Since the beginning of the joint US-Israeli military campaign against Iran in late February and Israel’s subsequent ground operations to dismantle Hezbollah’s presence in southern Lebanon, the Lebanese militant group and major Iranian proxies in Iraq have launched hundreds of attacks targeting both Israeli and US force and installations across the region.

Unsurprisingly, uncrewed aerial vehicles (UAVs) represent a big share of the weapons used in these attacks, following a pattern that consolidated over the past few years. While fixed-wing long-range attack drones such as the Shahed-101/107 and Sayyad-107 remain the predominant platforms, small weaponized first-person view (FPV) quadcopters popularized by the war in Ukraine have finally made their way into the arsenal of these groups and have been used more regularly for tactical strikes across southern Lebanon and in the surroundings of the Iraqi capital, Baghdad.

Share

Hezbollah’s FPV Drone Campaign

The first publicly documented use of FPV drones by Hezbollah emerged in the spring of 2024, but their employment remained sporadic throughout 2024 and the following year, with nine attacks published by the group on its social media channels (the real number is likely higher). These strikes primarily targeted Israeli fixed military installations – including tactical radars and communication towers – along the Israeli-Lebanese border but played a negligible part in the group’s targeting strategy.

Since February of this year, however, Hezbollah has ramped up FPV drone attacks against Israeli mechanized units that have penetrated into southern Lebanon as part of what Israeli authorities defined as “targeted ground operations” to expand the “forward defense area” and “create an additional layer of security for [Israeli] residents of the north.” This author has geolocated 23 out of 25 FPV drone attacks published by Hezbollah since February 28, as shown in the map below. The strikes are distributed along a fairly regular arch from the southwestern Lebanese coast, near the village of Al-Bayada, to areas along the northeastern border with Israel, in the Marjayoun district.

As Israeli forces push deeper into Lebanese territory south of the Litani River, the likelihood of them becoming more exposed to FPV drone strikes will increase. At the same time, recent reports indicate that Israeli forces are also using FPV drones to hunt Hezbollah’s operatives in the border town of Bint-Jbeil, suggesting a cat-and-mouse game between the two sides.

FPV drones provide Hezbollah with a rapidly deployable, cost-effective precision-strike tool for beyond-line-of-sight tactical attacks within the 5-20 km zone, which the group largely lacked previously. Available evidence indicates that these FPV drones are built from off-the-shelf components, with recovered systems equipped with custom 18650 lithium-ion battery packs to extend flight endurance beyond what standard LiPo configurations typically allow. Some of the documented examples feature what appear to be 7/9-inch frames paired with Chinese iFlight XING-family motors, suggesting a focus on balancing payload capacity with maneuverability.

Notably, some FPV drones employed fiber-optic command-and-control links to minimize vulnerability to electronic warfare and signal interception.

These UAVs are frequently equipped with cheap and widely available repurposed PG-7 pattern munitions (or Iranian variants such as the PG7-VL-AT1) and are typically employed in anti-armor and counter-mobility missions against Israeli mechanized units.

Interestingly, the target set remains almost entirely dominated by vehicles, which account for 88% (22 hits) of all FPV strikes. Only two attacks (8%) against buildings hosting Israeli troops near the village of Debel have been documented, and one strike (4%) against Israeli personnel via a munition dropped by a small quadcopter.

Share

Targeted vehicles include Merkava IV main battle tanks (MBT), infantry fighting vehicles (IFV) and armored personnel carriers (APC) such as the Namer, a GRX-8000 high-capacity communication vehicle, light tactical vehicles (LTV), and excavators.

Modus Operandi

An observation of the drone footage released by the group suggests an agile and distributed concept of operations relying on mobile drone crews and pre-positioned munitions stocks and other miscellaneous supplies, in order to cover as much territory as possible. The small size of FPV drones is ideal for this approach, as these systems can be easily concealed and do not entail a large logistic footprint, especially when used in relatively small quantities.

As of the writing of this analysis, documented attacks suggest a low sortie generation capacity among Hezbollah’s ranks, possibly due to a small number of proficient operators. Tactical finesse appears limited, especially when compared to the Ukrainian context, as demonstrated by the suboptimal selection of angle of attacks and target aimpoints, with operators often picking the most accessible area of vehicles rather than the most vulnerable ones, except for a few attacks aimed at weak spots of Israeli vehicles (e.g., rear doors, tracks).

While the extent of damage remains uncertain due to selective video editing and limited post-strike footage, there are some Israeli operational reports of injuries and possible fatalities among Israeli soldiers in armored brigades currently deployed in southern Lebanon, such as the 7^th Brigade.

The use of a fiber-optic command and control link allows Hezbollah’s drone crews to overcome Israeli electronic warfare (EW) countermeasures and operate in irregular and more challenging mountainous terrains that would otherwise impose line-of-sight limitations to common radio-controlled FPV drones.

Overall, small FPV UAVs provide Hezbollah with a much-needed tactical precision strike capability and complement its arsenal of anti-tank guided missiles (ATGMs). Compared to the latter, FPV quadcopters offer greater tactical flexibility and can be used to conduct both reconnaissance and strike missions, including against targets of opportunity. As Israeli forces push deeper into southern Lebanon, this combination of FPV drones and ATGMs will likely increase the attrition among their mechanized units and slow down their advances. However, this author assesses that unless Hezbollah manages to scale FPV drone strikes significantly, the latter’s overall operational impact will remain limited.

While advice and training support from Russia cannot be ruled out, it is also plausible that these capabilities are the result of independent development using domestic expertise and widely available tutorials for drone assembly, configuration, and testing. That said, it is worth remembering that Russian forces trained Assad’s regime loyalists in the use of FPV drones between 2023 and 2024, and it is possible that Hezbollah’s operatives benefited from some knowledge transfer, and even that some of the group’s members received the training themselves.

Iraqi Resistance Groups

Pro-Iran resistance groups in Iraq, in particular the Islamic Resistance in Iraq umbrella and Saraya Awliya al-Dam (Companies of the Guardians of Blood), have also started using weaponized FPV drones against US assets and installations near the Iraqi capital, though less frequently compared to the Lebanese Hezbollah.

Share

This author has recorded eight documented FPV drone attacks, with seven geolocated in the Victory Base complex near Baghdad international airport and one allegedly launched against the main headquarter of the Iraqi National Intelligence.

The video feed’s signal quality visible in published footage suggests that most, if not all, of the drones used were fiber-optic types, while the warheads were likely PG-7 pattern munitions (or similar).

Targets hit include a HH-60M medevac helicopter, one AN/MPQ-64 Sentinel radar, six military shelters and aircraft hangars, and a batch of fuel tanks. The attack launched against the Iraqi National Intelligence on March 21 allegedly consisted of two fiber-optic FPV quadcopters and caused one victim, with one of the drones apparently shot down by security forces (Figure 4).

Overall, observed FPV drone attacks by Iraqi groups indicate basic tactical proficiency, hinting at operators with modest operational experience. In one case, for example, the operators flew the drone back and forth before deciding to strike a reinforced shelter and a hangar, causing little to no damage.

However, in at least one instance, operators deployed two drones simultaneously, with one system providing real-time battle damage assessment (BDA) of the first strike before being flown against another high-value target, thus suggesting a more articulated mission planning as well as sophisticated tactics.

In another case, the Saraya Awliya al-Dam group used a fiber-optic FPV drone to conduct a very low-altitude reconnaissance flight over the US Embassy and diplomatic compound in Baghdad, flying completely unchallenged for several minutes (Figure 6). Such a tactic allows the mapping of potential targets and vulnerable areas for future attacks also in cluttered urban environments and – with fiber-optic drones – it can be countered only via kinetic means, which represent an obvious constraint for the defender in areas with a high risk of collateral damage.

Conclusion

The growing adoption of FPV drones by Hezbollah and pro-Iran Iraqi militias reflects an incremental but notable evolution in their tactical toolkits. These systems offer a relatively low-cost means to conduct precision strikes, expand engagement envelopes, and partially offset adversary advantages in armor and electronic warfare.

However, current evidence points to limited scale, uneven operator proficiency, and modest overall battlefield impact. Furthermore, while systems equipped with fiber-optic command link mitigate EW (electronic warfare) countermeasures and enable operations in contested environments, they do not fundamentally alter the battlefield balance absent a significant increase in deployment rates and tactical refinement.

In Lebanon, and even more so in Iraq, the observed pattern of FPV drones’ operational use suggests a still ongoing learning phase, with basic though gradually improving coordination, targeting, and mission planning. Should Hezbollah and Iranian proxies succeed in scaling production, training, and integration of FPV drones with other capabilities such as ATGMs, mortars, and other fixed wing attack UAVs, these systems will have a more consequential impact in future operations.

Subscribe now

Subscribe now

The bomb begins falling from the left side of the screen as soon as the video starts. The viewer has the perspective of the drone as it looks down at a white pickup truck with a full bed; men standing on the driver’s side of the vehicle appear to be talking, while the bombs gets smaller and smaller before impacting the bed of the truck and detonating. The men on the driver’s side flee as a man in the front passenger seat exits the vehicle and joins his comrades in flight. This is a short video released by the Mexican drug cartel Cárteles Unidos, showing an attack on the Jalisco New Generation Cartel (CJNG). This video, published by the pseudonymous conflict researcher War Noir in August of 2025, provides a glimpse into the emerging, but increasingly complex world of drone use by drug cartels.

Globally, drones have begun emerging in conflict zones around the world, to the point where they are being used, with varying degrees of effect, in every major and most minor, armed conflicts. This includes the use of drones by drug cartels and other transnational criminal organizations (TCOs) across Latin America. While drug cartels and other TCOs have been using drones in various capacities for several years now, innovations in drone technology and tactics have begun to filter out of the warzone in Ukraine and subsequently appearing in Latin America.

Commercial off-the-shelf (COTS) drones have dramatically reshaped how militant organizations globally fight, and cartels and TCOs are no exception. The introduction of relatively cheap, accessible, and easy to fly drones began in January 2013 with the release of the DJI Phantom. The Phantom was the world’s first ready to fly drone that met a low enough price point to reach mass adoption. Quickly, the terrorist group calling itself the Islamic State (IS) began using small, cheap, commercial off-the-shelf (COTS) hobby drones in operations, with this first being documented in 2014, and by no later than 2016 when IS had begun to weaponize them. Weaponization of COTS drones was, and still often is, rudimentary. Especially early on, weaponization focused on grenade dropper type systems, where hand grenades or launcher grenades were dropped from modified COTS drones. These early grenade dropper systems often relied on placing munitions inside of a plastic cup on the bottom of the drone, with the grenade being dropped with an improvised release mechanism.

