival of the Syrian state or to the national military balance. However, these findings risk being misleading if isolated from context. Sarayah Ansar al-Sunnah’s dangerousness lies not in its ability to conquer territory, but in its function as a chronic sectarian destabilizer. Through a combination of targeted violence and systematic propaganda, the group deepens community fractures, delegitimizes emerging institutions, and helps maintain a climate of widespread insecurity.

In terms of intelligence, Sarayah Ansar al-Sunnah must be read as an intermediate node within the Syrian jihadist ecosystem. Formally autonomous, the group increasingly exhibits marked ideological, organizational, and communicative compatibility with the Islamic State. This convergence does not necessarily imply direct subordination. Still, it increases the likelihood that Sarayah Ansar al-Sunnah could, in the medium term, serve as a local facilitator for more structured jihadist networks, especially in deteriorating security scenarios. A further element of risk is the group’s ability to attract disillusioned militants from other jihadist backgrounds or from groups that have accepted political compromises. In an environment where ideological legitimacy is a central currency, Sarayah Ansar al-Sunnah presents itself as a “pure” actor, untainted by pragmatism or negotiation. This narrative, though extremist, can be attractive to radicalized segments of the fighting population. In the medium term, Sarayah Ansar al-Sunnah is likely to continue operating as a low-visibility but high-impact actor, alternating phases of operational silence with sudden, violent resurfaces, calibrated to maximize media and sectarian effect. Any strengthening of the Islamic State or further weakening of government control in central Syria could significantly amplify the group’s role, transforming it from an autonomous micro-insurgency to a functional component of a broader jihadist strategy.

Current observations through May 2026 reinforce the assessment of Sarayah Ansar al-Sunnah as a persistent, low-visibility actor capable of sustaining sectarian destabilization without transitioning into a higher-order insurgent structure.

In conclusion, Sarayah Ansar al-Sunnah should not be underestimated or overestimated. It is a limited player in capabilities but lucid in strategy, marginal at the military level but central to the dynamics of sectarian radicalization. Ignoring its trajectory would mean losing a key indicator of the evolution of contemporary Syrian jihadism: a less visible, less territorial, but no less dangerous jihadism.

Subscribe now

Subscribe now

On 19 January 2026, Islamic State Khurasan Province (ISKP) carried out an attack on a Chinese restaurant in Kabul, Afghanistan, killing and wounding a number of Chinese nationals. The attack targeted an establishment located in a heavily fortified central district in close proximity to diplomatic and government facilities. ISKP subsequently claimed responsibility and used the operation as the centrepiece of a lengthy propaganda article published in late April in its Voice of Khurasan magazine under the title “Who Will Take Revenge for the Uyghur Muslims.”

The article was structured as both a justification of the January attack and a forward-looking declaration of intent. Opening with a direct address to the broader Islamic community, the magazine framed the operation as an act of religious retribution on behalf of persecuted Uyghur Muslims in Xinjiang, China. ISKP declared:

“First we congratulate the entire Islamic Ummah on this heroic attack by the Islamic State in which lillahilhamd the blood of the Murtad Taliban and communist Chinese was shed together.”

The article went on to address Uyghur Muslims directly, positioning ISKP as their sole defender in the face of Taliban and Pakistani inaction:

“Brothers of the Uyghurs: We answer the cries, wails, sighs, and captivity of your innocent children! Do not grieve; if the Pakistanis and the murtadd Taliban, instead of defending you, sided with the Chinese communists, you are not without brothers! Lillahilhamd, we are your brothers. This attack was a small sample of the revenge and retribution for the Uyghur Muslims; from now on, expect even harder and worse days!”

The broader ideological thrust of the piece was to construct China as a structural and irreconcilable enemy of Islam, delegitimise the Taliban’s governing authority through its engagement with Beijing, and normalise further anti-Chinese violence as a religious obligation. The following analysis examines the key narrative components of the article across six thematic areas.

Construction of China as a Structural Enemy

The text does not treat China as a contingent adversary but as a structurally defined enemy. The article asserts:

“It is clear to the whole world that the Chinese government is a kafir, secular communist regime. It does not accept Islam, it is an enemy of the Khilafah, and it is counted among the staunchest enemies of Islam.”

Read more

Subscribe now

The coordinated attacks carried out across Mali on April 25 may mark one of the most significant turning points in the country’s conflict since the collapse of the 2015 Algiers Peace Agreement and arguably since the battle of Tin Zaouatine in July 2024, where Russian mercenary group Wagner suffered one of its deadliest setbacks in the Sahel. Yet beyond the military implications, the attacks exposed something that for years was denied, downplayed, or deliberately kept ambiguous: the Northern Malian separatist military group Azawad Liberation Front (FLA) and Jama’at Nusrat al-Islam wal-Muslimin (JNIM), al-Qaeda’s branch in the Sahel, are increasingly operating on the same side of the battlefield.

For years, the northern rebel factions that make up FLA attempted to maintain at least a degree of political distance from JNIM. They operated in a deliberate grey zone where tactical coexistence with jihadi actors was widely suspected, but where political separation could still be publicly maintained. While local arrangements, battlefield coordination, and non-aggression agreements were often reported, the rebels consistently attempted to preserve an image of themselves as nationalist actors with political ambitions and agenda distinct from JNIM’s ideological jihadi agenda. However, the events of April 2026 severely damaged that distinction.

The attacks, reportedly conducted across six locations in Mali, demonstrated a level of operational coordination between JNIM and the FLA that goes far beyond temporary battlefield convenience. The offensive can also be considered one of FLA’s most symbolic victories since its rebranding, culminating in the recapture of the town of Kidal, located in the northern region of Mali.

A few days after the attack, the Russian Africa Corps confirmed its withdrawal from Kidal alongside Malian troops. Shortly afterwards, the FLA declared the city “free” and announced its control over Kidal, alongside claims that more than 200 soldiers from the Forces Armées Maliennes or the Mali state military, including senior officers and non-commissioned officers, had been captured.

The FLA’s military victory may become its political defeat

However, while coordination with JNIM gave the FLA operational advantages, particularly by expanding attacks beyond its traditional northern strongholds toward central Mali and areas linked to the Malian military establishment, such as Kati, the alliance may prove politically disastrous for the movement in the long term.

The FLA’s long-standing challenge has always been legitimacy. Unlike JNIM, which openly embraces jihadi militancy, the FLA attempted to position itself as a political and military alternative for northern Mali, capable of eventually attracting some degree of international engagement around a quasi-political project rooted in autonomy, marginalization, and ethnic grievances. However, the latest cooperation with JNIM places that political project under serious strain.

Subscribe now

By openly aligning on the battlefield with JNIM, the FLA risks increasingly being viewed internationally not as a nationalist insurgent movement with legitimate demands, but as another component within a broader al-Qaeda-aligned insurgent ecosystem in the central Sahel.

This shift comes at a particularly critical moment because there had been growing debate among analysts over whether JNIM itself could gradually evolve into a more politically pragmatic actor, drawing comparisons with Hay’at Tahrir al-Sham (HTS) in Syria.

The comparison was never baseless. Over the years, HTS gradually rebranded itself from a direct al-Qaeda affiliate into a more locally focused Islamist group, distancing itself publicly from transnational jihadi rhetoric, consolidating governance structures, and ultimately positioning itself as the dominant governing actor in Syria following the collapse of the Assad regime in Damascus.

JNIM has displayed some limited similar changes. The group has increasingly focused on local grievances, tribal mediation, dispute resolution, and forms of shadow governance. In several areas across Mali and Burkina Faso, JNIM has attempted to present itself less as a foreign ideological movement and more as a local actor in charge of resolving conflicts and governance.

However, JNIM has not yet taken the political steps necessary to transform itself into a genuinely pragmatic political actor. Unlike HTS, it has not seriously distanced itself from al-Qaeda central, nor has it attempted meaningful engagement with emerging civilian political movements inside Mali.

This is particularly important given the growing influence of Imam Mahmoud Dicko, one of Mali’s most influential religious and political figures. Dicko has increasingly positioned himself as a civilian alternative to the ruling junta, capable of mobilizing broad anti-government sentiment through religious networks and popular frustration over insecurity and economic decline. Figures surrounding his movement, including political allies and civil society actors, such as Etienne Fakaba Sissoko, have contributed to shaping an emerging opposition that criticizes both military rule and state failure.

AQAP’s message destroyed the illusion of distance

To make matters worse for both JNIM and the FLA’s political narratives, Al-Qaeda in the Arabian Peninsula (AQAP) reportedly congratulated JNIM and the “tribes” following the offensive, effectively framing the events as a victory for the broader al-Qaeda network.

The statement (below) undermined any perception that JNIM is distancing itself from al-Qaeda Central or moving toward an HTS-style transformation.

Instead, AQAP’s messaging reinforces the idea that JNIM remains firmly embedded within the global jihadi architecture despite its increasingly localised rhetoric.

For the FLA, the implications are equally severe as the movement not only failed to distance itself from JNIM but now risks becoming politically inseparable from it in the eyes of external actors.

This would also undermine opportunities the FLA may once have had to build broader political alliances inside Mali itself. Political figures in Bamako, particularly Imam Mahmoud Dicko and his wider movement, could theoretically have offered indirect political pathways toward legitimacy or at minimum broader anti-junta alignment. Instead, the latest offensive may push potential civilian or political allies away from any perceived association with al-Qaeda-linked actors.

Kidal is not necessarily Bamako’s collapse

The withdrawal of Africa Corps and Malian forces from Kidal should not automatically be interpreted as evidence of total strategic collapse or near collapse by Bamako.

