Subscribe now

The latest capture of an Islamic State Khorasan Province (ISKP) regional leader is a significant achievement, but it indicates larger questions needed to be asked about the province’s global role in Islamic State (IS).

On June 17, 2026, Turkey’s National Intelligence Organization (MİT) announced the arrest of Ahmet Kazancı. He was captured in Balochistan while crossing into Iran on his way back to Turkey.

Kazancı, also known as Abu Ubeyde and Abu İbrahim, was the apparent successor of Özgür Altun (a.k.a., Abu Yasir al-Turki or, online, “Khurasan.Lion”). Altun, previously ISKP media chief and Turkish logistics handler, was arrested in Pakistan in May 2025. Notably, Kazancı reportedly claims to have communicated with Altun exclusively over Telegram. This highlights the vulnerability of segments of ISKP leadership networks.

Read more

Preamble

The 1989 medfly attack on California agriculture by the Breeders is an interesting example of several disparate strands of terrorism – eco-terrorism, agro-terrorism, and entomological terrorism – coming together. The Breeders were ultimately able to exert economic pressure and the court of public opinion to successfully achieve their goals.

Introduction

While terrorism may be fundamentally defined as the use of violence or threats to intimidate a government or population in the pursuit of ideological, religious, or political goals, it remains a complex and ever-evolving field. As online discourse continues to increase, the possibility of cross-pollination between various modes of extremist thought continues to rise. Narratives, strategies, and beliefs are increasingly spreading between extremists of diverse ideological backgrounds.

The danger of this cross-pollination is that terrorist activities will become increasingly unpredictable. In this article, we demonstrate how a single 1989 terrorist campaign – launched before the Internet, but still influenced by multiple strands of terrorist thought – shows how these intersections of ideology and strategy can become dangerously effective.

Share

Eco-Terrorism: A Returning Threat?

In January 2026, a left-wing, anti-capitalist extremist group known as the Vulkangruppe claimed responsibility for an arson attack on Berlin’s power grid, cutting power to over 45,000 households and 2,000 businesses across the German capital. The group framed the terrorist attack, which included hospitals and retirement homes, as a protest against fossil fuels. This attack is part of a wider-ranging strain of ecoterrorism in Western nations that has persisted for several decades; within the United States, groups such as the Animal Liberation Front (ALF) and Earth Liberation Front (ELF) have committed hundreds of criminal acts and caused damages in the tens of millions of dollars. Previous evidence indicated that eco-terrorism peaked in the 1980s; however the recent attack by Vulkangruppe shows that eco-terrorism remains a disruptive force within the extremist community. Indeed, recent studies have indicated that a number of accelerationist groups – typically focused on attacking energy, transportation, and communication infrastructure – have increasingly begun to incorporate ecological rhetoric within their wider ideologies, influenced by a number of factors including climate change, mass migration, and the influence of figures such as Ted Kaczynski. In 2019 alone, the perpetrators in both the Christchurch, New Zealand and El Paso, Texas shootings released manifestos in which they described themselves as “eco-fascists” and stressed environmental themes. Similarly, the perpetrator of a mass shooting at a Buffalo, New York supermarket in May 2022 claimed that he did the attack in the name of “green nationalism.” An August 2025 paper, published a mere five months before the recent Vulkangruppe attack, specifically noted the worrying trend of radicalization and increasing militancy within the wider German climate protest movement.

Within France, a number of ZADs (“Zones to Defend”) have emerged from the increasingly radicalized environmental movement. In March 2025, a large protest targeted a water reserve meant for agriculture in Sainte-Soline. Protestors were able to sabotage pumps supplying the water reservoir, forcing a costly reconstruction and a constant police presence. Literature including the “L’appel des Soulèvements de la Terre” (”The call for Earth Uprisings”) have circulated through the movement, calling for targeting infrastructure that threatens the environment.

Agro-Terrorism

The deliberate targeting of agriculture in warfare is as old as mankind, from the deliberate “ravaging” of the countryside in the interminable wars of classical Greece, the chevauchée of the Hundred Years War, to the scorched-earth tactics of William Tecumseh Sherman’s “March to the Sea” in the American Civil War. While the mere presence of terrorist activity is enough to substantially reduce local agricultural yields and productivity, agro-terrorism is an often underrated potential security threat. A number of terrorist organizations engage in this behavior; for example, throughout Syria and Iraq, the Islamic State has punished regional farmers that did not pay tribute with extensive crop destruction through arson and expanding wildfires. Throughout 2018, Hamas used a number of incendiary kites, exploding balloons, and even condoms inflated with helium to start fires across Israeli territory, damaging thousands of acres of agricultural land; at the peak of the attacks, 25 fires were reportedly ignited in a single day. While rare, the United States has had occurrences of agro-terrorism in the past. During World War I, German agents deliberately infected over 3500 horses with anthrax and glanders, eliminating them from potential wartime service. Other examples include the sudden death of dozens of cows owned by an African-American group in Ashville, Alabama in 1970, possibly due to a mass cyanide poisoning perpetrated by the Ku Klux Klan. The economic impact of agro-terrorism can be massive; in 1978, when the Arab Revolutionary Council claimed to have poisoned Israeli oranges with mercury, Israeli orange exports collapsed by 40 percent.

American agriculture is an economic juggernaut, with exports of $176 billion in 2024 alone. Unfortunately, this also makes it a tempting target. A number of terrorist organizations have considered attacking the American agricultural sector for decades. In 2002, American forces in Afghanistan discovered thousands of al-Qaeda documents covering US agriculture and potential methods of attacking it. It may even be a target for state actors; in 2024, two Chinese nationals were arrested after being found attempting to smuggle the fungus Fusarium graminearum into the US through the Detroit Metropolitan Airport. While the perpetrators claimed they had smuggled the fungus in for research at the University of Michigan, F. graminearum, known as “head blight” poses a potentially devastating threat to wheat, barley, maize, and rice production.

Share

Entomological Terrorism

The use of insects in warfare stretches back millennia, with the earliest hypothesized use being prehistoric humans throwing nests of stinging insects as early as 100,000 years ago. Entomological terrorism encompasses a wide range of insect species, including pests such as the Mediterranean fruit fly and the durra stem borer, insects that pose a significant risk to crop yields and have the potential to cause vast economic damage. Other proposed uses of entomological terrorism include using insects as disease vectors, such as in Imperial Japan’s deployment of plague-infected fleas across China during World War II, and the Soviet Union’s experimentation with insect vectors during the Cold War. Insects have even been proposed as an unconventional radiological dispersion device (RDD), in which insects contaminated with radiation are released into the civilian population.

Entomological terrorism, while rare, can be performed cheaply and with minimal resources. Insects may be obtained through obtaining samples in the wild or through simple breeding, and quickly deployed at scale.

Entomological terrorism is uniquely suited to furthering agro-terrorism, as insects can spread pathogens among crops and livestock or directly damage them. The economic cost – in terms of lost crop productivity, an increased need for pesticides and veterinary treatment, subsequent trade restrictions, and the administrative burden on local and federal governments – can exponentially compound. Livestock may be targeted through deployment of biting insects such as the screw worm fly or the warble fly. Other invasive pests that could cause significant agricultural damage include the silvery moth – which poses a significant threat to field crops, vegetables, and greenhouses across an estimated 50 percent of the continental United States – and the light brown apple moth, which could pose a threat to fruit production across an estimated 90 percent of theUnited States. In one simulated scenario, a small group of terrorists disguised as tourists successfully spread grape lice throughout the vineyards of California, wiping out two thirds of the state’s wine production and costing the economy over $1 billion.

The 1989 Medfly Attack

Three disparate strands of terrorism – eco-terrorism, agro-terrorism, and entomological terrorism – uniquely came together in 1989. In September of that year, California officials noticed an unusual infestation of the Mediterranean fruit fly, better known as the medfly. Originally indigenous to Africa, the medfly spread to Hawaii in 1910, and has periodically infested California since 1975. The medfly poses a significant threat to agriculture, and is considered the “world’s most destructive pest of fruits,” capable of inflicting astronomical economic losses. It is uniquely adapted to the climate of southern California, which is one of the most productive agricultural regions in the world, and thus poses a significant threat to multiple crops, including oranges, peaches, mangoes, avocadoes, coffee beans, grapefruits, cocoa, and dates.

In 1989, officials discovered a worrying new medfly infestation spreading across the state. As part of the standard treatment at the time, the state used aerial-deployed pesticides in the contaminated regions, due in large part to the severe economic threat that the medfly posed to the region’s citrus production. Malathion, the pesticide that the state used, was a great source of contention for the local environmental community, which had protested its use during an earlier 1980-1982 medfly infestation. Public discourse about the use of malathion at the period was so contentious that B.T. Collins, director of the California Conservation Corps, once drank a small glass of the pesticide on television in an attempt to prove its safety. Despite this, fears about the potential health and environmental effects of aerial spraying lingered. The very visible spraying of malathion from helicopters, even when at a very low dose, was of particular concern to many California suburbanites. The political fallout from spraying campaigns – pitting the interests of farmers against environmental activists – was often intense, and had played a significant role in Governor Jerry Brown’s failed senate campaign in 1982.

Likely radicalized by earlier protests against the use of malathion, a group that called itself the Breeders sent a two-page typewritten letter to the Los Angeles Times. The letter declared that “the biosphere of the planet is on the verge of collapse” and excoriated the state for its use of malathion. Within the letter, the Breeders claimed that they had been deliberately breeding medflies and releasing them within Los Angeles and Orange County since March of that year. The group also threatened to release medflies within the highly productive San Joaquin Valley if the state did not halt its use of aerial pesticides. “Every time the copters go up to spray, we’ll… release a minimum of several thousand blue-eyed Medflies,” the letter threatened.

Share

While a number of officials suspected that the Breeders were a hoax, internal discussion by both state and federal employees strongly suspected that they were a real threat. The medfly infestation was highly unusual, with massive surges in the insect population occurring outside of their normal breeding season, infestations skipping 15 to 20 miles between locations, and adult flies suddenly appearing just outside of areas that had already been sprayed. Forced to react, the state had to expend resources to steadily expand the ever-spreading spraying area; this had the further effect of eroding public support as California citizens became disgruntled with being part of an “entomological war zone.” The Breeders continued to send copies of their letter to various newspapers, further taunting officials throughout the spreading infestation.

Despite investigations by the Los Angeles Police Department and the United States Department of Agriculture’s Office of Inspector General, officials were unable to find any conclusive leads. Aside from the letter, the only further contact from the Breeders was through a brief phone call in response to a classified ad, in which an unknown male simply repeated the threat of further medfly release if any further spraying was done. Wary of further economic damage, the state ultimately announced a two-week delay in further spraying operations. Officials switched tactics from aerial spraying, opting to instead introduce sterile flies into the local population, as well as tightening quarantine procedures. The state’s infestation rapidly declined and finally ended in November 1990. Aside from a handful of minor infestations in 2007 and 2008, there have been no significant outbreaks of the medfly in California since.

A subsequent 2001 study ultimately concluded that the Breeders had been a legitimate attack on California’s agricultural infrastructure. Furthermore, the Breeders’ stated goal of making “aerial spraying politically and financially intolerable” for the state can be viewed as an unqualified success. For over 30 years, there has been no further contact, leads, or physical evidence associated with the Breeders.

Several theories have been proposed to explain how the Breeders successfully spread the infestation. A number of officials theorized that the group was simply breeding medflies “in a garage somewhere in the L.A. basin.” However, medflies are reportedly difficult to rear in captivity. It may have been that the group had only a handful of medflies, but deliberately planted them in fly-catching traps set up by the state, thus tampering with data collection and artificially making the medfly infestation appear exponentially worse. Whether the sabotage was part of a systematic campaign or cunningly localized to a few collection sites, the end result was the same – the Breeders were able to manipulate economic pressure and public opinion to achieve their stated goals. In hindsight, the state got off lightly. Had the group targeted the extremely productive Central Valley, rather than confining its activities to the area surrounding Los Angeles, the economic fallout could have been catastrophic.