Since the early days of improvised drones being used by IS, drone warfare has taken substantial leaps — n particular, on the battlefields of Ukraine. For drones, the biggest innovation to come out of the war in Ukraine is the weaponized first-person-view (FPV) drone. Similar to how DJI’s introduction of the Phantom brought the camera drone to the world, FPV drones began to emerge as a COTS technology in 2013 to 2014. The technology was firmly on the global stage with the founding of the Drone Racing League (DRL) in 2015. However, these drones didn’t see substantial mass weaponization until after the full-scale Russian invasion of Ukraine in early 2022. It was not until later in 2022, with mass adoption finally occurring in 2023, that weaponized FPV drones finally began to appear on the battlefield in the now familiar “kamikaze” one-way-attack (OWA) format. The introduction of COTS drones to warzones also invited the introduction of a slew of complementary tools and countermeasures, anging from ground control stations to jammers and spectrum analyzers. Drones have helped usher in a new era of electronic warfare in conjunction with the introduction of cheap air forces.

The most common use of weaponized drones by cartels and TCOs is the grenade dropper. DJI Mavic drones are the most common type of drone that is used in grenade-dropping attacks. This is because of the Mavic’s ubiquity, low cost, and ability to produce enough power in order to carry small payloads. While early IS grenade-dropping drones used improvised dropper systems, today’s purpose-built after-market dropper mechanisms are often advertised on social media sites like Instagram, though often labeled as “water bottle droppers,” and are for sale on sites like Etsy. Grenade dropping attacks may involve actual hand or launcher grenades, or other professionally produced munitions such as mortar rounds, but very often use improvised explosive devices (IEDs). Ultimately, whether a cartel or TCO is using standard or modified factory built grenades of one kind or another, or using IEDs — this likely has to do with a group’s ability to easily obtain munitions or not. Recently, a dropper-style attack was conducted by the Gulf Cartel (CDG) on the house of the mother of the notorious drug kingpin El Chapo Guzman.

While dropper-type drones are seen with some degree of frequency in Latin America, FPV-style attacks are seen much less often. This is because FPV-style attack drones are a much more difficult technology to field effectively. FPV drones typically do not have fly-by-wire software like camera drones do, and therefore are much more difficult to fly. Forums and blogs for new FPV drone enthusiasts often recommend using FPV drone simulator games like Liftoff or Uncrashed for 20-30 hours of gameplay prior to attempting to fly a real FPV drone. This sharp learning curve is just the first major obstacle that cartels and TCOs face when attempting to adopt FPV style drones for attacks. Fuzing, or the technology and components needed to make munitions safe or armed and to detonate the explosives at the right moment, is the next big obstacle. In particular, the most common detonator mechanism for OWA FPV drones in Ukraine is a set of contact wires that cause the munition attached to the drone to explode when the drone impacts a target. Additionally, in Ukraine, OWA FPV drones are often armed with modified mortar rounds. While the available munitions fuzing technology has improved, many FPV drones have still not moved beyond the most primitive types of detonators, and fundamentally, these munitions are extremely dangerous to the individual making them. However, despite the higher degree of skill required to fly them and the greater danger involved in producing an effective munition for arming them, OWA FPV drones are still being used in Latin America. In particular, in August 2025, forces aligned with the Revolutionary Armed Forces of Colombia (FARC) shot down a Columbian Army UH-60 Blackhawk helicopter.

Cartels also use drones for more “mundane” activities such as reconnaissance and smuggling. For 2025, U.S. Customs and Border Protection detected 34,682 drone flights within 500 meters of the U.S.-Mexico border. While some portion of those flights were benign hobbyists or related to some form of legitimate work, many were likely being done in the furtherance of cartel objectives. These objectives could include conducting reconnaissance for illegal border crossings or smuggling contraband across the border. Additionally, drones are being used to smuggle contraband into prisons in Latin America as well as the United States. Notably, in February of 2026, the US Federal Aviation Administration initially shut down air space overEl Paso, Texas because of issues surrounding cartel drone use and the US military’s plans to use a new laser weapon as a countermeasure against those drones.

In particular, the Mexican drug cartel CJNG has been a prolific user of drones in operations in Mexico. CJNG frequently uses drones to conduct reconnaissance operations as well as to strike their opponents, most often other cartels. The Jalisco-based cartel was an early adopter of COTS drone technology, and has been highlighted for being a leading adopter of other innovative technologies as well. Notably, CJNG has been running at least one specialized drone unit since 2023, though possibly since as early as late 2021. This drone unit was responsible for approximately 20 percent of all drone attacks in Mexico from 2021 to 2025. Additionally, CJNG may be starting to adopt OWA FPV drones for attacks, with possible evidence of the adoption of such systems being documented in August 2025.

While the adoption of drone technology does not fundamentally change the conflict between state forces and drug cartels or TCOs, it does create additional layers of danger for police forces, as well as accelerating the ever expanding need for more resources to combat cartels. With cartels using larger and larger numbers of drones, state security forces will be forced to purchase sophisticated electronic warfare technologies that are able to locate, track, and defend against drones, as well as hire and train personnel who are able to operate that technology.

Subscribe now

Subscribe now

Since the Iran conflict started, a mysterious terror group calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) has appeared practically overnight to claim several attacks against Jewish and American targets in Europe — including the torching of four Jewish charity ambulances in London and an attack at the Israel Center in Nijkerk, Netherlands — while law enforcement has detained up to 15 people in connection with these incidents.

In its released videos and statements, HAYI threatens America, Israel, and Europe while visually modeling itself after pro-Iranian Axis of Resistance groups. But unusual signatures in its public communiques and behavior indicate that HAYI is not an authentic, grassroots Axis group but is instead a fabricated front for a grey zone operation that relies on paid freelancers and/or volunteers to carry out acts of terror and sabotage abroad — a strategy first deployed by Russians and also used by Iran, according to security analysts interviewed for this article.

“Authorities, intelligence agencies, and experts are attempting to determine if this is a case of ‘disposable agents,’” said Colin P. Clarke, executive director of The Soufan Center, in an interview. “Given the rather amateurish nature of some of these attacks, it could be a simple ‘pay-for-play’ scheme where the Iranians are recruiting European youth online and paying nominal fees to conduct these attacks.”

This seems readily apparent in the most recent incident, which occurred in the early morning of March 28 in Paris when police caught a 17-year-old Senegal national attempting to set off an explosive at a Bank of America building. He told investigators he was hired and paid to perform this action via Snapchat. An additional four people were also detained in connection with this attempt. French authorities said HAYI is suspected to be behind this attack due to HAYI mentioning the target in a video posted on March 21.

Some online critics, a few connected to large disinformation networks, have accused pro-Israel agents of involvement due to these attacks only damaging property, occurring at odd hours of the morning and night, and without injuring anyone. Notably, HAYI statements contain errors and use certain phrases that are atypical for such a militant group. As of this article’s publication, the investigation into HAYI is still ongoing, and European law enforcement have released scant evidence that neither proves or disproves this controversial hypothesis; however, officials’ preliminary comments appear to align with analysts’ expert assessment that disposable agents are involved and that these incidents likely have a connection with pro-Iranian operatives.

Still, big questions loom over the organization’s authenticity, origin, and possible motivation. This report examines the publicly available information that HAYI has released thus far — with a special focus on the audio used in its propaganda videos — while also probing whether this “group” has any connection with pro-Iranian Shi’ite Islamists and/or the Islamic Revolutionary Guard Corps, which is known to facilitate attacks abroad. This report also examines the context of these incidents within the broader security landscape of Europe.

Companions of the Right

The full name of the group translates into The Islamic Movement of the Companions of the Right. “Right”, as translated from Arabic, is equivalent to the concept of justness or justice. The group’s logo closely resembles the insignia for Hamas, Hezbollah, and other Iran-aligned Axis of Resistance terror groups: an upright fist holding a firearm while superimposed over a globe. But while every Axis group has AK weapons in its logo, HAYI has a SVD sniper rifle from the Soviet Union in its fist, as pointed out by The Jerusalem Post, a possibly relevant discrepancy.

The first known HAYI-linked attack occurred on the morning of March 9, when unknown assailants bombed the facade of a synagogue in Liege, Belgium. On that same day, HAYI first announced its existence in a statement that circulated on X and Telegram. In addition to quoting Quranic verses, the statement reads “Badr 1 – Badr 2 – Fath 6 – Khaybar 14” — which appear to refer to early battles in Islamic history, such as the conquest of Mecca — with the numbers serving an unknown purpose. Curiously, the statement doesn’t reference the Liege attack at all. A few days later, on March 11, a video surfaced on pro-Iranian online networks showing the Liege attack, which the group then claimed credit for.

Since the March 9 arson, HAYI has claimed several subsequent attacks in Europe: a March 13 arson at a synagogue in Rotterdam, Netherlands that resulted in five people getting detained in connection with the incident; a March 14 attack against a Jewish school in Amsterdam; a March 16 bombing of an office building in Amsterdam; the March 23 torching of four ambulances in the London neighborhood of Golders Green that resulted in two men getting detained for questioning; and the arson attack of a car in Antwerp, Belgium sometime on March 23 and 24 that also saw two minors detained. On April 4, an explosive device was detonated at an Israel Center in the town of Nijkerk in the Netherlands, which HAYI quickly claimed.

There was also the aborted attack at the Bank of America in Paris on March 28, with one person arrested, which investigators strongly suspect was a HAYI target because the group previously mentioned the location in a video. In addition, HAYI claimed an attack in Greece on March 11, but a report from the International Centre for Counter-Terrorism (ICCT) by analyst Julian Lanchès says it was most likely an attack in Rotterdam that happened on March 3.

Each of the incidents were commemorated with videos that HAYI quickly released after the attacks happened. The three exceptions to this pattern: one, the March 9 incident, whose footage was released two days later; two, the suspected Paris attempted bombing in which HAYI released a video targeting the location on March 21 — days before the actual attack on March 28 took place; and three, the so-called Greece attack, which HAYI claimed took place on March 11.

The quality of the propaganda videos that depict these incidents is amateurish: shaky camera work, poor video quality, and the usage of Google maps as visual props. The attacks at most caused minor damage, save for the ambulances in London, and caused zero injuries due to the fact they occurred at odd hours and almost all fell between Friday and Monday early morning hours.

Disposable Agents

The group exhibits certain traits that make it less likely to be an authentic Axis of Resistance group despite HAYI’s overt, conscious decision to emulate them. Two such examples are the amateur-looking videos (jihadist videos are typically slickly produced), the growing number of people getting caught, which suggests a lack of operational security, and that most of the arrested are young men who seemingly have no familial connection with Iran, such as the Senegal suspect of the suspected HAYI Paris attack.

