Subscribe now

Official and volunteer translators of Islamic State (IS) propaganda have made attempts to rebound in 2026, after laying the groundwork in the second half of 2025. Their current drive aims to undo the effects from 18 months of successful counter-terrorist operations that significantly hindered the terrorist organization’s multi-language propaganda output. While groups close to the organizational core of Islamic State have led these efforts, other less recognized and individualistic endeavors have also contributed.

In June 2024, an international law enforcement operation shut down the I’lam Foundation, one of the largest multilingual translators and distributors of pro-IS publications accessible on the surface and dark webs. Before the servers were seized, the I’lam Foundation hosted propaganda in more than thirty languages on its website, including the main languages of Central and South Asia, Africa, foreign fighters (e.g., Albanian, Uyghur, Indonesian), and external operations countries (i.e., English, Spanish, German). I’lam’s closure placed more importance on Fursan al-Tarjuma, a collective of roughly a dozen pro-IS translation foundations.

Fursan al-Tarjuma launched in March 2023 with 14 media foundations translating 18 languages. Most foundations focused on one language, relevant to a province or major foreign fighter group, but IS-Khorasan Province’s (ISKP) Al Azaim Media Foundation translated multiple Central and South Asian languages. Fursan al-Tarjuma is central to the current attempted resurgence.

In the months after I’lam Foundation was shuttered, additional arrests around the world stopped the production and dissemination of propaganda by both “munasir” (meaning: volunteer) and high-profile individuals.

One of the largest contingents of arrested volunteer translators was tied to IS’s Andalus region, referring to the historical Muslim state on the Iberian Peninsula. Most of those arrested or otherwise shut down, however, had resided in Latin America. “Abu Bakar al-Uruguayi,” a 14-year-old supporter, established and promoted multiple Spanish-language and Latin American groups online. He was tied to Thiago José Silva Barboza de Paula, a Brazilian recruiter behind the “Comando860” network active on multiple social media platforms. Finally, a Mexican youth known online as both “YihadAmerica” and “Abu Ibrahim” was twice forced to shutter Spanish-language social media channels in early 2025.

Other media munasirs inhibited by investigations and authorities were based in Europe or North America, translating into Dutch, French, German, or a variety of other languages as part of a volunteer media group.

Read more

Since the beginning of the joint US-Israeli military campaign against Iran in late February and Israel’s subsequent ground operations to dismantle Hezbollah’s presence in southern Lebanon, the Lebanese militant group and major Iranian proxies in Iraq have launched hundreds of attacks targeting both Israeli and US force and installations across the region.

Unsurprisingly, uncrewed aerial vehicles (UAVs) represent a big share of the weapons used in these attacks, following a pattern that consolidated over the past few years. While fixed-wing long-range attack drones such as the Shahed-101/107 and Sayyad-107 remain the predominant platforms, small weaponized first-person view (FPV) quadcopters popularized by the war in Ukraine have finally made their way into the arsenal of these groups and have been used more regularly for tactical strikes across southern Lebanon and in the surroundings of the Iraqi capital, Baghdad.

Share

Hezbollah’s FPV Drone Campaign

The first publicly documented use of FPV drones by Hezbollah emerged in the spring of 2024, but their employment remained sporadic throughout 2024 and the following year, with nine attacks published by the group on its social media channels (the real number is likely higher). These strikes primarily targeted Israeli fixed military installations – including tactical radars and communication towers – along the Israeli-Lebanese border but played a negligible part in the group’s targeting strategy.

Since February of this year, however, Hezbollah has ramped up FPV drone attacks against Israeli mechanized units that have penetrated into southern Lebanon as part of what Israeli authorities defined as “targeted ground operations” to expand the “forward defense area” and “create an additional layer of security for [Israeli] residents of the north.” This author has geolocated 23 out of 25 FPV drone attacks published by Hezbollah since February 28, as shown in the map below. The strikes are distributed along a fairly regular arch from the southwestern Lebanese coast, near the village of Al-Bayada, to areas along the northeastern border with Israel, in the Marjayoun district.

As Israeli forces push deeper into Lebanese territory south of the Litani River, the likelihood of them becoming more exposed to FPV drone strikes will increase. At the same time, recent reports indicate that Israeli forces are also using FPV drones to hunt Hezbollah’s operatives in the border town of Bint-Jbeil, suggesting a cat-and-mouse game between the two sides.

FPV drones provide Hezbollah with a rapidly deployable, cost-effective precision-strike tool for beyond-line-of-sight tactical attacks within the 5-20 km zone, which the group largely lacked previously. Available evidence indicates that these FPV drones are built from off-the-shelf components, with recovered systems equipped with custom 18650 lithium-ion battery packs to extend flight endurance beyond what standard LiPo configurations typically allow. Some of the documented examples feature what appear to be 7/9-inch frames paired with Chinese iFlight XING-family motors, suggesting a focus on balancing payload capacity with maneuverability.

Notably, some FPV drones employed fiber-optic command-and-control links to minimize vulnerability to electronic warfare and signal interception.

These UAVs are frequently equipped with cheap and widely available repurposed PG-7 pattern munitions (or Iranian variants such as the PG7-VL-AT1) and are typically employed in anti-armor and counter-mobility missions against Israeli mechanized units.

Interestingly, the target set remains almost entirely dominated by vehicles, which account for 88% (22 hits) of all FPV strikes. Only two attacks (8%) against buildings hosting Israeli troops near the village of Debel have been documented, and one strike (4%) against Israeli personnel via a munition dropped by a small quadcopter.

Share

Targeted vehicles include Merkava IV main battle tanks (MBT), infantry fighting vehicles (IFV) and armored personnel carriers (APC) such as the Namer, a GRX-8000 high-capacity communication vehicle, light tactical vehicles (LTV), and excavators.

Modus Operandi

An observation of the drone footage released by the group suggests an agile and distributed concept of operations relying on mobile drone crews and pre-positioned munitions stocks and other miscellaneous supplies, in order to cover as much territory as possible. The small size of FPV drones is ideal for this approach, as these systems can be easily concealed and do not entail a large logistic footprint, especially when used in relatively small quantities.

As of the writing of this analysis, documented attacks suggest a low sortie generation capacity among Hezbollah’s ranks, possibly due to a small number of proficient operators. Tactical finesse appears limited, especially when compared to the Ukrainian context, as demonstrated by the suboptimal selection of angle of attacks and target aimpoints, with operators often picking the most accessible area of vehicles rather than the most vulnerable ones, except for a few attacks aimed at weak spots of Israeli vehicles (e.g., rear doors, tracks).

While the extent of damage remains uncertain due to selective video editing and limited post-strike footage, there are some Israeli operational reports of injuries and possible fatalities among Israeli soldiers in armored brigades currently deployed in southern Lebanon, such as the 7^th Brigade.

The use of a fiber-optic command and control link allows Hezbollah’s drone crews to overcome Israeli electronic warfare (EW) countermeasures and operate in irregular and more challenging mountainous terrains that would otherwise impose line-of-sight limitations to common radio-controlled FPV drones.

Overall, small FPV UAVs provide Hezbollah with a much-needed tactical precision strike capability and complement its arsenal of anti-tank guided missiles (ATGMs). Compared to the latter, FPV quadcopters offer greater tactical flexibility and can be used to conduct both reconnaissance and strike missions, including against targets of opportunity. As Israeli forces push deeper into southern Lebanon, this combination of FPV drones and ATGMs will likely increase the attrition among their mechanized units and slow down their advances. However, this author assesses that unless Hezbollah manages to scale FPV drone strikes significantly, the latter’s overall operational impact will remain limited.

While advice and training support from Russia cannot be ruled out, it is also plausible that these capabilities are the result of independent development using domestic expertise and widely available tutorials for drone assembly, configuration, and testing. That said, it is worth remembering that Russian forces trained Assad’s regime loyalists in the use of FPV drones between 2023 and 2024, and it is possible that Hezbollah’s operatives benefited from some knowledge transfer, and even that some of the group’s members received the training themselves.

Iraqi Resistance Groups

Pro-Iran resistance groups in Iraq, in particular the Islamic Resistance in Iraq umbrella and Saraya Awliya al-Dam (Companies of the Guardians of Blood), have also started using weaponized FPV drones against US assets and installations near the Iraqi capital, though less frequently compared to the Lebanese Hezbollah.

Share

This author has recorded eight documented FPV drone attacks, with seven geolocated in the Victory Base complex near Baghdad international airport and one allegedly launched against the main headquarter of the Iraqi National Intelligence.

The video feed’s signal quality visible in published footage suggests that most, if not all, of the drones used were fiber-optic types, while the warheads were likely PG-7 pattern munitions (or similar).

Targets hit include a HH-60M medevac helicopter, one AN/MPQ-64 Sentinel radar, six military shelters and aircraft hangars, and a batch of fuel tanks. The attack launched against the Iraqi National Intelligence on March 21 allegedly consisted of two fiber-optic FPV quadcopters and caused one victim, with one of the drones apparently shot down by security forces (Figure 4).

Overall, observed FPV drone attacks by Iraqi groups indicate basic tactical proficiency, hinting at operators with modest operational experience. In one case, for example, the operators flew the drone back and forth before deciding to strike a reinforced shelter and a hangar, causing little to no damage.

However, in at least one instance, operators deployed two drones simultaneously, with one system providing real-time battle damage assessment (BDA) of the first strike before being flown against another high-value target, thus suggesting a more articulated mission planning as well as sophisticated tactics.

In another case, the Saraya Awliya al-Dam group used a fiber-optic FPV drone to conduct a very low-altitude reconnaissance flight over the US Embassy and diplomatic compound in Baghdad, flying completely unchallenged for several minutes (Figure 6). Such a tactic allows the mapping of potential targets and vulnerable areas for future attacks also in cluttered urban environments and – with fiber-optic drones – it can be countered only via kinetic means, which represent an obvious constraint for the defender in areas with a high risk of collateral damage.

Conclusion

The growing adoption of FPV drones by Hezbollah and pro-Iran Iraqi militias reflects an incremental but notable evolution in their tactical toolkits. These systems offer a relatively low-cost means to conduct precision strikes, expand engagement envelopes, and partially offset adversary advantages in armor and electronic warfare.