Conclusion

The 1989 Breeders medfly infestation is a unique example of three disparate strands of terrorism – eco-terrorism deliberately targeting agricultural production to exert economic pressure, employing the unusual tactic of entomological weaponry – coming together. By any standard, the attack was an unqualified success. No members of the group have ever been identified, and the Breeders were able to successfully bend the state to their will. While agro-terrorism and entomological terrorism fortunately remain rare in the West, the rising tide of eco-terrorism is concerning. The Breeders demonstrate the influence that even small, single-issue groups may exert upon the state. As cross-pollination between various terrorist ideologies increases, so does the future risk of similar attacks occurring.

Bio

Captain Matthew David Turner is a current activity-duty U.S. Army physician. Dr. Turner has long been interested in the intersection of medicine and history, with publications examining historical disease outbreaks, biological and chemical warfare, ancient pathology, toxicology, and military medical lessons. He also writes about the evolving world of counterinsurgency and counterterrorism, including modern conflict medicine and the use of chemical weapons by violent non-state actors. Professional updates are available on LinkedIn.

Subscribe now

Subscribe now

Islamic State–Sahel (IS‑Sahel) has been building out a support corridor that runs from its core zones in the Sahel through northern Morocco into Spain, using small, compartmented structures to cover recruitment, financing, logistics, and external operations (ExOps). This corridor leverages long‑standing smuggling and migration routes as well as dense human and commercial linkages across the Strait of Gibraltar, allowing African IS branches to plug into European spaces with relatively low visibility. IS‑Sahel uses trans‑Saharan trade and criminal infrastructures to support its operations, extending these existing networks into the Western Mediterranean. Recent Islamic State propaganda has explicitly encouraged attacks in North Africa, with a recent editorial in the group’s Arabic‑language weekly al‑Naba calling for operations targeting Morocco and Tunisia as part of a broader campaign to punish states cooperating with Western counterterrorism efforts. This messaging underscores that the Morocco–Spain corridor is embedded in a wider IS strategy that links Sahel battlefields to strike options on both sides of the Mediterranean.

This dynamic was on full display on July 6, 2026, when Morocco’s Central Bureau for Judicial Investigations (BCIJ) announced it had thwarted a plot by a cell loyal to Islamic State’s Sahel branch to strike sensitive sites and security targets inside the kingdom. Coordinated raids across seven cities, Agadir, Taroudant, Casablanca, Hajeb, Tetouan, Fqih Ben Salah, and Safi, led to the arrest of ten suspects who investigators say had sworn allegiance to Islamic State and were taking direct guidance from its Sahel branch. Searches turned up bladed weapons, military-style uniforms, bomb-making instructions, digital files, and chemical precursors, along with a vehicle that had been altered and was believed to be earmarked for a suicide bombing or ramming attack. A separate warehouse yielded butane canisters and pressure cookers, some packed with nails and wired for detonation. BCIJ figures put the number of Moroccans recruited by IS’s African branches in recent years at more than 130, and since the bureau’s founding in 2015, it has broken up dozens of militant cells and detained upward of 1,000 suspected jihadists, though the country’s most recent successful attack dates to 2023, when IS loyalists killed a police officer in Casablanca.

IS‑Sahel and associated IS elements are increasingly using the Morocco–Spain axis, particularly the Tangier–Strait of Gibraltar–Balearic Islands line, as a functional corridor rather than an occasional transit path, integrating financial, logistical, and operational roles across both shores. The March 2026 Morocco–Spain operation that dismantled a three-man cell distributed between Tangier in Morocco and Palma de Mallorca in Spain reveals a more mature architecture — rear area support activities in Morocco directly servicing an attack-planning node inside Spain. The cell’s reported support to IS fighters in both the Sahel and Somalia signals growing convergence between African IS “provinces,” with the Western Mediterranean emerging as a shared support basin. While sustained Spain–Morocco cooperation has driven down the size and sophistication of networks since the mid-2010s, permissive structural factors such as geography, diaspora ties, mixed licit and illicit trade, and ubiquitous online radical content ensure that IS‑Sahel‑linked activity will remain resilient and adaptive. Since at least 2014, Moroccan security forces have dismantled dozens of IS‑linked cells that pledged allegiance to the group and were allegedly in the early stages of planning attacks on public buildings, tourist sites, officials, and security forces — demonstrating both the scale of the threat and the capacity of these networks to strike foreign and Western targets inside Morocco and, if left unchecked, across the wider region.

March 2026: The Tangier–Mallorca Cell
In late March 2026, Moroccan and Spanish security services jointly dismantled a small IS‑aligned jihadist cell spanning Tangier and Palma de Mallorca. Two members were arrested in Tangier, while the alleged ringleader was detained in Palma in a coordinated operation involving Morocco’s General Directorate for Territorial Surveillance (DGST) and Spain’s Policía Nacional. Open reporting describes this as a dangerous jihadist cell with clear IS allegiance and a unified operational concept despite its geographic dispersion. The Tangier‑based suspects are reported to have specialized in providing financing and logistical support to IS fighters in the Sahel, Somalia, and other zones south of the Sahara, while the Mallorca‑based member combined intensive online IS propaganda consumption with concrete attack planning in Spain using methods inspired by “individual terrorism.” The case shows that a single, compact network can simultaneously fund African IS branches and prepare a lone actor-style operation in Spain, illustrating how IS‑Sahel and IS‑Somalia are now plugged into the Iberian theater through Morocco.

February 2025: “Lions of the Caliphate” Cell in Morocco
In February 2025, Morocco’s Bureau Central d’Investigation Judiciaire (BCIJ) announced the dismantling of a roughly 12-man network spread across nine cities —including Casablanca, Fez, Tangier, and Errachidia —that it said was operating on behalf of Islamic State’s Sahel Province. Moroccan officials described the group, which referred to itself as the “Lions of the Caliphate in the Maghreb,” as an external project of IS‑Sahel leadership designed to establish a durable operational wing in Morocco. Raids uncovered a concealed rear base in mountainous terrain near the Algerian border stocked with weapons, explosive components, and training material. Authorities said the network was preparing remotely detonated bomb attacks on Moroccan targets under direct guidance from IS‑Sahel commanders. The head of BCIJ, Cherkaoui Habboub, publicly argued that the case showed IS‑Sahel seeking both to entrench itself inside Morocco and to draw Moroccan recruits into Sahel and Somali battlefields, noting that the group “does not hide its desire to target Morocco” in its propaganda.

Read more

Subscribe now

During the war that began between Iran and the Israeli–U.S. coalition, which later expanded into a broader regional conflict, FPV drones found extensive use on the battlefield. In particular, Hezbollah employed these systems with considerable success, as they played a crucial role in carrying out numerous effective attacks against Israeli forces operating in Lebanon.

In addition to Hezbollah, the Islamic Resistance in Iraq also employed FPV kamikaze drones on several occasions. Although such attacks were relatively limited in number, the group nevertheless carried out a number of strikes against U.S. military bases in the region using these systems.

The Islamic Resistance appears to have used FPV drones for both attack and surveillance purposes. Nearly all drone-related strikes conducted by the group were directed against the U.S. Victory Base in Baghdad. On several occasions, FPV drones were also employed to monitor and observe both the U.S. Embassy and Victory Base.

Read more

Subscribe now

The Russia-Ukraine War has become synonymous with drone warfare. Online, any mention of the Ukraine War will bring on an onslaught of comments around how cheap and easy-to-use drones have forever changed the nature of war. Regardless of whether the fundamentals of warfare have been changed by innovations in drones, a new skill set that is in high demand is being forged in the crucible of Ukraine’s east. In particular, skilled drone operators are in high demand, increasingly in the criminal underworld.

Both the Ukrainian and Russian militaries have trained thousands of drone operators, who have then gone on and become seasoned combat drone pilots. However, this is not just a story of soldiers serving their countries. With both Ukraine and Russia accepting foreign volunteers, there are now numerous trained, experienced drone operators who have left military service and gone on to lives outside of the conflict zone. Some of these combat veterans have chosen to use their skills in the service of criminal organizations. Yet others were originally sent to the front by criminal organizations in the first place, in order to gain the desired skills.

The combat drone operator skillset is in high demand with nonstate militant organizations, ranging from rebel groups to criminal syndicates. There is an increasing number of nonstate militant organizations that are using drones in attacks against both agents of the state as well as opposing nonstate actors. These organizations include the Marxist-Leninist National Liberation Army (ELN) in Colombia, the Jalisco New Generation Cartel (CJNG) in Mexico, and Chinland Defense Force rebel group in Myanmar, among others. Analysts are paying attention to the growing nonstate use of combat drones because of the asymmetric impacts that effective combat drone use can have on both states and other nonstate actors. As the nonstate use of combat drones increases, the market for skilled and seasoned drone operators will also continue to expand.

The Foreign Volunteer Pipeline

The Ukraine War has already attracted thousands of foreign fighters to both sides. Early in 2022, the Armed Forces of Ukraine (AFU) stood up its International Legion specifically to provide foreign volunteers an easy onramp to service in the Ukrainian military and attract more volunteers in the future. While the Ukrainian government does not release official figures, it is likely that at least 15,000 foreign fighters have served with the AFU. For the Russians, at least 27,000 foreign fighters have served in the Russian military in Ukraine since the start of the full-scale war, with the Russian government seeking to recruit an additional 18,500 foreigners to serve in 2026 alone.

In both the Ukrainian and Russian militaries, foreign fighters fill a number of roles, including many that have nothing to do with drone operation. However, with drones having become such a significant part of the order of battle in both countries’ militaries, a substantial number of the foreign fighters do become drone operators. In 2025 alone, Ukraine trained over 50,000 drone operators, and that same year, Russia had at least 80,000 soldiers serving in drone units.

In this hothouse of drone innovation, both technological and tactical, criminal and rebel groups have seen the opportunity to increase their capabilities by either sending existing members to serve in the Ukrainian or Russian militaries, recruiting returned fighters into their organizations, or otherwise to purchase the services of returned fighters on a mercenary basis. Currently, criminal organizations are pursuing all three paths of bringing skilled drone operators into their organizations, but some notable examples of criminal organizations sending existing members to Ukraine to gain desired skills include a Mexican national with likely connections to the Zetas crime syndicate and at least three former Revolutionary Armed Forces of Colombia (FARC) fighters, all of whom were rooted out of the AFU by the Security Service of Ukraine (SBU).

Ukraine War Veterans Bring Critical Skills to Criminal Organizations

Veterans of the Ukraine War can bring critical skills to criminal organizations. Effective drone operators are time-intensive and expensive to train, and bringing this knowledge in-house at an accelerated rate via previously trained and seasoned personnel is a high priority for criminal organizations, especially in Latin America. Some particular use cases that drug cartels in Latin America are interested in using drones for include smuggling narcotics across the US-Mexico border, conducting reconnaissance, and attacking rivals.

The skills and knowledge that these war veterans bring include piloting skills, munition payloads, electronic warfare, drone countermeasures, and tactics. A typical introductory drone course has pilots undergoing five weeks of flight training before they’re ready to be sent to the front for further on-the-job training. It is at the front that pilots become truly skilled, accruing hundreds or thousands of flight hours in order to gain proficiency. However, beyond piloting, effective combat use of drones requires additional knowledge, including how to arm them for attack missions. Most armed drones in Ukraine are still using improvised payloads that require craft-modifying munitions using existing munitions such as mortar rounds and rocket-propelled grenades (RPG), a dangerous process where existing munitions are stripped and fuzed in the field. Further knowledge of radio theory, frequencies, and repeaters is critical for operating in environments with hostile electronic warfare and geographies that prevent simple line-of-sight flight. Finally, effectively using drones in combat requires distributed teams where the drone pilot is only a single actor in a larger mission, whether it’s reconnaissance, attack, or logistics, and the knowledge of how to conduct these operations, including what organization to use, is critical for mission success. Already, drones are being used extensively in various parts of Latin America, including for offensive drone attacks, including both FPV and dropper style attacks.