Iran proxy expert and analyst Phillip Smyth said in an interview with Militant Wire: “The low-level types you are describing fit a pattern for Iranian recruitment of individuals to launch low-level attacks for them in Europe,” said Iran proxy expert and analyst Phillip Smyth in an interview with Militant Wire. “They’re going to criminal groups/gangs, younger true believers, and anyone else they can snag. What they’re doing is roping in their attacks (note how they videotape this stuff and send it in) into an overarching front group structure. Higher likelihood a good number of attackers don’t even know that’s how their attacks are being branded.”

This is shown in the case of the possible HAYI-linked Bank of America, Paris incident: the Senegal suspect, who has a drug record, was paid 600 Euros to ignite a homemade explosive, five liters of an unknown liquid fuel with an ignition charge made of a firecracker with 650 grams of explosive powder.

“The low-sophistication modus operandi also matches HAYI’s pattern of using minors and young men for attacks on Jewish and Western targets across Europe since early March 2026,” said Adrian Shtun, associate fellow at International Centre for Counter-Terrorism (ICCT).

Hiring freelancers is a type of grey or hybrid warfare tactic that Russian-linked operatives have done in the past, and which Iran has deployed as well. Iranian officials have been known to hire freelancers, including ones involved with criminal organizations, to carry out acts of terror abroad, such as an unexploded grenade found at an Israeli embassy in Sweden in 2024, which had been linked to gangs. Iran contracts freelancers and criminal organizations in order to maintain plausible deniability from these incidents and cause confusion.

Another clue that dispels the idea that this is an authentic Axis group: HAYI had zero digital footprint prior to March 9, atypical behavior by terror groups, which usually make a big announcement and establish dedicated online channels for their cause before initiating operations. Another clue is that a Telegram channel that styles itself as an official HAYI account only became active this month, even though it was registered back in 2023. This account, which remains active, could not be authenticated.

CBS News got in contact with the anonymous administrator named Asad-Allah of a HAYI Telegram channel, which was advertised on a QR code at the end of one of the HAYI-branded videos, and this suspect raised the Gaza occupation and the war in Iran as justification for its actions while using American English in texts — a relevant detail.

Another unusual feature of this group is its use of AI. Middle East Eye journalists ran HAYI statements through AI detection software and determined that at least one HAYI statement was AI-generated; one block of text was translated into English, Arabic, and Hebrew, and had unusual phrasing for a Shia Muslim terror group to use, such as terms like the “Land of Israel” and “the Gaza war” being mentioned in English. Use of AI may explain why the HAYI logo uses a different rifle in its logo versus an AK and why the word “Islamia” is misspelled in at least one HAYI communique.

Audio Findings

Another atypical signature about HAYI communiques is the group’s use of audio in their videos. Jihadist terror groups have typically used nasheeds as background music, but HAYI uses instrumental music.

For the video depicting the March 14 arson attack of a synagogue in Amsterdam, HAYI used a snippet that was traced to this YouTube clip with the below thumbnail.

First word in the above image has in Arabic موسيقى or “musiqaa” — which means “Music.” Second line of text in the image has in Arabic أولي البأس or “uwli albas” — which means “Those of Might/Valor” — as in those “people of strength/courage” or “the fierce ones.” Another stronger translation is “Men of Might.” This appears to reference Quranic passages Surah Al-Isra’ (17:5) and Surah Al-Fath (48:16). Combined, the text roughly means: “Music of Brave Men” or “ Music of Warriors.”

Caption for the video mentions the Arabic words الإعلام الحربي or al’iielam alharbiu, which means “War Media” or “Military Media,” the music’s publisher. The listed composers are labeled as M Kallas and T Charife. Another significant finding is that the music was first released on September 17, 2024 — the same day as the pager attack against Hezbollah in Lebanon, suggesting this audio has a Hezbollah connection. A search of this clip on TikTok turns up accounts that promote the Iranian regime, Shia Islam, and the Popular Mobilization Front in Iraq.

In another video, the March 16 bombing of an Amsterdam central business building, HAYI used the background music directly lifted from a concert by the Tehran Symphonic Orchestra, specifically the Symphony of the Epic of Khorramshahr by composer Majid Entezami, which commemorates the liberation of the city Khorramshahr from Iraqi occupation during the Iran-Iraq War. Specifically, the video lifts a snippet from the third movement, which is entitled, Preparation for War. HAYI repeated the use of this music in a few other videos, including the one claiming the attack on the Israel Center in the Netherlands.

Who’s Behind HAYI?

A report from the International Centre for Counter-Terrorism points out that four large Telegram accounts — two Iraqi Shia militia-affiliated and the other two being pro-Iranian news — would first share the HAYI videos and statements claiming credit for these attacks, and then a broader network of pro-Iranian influencers would amplify the content’s reach. The pro-Iranian news accounts also shared posts from pro-Russian accounts that have been sanctioned — suggesting a connection or alliance. In addition, one of the Iraqi Shia militia Telegram accounts promotes a militia group that is known to have close ties with IRGC’s Quds Force.

Because of this Iraqi Shia connection and how the videos were first shared before gaining a wider audience, Lucas Webber, co-founder of Militant Wire, said that HAYI and its activities are likely connected with Iraqi Shia militias, who collaborate with the IRGC.

“[L]ooks less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems, plugged into an existing Iran-aligned network and experimenting with low-cost, high-visibility operations in Europe,” he told CBS News.

Online critics of Israel have seized the same discrepancies that analysts have pointed out, and that must mean pro-Israeli agents could be involved. The fact that it was networks associated with Iraqi Shia militants that first shared HAYI propaganda goes against this controversial notion. In addition, the curious musical choices may point towards a connection with Iraqi Shia militia groups.

The amateurish nature of the operation has also been seized by anti-Israeli critics as a possible sign of a false flag, but this could be a function of unprofessional saboteurs making clumsy mistakes and use of AI, prone to hallucinations, to generate content and translate text.

In another possible connection with HAYI, ICCT report points out that an unknown person had posted a message on March 7 to a pro-Iranian Iraqi Shia Telegram account that called for “all silent cells” to activate, which a HAYI statement on the Liege attack later referenced.

Europe at Risk

Though these attacks have injured no one, they highlight the risk that Jewish communities (along with American-linked organizations) are facing from Iran-connected terror groups: “[T]he most elevated and complex threat environment the Jewish community and this country has seen in modern history,” according to Kerry Sleeper, the Chief of Threat Management and Information Sharing for the Secure Community Network, a Jewish security organization based in Chicago, in a statement to the Jewish Telegraphic Agency.

These incidents come as Europe deals with a complicated threat environment, amplified by the war in the Middle East. Besides any pro-Iranian or Shi’ite Islam extremist agents, European investigators are also dealing with Sunni jihadists, Russian hybrid attacks, and other ideologically motivated violent extremists from across the spectrum (far-left, far-right, anti-government, etc.), said Clarke.

Case in point, law enforcement recently detained two suspected Iranian spies who were found attempting to infiltrate a nuclear submarine base in Scotland. In addition, the Netherlands saw Mohamed (Mohi) Shafiei, a local police officer and outspoken Iranian dissident, get shot by unknown assailants; Dutch authorities are investigating whether he may have been targeted by pro-Iranian operatives.

As for HAYI, their efforts have followed a regular pattern: attack targets at night or in the morning and avoid casualties. But that may not be the case as the Iran conflict drags on further.

“[T]hings may change, and they may start targeting people, too, during the day, when it’s busy,” said Joe Truzman, senior research analyst and editor at the Foundation for Defense of Democracies, told Fox News Digital.

Subscribe now

Subscribe now

After the Islamic State-inspired attack at Bondi Beach in Sydney, Australia, on December 14, 2025, the deadliest terror attack in the country, there was talk about the potential resurgence of the Islamic State Southeast Asia Province (ISEAP).

The links between ISEAP and the attack have been drawn from the fact that the two perpetrators visited the Philippines a month before conducting the operation.

The Philippines was a hot spot for ISEAP in the mid-to-late 2010s; it was even the location where over 1,000 pro-Islamic State fighters attempted to take over the city of Marawi in the country’s south for five months. This was an attempt to establish a wilayah, or province, in Southeast Asia in 2017. The siege was unsuccessful, and Marawi was retaken by the Armed Forces of the Philippines (AFP). Remnants of pro-IS groups are still active in the Philippines, though they barely have a foothold now. This has led to perceptions that the Sydney attack perpetrators potentially linked up with some of these pro-IS remnants for training or logistical support before their attack.

Australian police are now stating that the Sydney perpetrators acted on their own volition and were not part of a wider network; however, they are still investigating why they were in the Philippines, in a region previously occupied by IS fighters and presumably with remnants and sympathizers still present.

ISEAP in the Philippines Today

The ISEAP, as a cohesive organization, is essentially defunct in the Philippines, Indonesia, and Malaysia, where it had varying degrees of presence and activities. Online chatter by pro-IS supporters continues to suggest that the ISEAP and the smaller groups forming it are present and active, yet that is not true. Security forces in all the aforementioned countries have significantly cracked down on these groups and networks to the extent that the earlier regional coordination and cooperation between pro-IS groups is essentially zero.

Referring specifically to the Philippines, where the IS attempted to form a province following calls from IS-Central in Syria and Iraq, the threat of pro-IS groups has been relegated back to being lower than the threat from the communist New People’s Army (which is the longest-running insurgency in the world, currently). Even the communist threat has been diminished significantly in the Philippines, highlighting how the pro-IS remnants there are essentially unable to organize under the IS banner. There is no IS resurgence in the Philippines; the activity levels of anti-government Islamist groups are at their lowest in decades, and it is a far cry from IS-affiliated groups in West Africa, for example.

In the Philippines, there were three major IS groups (with various factions): the Maute Group, the Bangsamoro Islamic Freedom Fighters (BIFF), and the Abu Sayyaf Group (ASG). The ISEAP emir would often be picked from one of these groups following the killing of the preceding emir. Today, all of these groups fall under the banner of Dawlah Islamiyah, or the Islamic State. Taking a closer look, however, indicates how far these groups have deteriorated in capabilities. The ASG has essentially been decimated after over two decades of terror and historical ties to Al-Qaeda and major terror groups in Indonesia, such as the Jemaah Islamiyah and Jamaat Ansharut Daulah. The ASG was notorious for kidnapping and operating in the Sulu archipelago. There has been no kidnapping since January 2020, and as of last year, the ASG splinter groups have also seemed to have faded away. The Maute Group, which largely led and funded the Marawi siege, is also a sliver of what it once was, and possibly standing on its last legs. BIFF is in a similar position; last year, a BIFF sub-leader, his brother, and his son were killed in a clash with the AFP.