However, current evidence points to limited scale, uneven operator proficiency, and modest overall battlefield impact. Furthermore, while systems equipped with fiber-optic command link mitigate EW (electronic warfare) countermeasures and enable operations in contested environments, they do not fundamentally alter the battlefield balance absent a significant increase in deployment rates and tactical refinement.

In Lebanon, and even more so in Iraq, the observed pattern of FPV drones’ operational use suggests a still ongoing learning phase, with basic though gradually improving coordination, targeting, and mission planning. Should Hezbollah and Iranian proxies succeed in scaling production, training, and integration of FPV drones with other capabilities such as ATGMs, mortars, and other fixed wing attack UAVs, these systems will have a more consequential impact in future operations.

Subscribe now

Subscribe now

The bomb begins falling from the left side of the screen as soon as the video starts. The viewer has the perspective of the drone as it looks down at a white pickup truck with a full bed; men standing on the driver’s side of the vehicle appear to be talking, while the bombs gets smaller and smaller before impacting the bed of the truck and detonating. The men on the driver’s side flee as a man in the front passenger seat exits the vehicle and joins his comrades in flight. This is a short video released by the Mexican drug cartel Cárteles Unidos, showing an attack on the Jalisco New Generation Cartel (CJNG). This video, published by the pseudonymous conflict researcher War Noir in August of 2025, provides a glimpse into the emerging, but increasingly complex world of drone use by drug cartels.

Globally, drones have begun emerging in conflict zones around the world, to the point where they are being used, with varying degrees of effect, in every major and most minor, armed conflicts. This includes the use of drones by drug cartels and other transnational criminal organizations (TCOs) across Latin America. While drug cartels and other TCOs have been using drones in various capacities for several years now, innovations in drone technology and tactics have begun to filter out of the warzone in Ukraine and subsequently appearing in Latin America.

Commercial off-the-shelf (COTS) drones have dramatically reshaped how militant organizations globally fight, and cartels and TCOs are no exception. The introduction of relatively cheap, accessible, and easy to fly drones began in January 2013 with the release of the DJI Phantom. The Phantom was the world’s first ready to fly drone that met a low enough price point to reach mass adoption. Quickly, the terrorist group calling itself the Islamic State (IS) began using small, cheap, commercial off-the-shelf (COTS) hobby drones in operations, with this first being documented in 2014, and by no later than 2016 when IS had begun to weaponize them. Weaponization of COTS drones was, and still often is, rudimentary. Especially early on, weaponization focused on grenade dropper type systems, where hand grenades or launcher grenades were dropped from modified COTS drones. These early grenade dropper systems often relied on placing munitions inside of a plastic cup on the bottom of the drone, with the grenade being dropped with an improvised release mechanism.

Since the early days of improvised drones being used by IS, drone warfare has taken substantial leaps — n particular, on the battlefields of Ukraine. For drones, the biggest innovation to come out of the war in Ukraine is the weaponized first-person-view (FPV) drone. Similar to how DJI’s introduction of the Phantom brought the camera drone to the world, FPV drones began to emerge as a COTS technology in 2013 to 2014. The technology was firmly on the global stage with the founding of the Drone Racing League (DRL) in 2015. However, these drones didn’t see substantial mass weaponization until after the full-scale Russian invasion of Ukraine in early 2022. It was not until later in 2022, with mass adoption finally occurring in 2023, that weaponized FPV drones finally began to appear on the battlefield in the now familiar “kamikaze” one-way-attack (OWA) format. The introduction of COTS drones to warzones also invited the introduction of a slew of complementary tools and countermeasures, anging from ground control stations to jammers and spectrum analyzers. Drones have helped usher in a new era of electronic warfare in conjunction with the introduction of cheap air forces.

The most common use of weaponized drones by cartels and TCOs is the grenade dropper. DJI Mavic drones are the most common type of drone that is used in grenade-dropping attacks. This is because of the Mavic’s ubiquity, low cost, and ability to produce enough power in order to carry small payloads. While early IS grenade-dropping drones used improvised dropper systems, today’s purpose-built after-market dropper mechanisms are often advertised on social media sites like Instagram, though often labeled as “water bottle droppers,” and are for sale on sites like Etsy. Grenade dropping attacks may involve actual hand or launcher grenades, or other professionally produced munitions such as mortar rounds, but very often use improvised explosive devices (IEDs). Ultimately, whether a cartel or TCO is using standard or modified factory built grenades of one kind or another, or using IEDs — this likely has to do with a group’s ability to easily obtain munitions or not. Recently, a dropper-style attack was conducted by the Gulf Cartel (CDG) on the house of the mother of the notorious drug kingpin El Chapo Guzman.

While dropper-type drones are seen with some degree of frequency in Latin America, FPV-style attacks are seen much less often. This is because FPV-style attack drones are a much more difficult technology to field effectively. FPV drones typically do not have fly-by-wire software like camera drones do, and therefore are much more difficult to fly. Forums and blogs for new FPV drone enthusiasts often recommend using FPV drone simulator games like Liftoff or Uncrashed for 20-30 hours of gameplay prior to attempting to fly a real FPV drone. This sharp learning curve is just the first major obstacle that cartels and TCOs face when attempting to adopt FPV style drones for attacks. Fuzing, or the technology and components needed to make munitions safe or armed and to detonate the explosives at the right moment, is the next big obstacle. In particular, the most common detonator mechanism for OWA FPV drones in Ukraine is a set of contact wires that cause the munition attached to the drone to explode when the drone impacts a target. Additionally, in Ukraine, OWA FPV drones are often armed with modified mortar rounds. While the available munitions fuzing technology has improved, many FPV drones have still not moved beyond the most primitive types of detonators, and fundamentally, these munitions are extremely dangerous to the individual making them. However, despite the higher degree of skill required to fly them and the greater danger involved in producing an effective munition for arming them, OWA FPV drones are still being used in Latin America. In particular, in August 2025, forces aligned with the Revolutionary Armed Forces of Colombia (FARC) shot down a Columbian Army UH-60 Blackhawk helicopter.

Cartels also use drones for more “mundane” activities such as reconnaissance and smuggling. For 2025, U.S. Customs and Border Protection detected 34,682 drone flights within 500 meters of the U.S.-Mexico border. While some portion of those flights were benign hobbyists or related to some form of legitimate work, many were likely being done in the furtherance of cartel objectives. These objectives could include conducting reconnaissance for illegal border crossings or smuggling contraband across the border. Additionally, drones are being used to smuggle contraband into prisons in Latin America as well as the United States. Notably, in February of 2026, the US Federal Aviation Administration initially shut down air space overEl Paso, Texas because of issues surrounding cartel drone use and the US military’s plans to use a new laser weapon as a countermeasure against those drones.

In particular, the Mexican drug cartel CJNG has been a prolific user of drones in operations in Mexico. CJNG frequently uses drones to conduct reconnaissance operations as well as to strike their opponents, most often other cartels. The Jalisco-based cartel was an early adopter of COTS drone technology, and has been highlighted for being a leading adopter of other innovative technologies as well. Notably, CJNG has been running at least one specialized drone unit since 2023, though possibly since as early as late 2021. This drone unit was responsible for approximately 20 percent of all drone attacks in Mexico from 2021 to 2025. Additionally, CJNG may be starting to adopt OWA FPV drones for attacks, with possible evidence of the adoption of such systems being documented in August 2025.

While the adoption of drone technology does not fundamentally change the conflict between state forces and drug cartels or TCOs, it does create additional layers of danger for police forces, as well as accelerating the ever expanding need for more resources to combat cartels. With cartels using larger and larger numbers of drones, state security forces will be forced to purchase sophisticated electronic warfare technologies that are able to locate, track, and defend against drones, as well as hire and train personnel who are able to operate that technology.

Subscribe now

Subscribe now

Since the Iran conflict started, a mysterious terror group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has appeared practically overnight to claim several attacks against Jewish and American targets in Europe — including the torching of four Jewish charity ambulances in London and an attack at the Israel Center in Nijkerk, Netherlands — while law enforcement has detained up to 15 people in connection with these incidents.

In its released videos and statements, HAYI threatens America, Israel, and Europe while visually modeling itself after pro-Iranian Axis of Resistance groups. But unusual signatures in its public communiques and behavior indicate that HAYI is not an authentic, grassroots Axis group but is instead a fabricated front for a grey zone operation that relies on paid freelancers and/or volunteers to carry out acts of terror and sabotage abroad — a strategy first deployed by Russians and also used by Iran, according to security analysts interviewed for this article.

“Authorities, intelligence agencies, and experts are attempting to determine if this is a case of ‘disposable agents,’” said Colin P. Clarke, executive director of The Soufan Center, in an interview. “Given the rather amateurish nature of some of these attacks, it could be a simple ‘pay-for-play’ scheme where the Iranians are recruiting European youth online and paying nominal fees to conduct these attacks.”

This seems readily apparent in the most recent incident, which occurred in the early morning of March 28 in Paris when police caught a 17-year-old Senegal national attempting to set off an explosive at a Bank of America building. He told investigators he was hired and paid to perform this action via Snapchat. An additional four people were also detained in connection with this attempt. French authorities said HAYI is suspected to be behind this attack due to HAYI mentioning the target in a video posted on March 21.

Some online critics, a few connected to large disinformation networks, have accused pro-Israel agents of involvement due to these attacks only damaging property, occurring at odd hours of the morning and night, and without injuring anyone. Notably, HAYI statements contain errors and use certain phrases that are atypical for such a militant group. As of this article’s publication, the investigation into HAYI is still ongoing, and European law enforcement have released scant evidence that neither proves or disproves this controversial hypothesis; however, officials’ preliminary comments appear to align with analysts’ expert assessment that disposable agents are involved and that these incidents likely have a connection with pro-Iranian operatives.

Still, big questions loom over the organization’s authenticity, origin, and possible motivation. This report examines the publicly available information that HAYI has released thus far — with a special focus on the audio used in its propaganda videos — while also probing whether this “group” has any connection with pro-Iranian Shi’ite Islamists and/or the Islamic Revolutionary Guard Corps, which is known to facilitate attacks abroad. This report also examines the context of these incidents within the broader security landscape of Europe.