A Ticking Time-Bomb

It is not currently known how widespread the problem is, but with the Ukraine War showing no signs of stopping, there is the very real possibility that the flow of skilled drone operators from the frontlines in Eastern Europe to the black market will continue. Thousands of Latin Americans have already fought on Ukraine’s frontlines. While many have done so honorably, active gang members, cartel sicarios, and want-to-be mercenaries are among those who have fought. As ever-increasing numbers of combat drone operators return from the frontlines of Ukraine, criminal organizations will have an increasing number of potential recruits to select from. Importantly, governments, especially those south of the US-Mexico border, are not prepared to counter the growing drone threat. With this threat in mind, governments may soon begin following returning Ukraine War veterans, especially those with drone combat skills, more closely.

Subscribe now

Subscribe now

Since December 2025, the Islamic State (IS), its Khurasan affiliate (ISKP), and aligned pro-IS media outlets have been waging a coordinated propaganda campaign around the Bondi Beach attack in Sydney, in which a father and son opened fire on a Jewish Hanukkah gathering, killing and wounding approximately 15 people. The campaign repeatedly invokes the Israel-Palestine conflict, framing the attack as retaliation for Israeli actions in Gaza and positioning violence against Jewish civilians in the West as inseparable from the broader struggle over Jerusalem. Across four major publications spanning December 2025 through June 2026, the outlets have moved from an initial celebration of the attack to systematic operational incitement, theological argumentation, and direct calls to replicate attacks against Western targets. Running beneath and alongside the formal publications, and even praise given to the shooters in the IS spokesman’s latest audio address, IS supporter networks have amplified the campaign online, producing unofficial propaganda content, circulating attack footage set to nasheeds, and calling for more media producers to assist prospective attackers. The publications analyzed here are the Islamic State’s al-Naba newspaper (Issues 526 and 527), ISKP’s Khurasan Voice (Issue 48), and the Al-Iman Media Center’s article “Attacks in Australia.” Together, they constitute not a media echo chamber but a division of labor, with each outlet contributing a distinct layer of a unified radicalization architecture.

Al-Naba Issues 526 and 527: Celebration, Incitement, and Operational Doctrine

Al-Naba is the Islamic State’s primary Arabic-language weekly newspaper, and its two editorials responding to Bondi, “The Pride of Sydney” in Issue 526 (December 2025) and “The Season of Terror” in Issue 527 (December 2025), represent the backbone of the campaign. Issue 526 arrived within weeks of the attack; Issue 527 followed six months later, timed to another Western holiday season. Read together, they constitute something close to a campaign manual: the first establishes theological and organizational framing, the second converts that framing into explicit operational guidance.

Issue 526 opens not with celebration of Bondi specifically but with a broader declaration about the IS brand and its relationship to attacks it does not formally claim. The editorial preemptively dismisses the criticism that greets every IS-linked operation: that the group is fraudulent, its claims opportunistic, its attackers misguided, by treating such criticism as confirmation of the attackers’ authenticity:

No operation carried out by the Islamic State in the heart of the lands of the kuffar has ever escaped doubt, accusations, and betrayal: whether the Islamic State officially claimed it, implicitly praised it, or deliberately remained silent and left the enemy confused and hesitant; whether the attackers received direct guidance and support or were merely the product of its incitement and methodology; or whether the targets were murtaddin, Crusaders, or even the accursed Jews. All your heroics, O strangers, will never please the rabble and the mob.

The rhetorical move here is deliberate. By folding all possible responses to an attack (claim, implicit praise, silence) into a single coherent IS strategy, the editorial makes the organization’s relationship to any given operation permanently unfalsifiable. It also pre-insulates future attackers against the community disapproval they will inevitably face. The editorial anticipates condemnation and frames it as spiritual noise.

The editorial’s treatment of the Bondi attack itself is brief but pointed. It presents the attack as the direct product of standing IS doctrine, years of consistent instruction to target Jewish and Christian holiday gatherings, and positions the attackers as men who obeyed where others equivocated:

Today, Jews bleed in the streets of Australia after the zealous answered the call and implemented the recommendations to target holidays and gatherings. They armed themselves with the prophetic method and proceeded without turning back, plunging bareheaded into Hanukkah and turning it into mourning. They did not listen to the voices of the rabble among impostors and fools who spared Jewish blood through methods of weakness and dilution.

The phrase “implemented the recommendations” is significant. IS is not claiming credit for directing the attack; it is claiming credit for the doctrine that shaped it. This is a meaningful distinction. It allows the organization to take organizational credit while maintaining plausible distance from operational involvement, and it signals to prospective attackers that inspiration from IS publications is itself sufficient to constitute membership in the IS project. The editorial makes this explicit when it describes IS’s recruitment model as methodical: the organization, it says, “recruits them methodically, fills them with morale, then throws them into the throat of its enemy, bleeding him and striking him fatally, leaving him unable to escape this nightmare.”

Read more

Subscribe now

In the spaces left uncovered by the collapse of the Syrian state order and the post-Assad political transition, jihadist violence has not disappeared: it has fragmented, adapted, and sectarianized. In this fluid and volatile context, Sarayah Ansar al-Sunnah, a Sunni militant group, represents one of the most emblematic examples of how ideologically rigid yet operationally light micro-insurrections can exert a disproportionate impact on local security and social cohesion.

While remaining a numerically limited player, Sarayah Ansar al-Sunnah has demonstrated a growing ability to combine targeted sectarian violence, structured propaganda, and takfir religious narratives functional to the radicalization and intimidation of minorities. Recent attacks against the Alawite community in Homs, accompanied by a coordinated and stylistically refined communication campaign, confirm that the group does not operate episodically, but according to a coherent logic of symbolic and sectarian escalation. The analytical importance of Sarayah Ansar al-Sunnah lies not so much in its military capabilities, but in its ideological and functional positioning within the Syrian jihadist ecosystem. The group is, in fact, placed in a grey area: formally independent but increasingly aligned, at the doctrinal, communicative, and operational levels, with the Islamic State’s models and vision. This “shadow” does not necessarily imply direct command or organizational fusion but rather suggests strategic convergence that warrants attention.

Developments observed between January and April 2026 confirm the persistence of these patterns, with no evidence of a shift toward higher-intensity operations but continued reliance on targeted sectarian violence and narrative amplification.

Analyzing Sarayah Ansar al-Sunnah, therefore, highlights the evolving nature of Syrian jihadism: less territorial, more cellular, less control-focused, and more sectarian destabilization — underscoring the need for the audience to stay alert to these shifts.

History, Genesis, and Operational Development: From the Birth to the Centrality of Homs

Sarayah Ansar al-Sunnah emerged publicly in early 2025. Still, its appearance was not a sudden event, but rather the result of an underground radicalization process that had matured over the final years of the Syrian conflict. The group was born in a context marked by the disillusionment of more intransigent jihadist sectors with the political and military pragmatism adopted by the de facto authorities in northwestern Syria. In particular, the post-Assad transition and the progressive institutionalization of power have created a fertile space for actors who reject any compromise and demand a purely punitive and sectarian reading of jihad.

From the earliest claims, Sarayah Ansar al-Sunnah presents itself as a decentralized clandestine network, lacking defined territorial control but capable of operating continuously through autonomous cells. This structural choice is not accidental: it allows the group to survive in a highly repressive environment, reducing exposure to counterterrorism operations and making it more difficult to attribute and neutralize its operational capabilities. The rhetoric adopted from the beginning is unequivocal: the group defines itself as an instrument of “justice” against apostates, religious minorities, and alleged collaborators of the old state apparatus. Operationally, the first phase of Sarayah Ansar al-Sunnah’s activity is characterized by low-intensity, high-frequency attacks, predominantly in rural and peripheral areas of Hama, Latakia, and Homs. These involve targeted assassinations, seizures, arson, and acts of intimidation against civilians belonging to Alawite communities and, to a lesser extent, against former members of the security forces.

These operations have a dual function: on the one hand, they consolidate the group’s reputation as a determined sectarian actor; on the other hand, they fuel a narrative of impunity and moral control over the territory, even in the absence of a visible and stable armed presence. As the months pass, Sarayah Ansar al-Sunnah shows a progressive qualitative evolution. The use of improvised explosive devices, initially sporadic, becomes more structured, signaling an accumulation of technical expertise and better logistical organization. In parallel, the group expands its scope of action, demonstrating the ability to strike even in urban settings and in areas formally under government control. This operational leap is accompanied by a growing sophistication of its propaganda, which begins to follow narrative and graphic patterns attributable to the transnational jihadist ecosystem. Within this framework, Homs takes a central role in the group’s strategy. The city and its province represent an ideal environment: a geographical crossroads, an area historically marked by sectarian fractures and, above all, a space characterized by large grey security zones. It is therefore not surprising that Homs has become the main theatre of Sarayah Ansar al-Sunnah’s most significant operations, culminating in the most recent attacks against Alawite targets. In particular, the December 2025 attack by the group represents a turning point. The use of an explosive device within an Alawite place of worship, the immediate claim, and the subsequent multi-layered communication campaign indicate full operational and narrative maturity. The group doesn’t just strike, it constructs a story, pre-emptively defends its religious legitimacy, and places it within a framework of future threat. The violence is not presented as an isolated event, but as part of a campaign destined to intensify.

Taken together, the evolution of Sarayah Ansar al-Sunnah shows the typical trajectory of a contemporary jihadist micro-insurgency: emergence in dissident environments, consolidation through targeted sectarian violence, progressive technical and communicative sophistication, and concentration of operations in symbolically and strategically relevant areas. Homs is not just an operational target, but the laboratory through which the group attempts to demonstrate its relevance and project itself as a credible jihadist actor in the new Syrian landscape.

Recent monitoring in early 2026 indicates that central Syria, particularly Homs and adjacent areas, remains the primary operational environment, with activity characterized by intermittent, recurrent low-signature attacks.

Propaganda and strategic communication

In the case of Sarayah Ansar al-Sunnah, propaganda is not just an accessory but a core element that enhances its operational reach, and emphasizing the importance of the audience monitoring its narrative strategies closely.

Telegram represents the central axis of this ecosystem. The group has gradually abandoned a fragmented, opportunistic dissemination of content to stabilize itself on a network of official and semi-official channels, each with a distinct function: operational demand, ideological dissemination, and doctrinal consolidation. This segmentation allows the group to target different audiences — militants, sympathizers, and external observers — without overlapping communication levels. Stylistically, Sarayah Ansar al-Sunnah’s propaganda shows a clear evolution. The first communiques were essential, sometimes rudimentary. As the months passed, however, the group adopted standardized visual formats, detailed infographics, maps, casualty counts, and structured post-attack narratives. The goal is not only to inform but also to impose an interpretative framework for the event: define the target, justify action, neutralize criticism in advance, and project future threats. The deliberate use of sectarian language as a political tool is particularly relevant. The constant semantic redefinition of objectives, for example, the denial of the “Islamic” nature of the affected Alawite places of worship, is not accidental, but part of a defensive and offensive communication strategy at the same time. Defensive, because it aims to shield the group from accusations of excess or deviation; offensive, because it normalizes violence against specific communities, transforming it into a legitimate religious act. Propaganda is not limited to claims. A recurring element is the publication of names, photographs, and accusations against alleged collaborators of the old regime or members of minorities, creating a sort of “digital proscription list.” This approach has a strong, intimidating effect. It suggests that Sarayah Ansar al-Sunnah also serves as a platform for incitement and indirect coordination, rather than as a rigidly centralized organization.

In short, the group’s strategic communication aims not so much to claim control of the territory, but to control the narrative. It is in this symbolic space that Sarayah Ansar al-Sunnah attempts to compensate for its limited military capacity, presenting itself as a coherent, ideologically pure, and inevitable actor.

Ties and convergences with the Islamic State

The relationship between Sarayah Ansar al-Sunnah and the Islamic State cannot be read in the classical terms of formal affiliation. There is, at present, no public evidence of a direct command, official bay’a, or organizational merger. However, limiting this observation would mean losing sight of the most relevant dynamic: functional and ideological convergence.