The Malian government may instead have calculated that defending Kidal no longer justifies the military and political cost, especially as security threats increasingly shift toward central and southern Mali, including areas strategically closer to Bamako and Kati, where the regime’s actual survival is determined.

Successive Malian governments have lost control of Kidal before without collapsing in Bamako itself. In 2012, the north fell almost entirely out of state control before the French military intervention under Operation Serval, launched at the request of the Malian government, helped restore major northern urban centres from jihadi and rebel control.

From Bamako’s perspective, preserving the regime and protecting strategic southern corridors may matter far more than indefinitely overcommitting resources to an isolated northern stronghold that has historically remained difficult to govern.

Rather than fully engaging militarily in Kidal, Bamako may rely on local allied armed groups, particularly Imghad Tuareg networks associated with General El Hadj Ag Gamou and GATIA.

In many ways, the conflict around Kidal increasingly resembles a struggle between interconnected northern armed networks competing over territory, influence, tribal legitimacy, and historical dominance. The rivalry between Ifoghas-dominated rebel structures historically associated with separatist movements and Imghad-aligned armed groups loyal to Bamako continues to shape much of the region’s security landscape beneath the broader state against insurgency narrative.

From the perspective of Russia’s Africa Corps, deeper involvement in Kidal may increasingly appear less like counterterrorism and more like entering a prolonged tribal war with limited strategic return.

The events of April 2026 may therefore represent both the peak of the FLA’s military resurgence and the beginning of its political decline.

By helping recapture Kidal, JNIM gave the rebels a battlefield victory they had sought for years. But in return, the FLA may have surrendered the very ambiguity that once allowed it to present itself as something other than an armed partner operating alongside al-Qaeda in the Sahel.

Subscribe now

In the ongoing clashes in southern Lebanon, Hezbollah has increasingly relied on FPV (First-Person View) kamikaze drones against the Israel Defense Forces (IDF). These drones, which gained widespread prominence during the Russia–Ukraine war and have since been employed in numerous conflict zones, have become one of Hezbollah’s most frequently used weapons. They have been utilized extensively in attacks targeting both military positions in southern Lebanon and locations in northern Israel.

In attacks carried out using these drones, the group has targeted a wide range of objectives, including Merkava main battle tanks, armored vehicles such as the Namer APC, launchers of Iron Dome air defense systems, military vehicles, and Israeli soldiers.

Read more

Subscribe now

While organizational terrorist networks in Russia have degraded, attack plots continue to stem from individual supporters, munasir foundations, and unofficial groups adapted to the new multi-spatial security environment.

An explosion punctured the silence of an early morning in Moscow on February 24 this year, killing one policeman and injuring two more. In a country fixated on its invasion of Ukraine, the bombing was a reminder that not even two years after the attack on Crocus City Hall, Islamic State’s supporters continue to pose a threat.

The attack was not claimed by Islamic State’s Amaq Agency, but rather by a pro-IS foundation based in the North Caucasus: Nabd al-Salaf al-Qawqazi (NSQ). The munasir (meaning: volunteer) organization claimed the bombing in its periodical The White One from Grozny. This was the first claim of attack responsibility ever made by the group.

Russian media reported that the Moscow police attacker was a 22-year-old native of the Udmurtia Republic. This is an odd profile for IS supporters in Russia, as Udmurt does not have a large Muslim population — this additionally suggests that Russia should move away from its biased investigative profile to focus more on actual supporters, rather than general ethnic groups. Traffic police, however, are a standard target for various armed actors in Russia, due to their characteristically being both more exposed and less armored than other security services.

Share

Read more

Subscribe now

An article released on Tech Haven on June 1 by Al‑Iman Media Center, a new, unofficial Islamic State–linked propaganda outlet, titled “The Alienation of Muslims in China,” offers a stark and highly charged portrayal of the situation facing Uyghur Muslims in China. From its opening lines, which describe “millions of Uyghur Muslims…languish[ing] under the yoke of the most horrific process of identity and religious eradication in the modern era,” the piece signals that it is not simply reporting events, but constructing a sweeping narrative of civilizational conflict, oppression, and religious persecution.

This messaging reflects a broader shift in Islamic State propaganda. Since around 2021, the group and its affiliated media networks have increasingly focused on China, elevating the issue of Uyghur Muslims in their publications and rhetoric. References to “East Turkestan” and depictions of Chinese authorities as central enemy figures in a global struggle have become more frequent, alongside explicit threats and calls for retaliation. The Al‑Iman article fits squarely within this trajectory, amplifying established themes while intensifying their language.

Read more

Subscribe now

Official and volunteer translators of Islamic State (IS) propaganda have made attempts to rebound in 2026, after laying the groundwork in the second half of 2025. Their current drive aims to undo the effects from 18 months of successful counter-terrorist operations that significantly hindered the terrorist organization’s multi-language propaganda output. While groups close to the organizational core of Islamic State have led these efforts, other less recognized and individualistic endeavors have also contributed.

In June 2024, an international law enforcement operation shut down the I’lam Foundation, one of the largest multilingual translators and distributors of pro-IS publications accessible on the surface and dark webs. Before the servers were seized, the I’lam Foundation hosted propaganda in more than thirty languages on its website, including the main languages of Central and South Asia, Africa, foreign fighters (e.g., Albanian, Uyghur, Indonesian), and external operations countries (i.e., English, Spanish, German). I’lam’s closure placed more importance on Fursan al-Tarjuma, a collective of roughly a dozen pro-IS translation foundations.

Fursan al-Tarjuma launched in March 2023 with 14 media foundations translating 18 languages. Most foundations focused on one language, relevant to a province or major foreign fighter group, but IS-Khorasan Province’s (ISKP) Al Azaim Media Foundation translated multiple Central and South Asian languages. Fursan al-Tarjuma is central to the current attempted resurgence.

In the months after I’lam Foundation was shuttered, additional arrests around the world stopped the production and dissemination of propaganda by both “munasir” (meaning: volunteer) and high-profile individuals.

One of the largest contingents of arrested volunteer translators was tied to IS’s Andalus region, referring to the historical Muslim state on the Iberian Peninsula. Most of those arrested or otherwise shut down, however, had resided in Latin America. “Abu Bakar al-Uruguayi,” a 14-year-old supporter, established and promoted multiple Spanish-language and Latin American groups online. He was tied to Thiago José Silva Barboza de Paula, a Brazilian recruiter behind the “Comando860” network active on multiple social media platforms. Finally, a Mexican youth known online as both “YihadAmerica” and “Abu Ibrahim” was twice forced to shutter Spanish-language social media channels in early 2025.

Other media munasirs inhibited by investigations and authorities were based in Europe or North America, translating into Dutch, French, German, or a variety of other languages as part of a volunteer media group.

Read more

Since the beginning of the joint US-Israeli military campaign against Iran in late February and Israel’s subsequent ground operations to dismantle Hezbollah’s presence in southern Lebanon, the Lebanese militant group and major Iranian proxies in Iraq have launched hundreds of attacks targeting both Israeli and US force and installations across the region.

Unsurprisingly, uncrewed aerial vehicles (UAVs) represent a big share of the weapons used in these attacks, following a pattern that consolidated over the past few years. While fixed-wing long-range attack drones such as the Shahed-101/107 and Sayyad-107 remain the predominant platforms, small weaponized first-person view (FPV) quadcopters popularized by the war in Ukraine have finally made their way into the arsenal of these groups and have been used more regularly for tactical strikes across southern Lebanon and in the surroundings of the Iraqi capital, Baghdad.

Share

Hezbollah’s FPV Drone Campaign

The first publicly documented use of FPV drones by Hezbollah emerged in the spring of 2024, but their employment remained sporadic throughout 2024 and the following year, with nine attacks published by the group on its social media channels (the real number is likely higher). These strikes primarily targeted Israeli fixed military installations – including tactical radars and communication towers – along the Israeli-Lebanese border but played a negligible part in the group’s targeting strategy.

Since February of this year, however, Hezbollah has ramped up FPV drone attacks against Israeli mechanized units that have penetrated into southern Lebanon as part of what Israeli authorities defined as “targeted ground operations” to expand the “forward defense area” and “create an additional layer of security for [Israeli] residents of the north.” This author has geolocated 23 out of 25 FPV drone attacks published by Hezbollah since February 28, as shown in the map below. The strikes are distributed along a fairly regular arch from the southwestern Lebanese coast, near the village of Al-Bayada, to areas along the northeastern border with Israel, in the Marjayoun district.

As Israeli forces push deeper into Lebanese territory south of the Litani River, the likelihood of them becoming more exposed to FPV drone strikes will increase. At the same time, recent reports indicate that Israeli forces are also using FPV drones to hunt Hezbollah’s operatives in the border town of Bint-Jbeil, suggesting a cat-and-mouse game between the two sides.

FPV drones provide Hezbollah with a rapidly deployable, cost-effective precision-strike tool for beyond-line-of-sight tactical attacks within the 5-20 km zone, which the group largely lacked previously. Available evidence indicates that these FPV drones are built from off-the-shelf components, with recovered systems equipped with custom 18650 lithium-ion battery packs to extend flight endurance beyond what standard LiPo configurations typically allow. Some of the documented examples feature what appear to be 7/9-inch frames paired with Chinese iFlight XING-family motors, suggesting a focus on balancing payload capacity with maneuverability.

Notably, some FPV drones employed fiber-optic command-and-control links to minimize vulnerability to electronic warfare and signal interception.

These UAVs are frequently equipped with cheap and widely available repurposed PG-7 pattern munitions (or Iranian variants such as the PG7-VL-AT1) and are typically employed in anti-armor and counter-mobility missions against Israeli mechanized units.