Companions of the Right

The full name of the group translates into The Islamic Movement of the Companions of the Right. “Right”, as translated from Arabic, is equivalent to the concept of justness or justice. The group’s logo closely resembles the insignia for Hamas, Hezbollah, and other Iran-aligned Axis of Resistance terror groups: an upright fist holding a firearm while superimposed over a globe. But while every Axis group has AK weapons in its logo, HAYI has a SVD sniper rifle from the Soviet Union in its fist, as pointed out by The Jerusalem Post, a possibly relevant discrepancy.

The first known HAYI-linked attack occurred on the morning of March 9, when unknown assailants bombed the facade of a synagogue in Liege, Belgium. On that same day, HAYI first announced its existence in a statement that circulated on X and Telegram. In addition to quoting Quranic verses, the statement reads “Badr 1 – Badr 2 – Fath 6 – Khaybar 14” — which appear to refer to early battles in Islamic history, such as the conquest of Mecca — with the numbers serving an unknown purpose. Curiously, the statement doesn’t reference the Liege attack at all. A few days later, on March 11, a video surfaced on pro-Iranian online networks showing the Liege attack, which the group then claimed credit for.

Since the March 9 arson, HAYI has claimed several subsequent attacks in Europe: a March 13 arson at a synagogue in Rotterdam, Netherlands that resulted in five people getting detained in connection with the incident; a March 14 attack against a Jewish school in Amsterdam; a March 16 bombing of an office building in Amsterdam; the March 23 torching of four ambulances in the London neighborhood of Golders Green that resulted in two men getting detained for questioning; and the arson attack of a car in Antwerp, Belgium sometime on March 23 and 24 that also saw two minors detained. On April 4, an explosive device was detonated at an Israel Center in the town of Nijkerk in the Netherlands, which HAYI quickly claimed.

There was also the aborted attack at the Bank of America in Paris on March 28, with one person arrested, which investigators strongly suspect was a HAYI target because the group previously mentioned the location in a video. In addition, HAYI claimed an attack in Greece on March 11, but a report from the International Centre for Counter-Terrorism (ICCT) by analyst Julian Lanchès says it was most likely an attack in Rotterdam that happened on March 3.

Each of the incidents were commemorated with videos that HAYI quickly released after the attacks happened. The three exceptions to this pattern: one, the March 9 incident, whose footage was released two days later; two, the suspected Paris attempted bombing in which HAYI released a video targeting the location on March 21 — days before the actual attack on March 28 took place; and three, the so-called Greece attack, which HAYI claimed took place on March 11.

The quality of the propaganda videos that depict these incidents is amateurish: shaky camera work, poor video quality, and the usage of Google maps as visual props. The attacks at most caused minor damage, save for the ambulances in London, and caused zero injuries due to the fact they occurred at odd hours and almost all fell between Friday and Monday early morning hours.

Disposable Agents

The group exhibits certain traits that make it less likely to be an authentic Axis of Resistance group despite HAYI’s overt, conscious decision to emulate them. Two such examples are the amateur-looking videos (jihadist videos are typically slickly produced), the growing number of people getting caught, which suggests a lack of operational security, and that most of the arrested are young men who seemingly have no familial connection with Iran, such as the Senegal suspect of the suspected HAYI Paris attack.

Iran proxy expert and analyst Phillip Smyth said in an interview with Militant Wire: “The low-level types you are describing fit a pattern for Iranian recruitment of individuals to launch low-level attacks for them in Europe,” said Iran proxy expert and analyst Phillip Smyth in an interview with Militant Wire. “They’re going to criminal groups/gangs, younger true believers, and anyone else they can snag. What they’re doing is roping in their attacks (note how they videotape this stuff and send it in) into an overarching front group structure. Higher likelihood a good number of attackers don’t even know that’s how their attacks are being branded.”

This is shown in the case of the possible HAYI-linked Bank of America, Paris incident: the Senegal suspect, who has a drug record, was paid 600 Euros to ignite a homemade explosive, five liters of an unknown liquid fuel with an ignition charge made of a firecracker with 650 grams of explosive powder.

“The low-sophistication modus operandi also matches HAYI’s pattern of using minors and young men for attacks on Jewish and Western targets across Europe since early March 2026,” said Adrian Shtun, associate fellow at International Centre for Counter-Terrorism (ICCT).

Hiring freelancers is a type of grey or hybrid warfare tactic that Russian-linked operatives have done in the past, and which Iran has deployed as well. Iranian officials have been known to hire freelancers, including ones involved with criminal organizations, to carry out acts of terror abroad, such as an unexploded grenade found at an Israeli embassy in Sweden in 2024, which had been linked to gangs. Iran contracts freelancers and criminal organizations in order to maintain plausible deniability from these incidents and cause confusion.

Another clue that dispels the idea that this is an authentic Axis group: HAYI had zero digital footprint prior to March 9, atypical behavior by terror groups, which usually make a big announcement and establish dedicated online channels for their cause before initiating operations. Another clue is that a Telegram channel that styles itself as an official HAYI account only became active this month, even though it was registered back in 2023. This account, which remains active, could not be authenticated.

CBS News got in contact with the anonymous administrator named Asad-Allah of a HAYI Telegram channel, which was advertised on a QR code at the end of one of the HAYI-branded videos, and this suspect raised the Gaza occupation and the war in Iran as justification for its actions while using American English in texts — a relevant detail.

Another unusual feature of this group is its use of AI. Middle East Eye journalists ran HAYI statements through AI detection software and determined that at least one HAYI statement was AI-generated; one block of text was translated into English, Arabic, and Hebrew, and had unusual phrasing for a Shia Muslim terror group to use, such as terms like the “Land of Israel” and “the Gaza war” being mentioned in English. Use of AI may explain why the HAYI logo uses a different rifle in its logo versus an AK and why the word “Islamia” is misspelled in at least one HAYI communique.

Audio Findings

Another atypical signature about HAYI communiques is the group’s use of audio in their videos. Jihadist terror groups have typically used nasheeds as background music, but HAYI uses instrumental music.

For the video depicting the March 14 arson attack of a synagogue in Amsterdam, HAYI used a snippet that was traced to this YouTube clip with the below thumbnail.

First word in the above image has in Arabic موسيقى or “musiqaa” — which means “Music.” Second line of text in the image has in Arabic أولي البأس or “uwli albas” — which means “Those of Might/Valor” — as in those “people of strength/courage” or “the fierce ones.” Another stronger translation is “Men of Might.” This appears to reference Quranic passages Surah Al-Isra’ (17:5) and Surah Al-Fath (48:16). Combined, the text roughly means: “Music of Brave Men” or “ Music of Warriors.”

Caption for the video mentions the Arabic words الإعلام الحربي or al’iielam alharbiu, which means “War Media” or “Military Media,” the music’s publisher. The listed composers are labeled as M Kallas and T Charife. Another significant finding is that the music was first released on September 17, 2024 — the same day as the pager attack against Hezbollah in Lebanon, suggesting this audio has a Hezbollah connection. A search of this clip on TikTok turns up accounts that promote the Iranian regime, Shia Islam, and the Popular Mobilization Front in Iraq.

In another video, the March 16 bombing of an Amsterdam central business building, HAYI used the background music directly lifted from a concert by the Tehran Symphonic Orchestra, specifically the Symphony of the Epic of Khorramshahr by composer Majid Entezami, which commemorates the liberation of the city Khorramshahr from Iraqi occupation during the Iran-Iraq War. Specifically, the video lifts a snippet from the third movement, which is entitled, Preparation for War. HAYI repeated the use of this music in a few other videos, including the one claiming the attack on the Israel Center in the Netherlands.

Who’s Behind HAYI?

A report from the International Centre for Counter-Terrorism points out that four large Telegram accounts — two Iraqi Shia militia-affiliated and the other two being pro-Iranian news — would first share the HAYI videos and statements claiming credit for these attacks, and then a broader network of pro-Iranian influencers would amplify the content’s reach. The pro-Iranian news accounts also shared posts from pro-Russian accounts that have been sanctioned — suggesting a connection or alliance. In addition, one of the Iraqi Shia militia Telegram accounts promotes a militia group that is known to have close ties with IRGC’s Quds Force.

Because of this Iraqi Shia connection and how the videos were first shared before gaining a wider audience, Lucas Webber, co-founder of Militant Wire, said that HAYI and its activities are likely connected with Iraqi Shia militias, who collaborate with the IRGC.

“[L]ooks less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network and experimenting with low-cost, high-visibility operations in Europe,” he told CBS News.

Online critics of Israel have seized the same discrepancies that analysts have pointed out, and that must mean pro-Israeli agents could be involved. The fact that it was networks associated with Iraqi Shia militants that first shared HAYI propaganda goes against this controversial notion. In addition, the curious musical choices may point towards a connection with Iraqi Shia militia groups.

The amateurish nature of the operation has also been seized by anti-Israeli critics as a possible sign of a false flag, but this could be a function of unprofessional saboteurs making clumsy mistakes and use of AI, prone to hallucinations, to generate content and translate text.

In another possible connection with HAYI, ICCT report points out that an unknown person had posted a message on March 7 to a pro-Iranian Iraqi Shia Telegram account that called for “all silent cells” to activate, which a HAYI statement on the Liege attack later referenced.

Europe at Risk

Though these attacks have injured no one, they highlight the risk that Jewish communities (along with American-linked organizations) are facing from Iran-connected terror groups: “[T]he most elevated and complex threat environment the Jewish community and this country has seen in modern history,” according to Kerry Sleeper, the Chief of Threat Management and Information Sharing for the Secure Community Network, a Jewish security organization based in Chicago, in a statement to the Jewish Telegraphic Agency.

These incidents come as Europe deals with a complicated threat environment, amplified by the war in the Middle East. Besides any pro-Iranian or Shi’ite Islam extremist agents, European investigators are also dealing with Sunni jihadists, Russian hybrid attacks, and other ideologically motivated violent extremists from across the spectrum (far-left, far-right, anti-government, etc.), said Clarke.

Case in point, law enforcement recently detained two suspected Iranian spies who were found attempting to infiltrate a nuclear submarine base in Scotland. In addition, the Netherlands saw Mohamed (Mohi) Shafiei, a local police officer and outspoken Iranian dissident, get shot by unknown assailants; Dutch authorities are investigating whether he may have been targeted by pro-Iranian operatives.

As for HAYI, their efforts have followed a regular pattern: attack targets at night or in the morning and avoid casualties. But that may not be the case as the Iran conflict drags on further.