On a doctrinal level, the affinities are evident. The vision of takfir, the rejection of any political authority not based on a radical interpretation of Sharia law, and the centrality of sectarian violence as a tool for social purification are elements that fully overlap with the ideological matrix of the Islamic State. Sarayah Ansar al-Sunnah does not simply share these principles: it explicitly reaffirms them in its own texts and religious production.

Even more significant is the convergence at the communicative and organizational levels. The adoption of propaganda models within the Islamic State’s media ecosystem, from the structure of infographics to the language of claims, suggests not only imitation but also recognition of a canon. In jihadist circles, this type of imitation is not neutral: it signals belonging to a very specific tradition and worldview. The same applies to the operational organization. The autonomous cell structure, the emphasis on small groups, the rhetoric of “lone wolves”, and the ability to strike without a visible chain of command mirror models already tested by the Islamic State in Syria in recent years. Sarayah Ansar al-Sunnah appears to move along the same route, adapting it to a smaller scale and a more fragmented context. Particularly indicative is the group’s ambiguous posture towards the Islamic State. The statements in which Sarayah Ansar al-Sunnah states that it is not currently cooperating with IS, while explicitly leaving open the possibility of doing so in the future, are not simple rhetorical formulas. These are calibrated messages - intended for a wider audience: they reassure about formal autonomy but signal ideological compatibility and strategic availability.

In terms of intelligence, this positioning makes Sarayah Ansar al-Sunnah a potential convergence asset. In a scenario of strengthening the Islamic State or further deteriorating security in central Syria, groups like SAS could act as local multipliers, facilitating recruitment, logistics, and social penetration without the need for direct deployment of IS cadres.

In conclusion, the relationship between Sarayah Ansar al-Sunnah and the Islamic State should not be read as a hierarchical relationship, but as a relationship of shadow and reflection. SAS operates in the space vacated by IS, takes up its languages and models, and helps keep alive a jihadist ecosystem that, although fragmented, remains deeply interconnected. No new evidence as of May 2026 indicates formal affiliation with the Islamic State, although ideological and operational convergence remains consistent.

Conclusion: Patterns, Threat Assessment, and Intelligence Outlook. Why Sarayah Ansar al-Sunnah Matters

Sarayah Ansar al-Sunnah’s overall analysis clearly shows that the group cannot be reduced to a mere acronym or to an ephemeral phenomenon linked to the volatility of the post-Assad period. In contrast, Sarayah Ansar al-Sunnah embodies a mature form of jihadist micro-insurgency, designed to operate persistently in an environment characterized by political fragmentation, security vacuums, and unresolved sectarian rifts. The group’s operating patterns are consistent and repetitive. Sarayah Ansar al-Sunnah favors attacks with low tactical complexity but high symbolic value, focusing on carefully selected sectarian targets. The areas of operation, particularly Homs and central Syria, are not random, but respond to a precise geographical and political logic: transition zones, with discontinuous state control, crisscrossed by communal tensions and historically used by jihadist networks as spaces for maneuver and refuge. Another recurring element is the absence of indiscriminate military escalation. The group avoids operations that would require prolonged exposure or a heavy logistical structure, preferring to strike and dissolve quickly. This choice reflects an operational rationality, not a weakness: Sarayah Ansar al-Sunnah does not aim at territorial control, but at the normalization of sectarian violence as a political tool. In this sense, every attack is conceived as a message, rather than a military action in the strict sense.

From a threat perspective, the group does not, at present, pose an existential danger to the survival of the Syrian state or to the national military balance. However, these findings risk being misleading if isolated from context. Sarayah Ansar al-Sunnah’s dangerousness lies not in its ability to conquer territory, but in its function as a chronic sectarian destabilizer. Through a combination of targeted violence and systematic propaganda, the group deepens community fractures, delegitimizes emerging institutions, and helps maintain a climate of widespread insecurity.

In terms of intelligence, Sarayah Ansar al-Sunnah must be read as an intermediate node within the Syrian jihadist ecosystem. Formally autonomous, the group increasingly exhibits marked ideological, organizational, and communicative compatibility with the Islamic State. This convergence does not necessarily imply direct subordination. Still, it increases the likelihood that Sarayah Ansar al-Sunnah could, in the medium term, serve as a local facilitator for more structured jihadist networks, especially in deteriorating security scenarios. A further element of risk is the group’s ability to attract disillusioned militants from other jihadist backgrounds or from groups that have accepted political compromises. In an environment where ideological legitimacy is a central currency, Sarayah Ansar al-Sunnah presents itself as a “pure” actor, untainted by pragmatism or negotiation. This narrative, though extremist, can be attractive to radicalized segments of the fighting population. In the medium term, Sarayah Ansar al-Sunnah is likely to continue operating as a low-visibility but high-impact actor, alternating phases of operational silence with sudden, violent resurfaces, calibrated to maximize media and sectarian effect. Any strengthening of the Islamic State or further weakening of government control in central Syria could significantly amplify the group’s role, transforming it from an autonomous micro-insurgency to a functional component of a broader jihadist strategy.

Current observations through May 2026 reinforce the assessment of Sarayah Ansar al-Sunnah as a persistent, low-visibility actor capable of sustaining sectarian destabilization without transitioning into a higher-order insurgent structure.

In conclusion, Sarayah Ansar al-Sunnah should not be underestimated or overestimated. It is a limited player in capabilities but lucid in strategy, marginal at the military level but central to the dynamics of sectarian radicalization. Ignoring its trajectory would mean losing a key indicator of the evolution of contemporary Syrian jihadism: a less visible, less territorial, but no less dangerous jihadism.

Subscribe now

Subscribe now

On 19 January 2026, Islamic State Khurasan Province (ISKP) carried out an attack on a Chinese restaurant in Kabul, Afghanistan, killing and wounding a number of Chinese nationals. The attack targeted an establishment located in a heavily fortified central district in close proximity to diplomatic and government facilities. ISKP subsequently claimed responsibility and used the operation as the centrepiece of a lengthy propaganda article published in late April in its Voice of Khurasan magazine under the title “Who Will Take Revenge for the Uyghur Muslims.”

The article was structured as both a justification of the January attack and a forward-looking declaration of intent. Opening with a direct address to the broader Islamic community, the magazine framed the operation as an act of religious retribution on behalf of persecuted Uyghur Muslims in Xinjiang, China. ISKP declared:

“First we congratulate the entire Islamic Ummah on this heroic attack by the Islamic State in which lillahilhamd the blood of the Murtad Taliban and communist Chinese was shed together.”

The article went on to address Uyghur Muslims directly, positioning ISKP as their sole defender in the face of Taliban and Pakistani inaction:

“Brothers of the Uyghurs: We answer the cries, wails, sighs, and captivity of your innocent children! Do not grieve; if the Pakistanis and the murtadd Taliban, instead of defending you, sided with the Chinese communists, you are not without brothers! Lillahilhamd, we are your brothers. This attack was a small sample of the revenge and retribution for the Uyghur Muslims; from now on, expect even harder and worse days!”

The broader ideological thrust of the piece was to construct China as a structural and irreconcilable enemy of Islam, delegitimise the Taliban’s governing authority through its engagement with Beijing, and normalise further anti-Chinese violence as a religious obligation. The following analysis examines the key narrative components of the article across six thematic areas.

Construction of China as a Structural Enemy

The text does not treat China as a contingent adversary but as a structurally defined enemy. The article asserts:

“It is clear to the whole world that the Chinese government is a kafir, secular communist regime. It does not accept Islam, it is an enemy of the Khilafah, and it is counted among the staunchest enemies of Islam.”

Read more

Subscribe now

The coordinated attacks carried out across Mali on April 25 may mark one of the most significant turning points in the country’s conflict since the collapse of the 2015 Algiers Peace Agreement and arguably since the battle of Tin Zaouatine in July 2024, where Russian mercenary group Wagner suffered one of its deadliest setbacks in the Sahel. Yet beyond the military implications, the attacks exposed something that for years was denied, downplayed, or deliberately kept ambiguous: the Northern Malian separatist military group Azawad Liberation Front (FLA) and Jama’at Nusrat al-Islam wal-Muslimin (JNIM), al-Qaeda’s branch in the Sahel, are increasingly operating on the same side of the battlefield.

For years, the northern rebel factions that make up FLA attempted to maintain at least a degree of political distance from JNIM. They operated in a deliberate grey zone where tactical coexistence with jihadi actors was widely suspected, but where political separation could still be publicly maintained. While local arrangements, battlefield coordination, and non-aggression agreements were often reported, the rebels consistently attempted to preserve an image of themselves as nationalist actors with political ambitions and agenda distinct from JNIM’s ideological jihadi agenda. However, the events of April 2026 severely damaged that distinction.

The attacks, reportedly conducted across six locations in Mali, demonstrated a level of operational coordination between JNIM and the FLA that goes far beyond temporary battlefield convenience. The offensive can also be considered one of FLA’s most symbolic victories since its rebranding, culminating in the recapture of the town of Kidal, located in the northern region of Mali.

A few days after the attack, the Russian Africa Corps confirmed its withdrawal from Kidal alongside Malian troops. Shortly afterwards, the FLA declared the city “free” and announced its control over Kidal, alongside claims that more than 200 soldiers from the Forces Armées Maliennes or the Mali state military, including senior officers and non-commissioned officers, had been captured.

The FLA’s military victory may become its political defeat

However, while coordination with JNIM gave the FLA operational advantages, particularly by expanding attacks beyond its traditional northern strongholds toward central Mali and areas linked to the Malian military establishment, such as Kati, the alliance may prove politically disastrous for the movement in the long term.

The FLA’s long-standing challenge has always been legitimacy. Unlike JNIM, which openly embraces jihadi militancy, the FLA attempted to position itself as a political and military alternative for northern Mali, capable of eventually attracting some degree of international engagement around a quasi-political project rooted in autonomy, marginalization, and ethnic grievances. However, the latest cooperation with JNIM places that political project under serious strain.

Subscribe now

By openly aligning on the battlefield with JNIM, the FLA risks increasingly being viewed internationally not as a nationalist insurgent movement with legitimate demands, but as another component within a broader al-Qaeda-aligned insurgent ecosystem in the central Sahel.

This shift comes at a particularly critical moment because there had been growing debate among analysts over whether JNIM itself could gradually evolve into a more politically pragmatic actor, drawing comparisons with Hay’at Tahrir al-Sham (HTS) in Syria.

The comparison was never baseless. Over the years, HTS gradually rebranded itself from a direct al-Qaeda affiliate into a more locally focused Islamist group, distancing itself publicly from transnational jihadi rhetoric, consolidating governance structures, and ultimately positioning itself as the dominant governing actor in Syria following the collapse of the Assad regime in Damascus.

JNIM has displayed some limited similar changes. The group has increasingly focused on local grievances, tribal mediation, dispute resolution, and forms of shadow governance. In several areas across Mali and Burkina Faso, JNIM has attempted to present itself less as a foreign ideological movement and more as a local actor in charge of resolving conflicts and governance.

However, JNIM has not yet taken the political steps necessary to transform itself into a genuinely pragmatic political actor. Unlike HTS, it has not seriously distanced itself from al-Qaeda central, nor has it attempted meaningful engagement with emerging civilian political movements inside Mali.

This is particularly important given the growing influence of Imam Mahmoud Dicko, one of Mali’s most influential religious and political figures. Dicko has increasingly positioned himself as a civilian alternative to the ruling junta, capable of mobilizing broad anti-government sentiment through religious networks and popular frustration over insecurity and economic decline. Figures surrounding his movement, including political allies and civil society actors, such as Etienne Fakaba Sissoko, have contributed to shaping an emerging opposition that criticizes both military rule and state failure.

AQAP’s message destroyed the illusion of distance

To make matters worse for both JNIM and the FLA’s political narratives, Al-Qaeda in the Arabian Peninsula (AQAP) reportedly congratulated JNIM and the “tribes” following the offensive, effectively framing the events as a victory for the broader al-Qaeda network.