Interestingly, the target set remains almost entirely dominated by vehicles, which account for 88% (22 hits) of all FPV strikes. Only two attacks (8%) against buildings hosting Israeli troops near the village of Debel have been documented, and one strike (4%) against Israeli personnel via a munition dropped by a small quadcopter.

Share

Targeted vehicles include Merkava IV main battle tanks (MBT), infantry fighting vehicles (IFV) and armored personnel carriers (APC) such as the Namer, a GRX-8000 high-capacity communication vehicle, light tactical vehicles (LTV), and excavators.

Modus Operandi

An observation of the drone footage released by the group suggests an agile and distributed concept of operations relying on mobile drone crews and pre-positioned munitions stocks and other miscellaneous supplies, in order to cover as much territory as possible. The small size of FPV drones is ideal for this approach, as these systems can be easily concealed and do not entail a large logistic footprint, especially when used in relatively small quantities.

As of the writing of this analysis, documented attacks suggest a low sortie generation capacity among Hezbollah’s ranks, possibly due to a small number of proficient operators. Tactical finesse appears limited, especially when compared to the Ukrainian context, as demonstrated by the suboptimal selection of angle of attacks and target aimpoints, with operators often picking the most accessible area of vehicles rather than the most vulnerable ones, except for a few attacks aimed at weak spots of Israeli vehicles (e.g., rear doors, tracks).

While the extent of damage remains uncertain due to selective video editing and limited post-strike footage, there are some Israeli operational reports of injuries and possible fatalities among Israeli soldiers in armored brigades currently deployed in southern Lebanon, such as the 7^th Brigade.

The use of a fiber-optic command and control link allows Hezbollah’s drone crews to overcome Israeli electronic warfare (EW) countermeasures and operate in irregular and more challenging mountainous terrains that would otherwise impose line-of-sight limitations to common radio-controlled FPV drones.

Overall, small FPV UAVs provide Hezbollah with a much-needed tactical precision strike capability and complement its arsenal of anti-tank guided missiles (ATGMs). Compared to the latter, FPV quadcopters offer greater tactical flexibility and can be used to conduct both reconnaissance and strike missions, including against targets of opportunity. As Israeli forces push deeper into southern Lebanon, this combination of FPV drones and ATGMs will likely increase the attrition among their mechanized units and slow down their advances. However, this author assesses that unless Hezbollah manages to scale FPV drone strikes significantly, the latter’s overall operational impact will remain limited.

While advice and training support from Russia cannot be ruled out, it is also plausible that these capabilities are the result of independent development using domestic expertise and widely available tutorials for drone assembly, configuration, and testing. That said, it is worth remembering that Russian forces trained Assad’s regime loyalists in the use of FPV drones between 2023 and 2024, and it is possible that Hezbollah’s operatives benefited from some knowledge transfer, and even that some of the group’s members received the training themselves.

Iraqi Resistance Groups

Pro-Iran resistance groups in Iraq, in particular the Islamic Resistance in Iraq umbrella and Saraya Awliya al-Dam (Companies of the Guardians of Blood), have also started using weaponized FPV drones against US assets and installations near the Iraqi capital, though less frequently compared to the Lebanese Hezbollah.

Share

This author has recorded eight documented FPV drone attacks, with seven geolocated in the Victory Base complex near Baghdad international airport and one allegedly launched against the main headquarter of the Iraqi National Intelligence.

The video feed’s signal quality visible in published footage suggests that most, if not all, of the drones used were fiber-optic types, while the warheads were likely PG-7 pattern munitions (or similar).

Targets hit include a HH-60M medevac helicopter, one AN/MPQ-64 Sentinel radar, six military shelters and aircraft hangars, and a batch of fuel tanks. The attack launched against the Iraqi National Intelligence on March 21 allegedly consisted of two fiber-optic FPV quadcopters and caused one victim, with one of the drones apparently shot down by security forces (Figure 4).

Overall, observed FPV drone attacks by Iraqi groups indicate basic tactical proficiency, hinting at operators with modest operational experience. In one case, for example, the operators flew the drone back and forth before deciding to strike a reinforced shelter and a hangar, causing little to no damage.

However, in at least one instance, operators deployed two drones simultaneously, with one system providing real-time battle damage assessment (BDA) of the first strike before being flown against another high-value target, thus suggesting a more articulated mission planning as well as sophisticated tactics.

In another case, the Saraya Awliya al-Dam group used a fiber-optic FPV drone to conduct a very low-altitude reconnaissance flight over the US Embassy and diplomatic compound in Baghdad, flying completely unchallenged for several minutes (Figure 6). Such a tactic allows the mapping of potential targets and vulnerable areas for future attacks also in cluttered urban environments and – with fiber-optic drones – it can be countered only via kinetic means, which represent an obvious constraint for the defender in areas with a high risk of collateral damage.

Conclusion

The growing adoption of FPV drones by Hezbollah and pro-Iran Iraqi militias reflects an incremental but notable evolution in their tactical toolkits. These systems offer a relatively low-cost means to conduct precision strikes, expand engagement envelopes, and partially offset adversary advantages in armor and electronic warfare.

However, current evidence points to limited scale, uneven operator proficiency, and modest overall battlefield impact. Furthermore, while systems equipped with fiber-optic command link mitigate EW (electronic warfare) countermeasures and enable operations in contested environments, they do not fundamentally alter the battlefield balance absent a significant increase in deployment rates and tactical refinement.

In Lebanon, and even more so in Iraq, the observed pattern of FPV drones’ operational use suggests a still ongoing learning phase, with basic though gradually improving coordination, targeting, and mission planning. Should Hezbollah and Iranian proxies succeed in scaling production, training, and integration of FPV drones with other capabilities such as ATGMs, mortars, and other fixed wing attack UAVs, these systems will have a more consequential impact in future operations.

Subscribe now

Subscribe now

The bomb begins falling from the left side of the screen as soon as the video starts. The viewer has the perspective of the drone as it looks down at a white pickup truck with a full bed; men standing on the driver’s side of the vehicle appear to be talking, while the bombs gets smaller and smaller before impacting the bed of the truck and detonating. The men on the driver’s side flee as a man in the front passenger seat exits the vehicle and joins his comrades in flight. This is a short video released by the Mexican drug cartel Cárteles Unidos, showing an attack on the Jalisco New Generation Cartel (CJNG). This video, published by the pseudonymous conflict researcher War Noir in August of 2025, provides a glimpse into the emerging, but increasingly complex world of drone use by drug cartels.

Globally, drones have begun emerging in conflict zones around the world, to the point where they are being used, with varying degrees of effect, in every major and most minor, armed conflicts. This includes the use of drones by drug cartels and other transnational criminal organizations (TCOs) across Latin America. While drug cartels and other TCOs have been using drones in various capacities for several years now, innovations in drone technology and tactics have begun to filter out of the warzone in Ukraine and subsequently appearing in Latin America.

Commercial off-the-shelf (COTS) drones have dramatically reshaped how militant organizations globally fight, and cartels and TCOs are no exception. The introduction of relatively cheap, accessible, and easy to fly drones began in January 2013 with the release of the DJI Phantom. The Phantom was the world’s first ready to fly drone that met a low enough price point to reach mass adoption. Quickly, the terrorist group calling itself the Islamic State (IS) began using small, cheap, commercial off-the-shelf (COTS) hobby drones in operations, with this first being documented in 2014, and by no later than 2016 when IS had begun to weaponize them. Weaponization of COTS drones was, and still often is, rudimentary. Especially early on, weaponization focused on grenade dropper type systems, where hand grenades or launcher grenades were dropped from modified COTS drones. These early grenade dropper systems often relied on placing munitions inside of a plastic cup on the bottom of the drone, with the grenade being dropped with an improvised release mechanism.

Since the early days of improvised drones being used by IS, drone warfare has taken substantial leaps — n particular, on the battlefields of Ukraine. For drones, the biggest innovation to come out of the war in Ukraine is the weaponized first-person-view (FPV) drone. Similar to how DJI’s introduction of the Phantom brought the camera drone to the world, FPV drones began to emerge as a COTS technology in 2013 to 2014. The technology was firmly on the global stage with the founding of the Drone Racing League (DRL) in 2015. However, these drones didn’t see substantial mass weaponization until after the full-scale Russian invasion of Ukraine in early 2022. It was not until later in 2022, with mass adoption finally occurring in 2023, that weaponized FPV drones finally began to appear on the battlefield in the now familiar “kamikaze” one-way-attack (OWA) format. The introduction of COTS drones to warzones also invited the introduction of a slew of complementary tools and countermeasures, anging from ground control stations to jammers and spectrum analyzers. Drones have helped usher in a new era of electronic warfare in conjunction with the introduction of cheap air forces.

The most common use of weaponized drones by cartels and TCOs is the grenade dropper. DJI Mavic drones are the most common type of drone that is used in grenade-dropping attacks. This is because of the Mavic’s ubiquity, low cost, and ability to produce enough power in order to carry small payloads. While early IS grenade-dropping drones used improvised dropper systems, today’s purpose-built after-market dropper mechanisms are often advertised on social media sites like Instagram, though often labeled as “water bottle droppers,” and are for sale on sites like Etsy. Grenade dropping attacks may involve actual hand or launcher grenades, or other professionally produced munitions such as mortar rounds, but very often use improvised explosive devices (IEDs). Ultimately, whether a cartel or TCO is using standard or modified factory built grenades of one kind or another, or using IEDs — this likely has to do with a group’s ability to easily obtain munitions or not. Recently, a dropper-style attack was conducted by the Gulf Cartel (CDG) on the house of the mother of the notorious drug kingpin El Chapo Guzman.