“[T]hings may change, and they may start targeting people, too, during the day, when it’s busy,” said Joe Truzman, senior research analyst and editor at the Foundation for Defense of Democracies, told Fox News Digital.

Subscribe now

Subscribe now

Since the outbreak of the US/Israel–Iran war on February 28, 2026, the Islamic State (IS) has treated the conflict as both a propaganda windfall and an operational opportunity. Through a sequence of Al‑Naba editorials and a renewed tempo of inspired plotting, the group has attempted to reinsert itself into the center of global jihadist dynamics and to re-energize attacks in the Western homelands. IS‑linked attackers have again struck the U.S. homeland, with the Old Dominion University shooting standing out as the most significant successful operation since the January 1, 2025, New Orleans truck attack on Bourbon Street. At the same time, the narrative constructed around the war and Ramadan is explicitly framed as global, which heightens the threat not only to the United States but also to Europe and the broader West, where IS has a long record of exploiting external wars to incite “lone actor” and small‑cell operations. The recently disrupted plot in Spain, linked to IS branches in Somalia and the Sahel, further demonstrates that the current wave of incitement is knitting together multiple regional branches into a threat network that directly targets Europe. The IS Khurasan Province (ISKP) arrest in Italy earlier this year further indicates the continued expansion of the organization’s more multivectored external operations strategy and threat to the West.

IS Incitement Propaganda and Operational Momentum Leading Up to the Conflict
In the months leading up to the US/Israel vs Iran conflict, the Islamic State’s 2025 attack and plot campaign created a foundation for intensified calls for violence against Jews, Christians, and the wider Western public across North America, Europe, and the Pacific. From New Orleans and Bondi Beach to Villach, Berlin, Mulhouse, Bielefeld, Manchester, and disrupted conspiracies in the United States, Europe, and Turkey, the group repeatedly targeted religious holidays, memorials, markets, nightlife districts, and other soft targets, thus turning Christmas, New Year, and Jewish festivals into focal points for terror. Bondi, the Hanukkah mass shooting at Sydney’s waterfront that killed 15 and injured more than 40 on December 14, 2025, became both the apex of this wave and a springboard for renewed incitement in early 2026, as IS media and supporter channels treated it as a model for lone‑actor and small‑cell operations.

Al‑Naba quickly codified Bondi’s significance. “The Pride of Sydney” celebrated the “glorious deed of Sydney,” boasted that “the Jews are bleeding in Australia’s streets,” and urged believers who had absorbed IS’ “jihadist code” online to attack Jews and “Crusaders” at festivals and gatherings, presenting online guidance as sufficient for a single reader to “set out like the whirlwind” against synagogues, churches, and holiday crowds. A subsequent editorial, “The Season of Terrorism,” framed Christmas, New Year, and Jewish holidays as a “season of terror and anxiety” for “Crusader” societies, argued that heightened security and disrupted celebrations showed the battle had been “transferred to their homes,” and urged low‑tech violence such as vehicle rammings and attacks with heavy tools so that “there be a kill with every blow.” These texts explicitly folded Jews and Christians into a single enemy category “from Yobi to Bondi” and treated any Western crowd as legitimate blood.

Read more

Subscribe now

It had previously been identified and examined as one of the kamikaze drones (One-Way Attack UAVs, OWA-UAVs) employed by pro-Iranian groups in their recent attacks. (Articles: Kamikaze Drones Used by Pro-Iranian Militant Groups in Iraq and Lebanon and Islamic Resistance in Iraq Using Stealth Kamikaze Drones)

The first guided missile to be introduced in the conflict was a short-range ballistic missile known as “The Striker” (Arabic: “Al-Qāriʿ”). It initially appeared in propaganda footage released by “Guardians of Blood Brigades” (Arabic: “Saraya Awliya al-Dam”), a subgroup affiliated with the Islamic Resistance in Iraq. In the following period, it was used in attacks targeting U.S. bases in Iraq during the escalation of hostilities in the region.

Read more

Subscribe now

After the Islamic State-inspired attack at Bondi Beach in Sydney, Australia, on December 14, 2025, the deadliest terror attack in the country, there was talk about the potential resurgence of the Islamic State Southeast Asia Province (ISEAP).

The links between ISEAP and the attack have been drawn from the fact that the two perpetrators visited the Philippines a month before conducting the operation.

The Philippines was a hot spot for ISEAP in the mid-to-late 2010s; it was even the location where over 1,000 pro-Islamic State fighters attempted to take over the city of Marawi in the country’s south for five months. This was an attempt to establish a wilayah, or province, in Southeast Asia in 2017. The siege was unsuccessful, and Marawi was retaken by the Armed Forces of the Philippines (AFP). Remnants of pro-IS groups are still active in the Philippines, though they barely have a foothold now. This has led to perceptions that the Sydney attack perpetrators potentially linked up with some of these pro-IS remnants for training or logistical support before their attack.

Australian police are now stating that the Sydney perpetrators acted on their own volition and were not part of a wider network; however, they are still investigating why they were in the Philippines, in a region previously occupied by IS fighters and presumably with remnants and sympathizers still present.

ISEAP in the Philippines Today

The ISEAP, as a cohesive organization, is essentially defunct in the Philippines, Indonesia, and Malaysia, where it had varying degrees of presence and activities. Online chatter by pro-IS supporters continues to suggest that the ISEAP and the smaller groups forming it are present and active, yet that is not true. Security forces in all the aforementioned countries have significantly cracked down on these groups and networks to the extent that the earlier regional coordination and cooperation between pro-IS groups is essentially zero.

Referring specifically to the Philippines, where the IS attempted to form a province following calls from IS-Central in Syria and Iraq, the threat of pro-IS groups has been relegated back to being lower than the threat from the communist New People’s Army (which is the longest-running insurgency in the world, currently). Even the communist threat has been diminished significantly in the Philippines, highlighting how the pro-IS remnants there are essentially unable to organize under the IS banner. There is no IS resurgence in the Philippines; the activity levels of anti-government Islamist groups are at their lowest in decades, and it is a far cry from IS-affiliated groups in West Africa, for example.

In the Philippines, there were three major IS groups (with various factions): the Maute Group, the Bangsamoro Islamic Freedom Fighters (BIFF), and the Abu Sayyaf Group (ASG). The ISEAP emir would often be picked from one of these groups following the killing of the preceding emir. Today, all of these groups fall under the banner of Dawlah Islamiyah, or the Islamic State. Taking a closer look, however, indicates how far these groups have deteriorated in capabilities. The ASG has essentially been decimated after over two decades of terror and historical ties to Al-Qaeda and major terror groups in Indonesia, such as the Jemaah Islamiyah and Jamaat Ansharut Daulah. The ASG was notorious for kidnapping and operating in the Sulu archipelago. There has been no kidnapping since January 2020, and as of last year, the ASG splinter groups have also seemed to have faded away. The Maute Group, which largely led and funded the Marawi siege, is also a sliver of what it once was, and possibly standing on its last legs. BIFF is in a similar position; last year, a BIFF sub-leader, his brother, and his son were killed in a clash with the AFP.

While a large part of the fading presence of IS groups in the Philippines is due to the AFP’s actions, it also comes from the government’s wider movement to integrate disenfranchised Muslim Moro communities who live in Mindanao and were part of groups like the Moro Islamic Liberation Front (MILF). At one point, MILF was a major internal security threat in the Philippines, but following a peace agreement and normalization, the MILF and the AFP have worked together to counter the more radical Islamist pro-IS groups that fall under Dawlah Islamiyah.

As such, recent characterizations of the Philippines and Mindanao, especially as a terror hot-spot, are false and disingenuous; the ISEAP is defunct, and the groups that comprised it are struggling to survive.

Subscribe now

Subscribe now

On March 25, 2026, Morocco dismantled an Islamic State (IS)‑affiliated cell operating across its northern cities and Spain — an operation that offers a concrete glimpse of how Islamic State Somalia (IS‑S) is becoming embedded in a wider ecosystem of transnational support structures that stretch from East Africa to Europe. While the underlying case centers on a joint Moroccan-Spanish operation led by Morocco’s Central Bureau of Judicial Investigations and Spanish security services, it also illustrates the kind of recruitment, online indoctrination, and travel facilitation pipelines that IS‑S increasingly seeks to exploit as it internationalizes and looks beyond its Puntland strongholds towards North African and European networks. In this sense, the March 2026 Morocco-Spain cell can be read as part of the broader architecture through which IS‑S content circulates into diaspora communities, sympathizers seek to move toward active combat zones, and intermediaries help connect would‑be recruits to Islamic State nodes abroad, including in Somalia.

Viewed through the lens of IS‑S’s evolution, the activities described in this case underscore three overlapping threat vectors: external operations, guided plots, and inspired attacks. External operations become more plausible as cells in Morocco and Spain develop the capability to channel money, recruits, or operational information to and from hubs like IS‑S, effectively serving as forward extensions of a Somalia-centered command and facilitation system. Guided plots are enabled when individuals in such cells receive direction, encouragement, or technical input from actors linked to IS‑S, whether on target selection, timing, or attack methods, turning local networks into instruments of a geographically distant leadership. Finally, the focus on propaganda, online radicalization, and recruitment highlights the enduring risk of inspired attacks, in which self‑radicalized supporters in Morocco, Spain, or elsewhere in Europe consume IS‑S branded or aligned content and then act on its calls to violence without direct tasking, making the March 2026 Moroccan-Spanish case a warning sign of how IS‑S’s growing reach into European spaces can translate into diverse and hard-to-predict attack scenarios. Examining this case also serves as an entry point to have a closer examination of how IS‑S itself emerged and evolved into a pivotal node within the global Islamic State movement.

IS-S has evolved from a small splinter group in Puntland into one of the most strategically important components of the international Islamic State organization and global movement, but this rise now coincides with heavy military pressure and battlefield losses. Since late 2024, a large-scale Puntland campaign, often referred to as Operation Hilaac and backed by U.S. airpower and other international support, has overrun key strongholds in the Cal Miskaad and Al Miskad mountains, killed hundreds of fighters including many foreigners, captured senior commanders, and reduced IS‑S’s territorial presence in Bari region by well over half according to Puntland officials, forcing surviving cadres into scattered hideouts and stressing the group’s command and control and recruitment pipelines. Yet even as a heavily degraded IS‑S absorbs these losses on the ground, it continues to operate as a regional and transnational command, financial, and propaganda hub with a history of international recruitment, overseas facilitation, and plots, and this combination of attrition at home and persistence in its transnational functions underpins its emerging role as a concrete external operations threat, particularly to Europe and North America.