The statement (below) undermined any perception that JNIM is distancing itself from al-Qaeda Central or moving toward an HTS-style transformation.

Instead, AQAP’s messaging reinforces the idea that JNIM remains firmly embedded within the global jihadi architecture despite its increasingly localised rhetoric.

For the FLA, the implications are equally severe as the movement not only failed to distance itself from JNIM but now risks becoming politically inseparable from it in the eyes of external actors.

This would also undermine opportunities the FLA may once have had to build broader political alliances inside Mali itself. Political figures in Bamako, particularly Imam Mahmoud Dicko and his wider movement, could theoretically have offered indirect political pathways toward legitimacy or at minimum broader anti-junta alignment. Instead, the latest offensive may push potential civilian or political allies away from any perceived association with al-Qaeda-linked actors.

Kidal is not necessarily Bamako’s collapse

The withdrawal of Africa Corps and Malian forces from Kidal should not automatically be interpreted as evidence of total strategic collapse or near collapse by Bamako.

The Malian government may instead have calculated that defending Kidal no longer justifies the military and political cost, especially as security threats increasingly shift toward central and southern Mali, including areas strategically closer to Bamako and Kati, where the regime’s actual survival is determined.

Successive Malian governments have lost control of Kidal before without collapsing in Bamako itself. In 2012, the north fell almost entirely out of state control before the French military intervention under Operation Serval, launched at the request of the Malian government, helped restore major northern urban centres from jihadi and rebel control.

From Bamako’s perspective, preserving the regime and protecting strategic southern corridors may matter far more than indefinitely overcommitting resources to an isolated northern stronghold that has historically remained difficult to govern.

Rather than fully engaging militarily in Kidal, Bamako may rely on local allied armed groups, particularly Imghad Tuareg networks associated with General El Hadj Ag Gamou and GATIA.

In many ways, the conflict around Kidal increasingly resembles a struggle between interconnected northern armed networks competing over territory, influence, tribal legitimacy, and historical dominance. The rivalry between Ifoghas-dominated rebel structures historically associated with separatist movements and Imghad-aligned armed groups loyal to Bamako continues to shape much of the region’s security landscape beneath the broader state against insurgency narrative.

From the perspective of Russia’s Africa Corps, deeper involvement in Kidal may increasingly appear less like counterterrorism and more like entering a prolonged tribal war with limited strategic return.

The events of April 2026 may therefore represent both the peak of the FLA’s military resurgence and the beginning of its political decline.

By helping recapture Kidal, JNIM gave the rebels a battlefield victory they had sought for years. But in return, the FLA may have surrendered the very ambiguity that once allowed it to present itself as something other than an armed partner operating alongside al-Qaeda in the Sahel.

Subscribe now

In the ongoing clashes in southern Lebanon, Hezbollah has increasingly relied on FPV (First-Person View) kamikaze drones against the Israel Defense Forces (IDF). These drones, which gained widespread prominence during the Russia–Ukraine war and have since been employed in numerous conflict zones, have become one of Hezbollah’s most frequently used weapons. They have been utilized extensively in attacks targeting both military positions in southern Lebanon and locations in northern Israel.

In attacks carried out using these drones, the group has targeted a wide range of objectives, including Merkava main battle tanks, armored vehicles such as the Namer APC, launchers of Iron Dome air defense systems, military vehicles, and Israeli soldiers.

Read more

Subscribe now

While organizational terrorist networks in Russia have degraded, attack plots continue to stem from individual supporters, munasir foundations, and unofficial groups adapted to the new multi-spatial security environment.

An explosion punctured the silence of an early morning in Moscow on February 24 this year, killing one policeman and injuring two more. In a country fixated on its invasion of Ukraine, the bombing was a reminder that not even two years after the attack on Crocus City Hall, Islamic State’s supporters continue to pose a threat.

The attack was not claimed by Islamic State’s Amaq Agency, but rather by a pro-IS foundation based in the North Caucasus: Nabd al-Salaf al-Qawqazi (NSQ). The munasir (meaning: volunteer) organization claimed the bombing in its periodical The White One from Grozny. This was the first claim of attack responsibility ever made by the group.

Russian media reported that the Moscow police attacker was a 22-year-old native of the Udmurtia Republic. This is an odd profile for IS supporters in Russia, as Udmurt does not have a large Muslim population — this additionally suggests that Russia should move away from its biased investigative profile to focus more on actual supporters, rather than general ethnic groups. Traffic police, however, are a standard target for various armed actors in Russia, due to their characteristically being both more exposed and less armored than other security services.

Share

Read more

Subscribe now

An article released on Tech Haven on June 1 by Al‑Iman Media Center, a new, unofficial Islamic State–linked propaganda outlet, titled “The Alienation of Muslims in China,” offers a stark and highly charged portrayal of the situation facing Uyghur Muslims in China. From its opening lines, which describe “millions of Uyghur Muslims…languish[ing] under the yoke of the most horrific process of identity and religious eradication in the modern era,” the piece signals that it is not simply reporting events, but constructing a sweeping narrative of civilizational conflict, oppression, and religious persecution.

This messaging reflects a broader shift in Islamic State propaganda. Since around 2021, the group and its affiliated media networks have increasingly focused on China, elevating the issue of Uyghur Muslims in their publications and rhetoric. References to “East Turkestan” and depictions of Chinese authorities as central enemy figures in a global struggle have become more frequent, alongside explicit threats and calls for retaliation. The Al‑Iman article fits squarely within this trajectory, amplifying established themes while intensifying their language.

Read more

Subscribe now

Official and volunteer translators of Islamic State (IS) propaganda have made attempts to rebound in 2026, after laying the groundwork in the second half of 2025. Their current drive aims to undo the effects from 18 months of successful counter-terrorist operations that significantly hindered the terrorist organization’s multi-language propaganda output. While groups close to the organizational core of Islamic State have led these efforts, other less recognized and individualistic endeavors have also contributed.

In June 2024, an international law enforcement operation shut down the I’lam Foundation, one of the largest multilingual translators and distributors of pro-IS publications accessible on the surface and dark webs. Before the servers were seized, the I’lam Foundation hosted propaganda in more than thirty languages on its website, including the main languages of Central and South Asia, Africa, foreign fighters (e.g., Albanian, Uyghur, Indonesian), and external operations countries (i.e., English, Spanish, German). I’lam’s closure placed more importance on Fursan al-Tarjuma, a collective of roughly a dozen pro-IS translation foundations.

Fursan al-Tarjuma launched in March 2023 with 14 media foundations translating 18 languages. Most foundations focused on one language, relevant to a province or major foreign fighter group, but IS-Khorasan Province’s (ISKP) Al Azaim Media Foundation translated multiple Central and South Asian languages. Fursan al-Tarjuma is central to the current attempted resurgence.

In the months after I’lam Foundation was shuttered, additional arrests around the world stopped the production and dissemination of propaganda by both “munasir” (meaning: volunteer) and high-profile individuals.

One of the largest contingents of arrested volunteer translators was tied to IS’s Andalus region, referring to the historical Muslim state on the Iberian Peninsula. Most of those arrested or otherwise shut down, however, had resided in Latin America. “Abu Bakar al-Uruguayi,” a 14-year-old supporter, established and promoted multiple Spanish-language and Latin American groups online. He was tied to Thiago José Silva Barboza de Paula, a Brazilian recruiter behind the “Comando860” network active on multiple social media platforms. Finally, a Mexican youth known online as both “YihadAmerica” and “Abu Ibrahim” was twice forced to shutter Spanish-language social media channels in early 2025.

Other media munasirs inhibited by investigations and authorities were based in Europe or North America, translating into Dutch, French, German, or a variety of other languages as part of a volunteer media group.

Read more

Since the beginning of the joint US-Israeli military campaign against Iran in late February and Israel’s subsequent ground operations to dismantle Hezbollah’s presence in southern Lebanon, the Lebanese militant group and major Iranian proxies in Iraq have launched hundreds of attacks targeting both Israeli and US force and installations across the region.

Unsurprisingly, uncrewed aerial vehicles (UAVs) represent a big share of the weapons used in these attacks, following a pattern that consolidated over the past few years. While fixed-wing long-range attack drones such as the Shahed-101/107 and Sayyad-107 remain the predominant platforms, small weaponized first-person view (FPV) quadcopters popularized by the war in Ukraine have finally made their way into the arsenal of these groups and have been used more regularly for tactical strikes across southern Lebanon and in the surroundings of the Iraqi capital, Baghdad.

Share

Hezbollah’s FPV Drone Campaign

The first publicly documented use of FPV drones by Hezbollah emerged in the spring of 2024, but their employment remained sporadic throughout 2024 and the following year, with nine attacks published by the group on its social media channels (the real number is likely higher). These strikes primarily targeted Israeli fixed military installations – including tactical radars and communication towers – along the Israeli-Lebanese border but played a negligible part in the group’s targeting strategy.

Since February of this year, however, Hezbollah has ramped up FPV drone attacks against Israeli mechanized units that have penetrated into southern Lebanon as part of what Israeli authorities defined as “targeted ground operations” to expand the “forward defense area” and “create an additional layer of security for [Israeli] residents of the north.” This author has geolocated 23 out of 25 FPV drone attacks published by Hezbollah since February 28, as shown in the map below. The strikes are distributed along a fairly regular arch from the southwestern Lebanese coast, near the village of Al-Bayada, to areas along the northeastern border with Israel, in the Marjayoun district.

As Israeli forces push deeper into Lebanese territory south of the Litani River, the likelihood of them becoming more exposed to FPV drone strikes will increase. At the same time, recent reports indicate that Israeli forces are also using FPV drones to hunt Hezbollah’s operatives in the border town of Bint-Jbeil, suggesting a cat-and-mouse game between the two sides.

FPV drones provide Hezbollah with a rapidly deployable, cost-effective precision-strike tool for beyond-line-of-sight tactical attacks within the 5-20 km zone, which the group largely lacked previously. Available evidence indicates that these FPV drones are built from off-the-shelf components, with recovered systems equipped with custom 18650 lithium-ion battery packs to extend flight endurance beyond what standard LiPo configurations typically allow. Some of the documented examples feature what appear to be 7/9-inch frames paired with Chinese iFlight XING-family motors, suggesting a focus on balancing payload capacity with maneuverability.

Notably, some FPV drones employed fiber-optic command-and-control links to minimize vulnerability to electronic warfare and signal interception.

These UAVs are frequently equipped with cheap and widely available repurposed PG-7 pattern munitions (or Iranian variants such as the PG7-VL-AT1) and are typically employed in anti-armor and counter-mobility missions against Israeli mechanized units.

Interestingly, the target set remains almost entirely dominated by vehicles, which account for 88% (22 hits) of all FPV strikes. Only two attacks (8%) against buildings hosting Israeli troops near the village of Debel have been documented, and one strike (4%) against Israeli personnel via a munition dropped by a small quadcopter.

Share

Targeted vehicles include Merkava IV main battle tanks (MBT), infantry fighting vehicles (IFV) and armored personnel carriers (APC) such as the Namer, a GRX-8000 high-capacity communication vehicle, light tactical vehicles (LTV), and excavators.

Modus Operandi

An observation of the drone footage released by the group suggests an agile and distributed concept of operations relying on mobile drone crews and pre-positioned munitions stocks and other miscellaneous supplies, in order to cover as much territory as possible. The small size of FPV drones is ideal for this approach, as these systems can be easily concealed and do not entail a large logistic footprint, especially when used in relatively small quantities.

As of the writing of this analysis, documented attacks suggest a low sortie generation capacity among Hezbollah’s ranks, possibly due to a small number of proficient operators. Tactical finesse appears limited, especially when compared to the Ukrainian context, as demonstrated by the suboptimal selection of angle of attacks and target aimpoints, with operators often picking the most accessible area of vehicles rather than the most vulnerable ones, except for a few attacks aimed at weak spots of Israeli vehicles (e.g., rear doors, tracks).