While a large part of the fading presence of IS groups in the Philippines is due to the AFP’s actions, it also comes from the government’s wider movement to integrate disenfranchised Muslim Moro communities who live in Mindanao and were part of groups like the Moro Islamic Liberation Front (MILF). At one point, MILF was a major internal security threat in the Philippines, but following a peace agreement and normalization, the MILF and the AFP have worked together to counter the more radical Islamist pro-IS groups that fall under Dawlah Islamiyah.

As such, recent characterizations of the Philippines and Mindanao, especially as a terror hot-spot, are false and disingenuous; the ISEAP is defunct, and the groups that comprised it are struggling to survive.

Subscribe now

Subscribe now

The recent resurgence of fighting in northern Mozambique is once again triggering alarms among observers. Attempts to resolve the violence are threatened by politics from elsewhere in Africa.

Data recently released by ACLED’s Mozambique Conflict Monitor for the first two weeks of March 2026 paint a somewhat bleak picture for the region. During the period covered, there were at least five incidents of political violence documented in the country. These resulted in the deaths of around 30 people, with at least two of the fatalities being civilians. The Islamic State Mozambique (ISM) was found to have been behind four additional events across Mozambique.

The numbers for the length of the insurgency may show why the interest in the country appears to be lackluster, to place it mildly. Since October 1, 2017, there have been a total of 2,338 acts of violence in Cabo Delgado. A total of 6,498 fatalities have occurred, with 2,721 of the deaths being civilians. ISM has launched 2,168 recorded attacks across the rest of the country. The situation in northern Mozambique is drawing some interest now in Washington.

It appears that an attempt by the Mozambican security forces to drive militants from the Catapu Forest Reserve in early February 2026 failed. Subsequently, the militants have been able to use the forest as a base of operations. Their presence in the forest also gives the militants the ability to contest control of the N380 Motorway. This is a major economic lifeline in the province, and militants’ ability to interrupt normal traffic flows presents a serious challenge to the government to provide services to the citizens, let alone disrupting commerce.

Recently, other events outside Mozambique may impact how the country will address this situation. Over the last couple of years, Rwanda has been a major security partner for the Mozambique government. In recent weeks, events regarding the situation in the Democratic Republic of Congo may modify if not end the Rwandan role in combating this insurgency.

The Rwandan presence in Mozambique has been underwritten by the EU since 2022 for 20 million Euros, or 23 million US Dollars. Earlier this month, the EU announced that after the current funding expires in May 2026, it would not renew the funding. The timing of this announcement is interesting to say the least. It comes after the U.S. has sanctioned the Rwandan military for not implementing the Washington Accords. This deal is designed to restore peace and improve the economies of both countries. It is fair to assume that the sanctions may have inspired the EU decision to halt funding to the Rwandan mission. The Rwandan military has stated that if the funding is not restored, it will then withdraw their troops from Mozambique.

This move places Mozambique’s Maputo in a precarious state. It still has an insurgency raging in its northeast, and the major ally that was aiding in counterinsurgency operations is having its funding cease over another issue in Central Africa.

The President of Mozambique, Daniel Chapo, has travelled to Brussels in order to have the funding restored. Currently, there are no reports on whether this trip will be successful. We might not find out the answer until June. Stalled funding is sure to give ISM time to rest and regroup for a new offensive.

Subscribe now

Subscribe now

On January 3, during a U.S. military operation in Caracas supported by the Department of Justice and the Central Intelligence Agency (CIA), Nicolás Maduro and his wife, First Lady Cilia Flores, were captured and transferred to the United States. Maduro was taken into federal custody in New York and is currently held at the Metropolitan Detention Center in Brooklyn. Both have pleaded not guilty.

U.S. prosecutors allege that Maduro, Flores, their son Nicolás Ernesto Maduro Guerra, and several senior officials led a long-running cocaine-trafficking conspiracy, collaborating with drug cartels designated as terrorist organizations. According to the indictment, the group abused positions of public trust and corrupted state institutions to move tons of cocaine into the United States as part of what authorities describe as a “narcoterrorism” operation.

The 25-page indictment filed in the Southern District of New York claims the scheme began in 1999, when Maduro entered public office, and involved systematic drug trafficking, violence, and intimidation.

Prosecutors allege Flores accepted hundreds of thousands of dollars in bribes in exchange for facilitating drug shipments and that the couple used state-backed gangs to enforce their operation through kidnappings, beatings, and killings.

Maduro’s son is accused of transporting drug shipments via military flights to Margarita Island and of helping arrange large-scale cocaine shipments to Miami and New York, including discussions about routing lower-quality cocaine to New York and concealing drugs in cargo and scrap-metal containers.

Also charged are current and former interior ministers Diosdado Cabello Rondón and Ramón Rodríguez Chacín. Cabello is accused of coordinating cocaine shipments with Colombian traffickers bound for Mexico and the U.S., while Rodríguez Chacín allegedly sheltered FARC operatives and accepted bribes to protect them.

All defendants are accused of having partnered with narco-terrorist organizations, including Colombia’s Revolutionary Armed Forces of Colombia (FARC), the National Liberation Army (ELN), Mexico’s Sinaloa Cartel and Los Zetas, as well as the Venezuelan criminal group Tren de Aragua (TdA). The indictment also names TdA’s leader, Héctor Rusthenford Guerrero Flores, also known as “Niño Guerrero,” as a co-conspirator. Tren de Aragua is the only Venezuelan criminal organization explicitly cited in the document, underscoring its central role in the narcotics trafficking network.

Since September 2025, President Donald Trump’s administration has struck more than 45 boats found sailing near the shores of Venezuela, with Defense Secretary Pete Hegseth accusing them of smuggling drugs and committing acts of narco-terrorism.

Besides accusations that Venezuela President Nicolas Maduro and his regime are narco-terrorists, Trump and Hegseth have also accused members of Tren de Aragua, Venezuela’s most powerful criminal organization, of using these boats to smuggle drugs and other contraband.

Eliminating TdA could be a tall order due to the nature of the group’s organization and its vast network that reaches beyond Venezuela. What follows is an introduction about TdA’s origins, key figures, its connections with the government, and its activities in the rest of Latin America.

Origins and Growth

Tren de Aragua (TdA), like many other Latin American gangs, was born inside prison, specifically the Tocorón facility in the state of Aragua in Venezuela, from which it takes its name, in 2014. (Tren means train, so the name of the organization is Aragua Train in English.)

In just over a decade, TdA has grown into a transnational criminal organization operating across much of Latin America. Its activities include drug trafficking, extortion, prostitution, migrant smuggling, and control of illegal mining. In February 2025, the Trump administration designated it both a Foreign Terrorist Organization (FTO) and a Specially Designated Global Terrorist (SDGT).

“This brutal criminal group has conducted kidnappings, extorted businesses, bribed public officials, authorized its members to attack and kill U.S. law enforcement,” the U.S. State Department declared in its announcement.

TdA’s rapid expansion across Latin America has been driven by its flexibility and adaptability. It functions as a living organism: a central leadership coexists with semi-autonomous cells. But unlike other criminal organizations, such as First Capital Command (PCC) or Red Command aka Comando Vermelho in Brazil, which both originally emerged inside prisons as movements to defend inmates’ rights, TdA was born out of then-President Hugo Chávez’s 2005 decision to quell prison violence by handing internal control to inmate gang leaders — the pranato.

The case of Luidig Guillermo Ochoa Fajardo is emblematic of the unforeseen results from this decision. Before his release in 2008, he was Tocorón’s second-in-command, known as the “lucero,” controlling three prison floors. He later attempted redemption through an animated series, Prison or Hell, depicting the horrors of incarceration.

“At Tocorón, you either kill, or you’re killed,” he told this reporter in Caracas in 2012.

Two years later, he was murdered—according to his mother, “assassinated by the government.”

In 2014, TdA was born with Héctor Rusthenford Guerrero Flores, better known as Niño Guerrero, as the top leader of the TdA.

Onward, under Guerrero’s leadership, Tocorón prison was transformed from Ochoa’s “hell” into a luxury resort with a swimming pool, zoo, and oyster bar—echoing Pablo Escobar’s style. This strategy created a parallel state, multiplied recruitment, and stockpiled weapons from assault rifles to explosives. From this prison-turned-command center, Guerrero slowly expanded TdA beyond Aragua to the rest of Venezuela, infiltrating local economies through stolen auto parts, black-market food, gambling, extortion of small businesses, and kidnappings for ransom—even targeting Venezuelan migrants abroad, as seen in Mexico and Guatemala.

Since 2018, TdA has imposed brutal control over gold mines and communities in Las Claritas in Venezuela, forcing miners to pay protection fees in gold. Enormous profits were reinvested in weapons, vehicles, and corruption, making gold the group’s primary asset. The organization has also expanded into human smuggling and contraband, capitalizing on the Venezuelan migration crisis in Brazil, Chile, and Peru.

Guerrero, 41, was sentenced in Venezuela to 17 years for murder, human trafficking, and smuggling — credited with turning what began as a small gang into a sprawling hydra-like structure that has expanded across the hemisphere. He has been on the run since September 20, 2023, when a massive police operation involving 11,000 officers retook control of Tocorón prison. Guerrero escaped through a tunnel with the help of corrupt guards and has remained a fugitive ever since. Washington has offered a $5 million reward for his capture.

Political Connections in Venezuela

Political ties have long been a strength. When Tareck El Aissami — later a Maduro minister — was governor of Aragua, he reportedly used TdA as a paid workforce. Evidence has since emerged linking the group directly to Maduro’s entourage. Photographs of dismembered TdA leader Carlos Breaker were found on the phones of the narcosobrinos—Efraín Antonio Campo Flores and Francisco Flores de Freitas, nephews of Maduro’s wife, Cilia Flores. These two nephews were arrested in 2015 in Haiti by the DEA while trying to traffic 800 kilos of cocaine to America. Venezuelan media reported Breaker was executed in 2015: electrocuted and dismembered in an internal feud. American investigators believe the photos and WhatsApp chats show how TdA operated as hitmen for the regime’s illicit interests.

“Under the cover of ideological revolution, Venezuela had in many ways become a criminalized state. The central government maintained its grip on power, but beyond the presidential palace, much of the country had slipped into fiefdoms, given over to political loyalists who could use criminal gangs to enrich themselves as they saw fit,” writes Chris Dalby in his book Tren de Aragua: The Guide to America’s Growing Criminal Threat.