While dropper-type drones are seen with some degree of frequency in Latin America, FPV-style attacks are seen much less often. This is because FPV-style attack drones are a much more difficult technology to field effectively. FPV drones typically do not have fly-by-wire software like camera drones do, and therefore are much more difficult to fly. Forums and blogs for new FPV drone enthusiasts often recommend using FPV drone simulator games like Liftoff or Uncrashed for 20-30 hours of gameplay prior to attempting to fly a real FPV drone. This sharp learning curve is just the first major obstacle that cartels and TCOs face when attempting to adopt FPV style drones for attacks. Fuzing, or the technology and components needed to make munitions safe or armed and to detonate the explosives at the right moment, is the next big obstacle. In particular, the most common detonator mechanism for OWA FPV drones in Ukraine is a set of contact wires that cause the munition attached to the drone to explode when the drone impacts a target. Additionally, in Ukraine, OWA FPV drones are often armed with modified mortar rounds. While the available munitions fuzing technology has improved, many FPV drones have still not moved beyond the most primitive types of detonators, and fundamentally, these munitions are extremely dangerous to the individual making them. However, despite the higher degree of skill required to fly them and the greater danger involved in producing an effective munition for arming them, OWA FPV drones are still being used in Latin America. In particular, in August 2025, forces aligned with the Revolutionary Armed Forces of Colombia (FARC) shot down a Columbian Army UH-60 Blackhawk helicopter.

Cartels also use drones for more “mundane” activities such as reconnaissance and smuggling. For 2025, U.S. Customs and Border Protection detected 34,682 drone flights within 500 meters of the U.S.-Mexico border. While some portion of those flights were benign hobbyists or related to some form of legitimate work, many were likely being done in the furtherance of cartel objectives. These objectives could include conducting reconnaissance for illegal border crossings or smuggling contraband across the border. Additionally, drones are being used to smuggle contraband into prisons in Latin America as well as the United States. Notably, in February of 2026, the US Federal Aviation Administration initially shut down air space overEl Paso, Texas because of issues surrounding cartel drone use and the US military’s plans to use a new laser weapon as a countermeasure against those drones.

In particular, the Mexican drug cartel CJNG has been a prolific user of drones in operations in Mexico. CJNG frequently uses drones to conduct reconnaissance operations as well as to strike their opponents, most often other cartels. The Jalisco-based cartel was an early adopter of COTS drone technology, and has been highlighted for being a leading adopter of other innovative technologies as well. Notably, CJNG has been running at least one specialized drone unit since 2023, though possibly since as early as late 2021. This drone unit was responsible for approximately 20 percent of all drone attacks in Mexico from 2021 to 2025. Additionally, CJNG may be starting to adopt OWA FPV drones for attacks, with possible evidence of the adoption of such systems being documented in August 2025.

While the adoption of drone technology does not fundamentally change the conflict between state forces and drug cartels or TCOs, it does create additional layers of danger for police forces, as well as accelerating the ever expanding need for more resources to combat cartels. With cartels using larger and larger numbers of drones, state security forces will be forced to purchase sophisticated electronic warfare technologies that are able to locate, track, and defend against drones, as well as hire and train personnel who are able to operate that technology.

Subscribe now

Subscribe now

Since the Iran conflict started, a mysterious terror group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has appeared practically overnight to claim several attacks against Jewish and American targets in Europe — including the torching of four Jewish charity ambulances in London and an attack at the Israel Center in Nijkerk, Netherlands — while law enforcement has detained up to 15 people in connection with these incidents.

In its released videos and statements, HAYI threatens America, Israel, and Europe while visually modeling itself after pro-Iranian Axis of Resistance groups. But unusual signatures in its public communiques and behavior indicate that HAYI is not an authentic, grassroots Axis group but is instead a fabricated front for a grey zone operation that relies on paid freelancers and/or volunteers to carry out acts of terror and sabotage abroad — a strategy first deployed by Russians and also used by Iran, according to security analysts interviewed for this article.

“Authorities, intelligence agencies, and experts are attempting to determine if this is a case of ‘disposable agents,’” said Colin P. Clarke, executive director of The Soufan Center, in an interview. “Given the rather amateurish nature of some of these attacks, it could be a simple ‘pay-for-play’ scheme where the Iranians are recruiting European youth online and paying nominal fees to conduct these attacks.”

This seems readily apparent in the most recent incident, which occurred in the early morning of March 28 in Paris when police caught a 17-year-old Senegal national attempting to set off an explosive at a Bank of America building. He told investigators he was hired and paid to perform this action via Snapchat. An additional four people were also detained in connection with this attempt. French authorities said HAYI is suspected to be behind this attack due to HAYI mentioning the target in a video posted on March 21.

Some online critics, a few connected to large disinformation networks, have accused pro-Israel agents of involvement due to these attacks only damaging property, occurring at odd hours of the morning and night, and without injuring anyone. Notably, HAYI statements contain errors and use certain phrases that are atypical for such a militant group. As of this article’s publication, the investigation into HAYI is still ongoing, and European law enforcement have released scant evidence that neither proves or disproves this controversial hypothesis; however, officials’ preliminary comments appear to align with analysts’ expert assessment that disposable agents are involved and that these incidents likely have a connection with pro-Iranian operatives.

Still, big questions loom over the organization’s authenticity, origin, and possible motivation. This report examines the publicly available information that HAYI has released thus far — with a special focus on the audio used in its propaganda videos — while also probing whether this “group” has any connection with pro-Iranian Shi’ite Islamists and/or the Islamic Revolutionary Guard Corps, which is known to facilitate attacks abroad. This report also examines the context of these incidents within the broader security landscape of Europe.

Companions of the Right

The full name of the group translates into The Islamic Movement of the Companions of the Right. “Right”, as translated from Arabic, is equivalent to the concept of justness or justice. The group’s logo closely resembles the insignia for Hamas, Hezbollah, and other Iran-aligned Axis of Resistance terror groups: an upright fist holding a firearm while superimposed over a globe. But while every Axis group has AK weapons in its logo, HAYI has a SVD sniper rifle from the Soviet Union in its fist, as pointed out by The Jerusalem Post, a possibly relevant discrepancy.

The first known HAYI-linked attack occurred on the morning of March 9, when unknown assailants bombed the facade of a synagogue in Liege, Belgium. On that same day, HAYI first announced its existence in a statement that circulated on X and Telegram. In addition to quoting Quranic verses, the statement reads “Badr 1 – Badr 2 – Fath 6 – Khaybar 14” — which appear to refer to early battles in Islamic history, such as the conquest of Mecca — with the numbers serving an unknown purpose. Curiously, the statement doesn’t reference the Liege attack at all. A few days later, on March 11, a video surfaced on pro-Iranian online networks showing the Liege attack, which the group then claimed credit for.

Since the March 9 arson, HAYI has claimed several subsequent attacks in Europe: a March 13 arson at a synagogue in Rotterdam, Netherlands that resulted in five people getting detained in connection with the incident; a March 14 attack against a Jewish school in Amsterdam; a March 16 bombing of an office building in Amsterdam; the March 23 torching of four ambulances in the London neighborhood of Golders Green that resulted in two men getting detained for questioning; and the arson attack of a car in Antwerp, Belgium sometime on March 23 and 24 that also saw two minors detained. On April 4, an explosive device was detonated at an Israel Center in the town of Nijkerk in the Netherlands, which HAYI quickly claimed.

There was also the aborted attack at the Bank of America in Paris on March 28, with one person arrested, which investigators strongly suspect was a HAYI target because the group previously mentioned the location in a video. In addition, HAYI claimed an attack in Greece on March 11, but a report from the International Centre for Counter-Terrorism (ICCT) by analyst Julian Lanchès says it was most likely an attack in Rotterdam that happened on March 3.

Each of the incidents were commemorated with videos that HAYI quickly released after the attacks happened. The three exceptions to this pattern: one, the March 9 incident, whose footage was released two days later; two, the suspected Paris attempted bombing in which HAYI released a video targeting the location on March 21 — days before the actual attack on March 28 took place; and three, the so-called Greece attack, which HAYI claimed took place on March 11.

The quality of the propaganda videos that depict these incidents is amateurish: shaky camera work, poor video quality, and the usage of Google maps as visual props. The attacks at most caused minor damage, save for the ambulances in London, and caused zero injuries due to the fact they occurred at odd hours and almost all fell between Friday and Monday early morning hours.

Disposable Agents

The group exhibits certain traits that make it less likely to be an authentic Axis of Resistance group despite HAYI’s overt, conscious decision to emulate them. Two such examples are the amateur-looking videos (jihadist videos are typically slickly produced), the growing number of people getting caught, which suggests a lack of operational security, and that most of the arrested are young men who seemingly have no familial connection with Iran, such as the Senegal suspect of the suspected HAYI Paris attack.

Iran proxy expert and analyst Phillip Smyth said in an interview with Militant Wire: “The low-level types you are describing fit a pattern for Iranian recruitment of individuals to launch low-level attacks for them in Europe,” said Iran proxy expert and analyst Phillip Smyth in an interview with Militant Wire. “They’re going to criminal groups/gangs, younger true believers, and anyone else they can snag. What they’re doing is roping in their attacks (note how they videotape this stuff and send it in) into an overarching front group structure. Higher likelihood a good number of attackers don’t even know that’s how their attacks are being branded.”

This is shown in the case of the possible HAYI-linked Bank of America, Paris incident: the Senegal suspect, who has a drug record, was paid 600 Euros to ignite a homemade explosive, five liters of an unknown liquid fuel with an ignition charge made of a firecracker with 650 grams of explosive powder.

“The low-sophistication modus operandi also matches HAYI’s pattern of using minors and young men for attacks on Jewish and Western targets across Europe since early March 2026,” said Adrian Shtun, associate fellow at International Centre for Counter-Terrorism (ICCT).