While the extent of damage remains uncertain due to selective video editing and limited post-strike footage, there are some Israeli operational reports of injuries and possible fatalities among Israeli soldiers in armored brigades currently deployed in southern Lebanon, such as the 7^th Brigade.

The use of a fiber-optic command and control link allows Hezbollah’s drone crews to overcome Israeli electronic warfare (EW) countermeasures and operate in irregular and more challenging mountainous terrains that would otherwise impose line-of-sight limitations to common radio-controlled FPV drones.

Overall, small FPV UAVs provide Hezbollah with a much-needed tactical precision strike capability and complement its arsenal of anti-tank guided missiles (ATGMs). Compared to the latter, FPV quadcopters offer greater tactical flexibility and can be used to conduct both reconnaissance and strike missions, including against targets of opportunity. As Israeli forces push deeper into southern Lebanon, this combination of FPV drones and ATGMs will likely increase the attrition among their mechanized units and slow down their advances. However, this author assesses that unless Hezbollah manages to scale FPV drone strikes significantly, the latter’s overall operational impact will remain limited.

While advice and training support from Russia cannot be ruled out, it is also plausible that these capabilities are the result of independent development using domestic expertise and widely available tutorials for drone assembly, configuration, and testing. That said, it is worth remembering that Russian forces trained Assad’s regime loyalists in the use of FPV drones between 2023 and 2024, and it is possible that Hezbollah’s operatives benefited from some knowledge transfer, and even that some of the group’s members received the training themselves.

Iraqi Resistance Groups

Pro-Iran resistance groups in Iraq, in particular the Islamic Resistance in Iraq umbrella and Saraya Awliya al-Dam (Companies of the Guardians of Blood), have also started using weaponized FPV drones against US assets and installations near the Iraqi capital, though less frequently compared to the Lebanese Hezbollah.

Share

This author has recorded eight documented FPV drone attacks, with seven geolocated in the Victory Base complex near Baghdad international airport and one allegedly launched against the main headquarter of the Iraqi National Intelligence.

The video feed’s signal quality visible in published footage suggests that most, if not all, of the drones used were fiber-optic types, while the warheads were likely PG-7 pattern munitions (or similar).

Targets hit include a HH-60M medevac helicopter, one AN/MPQ-64 Sentinel radar, six military shelters and aircraft hangars, and a batch of fuel tanks. The attack launched against the Iraqi National Intelligence on March 21 allegedly consisted of two fiber-optic FPV quadcopters and caused one victim, with one of the drones apparently shot down by security forces (Figure 4).

Overall, observed FPV drone attacks by Iraqi groups indicate basic tactical proficiency, hinting at operators with modest operational experience. In one case, for example, the operators flew the drone back and forth before deciding to strike a reinforced shelter and a hangar, causing little to no damage.

However, in at least one instance, operators deployed two drones simultaneously, with one system providing real-time battle damage assessment (BDA) of the first strike before being flown against another high-value target, thus suggesting a more articulated mission planning as well as sophisticated tactics.

In another case, the Saraya Awliya al-Dam group used a fiber-optic FPV drone to conduct a very low-altitude reconnaissance flight over the US Embassy and diplomatic compound in Baghdad, flying completely unchallenged for several minutes (Figure 6). Such a tactic allows the mapping of potential targets and vulnerable areas for future attacks also in cluttered urban environments and – with fiber-optic drones – it can be countered only via kinetic means, which represent an obvious constraint for the defender in areas with a high risk of collateral damage.

Conclusion

The growing adoption of FPV drones by Hezbollah and pro-Iran Iraqi militias reflects an incremental but notable evolution in their tactical toolkits. These systems offer a relatively low-cost means to conduct precision strikes, expand engagement envelopes, and partially offset adversary advantages in armor and electronic warfare.

However, current evidence points to limited scale, uneven operator proficiency, and modest overall battlefield impact. Furthermore, while systems equipped with fiber-optic command link mitigate EW (electronic warfare) countermeasures and enable operations in contested environments, they do not fundamentally alter the battlefield balance absent a significant increase in deployment rates and tactical refinement.

In Lebanon, and even more so in Iraq, the observed pattern of FPV drones’ operational use suggests a still ongoing learning phase, with basic though gradually improving coordination, targeting, and mission planning. Should Hezbollah and Iranian proxies succeed in scaling production, training, and integration of FPV drones with other capabilities such as ATGMs, mortars, and other fixed wing attack UAVs, these systems will have a more consequential impact in future operations.

Subscribe now

Subscribe now

The bomb begins falling from the left side of the screen as soon as the video starts. The viewer has the perspective of the drone as it looks down at a white pickup truck with a full bed; men standing on the driver’s side of the vehicle appear to be talking, while the bombs gets smaller and smaller before impacting the bed of the truck and detonating. The men on the driver’s side flee as a man in the front passenger seat exits the vehicle and joins his comrades in flight. This is a short video released by the Mexican drug cartel Cárteles Unidos, showing an attack on the Jalisco New Generation Cartel (CJNG). This video, published by the pseudonymous conflict researcher War Noir in August of 2025, provides a glimpse into the emerging, but increasingly complex world of drone use by drug cartels.

Globally, drones have begun emerging in conflict zones around the world, to the point where they are being used, with varying degrees of effect, in every major and most minor, armed conflicts. This includes the use of drones by drug cartels and other transnational criminal organizations (TCOs) across Latin America. While drug cartels and other TCOs have been using drones in various capacities for several years now, innovations in drone technology and tactics have begun to filter out of the warzone in Ukraine and subsequently appearing in Latin America.

Commercial off-the-shelf (COTS) drones have dramatically reshaped how militant organizations globally fight, and cartels and TCOs are no exception. The introduction of relatively cheap, accessible, and easy to fly drones began in January 2013 with the release of the DJI Phantom. The Phantom was the world’s first ready to fly drone that met a low enough price point to reach mass adoption. Quickly, the terrorist group calling itself the Islamic State (IS) began using small, cheap, commercial off-the-shelf (COTS) hobby drones in operations, with this first being documented in 2014, and by no later than 2016 when IS had begun to weaponize them. Weaponization of COTS drones was, and still often is, rudimentary. Especially early on, weaponization focused on grenade dropper type systems, where hand grenades or launcher grenades were dropped from modified COTS drones. These early grenade dropper systems often relied on placing munitions inside of a plastic cup on the bottom of the drone, with the grenade being dropped with an improvised release mechanism.

Since the early days of improvised drones being used by IS, drone warfare has taken substantial leaps — n particular, on the battlefields of Ukraine. For drones, the biggest innovation to come out of the war in Ukraine is the weaponized first-person-view (FPV) drone. Similar to how DJI’s introduction of the Phantom brought the camera drone to the world, FPV drones began to emerge as a COTS technology in 2013 to 2014. The technology was firmly on the global stage with the founding of the Drone Racing League (DRL) in 2015. However, these drones didn’t see substantial mass weaponization until after the full-scale Russian invasion of Ukraine in early 2022. It was not until later in 2022, with mass adoption finally occurring in 2023, that weaponized FPV drones finally began to appear on the battlefield in the now familiar “kamikaze” one-way-attack (OWA) format. The introduction of COTS drones to warzones also invited the introduction of a slew of complementary tools and countermeasures, anging from ground control stations to jammers and spectrum analyzers. Drones have helped usher in a new era of electronic warfare in conjunction with the introduction of cheap air forces.

The most common use of weaponized drones by cartels and TCOs is the grenade dropper. DJI Mavic drones are the most common type of drone that is used in grenade-dropping attacks. This is because of the Mavic’s ubiquity, low cost, and ability to produce enough power in order to carry small payloads. While early IS grenade-dropping drones used improvised dropper systems, today’s purpose-built after-market dropper mechanisms are often advertised on social media sites like Instagram, though often labeled as “water bottle droppers,” and are for sale on sites like Etsy. Grenade dropping attacks may involve actual hand or launcher grenades, or other professionally produced munitions such as mortar rounds, but very often use improvised explosive devices (IEDs). Ultimately, whether a cartel or TCO is using standard or modified factory built grenades of one kind or another, or using IEDs — this likely has to do with a group’s ability to easily obtain munitions or not. Recently, a dropper-style attack was conducted by the Gulf Cartel (CDG) on the house of the mother of the notorious drug kingpin El Chapo Guzman.

While dropper-type drones are seen with some degree of frequency in Latin America, FPV-style attacks are seen much less often. This is because FPV-style attack drones are a much more difficult technology to field effectively. FPV drones typically do not have fly-by-wire software like camera drones do, and therefore are much more difficult to fly. Forums and blogs for new FPV drone enthusiasts often recommend using FPV drone simulator games like Liftoff or Uncrashed for 20-30 hours of gameplay prior to attempting to fly a real FPV drone. This sharp learning curve is just the first major obstacle that cartels and TCOs face when attempting to adopt FPV style drones for attacks. Fuzing, or the technology and components needed to make munitions safe or armed and to detonate the explosives at the right moment, is the next big obstacle. In particular, the most common detonator mechanism for OWA FPV drones in Ukraine is a set of contact wires that cause the munition attached to the drone to explode when the drone impacts a target. Additionally, in Ukraine, OWA FPV drones are often armed with modified mortar rounds. While the available munitions fuzing technology has improved, many FPV drones have still not moved beyond the most primitive types of detonators, and fundamentally, these munitions are extremely dangerous to the individual making them. However, despite the higher degree of skill required to fly them and the greater danger involved in producing an effective munition for arming them, OWA FPV drones are still being used in Latin America. In particular, in August 2025, forces aligned with the Revolutionary Armed Forces of Colombia (FARC) shot down a Columbian Army UH-60 Blackhawk helicopter.

Cartels also use drones for more “mundane” activities such as reconnaissance and smuggling. For 2025, U.S. Customs and Border Protection detected 34,682 drone flights within 500 meters of the U.S.-Mexico border. While some portion of those flights were benign hobbyists or related to some form of legitimate work, many were likely being done in the furtherance of cartel objectives. These objectives could include conducting reconnaissance for illegal border crossings or smuggling contraband across the border. Additionally, drones are being used to smuggle contraband into prisons in Latin America as well as the United States. Notably, in February of 2026, the US Federal Aviation Administration initially shut down air space overEl Paso, Texas because of issues surrounding cartel drone use and the US military’s plans to use a new laser weapon as a countermeasure against those drones.

In particular, the Mexican drug cartel CJNG has been a prolific user of drones in operations in Mexico. CJNG frequently uses drones to conduct reconnaissance operations as well as to strike their opponents, most often other cartels. The Jalisco-based cartel was an early adopter of COTS drone technology, and has been highlighted for being a leading adopter of other innovative technologies as well. Notably, CJNG has been running at least one specialized drone unit since 2023, though possibly since as early as late 2021. This drone unit was responsible for approximately 20 percent of all drone attacks in Mexico from 2021 to 2025. Additionally, CJNG may be starting to adopt OWA FPV drones for attacks, with possible evidence of the adoption of such systems being documented in August 2025.

While the adoption of drone technology does not fundamentally change the conflict between state forces and drug cartels or TCOs, it does create additional layers of danger for police forces, as well as accelerating the ever expanding need for more resources to combat cartels. With cartels using larger and larger numbers of drones, state security forces will be forced to purchase sophisticated electronic warfare technologies that are able to locate, track, and defend against drones, as well as hire and train personnel who are able to operate that technology.

Subscribe now

Subscribe now

Since the Iran conflict started, a mysterious terror group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has appeared practically overnight to claim several attacks against Jewish and American targets in Europe — including the torching of four Jewish charity ambulances in London and an attack at the Israel Center in Nijkerk, Netherlands — while law enforcement has detained up to 15 people in connection with these incidents.

In its released videos and statements, HAYI threatens America, Israel, and Europe while visually modeling itself after pro-Iranian Axis of Resistance groups. But unusual signatures in its public communiques and behavior indicate that HAYI is not an authentic, grassroots Axis group but is instead a fabricated front for a grey zone operation that relies on paid freelancers and/or volunteers to carry out acts of terror and sabotage abroad — a strategy first deployed by Russians and also used by Iran, according to security analysts interviewed for this article.