Historical Background on IS-S’s Internationalization
IS‑S emerged in October 2015 when Abdulqadir Mumin defected from al-Shabaab with roughly thirty fighters in Puntland and pledged allegiance to the Islamic State’s central leadership. Initially a marginal faction, its prominence rose after it briefly captured the port town of Qandala in 2016 and was recognized as a province in 2017. It consolidated two main operational zones: mountain strongholds in Puntland’s Al Madow range and urban cells in Mogadishu, from which it has conducted dozens of attacks annually against Somali security forces, Puntland units, AU missions, and government officials. Despite a modest manpower estimate of 500 to 700 fighters, IS‑S’s strategic importance has grown disproportionately to its size because it increasingly functions as a regional hub for coordination, finance, and transnational recruitment.

This transformation centers on the Al Karrar regional office, established in northern Somalia by late 2018 under Mumin’s leadership. Al Karrar acts as a combined command and financial center responsible for Islamic State activity across eastern, central, and southern Africa, including Islamic State Central Africa Province in the Democratic Republic of Congo and the Mozambique Province. United States and United Nations reporting now describe Al Karrar as one of the movement’s most important leadership and revenue generation structures worldwide, with some assessments suggesting that Mumin may hold a broader global role beyond Somalia.

Read more

Subscribe now

The recent resurgence of fighting in northern Mozambique is once again triggering alarms among observers. Attempts to resolve the violence are threatened by politics from elsewhere in Africa.

Data recently released by ACLED’s Mozambique Conflict Monitor for the first two weeks of March 2026 paint a somewhat bleak picture for the region. During the period covered, there were at least five incidents of political violence documented in the country. These resulted in the deaths of around 30 people, with at least two of the fatalities being civilians. The Islamic State Mozambique (ISM) was found to have been behind four additional events across Mozambique.

The numbers for the length of the insurgency may show why the interest in the country appears to be lackluster, to place it mildly. Since October 1, 2017, there have been a total of 2,338 acts of violence in Cabo Delgado. A total of 6,498 fatalities have occurred, with 2,721 of the deaths being civilians. ISM has launched 2,168 recorded attacks across the rest of the country. The situation in northern Mozambique is drawing some interest now in Washington.

It appears that an attempt by the Mozambican security forces to drive militants from the Catapu Forest Reserve in early February 2026 failed. Subsequently, the militants have been able to use the forest as a base of operations. Their presence in the forest also gives the militants the ability to contest control of the N380 Motorway. This is a major economic lifeline in the province, and militants’ ability to interrupt normal traffic flows presents a serious challenge to the government to provide services to the citizens, let alone disrupting commerce.

Recently, other events outside Mozambique may impact how the country will address this situation. Over the last couple of years, Rwanda has been a major security partner for the Mozambique government. In recent weeks, events regarding the situation in the Democratic Republic of Congo may modify if not end the Rwandan role in combating this insurgency.

The Rwandan presence in Mozambique has been underwritten by the EU since 2022 for 20 million Euros, or 23 million US Dollars. Earlier this month, the EU announced that after the current funding expires in May 2026, it would not renew the funding. The timing of this announcement is interesting to say the least. It comes after the U.S. has sanctioned the Rwandan military for not implementing the Washington Accords. This deal is designed to restore peace and improve the economies of both countries. It is fair to assume that the sanctions may have inspired the EU decision to halt funding to the Rwandan mission. The Rwandan military has stated that if the funding is not restored, it will then withdraw their troops from Mozambique.

This move places Mozambique’s Maputo in a precarious state. It still has an insurgency raging in its northeast, and the major ally that was aiding in counterinsurgency operations is having its funding cease over another issue in Central Africa.

The President of Mozambique, Daniel Chapo, has travelled to Brussels in order to have the funding restored. Currently, there are no reports on whether this trip will be successful. We might not find out the answer until June. Stalled funding is sure to give ISM time to rest and regroup for a new offensive.

Subscribe now

Subscribe now

On the night of March 11 to 12, fighters linked to the Islamic State Central Africa Province (ISCAP) mounted a coordinated assault on Chinese gold mining facilities in Muchacha and nearby Mavuvu in Mambasa territory, Ituri province, in northeastern Democratic Republic of Congo (DRC). People were killed or kidnapped while others fled the area. This ISCAP attack on Chinese run-mining sites in the DRC is notable not only for its brutality, but because it may mark an expansion of Islamic State’s anti-China campaign from Asia into Africa, where previous IS attacks on Chinese interests and nationals have been almost exclusively concentrated in South and Central Asia. The operation in northeastern Ituri therefore needs to be read alongside a nearly decade-long record of Islamic State (IS), and especially Islamic State Khorasan Province (ISKP), targeting Chinese nationals, projects, and symbols as part of a broader propaganda and operational strategy that casts China as both an oppressor of Muslims in Xinjiang and an exploitative power across conflict-affected regions. Furthermore, it marks the second IS attack against Chinese interests in less than two months — the other being a suicide bombing in Kabul in mid January.

For this latest attack, soldiers from the Allied Democratic Forces (ADF), which had pledged allegiance to ISCAP, mounted the assault in Ituri. Targets included installations linked to the Chinese Kimia or Kimiya Mining Enterprise and MCC Resources, which operate industrial gold sites in the area. The attackers first struck Congolese army positions guarding the perimeter, then overran the mine itself, according to official statements and subsequent reporting. Islamic State propaganda released soon after claimed responsibility and circulated photographs showing fighters attacking the barracks, entering the Chinese-run site, torching vehicles and heavy equipment, and burning workers’ living quarters and camp structures. Images and local reports described extensive destruction: trucks, tractors, processing infrastructure, accommodation blocks burnt, and with the Muchacha site left heavily damaged.

Read more

Subscribe now

It had previously been identified and examined as one of the kamikaze drones (One-Way Attack UAVs, OWA-UAVs) employed by pro-Iranian groups in their recent attacks. (Article: Kamikaze Drones Used by Pro-Iranian Militant Groups in Iraq and Lebanon)

More recently, the Islamic Resistance in Iraq (IRI) has begun employing a new model of kamikaze drones. These drones are the Iranian-manufactured “Hadid-110”.

Read more

Subscribe now

On January 3, during a U.S. military operation in Caracas supported by the Department of Justice and the Central Intelligence Agency (CIA), Nicolás Maduro and his wife, First Lady Cilia Flores, were captured and transferred to the United States. Maduro was taken into federal custody in New York and is currently held at the Metropolitan Detention Center in Brooklyn. Both have pleaded not guilty.

U.S. prosecutors allege that Maduro, Flores, their son Nicolás Ernesto Maduro Guerra, and several senior officials led a long-running cocaine-trafficking conspiracy, collaborating with drug cartels designated as terrorist organizations. According to the indictment, the group abused positions of public trust and corrupted state institutions to move tons of cocaine into the United States as part of what authorities describe as a “narcoterrorism” operation.

The 25-page indictment filed in the Southern District of New York claims the scheme began in 1999, when Maduro entered public office, and involved systematic drug trafficking, violence, and intimidation.

Prosecutors allege Flores accepted hundreds of thousands of dollars in bribes in exchange for facilitating drug shipments and that the couple used state-backed gangs to enforce their operation through kidnappings, beatings, and killings.

Maduro’s son is accused of transporting drug shipments via military flights to Margarita Island and of helping arrange large-scale cocaine shipments to Miami and New York, including discussions about routing lower-quality cocaine to New York and concealing drugs in cargo and scrap-metal containers.

Also charged are current and former interior ministers Diosdado Cabello Rondón and Ramón Rodríguez Chacín. Cabello is accused of coordinating cocaine shipments with Colombian traffickers bound for Mexico and the U.S., while Rodríguez Chacín allegedly sheltered FARC operatives and accepted bribes to protect them.

All defendants are accused of having partnered with narco-terrorist organizations, including Colombia’s Revolutionary Armed Forces of Colombia (FARC), the National Liberation Army (ELN), Mexico’s Sinaloa Cartel and Los Zetas, as well as the Venezuelan criminal group Tren de Aragua (TdA). The indictment also names TdA’s leader, Héctor Rusthenford Guerrero Flores, also known as “Niño Guerrero,” as a co-conspirator. Tren de Aragua is the only Venezuelan criminal organization explicitly cited in the document, underscoring its central role in the narcotics trafficking network.

Since September 2025, President Donald Trump’s administration has struck more than 45 boats found sailing near the shores of Venezuela, with Defense Secretary Pete Hegseth accusing them of smuggling drugs and committing acts of narco-terrorism.

Besides accusations that Venezuela President Nicolas Maduro and his regime are narco-terrorists, Trump and Hegseth have also accused members of Tren de Aragua, Venezuela’s most powerful criminal organization, of using these boats to smuggle drugs and other contraband.

Eliminating TdA could be a tall order due to the nature of the group’s organization and its vast network that reaches beyond Venezuela. What follows is an introduction about TdA’s origins, key figures, its connections with the government, and its activities in the rest of Latin America.

Origins and Growth

Tren de Aragua (TdA), like many other Latin American gangs, was born inside prison, specifically the Tocorón facility in the state of Aragua in Venezuela, from which it takes its name, in 2014. (Tren means train, so the name of the organization is Aragua Train in English.)

In just over a decade, TdA has grown into a transnational criminal organization operating across much of Latin America. Its activities include drug trafficking, extortion, prostitution, migrant smuggling, and control of illegal mining. In February 2025, the Trump administration designated it both a Foreign Terrorist Organization (FTO) and a Specially Designated Global Terrorist (SDGT).

“This brutal criminal group has conducted kidnappings, extorted businesses, bribed public officials, authorized its members to attack and kill U.S. law enforcement,” the U.S. State Department declared in its announcement.