Hiring freelancers is a type of grey or hybrid warfare tactic that Russian-linked operatives have done in the past, and which Iran has deployed as well. Iranian officials have been known to hire freelancers, including ones involved with criminal organizations, to carry out acts of terror abroad, such as an unexploded grenade found at an Israeli embassy in Sweden in 2024, which had been linked to gangs. Iran contracts freelancers and criminal organizations in order to maintain plausible deniability from these incidents and cause confusion.

Another clue that dispels the idea that this is an authentic Axis group: HAYI had zero digital footprint prior to March 9, atypical behavior by terror groups, which usually make a big announcement and establish dedicated online channels for their cause before initiating operations. Another clue is that a Telegram channel that styles itself as an official HAYI account only became active this month, even though it was registered back in 2023. This account, which remains active, could not be authenticated.

CBS News got in contact with the anonymous administrator named Asad-Allah of a HAYI Telegram channel, which was advertised on a QR code at the end of one of the HAYI-branded videos, and this suspect raised the Gaza occupation and the war in Iran as justification for its actions while using American English in texts — a relevant detail.

Another unusual feature of this group is its use of AI. Middle East Eye journalists ran HAYI statements through AI detection software and determined that at least one HAYI statement was AI-generated; one block of text was translated into English, Arabic, and Hebrew, and had unusual phrasing for a Shia Muslim terror group to use, such as terms like the “Land of Israel” and “the Gaza war” being mentioned in English. Use of AI may explain why the HAYI logo uses a different rifle in its logo versus an AK and why the word “Islamia” is misspelled in at least one HAYI communique.

Audio Findings

Another atypical signature about HAYI communiques is the group’s use of audio in their videos. Jihadist terror groups have typically used nasheeds as background music, but HAYI uses instrumental music.

For the video depicting the March 14 arson attack of a synagogue in Amsterdam, HAYI used a snippet that was traced to this YouTube clip with the below thumbnail.

First word in the above image has in Arabic موسيقى or “musiqaa” — which means “Music.” Second line of text in the image has in Arabic أولي البأس or “uwli albas” — which means “Those of Might/Valor” — as in those “people of strength/courage” or “the fierce ones.” Another stronger translation is “Men of Might.” This appears to reference Quranic passages Surah Al-Isra’ (17:5) and Surah Al-Fath (48:16). Combined, the text roughly means: “Music of Brave Men” or “ Music of Warriors.”

Caption for the video mentions the Arabic words الإعلام الحربي or al’iielam alharbiu, which means “War Media” or “Military Media,” the music’s publisher. The listed composers are labeled as M Kallas and T Charife. Another significant finding is that the music was first released on September 17, 2024 — the same day as the pager attack against Hezbollah in Lebanon, suggesting this audio has a Hezbollah connection. A search of this clip on TikTok turns up accounts that promote the Iranian regime, Shia Islam, and the Popular Mobilization Front in Iraq.

In another video, the March 16 bombing of an Amsterdam central business building, HAYI used the background music directly lifted from a concert by the Tehran Symphonic Orchestra, specifically the Symphony of the Epic of Khorramshahr by composer Majid Entezami, which commemorates the liberation of the city Khorramshahr from Iraqi occupation during the Iran-Iraq War. Specifically, the video lifts a snippet from the third movement, which is entitled, Preparation for War. HAYI repeated the use of this music in a few other videos, including the one claiming the attack on the Israel Center in the Netherlands.

Who’s Behind HAYI?

A report from the International Centre for Counter-Terrorism points out that four large Telegram accounts — two Iraqi Shia militia-affiliated and the other two being pro-Iranian news — would first share the HAYI videos and statements claiming credit for these attacks, and then a broader network of pro-Iranian influencers would amplify the content’s reach. The pro-Iranian news accounts also shared posts from pro-Russian accounts that have been sanctioned — suggesting a connection or alliance. In addition, one of the Iraqi Shia militia Telegram accounts promotes a militia group that is known to have close ties with IRGC’s Quds Force.

Because of this Iraqi Shia connection and how the videos were first shared before gaining a wider audience, Lucas Webber, co-founder of Militant Wire, said that HAYI and its activities are likely connected with Iraqi Shia militias, who collaborate with the IRGC.

“[L]ooks less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network and experimenting with low-cost, high-visibility operations in Europe,” he told CBS News.

Online critics of Israel have seized the same discrepancies that analysts have pointed out, and that must mean pro-Israeli agents could be involved. The fact that it was networks associated with Iraqi Shia militants that first shared HAYI propaganda goes against this controversial notion. In addition, the curious musical choices may point towards a connection with Iraqi Shia militia groups.

The amateurish nature of the operation has also been seized by anti-Israeli critics as a possible sign of a false flag, but this could be a function of unprofessional saboteurs making clumsy mistakes and use of AI, prone to hallucinations, to generate content and translate text.

In another possible connection with HAYI, ICCT report points out that an unknown person had posted a message on March 7 to a pro-Iranian Iraqi Shia Telegram account that called for “all silent cells” to activate, which a HAYI statement on the Liege attack later referenced.

Europe at Risk

Though these attacks have injured no one, they highlight the risk that Jewish communities (along with American-linked organizations) are facing from Iran-connected terror groups: “[T]he most elevated and complex threat environment the Jewish community and this country has seen in modern history,” according to Kerry Sleeper, the Chief of Threat Management and Information Sharing for the Secure Community Network, a Jewish security organization based in Chicago, in a statement to the Jewish Telegraphic Agency.

These incidents come as Europe deals with a complicated threat environment, amplified by the war in the Middle East. Besides any pro-Iranian or Shi’ite Islam extremist agents, European investigators are also dealing with Sunni jihadists, Russian hybrid attacks, and other ideologically motivated violent extremists from across the spectrum (far-left, far-right, anti-government, etc.), said Clarke.

Case in point, law enforcement recently detained two suspected Iranian spies who were found attempting to infiltrate a nuclear submarine base in Scotland. In addition, the Netherlands saw Mohamed (Mohi) Shafiei, a local police officer and outspoken Iranian dissident, get shot by unknown assailants; Dutch authorities are investigating whether he may have been targeted by pro-Iranian operatives.

As for HAYI, their efforts have followed a regular pattern: attack targets at night or in the morning and avoid casualties. But that may not be the case as the Iran conflict drags on further.

“[T]hings may change, and they may start targeting people, too, during the day, when it’s busy,” said Joe Truzman, senior research analyst and editor at the Foundation for Defense of Democracies, told Fox News Digital.

Subscribe now

Subscribe now

Since the outbreak of the US/Israel–Iran war on February 28, 2026, the Islamic State (IS) has treated the conflict as both a propaganda windfall and an operational opportunity. Through a sequence of Al‑Naba editorials and a renewed tempo of inspired plotting, the group has attempted to reinsert itself into the center of global jihadist dynamics and to re-energize attacks in the Western homelands. IS‑linked attackers have again struck the U.S. homeland, with the Old Dominion University shooting standing out as the most significant successful operation since the January 1, 2025, New Orleans truck attack on Bourbon Street. At the same time, the narrative constructed around the war and Ramadan is explicitly framed as global, which heightens the threat not only to the United States but also to Europe and the broader West, where IS has a long record of exploiting external wars to incite “lone actor” and small‑cell operations. The recently disrupted plot in Spain, linked to IS branches in Somalia and the Sahel, further demonstrates that the current wave of incitement is knitting together multiple regional branches into a threat network that directly targets Europe. The IS Khurasan Province (ISKP) arrest in Italy earlier this year further indicates the continued expansion of the organization’s more multivectored external operations strategy and threat to the West.

IS Incitement Propaganda and Operational Momentum Leading Up to the Conflict
In the months leading up to the US/Israel vs Iran conflict, the Islamic State’s 2025 attack and plot campaign created a foundation for intensified calls for violence against Jews, Christians, and the wider Western public across North America, Europe, and the Pacific. From New Orleans and Bondi Beach to Villach, Berlin, Mulhouse, Bielefeld, Manchester, and disrupted conspiracies in the United States, Europe, and Turkey, the group repeatedly targeted religious holidays, memorials, markets, nightlife districts, and other soft targets, thus turning Christmas, New Year, and Jewish festivals into focal points for terror. Bondi, the Hanukkah mass shooting at Sydney’s waterfront that killed 15 and injured more than 40 on December 14, 2025, became both the apex of this wave and a springboard for renewed incitement in early 2026, as IS media and supporter channels treated it as a model for lone‑actor and small‑cell operations.

Al‑Naba quickly codified Bondi’s significance. “The Pride of Sydney” celebrated the “glorious deed of Sydney,” boasted that “the Jews are bleeding in Australia’s streets,” and urged believers who had absorbed IS’ “jihadist code” online to attack Jews and “Crusaders” at festivals and gatherings, presenting online guidance as sufficient for a single reader to “set out like the whirlwind” against synagogues, churches, and holiday crowds. A subsequent editorial, “The Season of Terrorism,” framed Christmas, New Year, and Jewish holidays as a “season of terror and anxiety” for “Crusader” societies, argued that heightened security and disrupted celebrations showed the battle had been “transferred to their homes,” and urged low‑tech violence such as vehicle rammings and attacks with heavy tools so that “there be a kill with every blow.” These texts explicitly folded Jews and Christians into a single enemy category “from Yobi to Bondi” and treated any Western crowd as legitimate blood.