Dalby describes a country where elements of the Bolivarian armed forces morphed into syndicates like the “Cartel of the Suns” — a network of senior military commanders facilitating cocaine exports, protecting cartels, and enriching themselves through drug and gold smuggling.

Even Maduro’s much-publicized 2023 reconquest of Tocorón — with 11,000 troops — was criticized as a sham. According to Infobae, TdA members had been tipped off and escaped through tunnels. Rather than weakening TdA, the operation strengthened it: half its members fled Venezuela along migrant routes to Brazil, Chile, Colombia, and Peru.

A 2024 U.S. Customs and Border Protection intelligence report noted TdA “has expanded its criminal presence throughout Latin America to include Bolivia, Brazil, Chile, Colombia, Costa Rica, Ecuador, Guatemala, Honduras, Panama, Peru, Nicaragua, and Mexico. TdA’s leadership has directed key members to new countries, including the United States and Canada, to oversee new criminal revenue streams.”

Tren de Aragua in Brazil

Brazil is increasingly strategic for TdA because of its proximity to Venezuela’s Bolívar state, where the group has grown its influence over the gold trade. It also reflects TdA’s broader criminal dynamics: exploiting Venezuelan migration flows to move both people and members, while forging strategic criminal alliances to expand power—at the cost of worsening violence statistics. According to the Special Action Group Against Organized Crime (GAECO) in Roraima, Brazil, the number of Venezuelans incarcerated in the state has surged 538 percent in the last six years, representing nine percent of the prison population — rising from 77 inmates in 2018 to more than 400 in 2024.

Brazilian authorities say TdA has also begun infiltrating local prisons, collaborating with Brazil’s largest criminal syndicate, the First Capital Command (PCC), particularly in border states such as Roraima, Amazonas, Paraná, Santa Catarina, and Rio Grande do Sul, to control the flow of people, drugs, gold, and weapons. A 2020 report from Roraima’s state prosecutor’s office had already warned: “There are 740 Venezuelans who are part of the PCC in Roraima,” and “this criminal organization has formed an alliance with the Venezuelan criminal structure Tren de Aragua.”

Guerrero may be hiding in Brazil or transiting through the country on a regular basis, according to Brazilian investigative sources. Guerrero’s possible presence in Brazil may have been facilitated by the porous border with Venezuela and the uncontrolled flow of Venezuelan migrants through the state of Roraima in Brazil, many of whom flee periodically from Nicolás Maduro’s regime.

“It is possible that Niño Guerrero is in Brazil, because all Venezuelans need to cross the border is a self-declaration. They don’t even need to present documents or give their names to immigration officers. They can walk across the border without going through checkpoints. Given the long land border with Venezuela, anyone can enter our territory simply by moving one kilometer away from official posts,” said Wesley Costa de Oliveira, Chief of Staff for the Suppression of Criminal Organizations in Roraima state, in an interview with Brazilian VEJA magazine.

In Boa Vista, Roraima’s capital, authorities arrested Juan Gabriel Rivas Núñez, alias Juancho, in November 2023. Leader of the “Banda Venezolana de Juancho,” a long-established group in southern Bolívar in Venezuela, he worked with TdA in illegal gold trafficking. His organization controlled illegal mining and smuggling in Las Claritas, Venezuela, near the borders with Brazil and Guyana.

Rivas Núñez, a 43-year-old Colombian who obtained Venezuelan nationality and multiple fake identities thanks to government connections, has been accused of murder, arms trafficking, extortion, and violence against indigenous communities, particularly the Arawak. Venezuela requested his extradition, which Brazil’s Supreme Federal Court granted in April 2025. However, he escaped house arrest by giving his electronic ankle monitor to a look-alike decoy. His current whereabouts remain unknown.

Two other top TdA fugitives who may be moving with Guerrero in Brazil are his right-hand man, Yohan José Romero (alias Johan Petrica), and Giovanni Vicente Mosquera Serrano. Petrica, 47, runs the group’s illegal gold mines in Venezuela, especially around Las Claritas, and also supplies TdA with military-grade weapons. In 2018, he appeared in Brazil under his real name to register his son’s birth in Boa Vista, where he owns multiple properties. The United States has offered $4 million for his capture.

Mosquera Serrano, 37, appeared on the FBI’s Ten Most Wanted list in July 2025, accused of coordinating TdA operations ranging from drug and human trafficking to arms smuggling and violent crimes in the U.S. Washington is offering $3 million for his arrest.

Journalist Donna Rísquez, author of the book El Tren de Aragua, has also reported that group co-founder Larry Amaury Álvarez Núñez, alias Larry Changa — who was arrested in Colombia in 2024 while operating in Chile — regularly sent money to Brazil as well as Venezuela and Spain.

Expansion Elsewhere in Latin America

TdA’s expansion into Mexico is especially concerning — for its control over migrant routes, often involving ransom kidnappings, and for its proximity to Mexican cartels. Mexico Security Secretary Omar García Harfuch confirmed in December 2024 that TdA members “are engaged in sexual exploitation and human trafficking.”

In July 2025, Chilean authorities uncovered 14 shell companies set up between 2020 and 2024 to launder $13.5 million via bank transfers and cryptocurrency. Chilean prosecutor Trinidad Steinert confirmed these profits stemmed from “human trafficking, murders, kidnappings, extortion, migrant smuggling, drug trafficking, and ‘fines’ imposed on anyone entering TdA-controlled territory.”

“What we are seeing is that Tren de Aragua is copying the money-laundering strategies developed by the Sinaloa Cartel or Jalisco New Generation Cartel,” Mexican security analyst David Saucedo told DW.

Analysts believe TdA may also move into synthetic drug markets, where there is more space for new players than in cocaine. In July 2025, Colombian authorities arrested two members wanted by a U.S. federal court in Colorado: Luis Alejandro Enríquez Charaima, alias Álex, and Luis Fernando Uribe Torrealba, alias Luisito. They are accused of arms trafficking, conspiracy, synthetic drug trafficking, and theft. They were caught in Medellín preparing tusi (known as “pink cocaine”). Colombian authorities said their goal was to expand TdA’s operations in the U.S., setting up clandestine labs for tusi and ketamine.

Though no evidence currently links TdA to Chinese organized crime, particularly the Bang de Fujian, Chile may become a hub for future alliances — not only in synthetic drug trafficking but also in laundering illicit proceeds. Chile’s Public Prosecutor’s Office reports that more than 400 organized crime groups now operate in the country, from Mexican cartels to Chinese mafias, alongside the PCC, Comando Vermelho, Colombia’s ELN, and the FARC. This crowded criminal landscape will almost certainly fuel TdA’s growth unless international cooperation improves through constant intelligence sharing and joint enforcement operations.

Strategic Implications

The new U.S. strategy is already reshaping the tactics of criminal organizations operating across the region. Instead of relying on high-speed “go-fast” boats — now increasingly vulnerable to drones and precision strikes — trafficking networks are dispersing shipments across multiple smaller, low-profile vessels.

At the same time, the use of semi-submersibles and narco-submarines, which are far more difficult to detect by radar or aerial surveillance, appears to be rising.

In February, Colombian authorities intercepted a semi-submersible carrying nearly ten tons of cocaine and arrested its four-member crew. The shift is also affecting trafficking routes. Land corridors are once again gaining importance, particularly those running through Colombia, Central America, and Mexico — a trend documented in recent investigations by InSight Crime, which note that trafficking groups routinely adapt routes in response to intensified maritime interdiction.

Should traffickers increasingly rely on commercial shipping — concealing cocaine in cargo containers rather than transporting it aboard smuggling vessels — criminal networks are likely to deepen their infiltration of ports and logistics companies. Analysts from the Global Initiative Against Transnational Organized Crime warn that containerized trafficking has become one of the fastest-growing methods used by transnational criminal organizations, precisely because it relies on corruption and infiltration of legitimate trade infrastructure.

The tactical removal of Maduro could further accelerate this transformation. Criminal groups may begin operating more like insurgent networks, with decentralized cells, diversified criminal portfolios, and greater reliance on encrypted communications. Networks linked to the so-called Cartel de los Soles — the military-connected trafficking structure long associated with Venezuela — could fragment into competing factions.

A range of actors, including transnational criminal networks such as Tren de Aragua, armed colectivos and elements of the state apparatus, are likely to compete for control of lucrative territories and illicit markets. The resulting instability could spill across the 2,200-kilometre border with Colombia, where groups such as the National Liberation Army (ELN) and dissident factions of the Revolutionary Armed Forces of Colombia already hold territorial influence.

Subscribe now

Subscribe now

A protest and counter-protest outside the New York City mayoral residence were suddenly disrupted Saturday, March 8, when two young men attempted to light and throw two improvised explosive devices (IEDs). Emir Balat, 18, and Ibrahim Kayumi, 19, were arrested. During and after their arrest, both of them referenced the terrorist group Islamic State (IS) as the inspiration for the plot, with Balat writing a shortened “bayah” to IS on a piece of paper.

Based on videos from the scene and the description of events in the criminal complaint, it appears that the targets were an anti-Muslim march led by white nationalist activist Jake Lang and New York Police Department (NYPD) officers. Whether the officers were the intended target originally or merely targeted in reaction to their spotting Balat is unclear. On video, Balat clearly threw the first IED at the anti-Muslim protest. Balat can be heard shouting “allahu akbar … [unintelligible],” with someone off-camera twice echoing “allahu akbar.” Balat grabs the second device from Kayumi and lights it, subsequently tossing it at a group of NYPD officers after they started chasing him.

Luckily, both IEDs failed, with one extinguishing upon impact and the second fuse quickly going out. A third device did not contain explosive material, but a storage facility elsewhere held an unspecified amount of additional material. Components for and notes about manufacturing IEDs were found in the suspects’ vehicle. Tests of the explosive material inside at least one of the devices showed that the material was TATP (triacetone triperoxide), the commonly recommended primary explosive of the Islamic State. Its high volatility has attracted doubts from online supporters, with its improper production killing two supporters in Alcanar, Spain, in 2017.

Its successful manufacturing here demonstrates its continued use by global supporters with limited to no expertise in explosives making.

The listed precursor components contained in the pair’s notebook appear to match the recipe for TATP published as part of the pro-Islamic State Al Saqri Foundation for Military Sciences’ “Easy Explosives” article series. This recipe calls for sulfuric acid, in contrast to older Islamic State TATP recipes that still circulate frequently on encrypted social media channels dedicated to this topic. Al Saqri Foundation’s recipe for TATP is not currently shared on its main social media channel, suggesting either Balat and/or Kayumi were in contact with the foundation’s representatives. This likely contact and the pair’s further notes on IED materials suggests Islamic State members might have provided some level of coaching, making this plot more than merely “inspired” by the terrorist group.