TdA’s rapid expansion across Latin America has been driven by its flexibility and adaptability. It functions as a living organism: a central leadership coexists with semi-autonomous cells. But unlike other criminal organizations, such as First Capital Command (PCC) or Red Command aka Comando Vermelho in Brazil, which both originally emerged inside prisons as movements to defend inmates’ rights, TdA was born out of then-President Hugo Chávez’s 2005 decision to quell prison violence by handing internal control to inmate gang leaders — the pranato.

The case of Luidig Guillermo Ochoa Fajardo is emblematic of the unforeseen results from this decision. Before his release in 2008, he was Tocorón’s second-in-command, known as the “lucero,” controlling three prison floors. He later attempted redemption through an animated series, Prison or Hell, depicting the horrors of incarceration.

“At Tocorón, you either kill, or you’re killed,” he told this reporter in Caracas in 2012.

Two years later, he was murdered—according to his mother, “assassinated by the government.”

In 2014, TdA was born with Héctor Rusthenford Guerrero Flores, better known as Niño Guerrero, as the top leader of the TdA.

Onward, under Guerrero’s leadership, Tocorón prison was transformed from Ochoa’s “hell” into a luxury resort with a swimming pool, zoo, and oyster bar—echoing Pablo Escobar’s style. This strategy created a parallel state, multiplied recruitment, and stockpiled weapons from assault rifles to explosives. From this prison-turned-command center, Guerrero slowly expanded TdA beyond Aragua to the rest of Venezuela, infiltrating local economies through stolen auto parts, black-market food, gambling, extortion of small businesses, and kidnappings for ransom—even targeting Venezuelan migrants abroad, as seen in Mexico and Guatemala.

Since 2018, TdA has imposed brutal control over gold mines and communities in Las Claritas in Venezuela, forcing miners to pay protection fees in gold. Enormous profits were reinvested in weapons, vehicles, and corruption, making gold the group’s primary asset. The organization has also expanded into human smuggling and contraband, capitalizing on the Venezuelan migration crisis in Brazil, Chile, and Peru.

Guerrero, 41, was sentenced in Venezuela to 17 years for murder, human trafficking, and smuggling — credited with turning what began as a small gang into a sprawling hydra-like structure that has expanded across the hemisphere. He has been on the run since September 20, 2023, when a massive police operation involving 11,000 officers retook control of Tocorón prison. Guerrero escaped through a tunnel with the help of corrupt guards and has remained a fugitive ever since. Washington has offered a $5 million reward for his capture.

Political Connections in Venezuela

Political ties have long been a strength. When Tareck El Aissami — later a Maduro minister — was governor of Aragua, he reportedly used TdA as a paid workforce. Evidence has since emerged linking the group directly to Maduro’s entourage. Photographs of dismembered TdA leader Carlos Breaker were found on the phones of the narcosobrinos—Efraín Antonio Campo Flores and Francisco Flores de Freitas, nephews of Maduro’s wife, Cilia Flores. These two nephews were arrested in 2015 in Haiti by the DEA while trying to traffic 800 kilos of cocaine to America. Venezuelan media reported Breaker was executed in 2015: electrocuted and dismembered in an internal feud. American investigators believe the photos and WhatsApp chats show how TdA operated as hitmen for the regime’s illicit interests.

“Under the cover of ideological revolution, Venezuela had in many ways become a criminalized state. The central government maintained its grip on power, but beyond the presidential palace, much of the country had slipped into fiefdoms, given over to political loyalists who could use criminal gangs to enrich themselves as they saw fit,” writes Chris Dalby in his book Tren de Aragua: The Guide to America’s Growing Criminal Threat.

Dalby describes a country where elements of the Bolivarian armed forces morphed into syndicates like the “Cartel of the Suns” — a network of senior military commanders facilitating cocaine exports, protecting cartels, and enriching themselves through drug and gold smuggling.

Even Maduro’s much-publicized 2023 reconquest of Tocorón — with 11,000 troops — was criticized as a sham. According to Infobae, TdA members had been tipped off and escaped through tunnels. Rather than weakening TdA, the operation strengthened it: half its members fled Venezuela along migrant routes to Brazil, Chile, Colombia, and Peru.

A 2024 U.S. Customs and Border Protection intelligence report noted TdA “has expanded its criminal presence throughout Latin America to include Bolivia, Brazil, Chile, Colombia, Costa Rica, Ecuador, Guatemala, Honduras, Panama, Peru, Nicaragua, and Mexico. TdA’s leadership has directed key members to new countries, including the United States and Canada, to oversee new criminal revenue streams.”

Tren de Aragua in Brazil

Brazil is increasingly strategic for TdA because of its proximity to Venezuela’s Bolívar state, where the group has grown its influence over the gold trade. It also reflects TdA’s broader criminal dynamics: exploiting Venezuelan migration flows to move both people and members, while forging strategic criminal alliances to expand power—at the cost of worsening violence statistics. According to the Special Action Group Against Organized Crime (GAECO) in Roraima, Brazil, the number of Venezuelans incarcerated in the state has surged 538 percent in the last six years, representing nine percent of the prison population — rising from 77 inmates in 2018 to more than 400 in 2024.

Brazilian authorities say TdA has also begun infiltrating local prisons, collaborating with Brazil’s largest criminal syndicate, the First Capital Command (PCC), particularly in border states such as Roraima, Amazonas, Paraná, Santa Catarina, and Rio Grande do Sul, to control the flow of people, drugs, gold, and weapons. A 2020 report from Roraima’s state prosecutor’s office had already warned: “There are 740 Venezuelans who are part of the PCC in Roraima,” and “this criminal organization has formed an alliance with the Venezuelan criminal structure Tren de Aragua.”

Guerrero may be hiding in Brazil or transiting through the country on a regular basis, according to Brazilian investigative sources. Guerrero’s possible presence in Brazil may have been facilitated by the porous border with Venezuela and the uncontrolled flow of Venezuelan migrants through the state of Roraima in Brazil, many of whom flee periodically from Nicolás Maduro’s regime.

“It is possible that Niño Guerrero is in Brazil, because all Venezuelans need to cross the border is a self-declaration. They don’t even need to present documents or give their names to immigration officers. They can walk across the border without going through checkpoints. Given the long land border with Venezuela, anyone can enter our territory simply by moving one kilometer away from official posts,” said Wesley Costa de Oliveira, Chief of Staff for the Suppression of Criminal Organizations in Roraima state, in an interview with Brazilian VEJA magazine.

In Boa Vista, Roraima’s capital, authorities arrested Juan Gabriel Rivas Núñez, alias Juancho, in November 2023. Leader of the “Banda Venezolana de Juancho,” a long-established group in southern Bolívar in Venezuela, he worked with TdA in illegal gold trafficking. His organization controlled illegal mining and smuggling in Las Claritas, Venezuela, near the borders with Brazil and Guyana.

Rivas Núñez, a 43-year-old Colombian who obtained Venezuelan nationality and multiple fake identities thanks to government connections, has been accused of murder, arms trafficking, extortion, and violence against indigenous communities, particularly the Arawak. Venezuela requested his extradition, which Brazil’s Supreme Federal Court granted in April 2025. However, he escaped house arrest by giving his electronic ankle monitor to a look-alike decoy. His current whereabouts remain unknown.

Two other top TdA fugitives who may be moving with Guerrero in Brazil are his right-hand man, Yohan José Romero (alias Johan Petrica), and Giovanni Vicente Mosquera Serrano. Petrica, 47, runs the group’s illegal gold mines in Venezuela, especially around Las Claritas, and also supplies TdA with military-grade weapons. In 2018, he appeared in Brazil under his real name to register his son’s birth in Boa Vista, where he owns multiple properties. The United States has offered $4 million for his capture.

Mosquera Serrano, 37, appeared on the FBI’s Ten Most Wanted list in July 2025, accused of coordinating TdA operations ranging from drug and human trafficking to arms smuggling and violent crimes in the U.S. Washington is offering $3 million for his arrest.

Journalist Donna Rísquez, author of the book El Tren de Aragua, has also reported that group co-founder Larry Amaury Álvarez Núñez, alias Larry Changa — who was arrested in Colombia in 2024 while operating in Chile — regularly sent money to Brazil as well as Venezuela and Spain.

Expansion Elsewhere in Latin America

TdA’s expansion into Mexico is especially concerning — for its control over migrant routes, often involving ransom kidnappings, and for its proximity to Mexican cartels. Mexico Security Secretary Omar García Harfuch confirmed in December 2024 that TdA members “are engaged in sexual exploitation and human trafficking.”

In July 2025, Chilean authorities uncovered 14 shell companies set up between 2020 and 2024 to launder $13.5 million via bank transfers and cryptocurrency. Chilean prosecutor Trinidad Steinert confirmed these profits stemmed from “human trafficking, murders, kidnappings, extortion, migrant smuggling, drug trafficking, and ‘fines’ imposed on anyone entering TdA-controlled territory.”

“What we are seeing is that Tren de Aragua is copying the money-laundering strategies developed by the Sinaloa Cartel or Jalisco New Generation Cartel,” Mexican security analyst David Saucedo told DW.

Analysts believe TdA may also move into synthetic drug markets, where there is more space for new players than in cocaine. In July 2025, Colombian authorities arrested two members wanted by a U.S. federal court in Colorado: Luis Alejandro Enríquez Charaima, alias Álex, and Luis Fernando Uribe Torrealba, alias Luisito. They are accused of arms trafficking, conspiracy, synthetic drug trafficking, and theft. They were caught in Medellín preparing tusi (known as “pink cocaine”). Colombian authorities said their goal was to expand TdA’s operations in the U.S., setting up clandestine labs for tusi and ketamine.

Though no evidence currently links TdA to Chinese organized crime, particularly the Bang de Fujian, Chile may become a hub for future alliances — not only in synthetic drug trafficking but also in laundering illicit proceeds. Chile’s Public Prosecutor’s Office reports that more than 400 organized crime groups now operate in the country, from Mexican cartels to Chinese mafias, alongside the PCC, Comando Vermelho, Colombia’s ELN, and the FARC. This crowded criminal landscape will almost certainly fuel TdA’s growth unless international cooperation improves through constant intelligence sharing and joint enforcement operations.

Strategic Implications

The new U.S. strategy is already reshaping the tactics of criminal organizations operating across the region. Instead of relying on high-speed “go-fast” boats — now increasingly vulnerable to drones and precision strikes — trafficking networks are dispersing shipments across multiple smaller, low-profile vessels.