Read more

Subscribe now

It had previously been identified and examined as one of the kamikaze drones (One-Way Attack UAVs, OWA-UAVs) employed by pro-Iranian groups in their recent attacks. (Articles: Kamikaze Drones Used by Pro-Iranian Militant Groups in Iraq and Lebanon and Islamic Resistance in Iraq Using Stealth Kamikaze Drones)

The first guided missile to be introduced in the conflict was a short-range ballistic missile known as “The Striker” (Arabic: “Al-Qāriʿ”). It initially appeared in propaganda footage released by “Guardians of Blood Brigades” (Arabic: “Saraya Awliya al-Dam”), a subgroup affiliated with the Islamic Resistance in Iraq. In the following period, it was used in attacks targeting U.S. bases in Iraq during the escalation of hostilities in the region.

Read more

Subscribe now

After the Islamic State-inspired attack at Bondi Beach in Sydney, Australia, on December 14, 2025, the deadliest terror attack in the country, there was talk about the potential resurgence of the Islamic State Southeast Asia Province (ISEAP).

The links between ISEAP and the attack have been drawn from the fact that the two perpetrators visited the Philippines a month before conducting the operation.

The Philippines was a hot spot for ISEAP in the mid-to-late 2010s; it was even the location where over 1,000 pro-Islamic State fighters attempted to take over the city of Marawi in the country’s south for five months. This was an attempt to establish a wilayah, or province, in Southeast Asia in 2017. The siege was unsuccessful, and Marawi was retaken by the Armed Forces of the Philippines (AFP). Remnants of pro-IS groups are still active in the Philippines, though they barely have a foothold now. This has led to perceptions that the Sydney attack perpetrators potentially linked up with some of these pro-IS remnants for training or logistical support before their attack.

Australian police are now stating that the Sydney perpetrators acted on their own volition and were not part of a wider network; however, they are still investigating why they were in the Philippines, in a region previously occupied by IS fighters and presumably with remnants and sympathizers still present.

ISEAP in the Philippines Today

The ISEAP, as a cohesive organization, is essentially defunct in the Philippines, Indonesia, and Malaysia, where it had varying degrees of presence and activities. Online chatter by pro-IS supporters continues to suggest that the ISEAP and the smaller groups forming it are present and active, yet that is not true. Security forces in all the aforementioned countries have significantly cracked down on these groups and networks to the extent that the earlier regional coordination and cooperation between pro-IS groups is essentially zero.

Referring specifically to the Philippines, where the IS attempted to form a province following calls from IS-Central in Syria and Iraq, the threat of pro-IS groups has been relegated back to being lower than the threat from the communist New People’s Army (which is the longest-running insurgency in the world, currently). Even the communist threat has been diminished significantly in the Philippines, highlighting how the pro-IS remnants there are essentially unable to organize under the IS banner. There is no IS resurgence in the Philippines; the activity levels of anti-government Islamist groups are at their lowest in decades, and it is a far cry from IS-affiliated groups in West Africa, for example.

In the Philippines, there were three major IS groups (with various factions): the Maute Group, the Bangsamoro Islamic Freedom Fighters (BIFF), and the Abu Sayyaf Group (ASG). The ISEAP emir would often be picked from one of these groups following the killing of the preceding emir. Today, all of these groups fall under the banner of Dawlah Islamiyah, or the Islamic State. Taking a closer look, however, indicates how far these groups have deteriorated in capabilities. The ASG has essentially been decimated after over two decades of terror and historical ties to Al-Qaeda and major terror groups in Indonesia, such as the Jemaah Islamiyah and Jamaat Ansharut Daulah. The ASG was notorious for kidnapping and operating in the Sulu archipelago. There has been no kidnapping since January 2020, and as of last year, the ASG splinter groups have also seemed to have faded away. The Maute Group, which largely led and funded the Marawi siege, is also a sliver of what it once was, and possibly standing on its last legs. BIFF is in a similar position; last year, a BIFF sub-leader, his brother, and his son were killed in a clash with the AFP.

While a large part of the fading presence of IS groups in the Philippines is due to the AFP’s actions, it also comes from the government’s wider movement to integrate disenfranchised Muslim Moro communities who live in Mindanao and were part of groups like the Moro Islamic Liberation Front (MILF). At one point, MILF was a major internal security threat in the Philippines, but following a peace agreement and normalization, the MILF and the AFP have worked together to counter the more radical Islamist pro-IS groups that fall under Dawlah Islamiyah.

As such, recent characterizations of the Philippines and Mindanao, especially as a terror hot-spot, are false and disingenuous; the ISEAP is defunct, and the groups that comprised it are struggling to survive.

Subscribe now

Subscribe now

On March 25, 2026, Morocco dismantled an Islamic State (IS)‑affiliated cell operating across its northern cities and Spain — an operation that offers a concrete glimpse of how Islamic State Somalia (IS‑S) is becoming embedded in a wider ecosystem of transnational support structures that stretch from East Africa to Europe. While the underlying case centers on a joint Moroccan-Spanish operation led by Morocco’s Central Bureau of Judicial Investigations and Spanish security services, it also illustrates the kind of recruitment, online indoctrination, and travel facilitation pipelines that IS‑S increasingly seeks to exploit as it internationalizes and looks beyond its Puntland strongholds towards North African and European networks. In this sense, the March 2026 Morocco-Spain cell can be read as part of the broader architecture through which IS‑S content circulates into diaspora communities, sympathizers seek to move toward active combat zones, and intermediaries help connect would‑be recruits to Islamic State nodes abroad, including in Somalia.

Viewed through the lens of IS‑S’s evolution, the activities described in this case underscore three overlapping threat vectors: external operations, guided plots, and inspired attacks. External operations become more plausible as cells in Morocco and Spain develop the capability to channel money, recruits, or operational information to and from hubs like IS‑S, effectively serving as forward extensions of a Somalia-centered command and facilitation system. Guided plots are enabled when individuals in such cells receive direction, encouragement, or technical input from actors linked to IS‑S, whether on target selection, timing, or attack methods, turning local networks into instruments of a geographically distant leadership. Finally, the focus on propaganda, online radicalization, and recruitment highlights the enduring risk of inspired attacks, in which self‑radicalized supporters in Morocco, Spain, or elsewhere in Europe consume IS‑S branded or aligned content and then act on its calls to violence without direct tasking, making the March 2026 Moroccan-Spanish case a warning sign of how IS‑S’s growing reach into European spaces can translate into diverse and hard-to-predict attack scenarios. Examining this case also serves as an entry point to have a closer examination of how IS‑S itself emerged and evolved into a pivotal node within the global Islamic State movement.

IS-S has evolved from a small splinter group in Puntland into one of the most strategically important components of the international Islamic State organization and global movement, but this rise now coincides with heavy military pressure and battlefield losses. Since late 2024, a large-scale Puntland campaign, often referred to as Operation Hilaac and backed by U.S. airpower and other international support, has overrun key strongholds in the Cal Miskaad and Al Miskad mountains, killed hundreds of fighters including many foreigners, captured senior commanders, and reduced IS‑S’s territorial presence in Bari region by well over half according to Puntland officials, forcing surviving cadres into scattered hideouts and stressing the group’s command and control and recruitment pipelines. Yet even as a heavily degraded IS‑S absorbs these losses on the ground, it continues to operate as a regional and transnational command, financial, and propaganda hub with a history of international recruitment, overseas facilitation, and plots, and this combination of attrition at home and persistence in its transnational functions underpins its emerging role as a concrete external operations threat, particularly to Europe and North America.

Historical Background on IS-S’s Internationalization
IS‑S emerged in October 2015 when Abdulqadir Mumin defected from al-Shabaab with roughly thirty fighters in Puntland and pledged allegiance to the Islamic State’s central leadership. Initially a marginal faction, its prominence rose after it briefly captured the port town of Qandala in 2016 and was recognized as a province in 2017. It consolidated two main operational zones: mountain strongholds in Puntland’s Al Madow range and urban cells in Mogadishu, from which it has conducted dozens of attacks annually against Somali security forces, Puntland units, AU missions, and government officials. Despite a modest manpower estimate of 500 to 700 fighters, IS‑S’s strategic importance has grown disproportionately to its size because it increasingly functions as a regional hub for coordination, finance, and transnational recruitment.

This transformation centers on the Al Karrar regional office, established in northern Somalia by late 2018 under Mumin’s leadership. Al Karrar acts as a combined command and financial center responsible for Islamic State activity across eastern, central, and southern Africa, including Islamic State Central Africa Province in the Democratic Republic of Congo and the Mozambique Province. United States and United Nations reporting now describe Al Karrar as one of the movement’s most important leadership and revenue generation structures worldwide, with some assessments suggesting that Mumin may hold a broader global role beyond Somalia.

Read more

Subscribe now

The recent resurgence of fighting in northern Mozambique is once again triggering alarms among observers. Attempts to resolve the violence are threatened by politics from elsewhere in Africa.

Data recently released by ACLED’s Mozambique Conflict Monitor for the first two weeks of March 2026 paint a somewhat bleak picture for the region. During the period covered, there were at least five incidents of political violence documented in the country. These resulted in the deaths of around 30 people, with at least two of the fatalities being civilians. The Islamic State Mozambique (ISM) was found to have been behind four additional events across Mozambique.

The numbers for the length of the insurgency may show why the interest in the country appears to be lackluster, to place it mildly. Since October 1, 2017, there have been a total of 2,338 acts of violence in Cabo Delgado. A total of 6,498 fatalities have occurred, with 2,721 of the deaths being civilians. ISM has launched 2,168 recorded attacks across the rest of the country. The situation in northern Mozambique is drawing some interest now in Washington.

It appears that an attempt by the Mozambican security forces to drive militants from the Catapu Forest Reserve in early February 2026 failed. Subsequently, the militants have been able to use the forest as a base of operations. Their presence in the forest also gives the militants the ability to contest control of the N380 Motorway. This is a major economic lifeline in the province, and militants’ ability to interrupt normal traffic flows presents a serious challenge to the government to provide services to the citizens, let alone disrupting commerce.