Read more

The Reichsbürger, a galaxy of German monarchists and right-wing extremists who style themselves as “citizens of the Reich,” have appeared more frequently in international news in recent years. This is due to incidents like the attempted assault on the German parliament in August 2020 and the large-scale anti-terrorism police operation against the coup-plotting group “Patriotische Union” in December 2022.

The term “Reichsbürger” describes a very heterogeneous conglomerate of groups and individuals who hold different beliefs, which are sometimes even in conflict with each other. (Some of their adherents can be thought of as similar to “sovereign citizens” in the United States.) However, all are crucially linked by the fundamental idea that the current BRD—Bundesrepublik Deutschland (German Federal Republic—is illegal or non-existent and that the former German Reich is instead still the valid and active political form of the German nation. The Reichsbürger scene is also deeply interlinked with the so-called Selbstverwalter (self-government individuals—again, taking us back to our sovereign citizen-types). Security authorities heavily monitor the Reichsbürger movement primarily because some of its members have access to weapons, and most if not all are heavily influenced by extremist ideology. Although the government and police have dismantled nonviolent Reichsbürger groups, the threat of violence remains the key concern. This was demonstrated in 2016 when a Reichsbürger killed a police officer for the first time.

The political and ideological constellation of the Reichsbürger and Selbstverwalter is complex to analyze due to its granularity, but several of its structural elements and tendencies can be explored in depth.

Share

The Ideologies of the Reichsbürger and Selbstverwalter

The Reichsbürger and Selbstverwalter milieu contains a wide range of positions, beliefs and ideologies. The scene began to develop substantially in the 1980s, incorporating political instances ranging from anti-democratic Second Reich monarchism to spontaneous right-wing libertarianism, from ethnonationalist ultra-racism to Third Reich Nazi-nostalgia. The core ideological belief is that the BRD - Bundesrepublik Deutschland is not sovereign and never was, and that the German Reich still exists, usually within the 1871 or 1937 borders. A fundamental conspiracy theory is that the BRD was not established as a national state but rather as a private company (a German GmbH) that simply continues to administer the country under the Allies’ ongoing post–World War II occupation. Accordingly, the current German Basic Law is rejected and the laws of the BRD are considered “general terms and conditions” that can be accepted or refused by individual citizens. All of these perspectives are based on a deep, extreme and absolute distrust of the German liberal-democratic state and its bureaucratic representatives. This framework produces a variety of political stances, including a strong push toward internal separatism, which aims to establish parallel, self-isolated state structures. Examples are the so-called “Exilregierungen” (“governments from exile”) or the “KRR - Kommissarische Reichsregierungen”, self-declared provisional Reich governments with their own “ministers” and “chancellors”. These entities, which can be quite surreal, are created by Reichsbürger groups that often compete with each other and all claim to be entitled to renegotiate the status of the German Reich with the current governments of the countries that won World War II. These anti-state and anti-government positions are clearly and deeply reactionary and far distant from any anti-state project elsewhere along the libertarian spectrum, since the current German state is usually set to be replaced by a more authoritarian one.

Read more

Subscribe now

Nigeria’s domestic insecurity has increasingly been instrumentalized within U.S. foreign policy discourse. In November last year, President Donald Trump threatened direct kinetic intervention to counter a so-called “Christian genocide” in Nigeria. Despite these claims, insecurity is driven by overlapping and long-standing land disputes, herder-farmer tensions, communal violence, and organized crime, with the vast majority of victims of militant violence in northern Nigeria being Muslim. Washington’s framing of the crisis through a religious lens, therefore, reflects political utility rather than empirical accuracy.

Washington’s strategic recalibration in West Africa has occurred alongside an ongoing decline of U.S. influence across the Sahel. Following Niger’s 2023 coup, the United States lost its primary intelligence hub at Air Base 201 near Agadez, while Chinese and Russian engagement expanded as junta-led governments increasingly distanced themselves from Western security partnerships. Since its expulsion from Niger in 2024, Washington has sought to reconstitute its regional intelligence and security posture, with Nigeria emerging as a central anchor for U.S. engagement. These have efforts have been made visible shift has bed by a marked increase in U.S. intelligence, surveillance, and reconnaissance (ISR) activity over Nigeria since late November, with flights reportedly originating from Ghana—underscoring Washington’s efforts to project influence and maintain situational awareness outside the Alliance of Sahel States (AES), including through partners such as Ghana, Benin, and Chad.

After weeks of escalating rhetoric, President Trump announced on December 26 that U.S. forces had conducted airstrikes against “Islamic State elements” in Nigeria. The operation is considered to be one of Washington’s most direct kinetic interventions in Nigeria’s domestic security landscape to date. On Christmas Day 2025, in coordination with Nigerian authorities, U.S. forces struck targets in the north-western state of Sokoto, ostensibly targeting Islamic State-linked militants operating under the label “Lakurawa.” The strikes were conducted using MQ-9 Reaper unmanned aerial vehicles and at least sixteen GPS-guided precision munitions launched from platforms in the Gulf of Guinea. The strikes were framed as a pre-emptive effort to prevent Islamic State elements from “penetrating Nigeria from the Sahel corridor.”

Despite the recent Sokoto strikes targeting “Islamic State militants” associated with Lakurawa, the term itself remains loosely defined, locally encompassing several intersecting but operationally disparate actors. Local accounts suggest that some Lakurawa-linked militants are also affiliated with al-Qaeda-aligned Jama’at Nusrat al-Islam wal-Muslimin (JNIM). Open-source reporting further indicates that “Lakurawa” is used interchangeably to describe Salafi-jihadist cells, criminal militias, and bandit networks, while some fighters may maintain ideological or operational linkages with the Islamic State Sahel Province (ISSP) or JNIM. Attribution remains inconsistent, and evidence of a consolidated Islamic State base in Sokoto remains limited.

Nearly three weeks on, the “Christmas Day” operation raises more strategic questions than it resolves. Sokoto is not Nigeria’s primary jihadist epicentre, and Lakurawa’s status as a structured Islamic State affiliate remains contested and tenuous. Meanwhile, the country’s most entrenched and operationally mature Islamic State faction — the Islamic State West Africa Province (ISWAP) — continues to consolidate its presence in northeastern Nigeria and along the periphery of the Lake Chad Basin. It has consolidated terrorists in the region through an elaborate system of governance, filling gaps in the state apparatus, and through its increasingly central role in the regional Islamic State network, including hosting the Al-Furqan media office.

In light of this, scrutiny has centred on why strikes in the northwest were prioritized over operations in the northeast — where Islamic State is most active in Nigeria — and over ISWAP, whose primary areas of operation remain concentrated in Borno and Yobe states following its 2016 split from Boko Haram. Several explanations have emerged. Part of the rationale appears symbolic, with Sokoto’s historical status as the seat of the 19^th century Sokoto Caliphate amplifying its political resonance. Lakurawa’s alleged links to the Islamic State Sahel Province (ISSP) — active in the Liptako-Gourma tri-border region and recently linked to several external plots in North Africa — may also have aligned with the Trump administration’s preference for targeting Islamic State affiliates framed as transnational threats.

The choice of Sokoto as a target of U.S. airstrikes is therefore significant. Beyond its proximity to Niger and Sahelian transit routes, the state holds symbolic importance as a historic and spiritual centre of Islam in Nigeria. It has also suffered escalating banditry, kidnappings, raids, and extortion. Moreover, from Washington’s perspective, ISSP may represent a model of transnational jihadist expansion exploiting governance vacuums and coup-induced instability.

By contrast, northeastern Nigeria remains the country’s jihadist heartland. Boko Haram splinter factions ISWAP and Jama’atu Ahlis Sunna Lidda’awati wal-Jihad (JAS) retain territorial influence across Borno State, anchored in the Lake Chad Basin, Sambisa and Alagarno forests, and cross-border corridors. ISWAP has evolved into one of the Islamic State’s most strategically significant African affiliates. In this context, the Sokoto strikes appear vastly misaligned with Nigeria’s most acute jihadist threat.

Trump has continued his escalatory rhetoric in a New York Times interview last week, stating: “I’d love to make it a one-time strike… But if they continue to kill Christians, it will be a many-time strike.” Following the Christmas Day strikes, U.S. ISR operations expanded over the north-eastern Borno state, including over the Sambisa Forest and the Timbuktu Triangle, and Washington delivered “critical military supplies” to Abuja. Yet kinetic interventions are unlikely to generate durable gains against Boko Haram’s decade-long insurgency, which escalated sharply in early 2025 as a result of a series of successful ISWAP operations.

The Nigerian Air Force (NAF) has performed poorly in its strike campaigns. Significant collateral damage and high civilian casualty rates resulting from Nigerian air strikes have eroded legitimacy and heightened domestic grievances vis-à-vis the state. Integrating U.S. systems into Nigerian operations reflects both the perceived precision of American platforms and the political utility of externalizing responsibility when operations fail. Persistent structural deficiencies within the Nigerian military mean that, despite significant defence spending, state forces have been consistently overwhelmed by jihadist groups.

ISWAP’s recent territorial and operational gains have been driven by these deficits, reinforcing perceptions of state fragility. Nigerian forces suffered high-visibility setbacks during the Islamic State’s “burn the camps” campaign in early 2025. Abuja has consequently prioritized short-term symbolic victories over long-term capacity building, deepening an asymmetric dependency on U.S. military assistance.

Last year alone, ISWAP carried out more than 300 attacks against military compounds, critical infrastructure, and civilian communities. These battlefield successes are, in part, a product of increased direct support from the Islamic State (IS) core, as well as tactical innovation, streamlined skill-sharing between IS affiliates, and the diffusion of advanced weaponry, alongside Sahelian geopolitical realignments toward Russia and China. Simultaneously, regional military cooperation has deteriorated in recent years. Niger’s withdrawal from the Multinational Joint Task Force in March 2025 disrupted intelligence-sharing and joint operations, while Chad’s threatened exit underscores the Task Force’s fragility. Strained Abuja-Niamey relations have further created operational vacuums along the Niger-Nigeria border, which jihadist and criminal groups have been quick to exploit.

Operationally, ISWAP has increasingly deployed explosive-rigged commercial drones. Initially used for reconnaissance and propaganda, these systems have since been weaponized — a trend observed across West Africa since late 2024. Influxes of foreign fighters arriving via the Bosso corridor further indicate rising funding, expertise, and external facilitation from the Islamic State core. ISWAP has integrated emerging technologies across surveillance, mobility, financing, and strike functions. Its use of drones, satellite navigation, digital financial channels, and complex VBIED construction reflects a concerted realignment with contemporary conflict environments. These adaptations have expanded ISWAP’s reach and lethality, enabling coordinated attacks on hardened targets even in the face of concerted state counterinsurgency pressure.