At the same time, the use of semi-submersibles and narco-submarines, which are far more difficult to detect by radar or aerial surveillance, appears to be rising.

In February, Colombian authorities intercepted a semi-submersible carrying nearly ten tons of cocaine and arrested its four-member crew. The shift is also affecting trafficking routes. Land corridors are once again gaining importance, particularly those running through Colombia, Central America, and Mexico — a trend documented in recent investigations by InSight Crime, which note that trafficking groups routinely adapt routes in response to intensified maritime interdiction.

Should traffickers increasingly rely on commercial shipping — concealing cocaine in cargo containers rather than transporting it aboard smuggling vessels — criminal networks are likely to deepen their infiltration of ports and logistics companies. Analysts from the Global Initiative Against Transnational Organized Crime warn that containerized trafficking has become one of the fastest-growing methods used by transnational criminal organizations, precisely because it relies on corruption and infiltration of legitimate trade infrastructure.

The tactical removal of Maduro could further accelerate this transformation. Criminal groups may begin operating more like insurgent networks, with decentralized cells, diversified criminal portfolios, and greater reliance on encrypted communications. Networks linked to the so-called Cartel de los Soles — the military-connected trafficking structure long associated with Venezuela — could fragment into competing factions.

A range of actors, including transnational criminal networks such as Tren de Aragua, armed colectivos and elements of the state apparatus, are likely to compete for control of lucrative territories and illicit markets. The resulting instability could spill across the 2,200-kilometre border with Colombia, where groups such as the National Liberation Army (ELN) and dissident factions of the Revolutionary Armed Forces of Colombia already hold territorial influence.

Subscribe now

Subscribe now

A protest and counter-protest outside the New York City mayoral residence were suddenly disrupted Saturday, March 8, when two young men attempted to light and throw two improvised explosive devices (IEDs). Emir Balat, 18, and Ibrahim Kayumi, 19, were arrested. During and after their arrest, both of them referenced the terrorist group Islamic State (IS) as the inspiration for the plot, with Balat writing a shortened “bayah” to IS on a piece of paper.

Based on videos from the scene and the description of events in the criminal complaint, it appears that the targets were an anti-Muslim march led by white nationalist activist Jake Lang and New York Police Department (NYPD) officers. Whether the officers were the intended target originally or merely targeted in reaction to their spotting Balat is unclear. On video, Balat clearly threw the first IED at the anti-Muslim protest. Balat can be heard shouting “allahu akbar … [unintelligible],” with someone off-camera twice echoing “allahu akbar.” Balat grabs the second device from Kayumi and lights it, subsequently tossing it at a group of NYPD officers after they started chasing him.

Luckily, both IEDs failed, with one extinguishing upon impact and the second fuse quickly going out. A third device did not contain explosive material, but a storage facility elsewhere held an unspecified amount of additional material. Components for and notes about manufacturing IEDs were found in the suspects’ vehicle. Tests of the explosive material inside at least one of the devices showed that the material was TATP (triacetone triperoxide), the commonly recommended primary explosive of the Islamic State. Its high volatility has attracted doubts from online supporters, with its improper production killing two supporters in Alcanar, Spain, in 2017.

Its successful manufacturing here demonstrates its continued use by global supporters with limited to no expertise in explosives making.

The listed precursor components contained in the pair’s notebook appear to match the recipe for TATP published as part of the pro-Islamic State Al Saqri Foundation for Military Sciences’ “Easy Explosives” article series. This recipe calls for sulfuric acid, in contrast to older Islamic State TATP recipes that still circulate frequently on encrypted social media channels dedicated to this topic. Al Saqri Foundation’s recipe for TATP is not currently shared on its main social media channel, suggesting either Balat and/or Kayumi were in contact with the foundation’s representatives. This likely contact and the pair’s further notes on IED materials suggests Islamic State members might have provided some level of coaching, making this plot more than merely “inspired” by the terrorist group.

Read more

Subscribe now

Following the killing of Ayatollah Ali Khamenei and the intense strikes carried out by Israel and the United States against Iran, several Iran-backed groups operating in Iraq and Lebanon launched a series of attacks targeting Israel, the United States’ assets abroad, and their allies, some of which were carried out using kamikaze drones, also known as One-Way Attack Unmanned Aerial Vehicles (OWA-UAVs).

Read more

The Reichsbürger, a galaxy of German monarchists and right-wing extremists who style themselves as “citizens of the Reich,” have appeared more frequently in international news in recent years. This is due to incidents like the attempted assault on the German parliament in August 2020 and the large-scale anti-terrorism police operation against the coup-plotting group “Patriotische Union” in December 2022.

The term “Reichsbürger” describes a very heterogeneous conglomerate of groups and individuals who hold different beliefs, which are sometimes even in conflict with each other. (Some of their adherents can be thought of as similar to “sovereign citizens” in the United States.) However, all are crucially linked by the fundamental idea that the current BRD—Bundesrepublik Deutschland (German Federal Republic—is illegal or non-existent and that the former German Reich is instead still the valid and active political form of the German nation. The Reichsbürger scene is also deeply interlinked with the so-called Selbstverwalter (self-government individuals—again, taking us back to our sovereign citizen-types). Security authorities heavily monitor the Reichsbürger movement primarily because some of its members have access to weapons, and most if not all are heavily influenced by extremist ideology. Although the government and police have dismantled nonviolent Reichsbürger groups, the threat of violence remains the key concern. This was demonstrated in 2016 when a Reichsbürger killed a police officer for the first time.

The political and ideological constellation of the Reichsbürger and Selbstverwalter is complex to analyze due to its granularity, but several of its structural elements and tendencies can be explored in depth.

Share

The Ideologies of the Reichsbürger and Selbstverwalter

The Reichsbürger and Selbstverwalter milieu contains a wide range of positions, beliefs and ideologies. The scene began to develop substantially in the 1980s, incorporating political instances ranging from anti-democratic Second Reich monarchism to spontaneous right-wing libertarianism, from ethnonationalist ultra-racism to Third Reich Nazi-nostalgia. The core ideological belief is that the BRD - Bundesrepublik Deutschland is not sovereign and never was, and that the German Reich still exists, usually within the 1871 or 1937 borders. A fundamental conspiracy theory is that the BRD was not established as a national state but rather as a private company (a German GmbH) that simply continues to administer the country under the Allies’ ongoing post–World War II occupation. Accordingly, the current German Basic Law is rejected and the laws of the BRD are considered “general terms and conditions” that can be accepted or refused by individual citizens. All of these perspectives are based on a deep, extreme and absolute distrust of the German liberal-democratic state and its bureaucratic representatives. This framework produces a variety of political stances, including a strong push toward internal separatism, which aims to establish parallel, self-isolated state structures. Examples are the so-called “Exilregierungen” (“governments from exile”) or the “KRR - Kommissarische Reichsregierungen”, self-declared provisional Reich governments with their own “ministers” and “chancellors”. These entities, which can be quite surreal, are created by Reichsbürger groups that often compete with each other and all claim to be entitled to renegotiate the status of the German Reich with the current governments of the countries that won World War II. These anti-state and anti-government positions are clearly and deeply reactionary and far distant from any anti-state project elsewhere along the libertarian spectrum, since the current German state is usually set to be replaced by a more authoritarian one.

Read more

Subscribe now

The Kurdistan Freedom Party (Partî Azadîyê Kurdistan, PAK) is an armed separatist militant organization operating in Iran, while its headquarters are located within the Kurdistan Regional Government in northern Iraq.

The PAK organization maintains cells in several cities across Iran, including the capital, Tehran, and carried out a number of armed attacks against Iranian security forces during the anti-regime protests that began in December 2025.

Read more

Subscribe now

A deadly bombing at the Chinese Noodle restaurant in Kabul’s Shahr‑e‑Naw district, which killed at least six Afghans and one Chinese national and injured many others, marks the latest flashpoint in the steadily intensifying confrontation between the Islamic State’s Khorasan Province (ISKP) and China. Claimed by the local Islamic State branch, the attack struck a venue run by a Chinese Muslim from Xinjiang in a heavily guarded area of the capital, starkly illustrating both the vulnerability of Chinese nationals in Afghanistan and the limits of Taliban security guarantees at a moment when Beijing is pressing Kabul to deliver stronger protection for its citizens and investments.

The official Islamic State (IS) claim noted that the suicide bomber “entered the hotel and stayed there for nearly 30 minutes, waiting for a large number of Chinese to gather, before detonating his explosive vest among them, causing significant destruction to the hotel.” “Chinese hotel visited by Chinese nationals in the secure “Shahr-e Naw” area, which houses embassies and government offices and is inhabited by officials and foreigners in the center of Kabul”. The statement concludes by putting China on notice, asserting “The Islamic State in Afghanistan has placed Chinese nationals on its target list, especially in light of the increasing crimes committed by the Chinese government against the persecuted Uyghur Muslims.”

Read more

Subscribe now

Nigeria’s domestic insecurity has increasingly been instrumentalized within U.S. foreign policy discourse. In November last year, President Donald Trump threatened direct kinetic intervention to counter a so-called “Christian genocide” in Nigeria. Despite these claims, insecurity is driven by overlapping and long-standing land disputes, herder-farmer tensions, communal violence, and organized crime, with the vast majority of victims of militant violence in northern Nigeria being Muslim. Washington’s framing of the crisis through a religious lens, therefore, reflects political utility rather than empirical accuracy.

Washington’s strategic recalibration in West Africa has occurred alongside an ongoing decline of U.S. influence across the Sahel. Following Niger’s 2023 coup, the United States lost its primary intelligence hub at Air Base 201 near Agadez, while Chinese and Russian engagement expanded as junta-led governments increasingly distanced themselves from Western security partnerships. Since its expulsion from Niger in 2024, Washington has sought to reconstitute its regional intelligence and security posture, with Nigeria emerging as a central anchor for U.S. engagement. These have efforts have been made visible shift has bed by a marked increase in U.S. intelligence, surveillance, and reconnaissance (ISR) activity over Nigeria since late November, with flights reportedly originating from Ghana—underscoring Washington’s efforts to project influence and maintain situational awareness outside the Alliance of Sahel States (AES), including through partners such as Ghana, Benin, and Chad.