“Authorities, intelligence agencies, and experts are attempting to determine if this is a case of ‘disposable agents,’” said Colin P. Clarke, executive director of The Soufan Center, in an interview. “Given the rather amateurish nature of some of these attacks, it could be a simple ‘pay-for-play’ scheme where the Iranians are recruiting European youth online and paying nominal fees to conduct these attacks.”

This seems readily apparent in the most recent incident, which occurred in the early morning of March 28 in Paris when police caught a 17-year-old Senegal national attempting to set off an explosive at a Bank of America building. He told investigators he was hired and paid to perform this action via Snapchat. An additional four people were also detained in connection with this attempt. French authorities said HAYI is suspected to be behind this attack due to HAYI mentioning the target in a video posted on March 21.

Some online critics, a few connected to large disinformation networks, have accused pro-Israel agents of involvement due to these attacks only damaging property, occurring at odd hours of the morning and night, and without injuring anyone. Notably, HAYI statements contain errors and use certain phrases that are atypical for such a militant group. As of this article’s publication, the investigation into HAYI is still ongoing, and European law enforcement have released scant evidence that neither proves or disproves this controversial hypothesis; however, officials’ preliminary comments appear to align with analysts’ expert assessment that disposable agents are involved and that these incidents likely have a connection with pro-Iranian operatives.

Still, big questions loom over the organization’s authenticity, origin, and possible motivation. This report examines the publicly available information that HAYI has released thus far — with a special focus on the audio used in its propaganda videos — while also probing whether this “group” has any connection with pro-Iranian Shi’ite Islamists and/or the Islamic Revolutionary Guard Corps, which is known to facilitate attacks abroad. This report also examines the context of these incidents within the broader security landscape of Europe.

Companions of the Right

The full name of the group translates into The Islamic Movement of the Companions of the Right. “Right”, as translated from Arabic, is equivalent to the concept of justness or justice. The group’s logo closely resembles the insignia for Hamas, Hezbollah, and other Iran-aligned Axis of Resistance terror groups: an upright fist holding a firearm while superimposed over a globe. But while every Axis group has AK weapons in its logo, HAYI has a SVD sniper rifle from the Soviet Union in its fist, as pointed out by The Jerusalem Post, a possibly relevant discrepancy.

The first known HAYI-linked attack occurred on the morning of March 9, when unknown assailants bombed the facade of a synagogue in Liege, Belgium. On that same day, HAYI first announced its existence in a statement that circulated on X and Telegram. In addition to quoting Quranic verses, the statement reads “Badr 1 – Badr 2 – Fath 6 – Khaybar 14” — which appear to refer to early battles in Islamic history, such as the conquest of Mecca — with the numbers serving an unknown purpose. Curiously, the statement doesn’t reference the Liege attack at all. A few days later, on March 11, a video surfaced on pro-Iranian online networks showing the Liege attack, which the group then claimed credit for.

Since the March 9 arson, HAYI has claimed several subsequent attacks in Europe: a March 13 arson at a synagogue in Rotterdam, Netherlands that resulted in five people getting detained in connection with the incident; a March 14 attack against a Jewish school in Amsterdam; a March 16 bombing of an office building in Amsterdam; the March 23 torching of four ambulances in the London neighborhood of Golders Green that resulted in two men getting detained for questioning; and the arson attack of a car in Antwerp, Belgium sometime on March 23 and 24 that also saw two minors detained. On April 4, an explosive device was detonated at an Israel Center in the town of Nijkerk in the Netherlands, which HAYI quickly claimed.

There was also the aborted attack at the Bank of America in Paris on March 28, with one person arrested, which investigators strongly suspect was a HAYI target because the group previously mentioned the location in a video. In addition, HAYI claimed an attack in Greece on March 11, but a report from the International Centre for Counter-Terrorism (ICCT) by analyst Julian Lanchès says it was most likely an attack in Rotterdam that happened on March 3.

Each of the incidents were commemorated with videos that HAYI quickly released after the attacks happened. The three exceptions to this pattern: one, the March 9 incident, whose footage was released two days later; two, the suspected Paris attempted bombing in which HAYI released a video targeting the location on March 21 — days before the actual attack on March 28 took place; and three, the so-called Greece attack, which HAYI claimed took place on March 11.

The quality of the propaganda videos that depict these incidents is amateurish: shaky camera work, poor video quality, and the usage of Google maps as visual props. The attacks at most caused minor damage, save for the ambulances in London, and caused zero injuries due to the fact they occurred at odd hours and almost all fell between Friday and Monday early morning hours.

Disposable Agents

The group exhibits certain traits that make it less likely to be an authentic Axis of Resistance group despite HAYI’s overt, conscious decision to emulate them. Two such examples are the amateur-looking videos (jihadist videos are typically slickly produced), the growing number of people getting caught, which suggests a lack of operational security, and that most of the arrested are young men who seemingly have no familial connection with Iran, such as the Senegal suspect of the suspected HAYI Paris attack.

Iran proxy expert and analyst Phillip Smyth said in an interview with Militant Wire: “The low-level types you are describing fit a pattern for Iranian recruitment of individuals to launch low-level attacks for them in Europe,” said Iran proxy expert and analyst Phillip Smyth in an interview with Militant Wire. “They’re going to criminal groups/gangs, younger true believers, and anyone else they can snag. What they’re doing is roping in their attacks (note how they videotape this stuff and send it in) into an overarching front group structure. Higher likelihood a good number of attackers don’t even know that’s how their attacks are being branded.”

This is shown in the case of the possible HAYI-linked Bank of America, Paris incident: the Senegal suspect, who has a drug record, was paid 600 Euros to ignite a homemade explosive, five liters of an unknown liquid fuel with an ignition charge made of a firecracker with 650 grams of explosive powder.

“The low-sophistication modus operandi also matches HAYI’s pattern of using minors and young men for attacks on Jewish and Western targets across Europe since early March 2026,” said Adrian Shtun, associate fellow at International Centre for Counter-Terrorism (ICCT).

Hiring freelancers is a type of grey or hybrid warfare tactic that Russian-linked operatives have done in the past, and which Iran has deployed as well. Iranian officials have been known to hire freelancers, including ones involved with criminal organizations, to carry out acts of terror abroad, such as an unexploded grenade found at an Israeli embassy in Sweden in 2024, which had been linked to gangs. Iran contracts freelancers and criminal organizations in order to maintain plausible deniability from these incidents and cause confusion.

Another clue that dispels the idea that this is an authentic Axis group: HAYI had zero digital footprint prior to March 9, atypical behavior by terror groups, which usually make a big announcement and establish dedicated online channels for their cause before initiating operations. Another clue is that a Telegram channel that styles itself as an official HAYI account only became active this month, even though it was registered back in 2023. This account, which remains active, could not be authenticated.

CBS News got in contact with the anonymous administrator named Asad-Allah of a HAYI Telegram channel, which was advertised on a QR code at the end of one of the HAYI-branded videos, and this suspect raised the Gaza occupation and the war in Iran as justification for its actions while using American English in texts — a relevant detail.

Another unusual feature of this group is its use of AI. Middle East Eye journalists ran HAYI statements through AI detection software and determined that at least one HAYI statement was AI-generated; one block of text was translated into English, Arabic, and Hebrew, and had unusual phrasing for a Shia Muslim terror group to use, such as terms like the “Land of Israel” and “the Gaza war” being mentioned in English. Use of AI may explain why the HAYI logo uses a different rifle in its logo versus an AK and why the word “Islamia” is misspelled in at least one HAYI communique.

Audio Findings

Another atypical signature about HAYI communiques is the group’s use of audio in their videos. Jihadist terror groups have typically used nasheeds as background music, but HAYI uses instrumental music.

For the video depicting the March 14 arson attack of a synagogue in Amsterdam, HAYI used a snippet that was traced to this YouTube clip with the below thumbnail.

First word in the above image has in Arabic موسيقى or “musiqaa” — which means “Music.” Second line of text in the image has in Arabic أولي البأس or “uwli albas” — which means “Those of Might/Valor” — as in those “people of strength/courage” or “the fierce ones.” Another stronger translation is “Men of Might.” This appears to reference Quranic passages Surah Al-Isra’ (17:5) and Surah Al-Fath (48:16). Combined, the text roughly means: “Music of Brave Men” or “ Music of Warriors.”

Caption for the video mentions the Arabic words الإعلام الحربي or al’iielam alharbiu, which means “War Media” or “Military Media,” the music’s publisher. The listed composers are labeled as M Kallas and T Charife. Another significant finding is that the music was first released on September 17, 2024 — the same day as the pager attack against Hezbollah in Lebanon, suggesting this audio has a Hezbollah connection. A search of this clip on TikTok turns up accounts that promote the Iranian regime, Shia Islam, and the Popular Mobilization Front in Iraq.

In another video, the March 16 bombing of an Amsterdam central business building, HAYI used the background music directly lifted from a concert by the Tehran Symphonic Orchestra, specifically the Symphony of the Epic of Khorramshahr by composer Majid Entezami, which commemorates the liberation of the city Khorramshahr from Iraqi occupation during the Iran-Iraq War. Specifically, the video lifts a snippet from the third movement, which is entitled, Preparation for War. HAYI repeated the use of this music in a few other videos, including the one claiming the attack on the Israel Center in the Netherlands.

Who’s Behind HAYI?

A report from the International Centre for Counter-Terrorism points out that four large Telegram accounts — two Iraqi Shia militia-affiliated and the other two being pro-Iranian news — would first share the HAYI videos and statements claiming credit for these attacks, and then a broader network of pro-Iranian influencers would amplify the content’s reach. The pro-Iranian news accounts also shared posts from pro-Russian accounts that have been sanctioned — suggesting a connection or alliance. In addition, one of the Iraqi Shia militia Telegram accounts promotes a militia group that is known to have close ties with IRGC’s Quds Force.

Because of this Iraqi Shia connection and how the videos were first shared before gaining a wider audience, Lucas Webber, co-founder of Militant Wire, said that HAYI and its activities are likely connected with Iraqi Shia militias, who collaborate with the IRGC.

“[L]ooks less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network and experimenting with low-cost, high-visibility operations in Europe,” he told CBS News.

Online critics of Israel have seized the same discrepancies that analysts have pointed out, and that must mean pro-Israeli agents could be involved. The fact that it was networks associated with Iraqi Shia militants that first shared HAYI propaganda goes against this controversial notion. In addition, the curious musical choices may point towards a connection with Iraqi Shia militia groups.

The amateurish nature of the operation has also been seized by anti-Israeli critics as a possible sign of a false flag, but this could be a function of unprofessional saboteurs making clumsy mistakes and use of AI, prone to hallucinations, to generate content and translate text.

In another possible connection with HAYI, ICCT report points out that an unknown person had posted a message on March 7 to a pro-Iranian Iraqi Shia Telegram account that called for “all silent cells” to activate, which a HAYI statement on the Liege attack later referenced.

Europe at Risk

Though these attacks have injured no one, they highlight the risk that Jewish communities (along with American-linked organizations) are facing from Iran-connected terror groups: “[T]he most elevated and complex threat environment the Jewish community and this country has seen in modern history,” according to Kerry Sleeper, the Chief of Threat Management and Information Sharing for the Secure Community Network, a Jewish security organization based in Chicago, in a statement to the Jewish Telegraphic Agency.

These incidents come as Europe deals with a complicated threat environment, amplified by the war in the Middle East. Besides any pro-Iranian or Shi’ite Islam extremist agents, European investigators are also dealing with Sunni jihadists, Russian hybrid attacks, and other ideologically motivated violent extremists from across the spectrum (far-left, far-right, anti-government, etc.), said Clarke.

Case in point, law enforcement recently detained two suspected Iranian spies who were found attempting to infiltrate a nuclear submarine base in Scotland. In addition, the Netherlands saw Mohamed (Mohi) Shafiei, a local police officer and outspoken Iranian dissident, get shot by unknown assailants; Dutch authorities are investigating whether he may have been targeted by pro-Iranian operatives.