Recently, other events outside Mozambique may impact how the country will address this situation. Over the last couple of years, Rwanda has been a major security partner for the Mozambique government. In recent weeks, events regarding the situation in the Democratic Republic of Congo may modify if not end the Rwandan role in combating this insurgency.

The Rwandan presence in Mozambique has been underwritten by the EU since 2022 for 20 million Euros, or 23 million US Dollars. Earlier this month, the EU announced that after the current funding expires in May 2026, it would not renew the funding. The timing of this announcement is interesting to say the least. It comes after the U.S. has sanctioned the Rwandan military for not implementing the Washington Accords. This deal is designed to restore peace and improve the economies of both countries. It is fair to assume that the sanctions may have inspired the EU decision to halt funding to the Rwandan mission. The Rwandan military has stated that if the funding is not restored, it will then withdraw their troops from Mozambique.

This move places Mozambique’s Maputo in a precarious state. It still has an insurgency raging in its northeast, and the major ally that was aiding in counterinsurgency operations is having its funding cease over another issue in Central Africa.

The President of Mozambique, Daniel Chapo, has travelled to Brussels in order to have the funding restored. Currently, there are no reports on whether this trip will be successful. We might not find out the answer until June. Stalled funding is sure to give ISM time to rest and regroup for a new offensive.

Subscribe now

Subscribe now

On the night of March 11 to 12, fighters linked to the Islamic State Central Africa Province (ISCAP) mounted a coordinated assault on Chinese gold mining facilities in Muchacha and nearby Mavuvu in Mambasa territory, Ituri province, in northeastern Democratic Republic of Congo (DRC). People were killed or kidnapped while others fled the area. This ISCAP attack on Chinese run-mining sites in the DRC is notable not only for its brutality, but because it may mark an expansion of Islamic State’s anti-China campaign from Asia into Africa, where previous IS attacks on Chinese interests and nationals have been almost exclusively concentrated in South and Central Asia. The operation in northeastern Ituri therefore needs to be read alongside a nearly decade-long record of Islamic State (IS), and especially Islamic State Khorasan Province (ISKP), targeting Chinese nationals, projects, and symbols as part of a broader propaganda and operational strategy that casts China as both an oppressor of Muslims in Xinjiang and an exploitative power across conflict-affected regions. Furthermore, it marks the second IS attack against Chinese interests in less than two months — the other being a suicide bombing in Kabul in mid January.

For this latest attack, soldiers from the Allied Democratic Forces (ADF), which had pledged allegiance to ISCAP, mounted the assault in Ituri. Targets included installations linked to the Chinese Kimia or Kimiya Mining Enterprise and MCC Resources, which operate industrial gold sites in the area. The attackers first struck Congolese army positions guarding the perimeter, then overran the mine itself, according to official statements and subsequent reporting. Islamic State propaganda released soon after claimed responsibility and circulated photographs showing fighters attacking the barracks, entering the Chinese-run site, torching vehicles and heavy equipment, and burning workers’ living quarters and camp structures. Images and local reports described extensive destruction: trucks, tractors, processing infrastructure, accommodation blocks burnt, and with the Muchacha site left heavily damaged.

Read more

Subscribe now

It had previously been identified and examined as one of the kamikaze drones (One-Way Attack UAVs, OWA-UAVs) employed by pro-Iranian groups in their recent attacks. (Article: Kamikaze Drones Used by Pro-Iranian Militant Groups in Iraq and Lebanon)

More recently, the Islamic Resistance in Iraq (IRI) has begun employing a new model of kamikaze drones. These drones are the Iranian-manufactured “Hadid-110”.

Read more

Subscribe now

On January 3, during a U.S. military operation in Caracas supported by the Department of Justice and the Central Intelligence Agency (CIA), Nicolás Maduro and his wife, First Lady Cilia Flores, were captured and transferred to the United States. Maduro was taken into federal custody in New York and is currently held at the Metropolitan Detention Center in Brooklyn. Both have pleaded not guilty.

U.S. prosecutors allege that Maduro, Flores, their son Nicolás Ernesto Maduro Guerra, and several senior officials led a long-running cocaine-trafficking conspiracy, collaborating with drug cartels designated as terrorist organizations. According to the indictment, the group abused positions of public trust and corrupted state institutions to move tons of cocaine into the United States as part of what authorities describe as a “narcoterrorism” operation.

The 25-page indictment filed in the Southern District of New York claims the scheme began in 1999, when Maduro entered public office, and involved systematic drug trafficking, violence, and intimidation.

Prosecutors allege Flores accepted hundreds of thousands of dollars in bribes in exchange for facilitating drug shipments and that the couple used state-backed gangs to enforce their operation through kidnappings, beatings, and killings.

Maduro’s son is accused of transporting drug shipments via military flights to Margarita Island and of helping arrange large-scale cocaine shipments to Miami and New York, including discussions about routing lower-quality cocaine to New York and concealing drugs in cargo and scrap-metal containers.

Also charged are current and former interior ministers Diosdado Cabello Rondón and Ramón Rodríguez Chacín. Cabello is accused of coordinating cocaine shipments with Colombian traffickers bound for Mexico and the U.S., while Rodríguez Chacín allegedly sheltered FARC operatives and accepted bribes to protect them.

All defendants are accused of having partnered with narco-terrorist organizations, including Colombia’s Revolutionary Armed Forces of Colombia (FARC), the National Liberation Army (ELN), Mexico’s Sinaloa Cartel and Los Zetas, as well as the Venezuelan criminal group Tren de Aragua (TdA). The indictment also names TdA’s leader, Héctor Rusthenford Guerrero Flores, also known as “Niño Guerrero,” as a co-conspirator. Tren de Aragua is the only Venezuelan criminal organization explicitly cited in the document, underscoring its central role in the narcotics trafficking network.

Since September 2025, President Donald Trump’s administration has struck more than 45 boats found sailing near the shores of Venezuela, with Defense Secretary Pete Hegseth accusing them of smuggling drugs and committing acts of narco-terrorism.

Besides accusations that Venezuela President Nicolas Maduro and his regime are narco-terrorists, Trump and Hegseth have also accused members of Tren de Aragua, Venezuela’s most powerful criminal organization, of using these boats to smuggle drugs and other contraband.

Eliminating TdA could be a tall order due to the nature of the group’s organization and its vast network that reaches beyond Venezuela. What follows is an introduction about TdA’s origins, key figures, its connections with the government, and its activities in the rest of Latin America.

Origins and Growth

Tren de Aragua (TdA), like many other Latin American gangs, was born inside prison, specifically the Tocorón facility in the state of Aragua in Venezuela, from which it takes its name, in 2014. (Tren means train, so the name of the organization is Aragua Train in English.)

In just over a decade, TdA has grown into a transnational criminal organization operating across much of Latin America. Its activities include drug trafficking, extortion, prostitution, migrant smuggling, and control of illegal mining. In February 2025, the Trump administration designated it both a Foreign Terrorist Organization (FTO) and a Specially Designated Global Terrorist (SDGT).

“This brutal criminal group has conducted kidnappings, extorted businesses, bribed public officials, authorized its members to attack and kill U.S. law enforcement,” the U.S. State Department declared in its announcement.

TdA’s rapid expansion across Latin America has been driven by its flexibility and adaptability. It functions as a living organism: a central leadership coexists with semi-autonomous cells. But unlike other criminal organizations, such as First Capital Command (PCC) or Red Command aka Comando Vermelho in Brazil, which both originally emerged inside prisons as movements to defend inmates’ rights, TdA was born out of then-President Hugo Chávez’s 2005 decision to quell prison violence by handing internal control to inmate gang leaders — the pranato.

The case of Luidig Guillermo Ochoa Fajardo is emblematic of the unforeseen results from this decision. Before his release in 2008, he was Tocorón’s second-in-command, known as the “lucero,” controlling three prison floors. He later attempted redemption through an animated series, Prison or Hell, depicting the horrors of incarceration.

“At Tocorón, you either kill, or you’re killed,” he told this reporter in Caracas in 2012.

Two years later, he was murdered—according to his mother, “assassinated by the government.”

In 2014, TdA was born with Héctor Rusthenford Guerrero Flores, better known as Niño Guerrero, as the top leader of the TdA.

Onward, under Guerrero’s leadership, Tocorón prison was transformed from Ochoa’s “hell” into a luxury resort with a swimming pool, zoo, and oyster bar—echoing Pablo Escobar’s style. This strategy created a parallel state, multiplied recruitment, and stockpiled weapons from assault rifles to explosives. From this prison-turned-command center, Guerrero slowly expanded TdA beyond Aragua to the rest of Venezuela, infiltrating local economies through stolen auto parts, black-market food, gambling, extortion of small businesses, and kidnappings for ransom—even targeting Venezuelan migrants abroad, as seen in Mexico and Guatemala.

Since 2018, TdA has imposed brutal control over gold mines and communities in Las Claritas in Venezuela, forcing miners to pay protection fees in gold. Enormous profits were reinvested in weapons, vehicles, and corruption, making gold the group’s primary asset. The organization has also expanded into human smuggling and contraband, capitalizing on the Venezuelan migration crisis in Brazil, Chile, and Peru.

Guerrero, 41, was sentenced in Venezuela to 17 years for murder, human trafficking, and smuggling — credited with turning what began as a small gang into a sprawling hydra-like structure that has expanded across the hemisphere. He has been on the run since September 20, 2023, when a massive police operation involving 11,000 officers retook control of Tocorón prison. Guerrero escaped through a tunnel with the help of corrupt guards and has remained a fugitive ever since. Washington has offered a $5 million reward for his capture.