After weeks of escalating rhetoric, President Trump announced on December 26 that U.S. forces had conducted airstrikes against “Islamic State elements” in Nigeria. The operation is considered to be one of Washington’s most direct kinetic interventions in Nigeria’s domestic security landscape to date. On Christmas Day 2025, in coordination with Nigerian authorities, U.S. forces struck targets in the north-western state of Sokoto, ostensibly targeting Islamic State-linked militants operating under the label “Lakurawa.” The strikes were conducted using MQ-9 Reaper unmanned aerial vehicles and at least sixteen GPS-guided precision munitions launched from platforms in the Gulf of Guinea. The strikes were framed as a pre-emptive effort to prevent Islamic State elements from “penetrating Nigeria from the Sahel corridor.”

Despite the recent Sokoto strikes targeting “Islamic State militants” associated with Lakurawa, the term itself remains loosely defined, locally encompassing several intersecting but operationally disparate actors. Local accounts suggest that some Lakurawa-linked militants are also affiliated with al-Qaeda-aligned Jama’at Nusrat al-Islam wal-Muslimin (JNIM). Open-source reporting further indicates that “Lakurawa” is used interchangeably to describe Salafi-jihadist cells, criminal militias, and bandit networks, while some fighters may maintain ideological or operational linkages with the Islamic State Sahel Province (ISSP) or JNIM. Attribution remains inconsistent, and evidence of a consolidated Islamic State base in Sokoto remains limited.

Nearly three weeks on, the “Christmas Day” operation raises more strategic questions than it resolves. Sokoto is not Nigeria’s primary jihadist epicentre, and Lakurawa’s status as a structured Islamic State affiliate remains contested and tenuous. Meanwhile, the country’s most entrenched and operationally mature Islamic State faction — the Islamic State West Africa Province (ISWAP) — continues to consolidate its presence in northeastern Nigeria and along the periphery of the Lake Chad Basin. It has consolidated terrorists in the region through an elaborate system of governance, filling gaps in the state apparatus, and through its increasingly central role in the regional Islamic State network, including hosting the Al-Furqan media office.

In light of this, scrutiny has centred on why strikes in the northwest were prioritized over operations in the northeast — where Islamic State is most active in Nigeria — and over ISWAP, whose primary areas of operation remain concentrated in Borno and Yobe states following its 2016 split from Boko Haram. Several explanations have emerged. Part of the rationale appears symbolic, with Sokoto’s historical status as the seat of the 19^th century Sokoto Caliphate amplifying its political resonance. Lakurawa’s alleged links to the Islamic State Sahel Province (ISSP) — active in the Liptako-Gourma tri-border region and recently linked to several external plots in North Africa — may also have aligned with the Trump administration’s preference for targeting Islamic State affiliates framed as transnational threats.

The choice of Sokoto as a target of U.S. airstrikes is therefore significant. Beyond its proximity to Niger and Sahelian transit routes, the state holds symbolic importance as a historic and spiritual centre of Islam in Nigeria. It has also suffered escalating banditry, kidnappings, raids, and extortion. Moreover, from Washington’s perspective, ISSP may represent a model of transnational jihadist expansion exploiting governance vacuums and coup-induced instability.

By contrast, northeastern Nigeria remains the country’s jihadist heartland. Boko Haram splinter factions ISWAP and Jama’atu Ahlis Sunna Lidda’awati wal-Jihad (JAS) retain territorial influence across Borno State, anchored in the Lake Chad Basin, Sambisa and Alagarno forests, and cross-border corridors. ISWAP has evolved into one of the Islamic State’s most strategically significant African affiliates. In this context, the Sokoto strikes appear vastly misaligned with Nigeria’s most acute jihadist threat.

Trump has continued his escalatory rhetoric in a New York Times interview last week, stating: “I’d love to make it a one-time strike… But if they continue to kill Christians, it will be a many-time strike.” Following the Christmas Day strikes, U.S. ISR operations expanded over the north-eastern Borno state, including over the Sambisa Forest and the Timbuktu Triangle, and Washington delivered “critical military supplies” to Abuja. Yet kinetic interventions are unlikely to generate durable gains against Boko Haram’s decade-long insurgency, which escalated sharply in early 2025 as a result of a series of successful ISWAP operations.

The Nigerian Air Force (NAF) has performed poorly in its strike campaigns. Significant collateral damage and high civilian casualty rates resulting from Nigerian air strikes have eroded legitimacy and heightened domestic grievances vis-à-vis the state. Integrating U.S. systems into Nigerian operations reflects both the perceived precision of American platforms and the political utility of externalizing responsibility when operations fail. Persistent structural deficiencies within the Nigerian military mean that, despite significant defence spending, state forces have been consistently overwhelmed by jihadist groups.

ISWAP’s recent territorial and operational gains have been driven by these deficits, reinforcing perceptions of state fragility. Nigerian forces suffered high-visibility setbacks during the Islamic State’s “burn the camps” campaign in early 2025. Abuja has consequently prioritized short-term symbolic victories over long-term capacity building, deepening an asymmetric dependency on U.S. military assistance.

Last year alone, ISWAP carried out more than 300 attacks against military compounds, critical infrastructure, and civilian communities. These battlefield successes are, in part, a product of increased direct support from the Islamic State (IS) core, as well as tactical innovation, streamlined skill-sharing between IS affiliates, and the diffusion of advanced weaponry, alongside Sahelian geopolitical realignments toward Russia and China. Simultaneously, regional military cooperation has deteriorated in recent years. Niger’s withdrawal from the Multinational Joint Task Force in March 2025 disrupted intelligence-sharing and joint operations, while Chad’s threatened exit underscores the Task Force’s fragility. Strained Abuja-Niamey relations have further created operational vacuums along the Niger-Nigeria border, which jihadist and criminal groups have been quick to exploit.

Operationally, ISWAP has increasingly deployed explosive-rigged commercial drones. Initially used for reconnaissance and propaganda, these systems have since been weaponized — a trend observed across West Africa since late 2024. Influxes of foreign fighters arriving via the Bosso corridor further indicate rising funding, expertise, and external facilitation from the Islamic State core. ISWAP has integrated emerging technologies across surveillance, mobility, financing, and strike functions. Its use of drones, satellite navigation, digital financial channels, and complex VBIED construction reflects a concerted realignment with contemporary conflict environments. These adaptations have expanded ISWAP’s reach and lethality, enabling coordinated attacks on hardened targets even in the face of concerted state counterinsurgency pressure.

The Nigerian military, meanwhile, remains overstretched, under-resourced, and internally compromised. Embezzlement, poor soldier welfare, and logistical sabotage have undercut operational effectiveness, leaving state forces impotent in localized contests against jihadists. Vigilante groups and informal militias increasingly fill security gaps, increasing the likelihood of intercommunal violence in the absence of a state monopoly over the use of force, further fragmenting Nigeria’s security landscape.

Subscribe now

Subscribe now

For over a decade, Islamic State (IS) and its affiliates, such as Islamic State Khorasan Province (ISKP), have refined a strategic doctrine that transforms great power rivalry, regional conflicts, and stretched Western security resources into operational advantages. As geopolitical tensions intensify and great power competition accelerates across multiple theaters, U.S.-China strategic rivalry in the Indo-Pacific over Taiwan and trade wars, Russia-West confrontation in Eastern Europe and the Middle East, Western retrenchment from the Sahel enabling Russian influence expansion, and regional power struggles involving Iran, Israel, and Gulf states, IS has positioned its jihadist operations within these fault lines to maximum effect.

The recent Al-Naba editorials (issues 526, 527, and 528) released between December 11, 2025, and January 1, 2026, represent not an isolated surge in incitement, but the culmination of a long-established pattern: capitalizing on divided attention, stretched resources, and the inability of competing powers to maintain unified counterterrorism coordination. This doctrine, articulated through sophisticated propaganda, validated through high-profile attacks, and sustained across multiple theaters, reveals IS as an organization that has internalized the mechanics of asymmetric warfare in a multipolar world fractured by competing strategic priorities.

Read more

Subscribe now

The beginning of 2026 was marked in Germany by a serious attack on the country’s power grid, affecting hundreds of thousands of people in Berlin during the cold early days of January, followed by another attack that got less attention, just outside of Düsseldorf in the village of Erkrath. Both attacks were acts of arson claimed by “left-wing” groups.

In the early morning hours of January 3rd, electrical distribution cables crossing a bridge over the Teltow Canal leading to the gas-fired Lichterfelde power plant were seen in flames. What was soon determined to be an act of arson disrupted power to some 45,000 homes and 2,200 businesses across southwest Berlin—including hospitals and other critical infrastructure—according to German and Western news outlets. For many, the power took up to five days to be restored. The attack was claimed by a known militant eco-activist group, Vulkangruppe—or “Volcano Group”. They denied that so many people would be affected when they released their claim the following day. Major news outlets further report that the effects of the outage included burglaries, train stoppages, and heating outages.

Vulkangruppe has been active since circa 2011 and has a notable resume of similar non-lethal sabotage actions, mainly arson attacks, targeting infrastructure, Big Tech, industrialists, and other perceived enemies of the earth and the environment. In 2024, they attacked an electricity pylon using an improvised incendiary device (IID), shutting down a Berlin-area Tesla auto factory for several days.

It is important, in this article, to examine sections of the claim that was released on an anti-authoritarian website the morning after the direct action. The header for the claim, which was repeated, reads “Shutting down fossil fuel power plants is manual labor. Courage. Militant New Year’s wishes.” It then begins:

We can stop the overexploitation of the earth. The earth is exhausted, depleted, burned, mistreated, set on fire, violated, destroyed by the greed of energy […] We know that we must stop this destruction […] Tonight, we successfully sabotaged the gas power plant in the Berlin district of Lichterfelde. There were power outages in the wealthy districts of Wannsee, Zehlendorf, and Nikolassee. The goal of the action was not the power outages, but the fossil fuel sector. We apologize to the less wealthy people in southwestern Berlin. For the many villa owners in these districts, our compassion is limited […] The attack on the gas power plant is an act of self-defense and international solidarity with all those who protect the earth and life. Infrastructures that serve the ‘technological attack’ and promote the destruction of the earth can be sabotaged. Fossil fuel energy production can be stopped. Smart cities, which is what Berlin is supposed to become, can be avoided […] For us, it is clear that we have at all times ruled out any risk of endangering human lives…

Read more