The Nigerian military, meanwhile, remains overstretched, under-resourced, and internally compromised. Embezzlement, poor soldier welfare, and logistical sabotage have undercut operational effectiveness, leaving state forces impotent in localized contests against jihadists. Vigilante groups and informal militias increasingly fill security gaps, increasing the likelihood of intercommunal violence in the absence of a state monopoly over the use of force, further fragmenting Nigeria’s security landscape.

Subscribe now

Subscribe now

It has been over three years since OpenAI launched ChatGPT, the large language model (LLM), which is now the fastest consumer application to reach 100 million users and has become synonymous with the term “artificial intelligence” (AI). Since then, a vast array of generative AI tools have entered the market, including chatbots, image, video, and audio generation tools. Much of the research on AI and terrorism has focused on these generative applications, examining how extremist groups might use them to create propaganda, amplify narratives through bot networks, and experiment with personalized “radicalization bots”. While this body of work has illuminated its impact on the digital realm, more attention needs to be paid to how AI tools, including those under the generative umbrella, are concretely used for operational planning and use by terrorists and violent extremists. This article addresses that gap by exploring how terrorists and violent extremists have leveraged AI in the operational planning of attacks and examines what this tells us about the incentives and benefits of AI use as perceived by perpetrators.

The year 2025 has witnessed a notable rise in incidents where terrorists and violent extremists have leveraged AI tools to plan, research, and prepare attacks. Just as terrorists and violent extremists have long relied heavily on internet forums, social media platforms, and messaging applications to acquire operational knowledge and guidance to execute plots, especially among lone wolves and inspired actors, we note an uptick in perpetrators and plotters turning to freely available AI products to optimize their operational toolkit. Specifically, according to our database of plots and attacks in which AI was used for operation planning in 2025, it serves a role in learning (ranging from operational security to the details of composing explosives), visualizing scenarios (e.g., creating images of the planned attack), and refining tactics through conversational, personalized guidance (e.g., step-by-step guidance on how to acquire the necessary chemical precursors for explosives). This trend underscores the urgent need for states, technology companies, and social media platforms to anticipate and adapt to the new realities of digital-enabled extremist activity and implement strategies to disrupt misuse.

Operational Use of AI in 2025 by Terrorists and Violent Extremists

Across 2025, this pattern has surfaced in a series of concrete plots and attacks that illustrate how AI tools now sit inside the operational workflow of violent actors. In Las Vegas, the suspect behind the New Year’s Day Cybertruck bombing consulted a chatbot to research explosives and detonation methods and gather information on gun stores and private phone devices, treating a conversational AI system as an immediately available tutor for the design of his attack. Hours earlier in New Orleans, an Islamic State-inspired attacker drove a truck into pedestrians, killing 14 and injuring more than 50. The attacker had earlier used AI-enabled smart glasses equipped with a voice assistant and camera for reconnaissance in the historic French Quarter, underscoring how consumer wearables can double as reconnaissance and surveillance tools for target selection and operational planning. While it is unclear whether the New Orleans attacker used the AI functionalities of the glasses – which, for example, allows the user to ask questions about their environment via the small embedded-camera – the possibilities of enhancing reconnaissance with wearable devices are significant. For example, a would-be plotter can quickly gather information on targets as it scouts an area, inquire about security protocols, and get a sense of crowd numbers and ambiance at a particular festivity.

In California, two cases in 2025 underscore that AI is used in operational planning across the ideological spectrum, but also in cases in which no clear ideological motive has been identified by investigators. In the May 17 bombing of a Palm Springs fertility clinic, which killed the perpetrator and injured four individuals, a chatbot was extensively used in preparation for the plot. The suicidal, efilist perpetrator used it to guide him through the making of a powerful bomb using ammonium nitrate and fuel. In Los Angeles, the suspect in the Palisades Fire arson, which killed 12 people and burned down close to 7,000 structures in January, appears to have used generative AI to visualize his alleged plot. Prompting to create an image of a fire, the suspect asked an image generator to depict impoverished people struggling against a giant gate emblazoned with a dollar sign, while on the other side, the wealthiest individuals were ‘laughing’ as the world ‘burned down.’ Aside from seemingly helping him with envisioning a scenario, the suspect also seemed to have engineered his chat history on the day of the fire to look innocent, asking, “Are you at fault if a fire is lit because of your cigarettes?”

Use of AI for operational planning has also appeared in other regions and among younger offenders. In Tira, Israel, a 16-year-old charged with attempting a knife attack on Israeli police is reported to have consulted a chatbot for information on attack methods and tactics before approaching his target. In this case, the suspect who acted “in protest of the Jewish occupation” bypassed traditional barriers to operational guidance, which can be hard to find within his highly securitized environment and complicated to digest without any prior experience. AI use for operational planning thus seems to have specific benefits for non-trained lone actors with no outside assistance.

In Finland, the 16-year-old responsible for the Pirkkala school stabbing, which saw three female students injured, used AI prompts to help draft a manifesto and to structure planning for the assault – this according to his manifesto that circulated online and that he sent to a Finnish newspaper. In this case, an LLM was used directly to steer the production of the manifesto outlining his justification for the attack and to prepare the logistics. The perpetrator’s explicit call-out of ChatGPT as a guiding tool for the attack plausibly also serves to inspire others.

In Vienna, an Islamic State supporter of just 18 years old, arrested in connection with alleged attack plans against the Israeli embassy in Vienna and the Imam Ali Islamic Center in Vienna-Floridsdorf, was convicted after a court found that he had used a chatbot for “attack fantasies” and bomb-making research. He had specifically discussed the production and storage of explosives.

Taken together, these incidents show AI operating at multiple points along the operation lifecycle, from ideation and fantasy, through research and planning, to reconnaissance in the physical world. In each case, AI accelerated learning and lowered the threshold between skillset and action. This emerging pattern suggests that counterterrorism, regulation, and platform governance must now treat the malicious use of AI as a core feature of contemporary extremist activity rather than a speculative concern.

Threat Assessment and Forecast

A recurring theme across these incidents is that the AI tools used in operational planning, such as smart glasses, chatbots, and image generators, function as shortcuts in operational planning. They transform fragmented information - for example, safe storage of chemicals, the technical steps of making a bomb, the places where one can acquire precursors - into clear, digestible steps that guide perpetrators through processes such as attack tactics, explosive composition, and logistical preparation. This capability significantly reduces the cognitive and technical barriers that previously constrained inexperienced or isolated actors. It is therefore important to keep tracking the profiles of users engaging with LLMs in attack plotting - are they indeed younger and more inexperienced than those who do not? Are they indeed not or less in contact with Islamic State virtual ‘guides’ or enablers?

For would-be attackers, three factors explain why LLMs have become integral to operational planning. First, LLMs make information accessible that would otherwise be difficult to locate without prior knowledge of where to look online. While IS and IS-aligned communities online, for example, host various DIY guides on attack planning or can provide ‘guides’ for enabled plotters, they still require someone to know where to look. Second, conversations with chatbots break down lengthy, technical information guides into bite-sized, actionable instructions, effectively converting documents or procedures that may be deemed far out of the skillset of an inexperienced plotter within his or her capabilities. While a foreign fighter with combat experience or a lone actor with mechanical engineering experience may easily understand the process of drone weaponization as explained in Islamic State guides, an inexperienced lone wolf may find the conversational, step-by-step nature of LLMs particularly useful. Three, the answers of chatbots are far more personalized than any search result from traditional search engines. These three factors closely parallel the benign use of generative AI for everyday problem-solving, where users seek personalized, accessible, and precise answers, including questions that they might hesitate to ask a human.

The efficiency and immediacy of these tools appeal to a wide spectrum of actors, but they so far seem particularly transformative for lone wolves and inspired individuals who lack formal training or mentorship from experienced operatives. For these users, LLMs serve as virtual tutors, bridging gaps in expertise and accelerating the transition from intent to action more quickly.

Subscribe now

Subscribe now

Belgian authorities recently disrupted a jihadist plot in Antwerp that involved the use of kamikaze drones – a disturbing evolution in terrorist tactics. The operation led to the arrest of two suspects who aimed to target Prime Minister Bart De Wever, among other politicians. Dutch far-right politician Geert Wilders, also reportedly on the hit list, suspended his election campaigning activities due to security concerns. Evidence uncovered so far in the investigation includes explosives resembling an IED, evidence of intent to weaponize a drone, and a 3D printer, which the suspects may have used to manufacture drone parts for delivering explosive payloads. The case highlights the growing threat posed by the convergence of advanced commercially available technologies within terrorist agendas, compounded by increasingly low barriers to accessing technical know-how and an online propaganda ecosystem saturated with do-it-yourself manuals. Investigations into the digital footprint of the two plotters showcased searches on drone weaponization and messages on Threema, an encrypted messaging application which has become popular with various Salafi-Jihadist groups. This development marks a significant shift in how terrorists employ advanced tools, reinforcing the urgent need for heightened vigilance and strategic responses to this emerging threat. While experts have warned that the rapid pace of drone innovation stemming from the Russia-Ukraine war is bound to enhance the operational capabilities of violent extremist actors, the most immediate concern is the proliferation of easily accessible instructional manuals on drone weaponization and deployment in DIY format that are just clicks away, accompanied by Islamic State (IS) and al-Qaeda propaganda explicitly calling for such attacks. Immediate action is needed to disrupt this vector: allocate additional resources to disrupt terrorist use of the internet (TUI) and improve content takedown processes across small and large platforms.

The disrupted plot in Belgium stands out for what appears to be the use of a 3D printer to facilitate drone weaponization. This is the second publicly disclosed incident in which 3D printers appear to be used to weaponize drones by Salafi-Jihadist perpetrators in the West. In September 2023, Mohamad al-Bared, a PhD student in engineering from Coventry, was convicted of preparing acts of terrorism. Authorities discovered a prototype “kamikaze” fixed-wing drone at his residence, which he had engineered and partially 3D printed. Prosecutors asserted that this device was meant to carry an explosive or chemical warhead for IS. Investigations revealed design files, weekly encrypted communications with IS contacts, and notebooks detailing chemical-weapon formulas.