Political Connections in Venezuela

Political ties have long been a strength. When Tareck El Aissami — later a Maduro minister — was governor of Aragua, he reportedly used TdA as a paid workforce. Evidence has since emerged linking the group directly to Maduro’s entourage. Photographs of dismembered TdA leader Carlos Breaker were found on the phones of the narcosobrinos—Efraín Antonio Campo Flores and Francisco Flores de Freitas, nephews of Maduro’s wife, Cilia Flores. These two nephews were arrested in 2015 in Haiti by the DEA while trying to traffic 800 kilos of cocaine to America. Venezuelan media reported Breaker was executed in 2015: electrocuted and dismembered in an internal feud. American investigators believe the photos and WhatsApp chats show how TdA operated as hitmen for the regime’s illicit interests.

“Under the cover of ideological revolution, Venezuela had in many ways become a criminalized state. The central government maintained its grip on power, but beyond the presidential palace, much of the country had slipped into fiefdoms, given over to political loyalists who could use criminal gangs to enrich themselves as they saw fit,” writes Chris Dalby in his book Tren de Aragua: The Guide to America’s Growing Criminal Threat.

Dalby describes a country where elements of the Bolivarian armed forces morphed into syndicates like the “Cartel of the Suns” — a network of senior military commanders facilitating cocaine exports, protecting cartels, and enriching themselves through drug and gold smuggling.

Even Maduro’s much-publicized 2023 reconquest of Tocorón — with 11,000 troops — was criticized as a sham. According to Infobae, TdA members had been tipped off and escaped through tunnels. Rather than weakening TdA, the operation strengthened it: half its members fled Venezuela along migrant routes to Brazil, Chile, Colombia, and Peru.

A 2024 U.S. Customs and Border Protection intelligence report noted TdA “has expanded its criminal presence throughout Latin America to include Bolivia, Brazil, Chile, Colombia, Costa Rica, Ecuador, Guatemala, Honduras, Panama, Peru, Nicaragua, and Mexico. TdA’s leadership has directed key members to new countries, including the United States and Canada, to oversee new criminal revenue streams.”

Tren de Aragua in Brazil

Brazil is increasingly strategic for TdA because of its proximity to Venezuela’s Bolívar state, where the group has grown its influence over the gold trade. It also reflects TdA’s broader criminal dynamics: exploiting Venezuelan migration flows to move both people and members, while forging strategic criminal alliances to expand power—at the cost of worsening violence statistics. According to the Special Action Group Against Organized Crime (GAECO) in Roraima, Brazil, the number of Venezuelans incarcerated in the state has surged 538 percent in the last six years, representing nine percent of the prison population — rising from 77 inmates in 2018 to more than 400 in 2024.

Brazilian authorities say TdA has also begun infiltrating local prisons, collaborating with Brazil’s largest criminal syndicate, the First Capital Command (PCC), particularly in border states such as Roraima, Amazonas, Paraná, Santa Catarina, and Rio Grande do Sul, to control the flow of people, drugs, gold, and weapons. A 2020 report from Roraima’s state prosecutor’s office had already warned: “There are 740 Venezuelans who are part of the PCC in Roraima,” and “this criminal organization has formed an alliance with the Venezuelan criminal structure Tren de Aragua.”

Guerrero may be hiding in Brazil or transiting through the country on a regular basis, according to Brazilian investigative sources. Guerrero’s possible presence in Brazil may have been facilitated by the porous border with Venezuela and the uncontrolled flow of Venezuelan migrants through the state of Roraima in Brazil, many of whom flee periodically from Nicolás Maduro’s regime.

“It is possible that Niño Guerrero is in Brazil, because all Venezuelans need to cross the border is a self-declaration. They don’t even need to present documents or give their names to immigration officers. They can walk across the border without going through checkpoints. Given the long land border with Venezuela, anyone can enter our territory simply by moving one kilometer away from official posts,” said Wesley Costa de Oliveira, Chief of Staff for the Suppression of Criminal Organizations in Roraima state, in an interview with Brazilian VEJA magazine.

In Boa Vista, Roraima’s capital, authorities arrested Juan Gabriel Rivas Núñez, alias Juancho, in November 2023. Leader of the “Banda Venezolana de Juancho,” a long-established group in southern Bolívar in Venezuela, he worked with TdA in illegal gold trafficking. His organization controlled illegal mining and smuggling in Las Claritas, Venezuela, near the borders with Brazil and Guyana.

Rivas Núñez, a 43-year-old Colombian who obtained Venezuelan nationality and multiple fake identities thanks to government connections, has been accused of murder, arms trafficking, extortion, and violence against indigenous communities, particularly the Arawak. Venezuela requested his extradition, which Brazil’s Supreme Federal Court granted in April 2025. However, he escaped house arrest by giving his electronic ankle monitor to a look-alike decoy. His current whereabouts remain unknown.

Two other top TdA fugitives who may be moving with Guerrero in Brazil are his right-hand man, Yohan José Romero (alias Johan Petrica), and Giovanni Vicente Mosquera Serrano. Petrica, 47, runs the group’s illegal gold mines in Venezuela, especially around Las Claritas, and also supplies TdA with military-grade weapons. In 2018, he appeared in Brazil under his real name to register his son’s birth in Boa Vista, where he owns multiple properties. The United States has offered $4 million for his capture.

Mosquera Serrano, 37, appeared on the FBI’s Ten Most Wanted list in July 2025, accused of coordinating TdA operations ranging from drug and human trafficking to arms smuggling and violent crimes in the U.S. Washington is offering $3 million for his arrest.

Journalist Donna Rísquez, author of the book El Tren de Aragua, has also reported that group co-founder Larry Amaury Álvarez Núñez, alias Larry Changa — who was arrested in Colombia in 2024 while operating in Chile — regularly sent money to Brazil as well as Venezuela and Spain.

Expansion Elsewhere in Latin America

TdA’s expansion into Mexico is especially concerning — for its control over migrant routes, often involving ransom kidnappings, and for its proximity to Mexican cartels. Mexico Security Secretary Omar García Harfuch confirmed in December 2024 that TdA members “are engaged in sexual exploitation and human trafficking.”

In July 2025, Chilean authorities uncovered 14 shell companies set up between 2020 and 2024 to launder $13.5 million via bank transfers and cryptocurrency. Chilean prosecutor Trinidad Steinert confirmed these profits stemmed from “human trafficking, murders, kidnappings, extortion, migrant smuggling, drug trafficking, and ‘fines’ imposed on anyone entering TdA-controlled territory.”

“What we are seeing is that Tren de Aragua is copying the money-laundering strategies developed by the Sinaloa Cartel or Jalisco New Generation Cartel,” Mexican security analyst David Saucedo told DW.

Analysts believe TdA may also move into synthetic drug markets, where there is more space for new players than in cocaine. In July 2025, Colombian authorities arrested two members wanted by a U.S. federal court in Colorado: Luis Alejandro Enríquez Charaima, alias Álex, and Luis Fernando Uribe Torrealba, alias Luisito. They are accused of arms trafficking, conspiracy, synthetic drug trafficking, and theft. They were caught in Medellín preparing tusi (known as “pink cocaine”). Colombian authorities said their goal was to expand TdA’s operations in the U.S., setting up clandestine labs for tusi and ketamine.

Though no evidence currently links TdA to Chinese organized crime, particularly the Bang de Fujian, Chile may become a hub for future alliances — not only in synthetic drug trafficking but also in laundering illicit proceeds. Chile’s Public Prosecutor’s Office reports that more than 400 organized crime groups now operate in the country, from Mexican cartels to Chinese mafias, alongside the PCC, Comando Vermelho, Colombia’s ELN, and the FARC. This crowded criminal landscape will almost certainly fuel TdA’s growth unless international cooperation improves through constant intelligence sharing and joint enforcement operations.

Strategic Implications

The new U.S. strategy is already reshaping the tactics of criminal organizations operating across the region. Instead of relying on high-speed “go-fast” boats — now increasingly vulnerable to drones and precision strikes — trafficking networks are dispersing shipments across multiple smaller, low-profile vessels.

At the same time, the use of semi-submersibles and narco-submarines, which are far more difficult to detect by radar or aerial surveillance, appears to be rising.

In February, Colombian authorities intercepted a semi-submersible carrying nearly ten tons of cocaine and arrested its four-member crew. The shift is also affecting trafficking routes. Land corridors are once again gaining importance, particularly those running through Colombia, Central America, and Mexico — a trend documented in recent investigations by InSight Crime, which note that trafficking groups routinely adapt routes in response to intensified maritime interdiction.

Should traffickers increasingly rely on commercial shipping — concealing cocaine in cargo containers rather than transporting it aboard smuggling vessels — criminal networks are likely to deepen their infiltration of ports and logistics companies. Analysts from the Global Initiative Against Transnational Organized Crime warn that containerized trafficking has become one of the fastest-growing methods used by transnational criminal organizations, precisely because it relies on corruption and infiltration of legitimate trade infrastructure.

The tactical removal of Maduro could further accelerate this transformation. Criminal groups may begin operating more like insurgent networks, with decentralized cells, diversified criminal portfolios, and greater reliance on encrypted communications. Networks linked to the so-called Cartel de los Soles — the military-connected trafficking structure long associated with Venezuela — could fragment into competing factions.

A range of actors, including transnational criminal networks such as Tren de Aragua, armed colectivos and elements of the state apparatus, are likely to compete for control of lucrative territories and illicit markets. The resulting instability could spill across the 2,200-kilometre border with Colombia, where groups such as the National Liberation Army (ELN) and dissident factions of the Revolutionary Armed Forces of Colombia already hold territorial influence.

Subscribe now