As for HAYI, their efforts have followed a regular pattern: attack targets at night or in the morning and avoid casualties. But that may not be the case as the Iran conflict drags on further.

“[T]hings may change, and they may start targeting people, too, during the day, when it’s busy,” said Joe Truzman, senior research analyst and editor at the Foundation for Defense of Democracies, told Fox News Digital.

Subscribe now

Subscribe now

Since the outbreak of the US/Israel–Iran war on February 28, 2026, the Islamic State (IS) has treated the conflict as both a propaganda windfall and an operational opportunity. Through a sequence of Al‑Naba editorials and a renewed tempo of inspired plotting, the group has attempted to reinsert itself into the center of global jihadist dynamics and to re-energize attacks in the Western homelands. IS‑linked attackers have again struck the U.S. homeland, with the Old Dominion University shooting standing out as the most significant successful operation since the January 1, 2025, New Orleans truck attack on Bourbon Street. At the same time, the narrative constructed around the war and Ramadan is explicitly framed as global, which heightens the threat not only to the United States but also to Europe and the broader West, where IS has a long record of exploiting external wars to incite “lone actor” and small‑cell operations. The recently disrupted plot in Spain, linked to IS branches in Somalia and the Sahel, further demonstrates that the current wave of incitement is knitting together multiple regional branches into a threat network that directly targets Europe. The IS Khurasan Province (ISKP) arrest in Italy earlier this year further indicates the continued expansion of the organization’s more multivectored external operations strategy and threat to the West.

IS Incitement Propaganda and Operational Momentum Leading Up to the Conflict
In the months leading up to the US/Israel vs Iran conflict, the Islamic State’s 2025 attack and plot campaign created a foundation for intensified calls for violence against Jews, Christians, and the wider Western public across North America, Europe, and the Pacific. From New Orleans and Bondi Beach to Villach, Berlin, Mulhouse, Bielefeld, Manchester, and disrupted conspiracies in the United States, Europe, and Turkey, the group repeatedly targeted religious holidays, memorials, markets, nightlife districts, and other soft targets, thus turning Christmas, New Year, and Jewish festivals into focal points for terror. Bondi, the Hanukkah mass shooting at Sydney’s waterfront that killed 15 and injured more than 40 on December 14, 2025, became both the apex of this wave and a springboard for renewed incitement in early 2026, as IS media and supporter channels treated it as a model for lone‑actor and small‑cell operations.

Al‑Naba quickly codified Bondi’s significance. “The Pride of Sydney” celebrated the “glorious deed of Sydney,” boasted that “the Jews are bleeding in Australia’s streets,” and urged believers who had absorbed IS’ “jihadist code” online to attack Jews and “Crusaders” at festivals and gatherings, presenting online guidance as sufficient for a single reader to “set out like the whirlwind” against synagogues, churches, and holiday crowds. A subsequent editorial, “The Season of Terrorism,” framed Christmas, New Year, and Jewish holidays as a “season of terror and anxiety” for “Crusader” societies, argued that heightened security and disrupted celebrations showed the battle had been “transferred to their homes,” and urged low‑tech violence such as vehicle rammings and attacks with heavy tools so that “there be a kill with every blow.” These texts explicitly folded Jews and Christians into a single enemy category “from Yobi to Bondi” and treated any Western crowd as legitimate blood.

Read more

Subscribe now

It had previously been identified and examined as one of the kamikaze drones (One-Way Attack UAVs, OWA-UAVs) employed by pro-Iranian groups in their recent attacks. (Articles: Kamikaze Drones Used by Pro-Iranian Militant Groups in Iraq and Lebanon and Islamic Resistance in Iraq Using Stealth Kamikaze Drones)

The first guided missile to be introduced in the conflict was a short-range ballistic missile known as “The Striker” (Arabic: “Al-Qāriʿ”). It initially appeared in propaganda footage released by “Guardians of Blood Brigades” (Arabic: “Saraya Awliya al-Dam”), a subgroup affiliated with the Islamic Resistance in Iraq. In the following period, it was used in attacks targeting U.S. bases in Iraq during the escalation of hostilities in the region.

Read more

Subscribe now

After the Islamic State-inspired attack at Bondi Beach in Sydney, Australia, on December 14, 2025, the deadliest terror attack in the country, there was talk about the potential resurgence of the Islamic State Southeast Asia Province (ISEAP).

The links between ISEAP and the attack have been drawn from the fact that the two perpetrators visited the Philippines a month before conducting the operation.

The Philippines was a hot spot for ISEAP in the mid-to-late 2010s; it was even the location where over 1,000 pro-Islamic State fighters attempted to take over the city of Marawi in the country’s south for five months. This was an attempt to establish a wilayah, or province, in Southeast Asia in 2017. The siege was unsuccessful, and Marawi was retaken by the Armed Forces of the Philippines (AFP). Remnants of pro-IS groups are still active in the Philippines, though they barely have a foothold now. This has led to perceptions that the Sydney attack perpetrators potentially linked up with some of these pro-IS remnants for training or logistical support before their attack.

Australian police are now stating that the Sydney perpetrators acted on their own volition and were not part of a wider network; however, they are still investigating why they were in the Philippines, in a region previously occupied by IS fighters and presumably with remnants and sympathizers still present.

ISEAP in the Philippines Today

The ISEAP, as a cohesive organization, is essentially defunct in the Philippines, Indonesia, and Malaysia, where it had varying degrees of presence and activities. Online chatter by pro-IS supporters continues to suggest that the ISEAP and the smaller groups forming it are present and active, yet that is not true. Security forces in all the aforementioned countries have significantly cracked down on these groups and networks to the extent that the earlier regional coordination and cooperation between pro-IS groups is essentially zero.

Referring specifically to the Philippines, where the IS attempted to form a province following calls from IS-Central in Syria and Iraq, the threat of pro-IS groups has been relegated back to being lower than the threat from the communist New People’s Army (which is the longest-running insurgency in the world, currently). Even the communist threat has been diminished significantly in the Philippines, highlighting how the pro-IS remnants there are essentially unable to organize under the IS banner. There is no IS resurgence in the Philippines; the activity levels of anti-government Islamist groups are at their lowest in decades, and it is a far cry from IS-affiliated groups in West Africa, for example.

In the Philippines, there were three major IS groups (with various factions): the Maute Group, the Bangsamoro Islamic Freedom Fighters (BIFF), and the Abu Sayyaf Group (ASG). The ISEAP emir would often be picked from one of these groups following the killing of the preceding emir. Today, all of these groups fall under the banner of Dawlah Islamiyah, or the Islamic State. Taking a closer look, however, indicates how far these groups have deteriorated in capabilities. The ASG has essentially been decimated after over two decades of terror and historical ties to Al-Qaeda and major terror groups in Indonesia, such as the Jemaah Islamiyah and Jamaat Ansharut Daulah. The ASG was notorious for kidnapping and operating in the Sulu archipelago. There has been no kidnapping since January 2020, and as of last year, the ASG splinter groups have also seemed to have faded away. The Maute Group, which largely led and funded the Marawi siege, is also a sliver of what it once was, and possibly standing on its last legs. BIFF is in a similar position; last year, a BIFF sub-leader, his brother, and his son were killed in a clash with the AFP.

While a large part of the fading presence of IS groups in the Philippines is due to the AFP’s actions, it also comes from the government’s wider movement to integrate disenfranchised Muslim Moro communities who live in Mindanao and were part of groups like the Moro Islamic Liberation Front (MILF). At one point, MILF was a major internal security threat in the Philippines, but following a peace agreement and normalization, the MILF and the AFP have worked together to counter the more radical Islamist pro-IS groups that fall under Dawlah Islamiyah.

As such, recent characterizations of the Philippines and Mindanao, especially as a terror hot-spot, are false and disingenuous; the ISEAP is defunct, and the groups that comprised it are struggling to survive.

Subscribe now

Subscribe now

On March 25, 2026, Morocco dismantled an Islamic State (IS)‑affiliated cell operating across its northern cities and Spain — an operation that offers a concrete glimpse of how Islamic State Somalia (IS‑S) is becoming embedded in a wider ecosystem of transnational support structures that stretch from East Africa to Europe. While the underlying case centers on a joint Moroccan-Spanish operation led by Morocco’s Central Bureau of Judicial Investigations and Spanish security services, it also illustrates the kind of recruitment, online indoctrination, and travel facilitation pipelines that IS‑S increasingly seeks to exploit as it internationalizes and looks beyond its Puntland strongholds towards North African and European networks. In this sense, the March 2026 Morocco-Spain cell can be read as part of the broader architecture through which IS‑S content circulates into diaspora communities, sympathizers seek to move toward active combat zones, and intermediaries help connect would‑be recruits to Islamic State nodes abroad, including in Somalia.

Viewed through the lens of IS‑S’s evolution, the activities described in this case underscore three overlapping threat vectors: external operations, guided plots, and inspired attacks. External operations become more plausible as cells in Morocco and Spain develop the capability to channel money, recruits, or operational information to and from hubs like IS‑S, effectively serving as forward extensions of a Somalia-centered command and facilitation system. Guided plots are enabled when individuals in such cells receive direction, encouragement, or technical input from actors linked to IS‑S, whether on target selection, timing, or attack methods, turning local networks into instruments of a geographically distant leadership. Finally, the focus on propaganda, online radicalization, and recruitment highlights the enduring risk of inspired attacks, in which self‑radicalized supporters in Morocco, Spain, or elsewhere in Europe consume IS‑S branded or aligned content and then act on its calls to violence without direct tasking, making the March 2026 Moroccan-Spanish case a warning sign of how IS‑S’s growing reach into European spaces can translate into diverse and hard-to-predict attack scenarios. Examining this case also serves as an entry point to have a closer examination of how IS‑S itself emerged and evolved into a pivotal node within the global Islamic State movement.

IS-S has evolved from a small splinter group in Puntland into one of the most strategically important components of the international Islamic State organization and global movement, but this rise now coincides with heavy military pressure and battlefield losses. Since late 2024, a large-scale Puntland campaign, often referred to as Operation Hilaac and backed by U.S. airpower and other international support, has overrun key strongholds in the Cal Miskaad and Al Miskad mountains, killed hundreds of fighters including many foreigners, captured senior commanders, and reduced IS‑S’s territorial presence in Bari region by well over half according to Puntland officials, forcing surviving cadres into scattered hideouts and stressing the group’s command and control and recruitment pipelines. Yet even as a heavily degraded IS‑S absorbs these losses on the ground, it continues to operate as a regional and transnational command, financial, and propaganda hub with a history of international recruitment, overseas facilitation, and plots, and this combination of attrition at home and persistence in its transnational functions underpins its emerging role as a concrete external operations threat, particularly to Europe and North America.

Historical Background on IS-S’s Internationalization
IS‑S emerged in October 2015 when Abdulqadir Mumin defected from al-Shabaab with roughly thirty fighters in Puntland and pledged allegiance to the Islamic State’s central leadership. Initially a marginal faction, its prominence rose after it briefly captured the port town of Qandala in 2016 and was recognized as a province in 2017. It consolidated two main operational zones: mountain strongholds in Puntland’s Al Madow range and urban cells in Mogadishu, from which it has conducted dozens of attacks annually against Somali security forces, Puntland units, AU missions, and government officials. Despite a modest manpower estimate of 500 to 700 fighters, IS‑S’s strategic importance has grown disproportionately to its size because it increasingly functions as a regional hub for coordination, finance, and transnational recruitment.

This transformation centers on the Al Karrar regional office, established in northern Somalia by late 2018 under Mumin’s leadership. Al Karrar acts as a combined command and financial center responsible for Islamic State activity across eastern, central, and southern Africa, including Islamic State Central Africa Province in the Democratic Republic of Congo and the Mozambique Province. United States and United Nations reporting now describe Al Karrar as one of the movement’s most important leadership and revenue generation structures worldwide, with some assessments suggesting that Mumin may hold a broader global role beyond Somalia.

Read more