While details are still emerging, the 3D printer appears to have been used to fabricate components intended to weaponize drones for attacks on Dutch and Belgian politicians. All of these points point towards a continuing escalation in technological diffusion that is steadily lowering the barriers to attack for terrorist groups and the individuals they inspire or direct in the West. The commercialization of drones, falling prices, and more user-friendly models now intersect with increasing affordability and commercial availability of 3D printers, effectively allowing terrorists and violent extremists to design and manufacture custom parts from home that enable commercially available drones to carry payloads, bypassing oversight. The threat stems from an ecosystem of off-the-shelf tools, community guides, and step-by-step manuals and tutorials that enable non-specialist actors to use them effectively. In recent years, both Islamic State and al-Qaeda have published instructional manuals on the use of drones and propaganda encouraging drone attacks on soft targets in the West. This uptick in propaganda comes at a time of surging incidents of political violence and assassination plots in Europe, Central Asia, and the Middle East, in which drones are increasingly involved.

In October 2023, al-Qaeda’s as-Sahab Media Foundation commended Hamas following the October 7 terrorist attack and called upon followers to execute attacks targeting embassies and military bases. They encouraged supporters to utilize their skills to create homemade explosives, deploy drones, or engage in other forms of attacks. Moreover, the Islamic State Khorasan Province (ISKP), IS’s Afghanistan-Pakistan branch, and online pro-IS networks have been ramping up their propaganda and strategic initiatives around the use of drones, particularly in targeting high-profile events. Following threats in the wake of the March 2024 Crocus City Hall attack in Moscow, phrases like “if they constrict you on the ground, then strike them from the sky” encapsulate their intent to leverage aerial capabilities to circumvent counterterrorism (CT) pressure. Propaganda also encourages drone attacks on specific events. In 2024, the pro-IS outlet Al Adiyat issued threats against the Paris Olympics in a graphic depicting a drone carrying munitions toward the Eiffel Tower. Pro-IS online supporters increasingly underscore the utility of “kitchen-made bombs” and “commercial drones,” indicating a shift towards more accessible terrorist tools. Accompanying this is their “Modern Warfare” drone manual series, spanning six issues, which provides comprehensive instructions on employing drones in attacks. This blend of propaganda and pragmatic guidance marks a sophisticated evolution in their tactical repertoire, posing an increased threat to international security, particularly at large public gatherings.

Terrorist groups have long leveraged drone technology to enhance their operational capabilities in conflict theaters. In the early 2000s, Iran-sponsored proxies, including Hamas, Palestine Islamic Jihad (PIJ), and Hezbollah, tested drones for surveillance and propaganda purposes but were heavily reliant on Iranian-supplied systems and did not conduct operations with immediate battlefield impact. It was IS in 2014 that seized upon the increasing commercial availability of drones to systematically operationalize them for surveillance, propaganda, and attacks. This period was marked by rapid innovation in drone terrorism with IS establishing dedicated units that weaponized drone systems and integrated them into combat operations, dropping mortar shells on targets in Iraq and Syria. The weaponization of civilian drones spread as a terrorist tactic globally, with terrorist groups, from the Houthis to JNIM, increasingly coordinating drone attacks with ground maneuvers. Later, the advent of first-person-view drones enabled ‘kamikaze’ attacks in which rather than dropping ammunition, drones fly into the designated target and trigger an explosion, further exploiting the aperture between evolving commercially available tools and CT efforts.

No successful jihadist-inspired drone attacks have occurred in Western countries, despite hundreds of such attacks in global conflict zones in recent years. Nonetheless, this does not indicate a lack of interest in using drones for external operations (EXOPS). Multiple directed, facilitated, and inspired plots in the United States and Europe have been disrupted, which involved drone technology. Other thwarted cases have shown Europe-based individuals procuring drones on behalf of terrorist groups operating in the Middle East. In the U.S. context, the first plot involved Rezwan Ferdaus, a physics graduate student at Northeastern University inspired by al-Qaeda, who planned to attack the Pentagon and U.S. Capitol using a remote-controlled aircraft filled with explosives in 2011. Since then, there have been a host of disrupted plots in the U.S. involving drones. In 2017, an Army Sergeant First Class stationed in Hawaii self-radicalized and purchased a drone he passed on to FBI agents he believed were IS operatives, intending them to be used to track U.S. troop movements in the Middle East. In Michigan, a self-described ‘son of the Islamic State,’ who had attempted to travel to Syria to join the group twice, gathered drones and built bombs over a multi-year period. He was arrested in 2017 after he pledged allegiance to IS. In May of this year, a 19-year-old former member of the Michigan Army National Guard radicalized by IS was arrested on the day he planned to carry out a mass shooting at a military base, which he had monitored with a drone to scout vehicle entry and exit points.

In Europe, the past five years have seen a surge in jihadist plots leveraging drones. In April 2020, German authorities arrested members of a Tajik IS cell that were plotting to attack the U.S. Air Base Spangdahlem and the NATO AWACS Air Base. The plot featured remote-controlled drones and paragliders armed with explosives to attack the bases. The members of the IS cell had downloaded guides from an IS Telegram channel that provided detailed instructions on how to drop munitions from drones. In 2017, in Denmark, multiple arrests were made of individuals who had bought drones for IS, a part of the international supply chain, by the Bangladeshi Sujan brothers. Materials shipped to IS included drone components and infrared cameras. In 2022, a Moroccan national was arrested by Spanish authorities for planning an IS-directed drone attack on the Camp Nou stadium during a soccer match, after he had rapidly radicalized during the COVID-19 lockdown. In March of this year, French authorities charged a 22-year-old who had previously spent one year in IS-controlled territory in Syria and Iraq with preparing a terrorist attack using a modified drone. He had already acquired the drone and researched online how to modify it, while remaining in contact with an IS recruiter on Telegram.

An emerging trend that is equally concerning in the European context is the leveraging of organized crime networks by terrorist organizations to procure drones. In 2023, Danish authorities discovered that individuals linked to the gang “Loyal to Familia” purchased drones online capable of carrying 30-kilogram payloads, intended for use by Hamas in terrorist attacks at an “unknown location in Denmark or abroad.” Investigations revealed the gang members were taking orders from Hamas leaders in Lebanon. A Europe-wide operation in 2024 and 2025 that spanned Spain, Germany, France, and the UK dismantled a Hezbollah logistics network for drone procurement that included multiple individuals who were also charged with membership in a criminal organization. Efforts to disrupt terrorist use of the internet (TUI) to prevent attacks cannot be separated from efforts to target the online platforms where terrorist and criminal actors converge or coordinate.

IS propaganda and recent disrupted drone plots show that militants regard military, civilian, and symbolic political sites as attractive targets. While plots tend to maximize for publicity and subsequent psychological impact, more strategic assets may be targeted in the future. As recent suspected Russian incursions into European airspace have shown, drone sightings around airports can force runway closures and have major cascading effects on air traffic and safety. Targeting of aviation infrastructure, including control towers, is another way that terrorists may seek to maximize impact. Similarly, critical infrastructure, including electrical substations and water treatment plants, and transportation nodes, may be selected to increase impact beyond the immediate target. At this point, large public gatherings and soft targets remain of primary concern, with IS having put out multiple propaganda items over the past year encouraging attacks on sporting events, including the 2024 Summer Olympics in France. In that case, multiple terrorist plots were disrupted, and over 3,570 people were excluded from participation in the event due to security concerns. Upcoming events such as the 2026 FIFA World Cup, to be held in Canada, Mexico, and the United States, combine high casualty potential and high publicity value.

The most urgent step to disrupt the evolving jihadist drone-terrorism threat to the West is to limit access to openly available content that shows how to convert commercial drones into weapons. This is not the only response needed — counter-drone capabilities and supply chain disruption matter — but a priority should be making manuals and instructional material harder to find and dedicating more resources to curbing their circulation. The emerging signals of crime-terror cooperation for the acquisition of coveted technologies reinforce the need for a strategy that recognizes hybrid threats: monitoring individual threat types is no longer sufficient. Policymakers and analysts should track evolving actor networks, hybrid partnerships, and shared infrastructures to close the systemic gaps these groups exploit.

Subscribe now

Attacks, direct actions and sabotage against Tesla have become commonplace in Western countries, especially over the past year, since Elon Musk publicly supported Donald Trump. In Germany, this trend has been developing for some time. This is due to two main factors:

1) the construction of the Tesla Gigafactory near Berlin, which employs 12,000 people and began production in March 2022.

2) Musk's vocal support for the far-right German party AfD - Alternative for Germany (from late 2024 onwards).

Initially, groups and individuals from the German autonomous, eco-anarchist and far-left spectrum began campaigning against Tesla as a symbol of “techno-capitalism” and “green capitalism”. This radical resistance to Tesla and other companies in the tech industry persists today and remains a defining characteristic of these militant groups' claims and attacks. However, anti-Tesla sentiment was surely reinforced further after Musk publicly and strongly supported the German far-right.

Subscribe now

The “Volcano Group” versus the Tesla Gigafactory

Protests against the construction and later expansion of the Tesla Gigafactory in Grünheide, located a few kilometers southeast of Berlin in the state of Brandenburg, have been ongoing for years. The protests are organized by environmental activists, far-left militants, and local residents. They all strongly oppose the factory, especially after the expansion plans were rejected in a local non-binding referendum that had no consequences.

However, this analysis does not focus on protests involving public demonstrations, civil disobedience, or peaceful land occupation. Rather, the focus here is solely on direct attacks against Tesla production and Tesla cars in Germany. This wave of sabotage originates from various radical anti-capitalist ideologies, including insurrectionary anarchism, eco-anarchism, anti-technology revolt, and militant antifascism.

One of the first significant acts of sabotage occurred on May 25–26, 2021, when six high-voltage cables supplying electricity to the Gigafactory construction site were set on fire (the construction site opened in 2020.)

The attack was followed by a responsibility claim that denounced Tesla as “neither green, ecological nor social. Tesla is a company exploiting land and peoples’ lives on a global scale, it relies on and produces colonial conditions. Our fire stands against the lies about green cars.”

The communiqué added that:

“Our attack is a call to attack the Green Deal” and “Elon Musk, owner and patriarch of Tesla, is for us only a representative of a caste of men who are united in their aggressive capitalist-technological will to modernize and their delusion of world domination.”

The long claim of responsibility was signed "Vulkangruppe: Gegen den Fortschritt der Zerstörung" ("Volcano Group: Against the Progress of Destruction").

The Vulkangruppe entity is believed to have been active since 2011. It is considered responsible for various arson attacks and acts of sabotage in the Berlin and Brandenburg areas. Probably emerging from the anarchist and eco-anarchist spectrum, the group has managed to remain elusive until now. The group's signatures, sometimes inspired by Icelandic volcano names, periodically change. This could be linked to an evolving composition or network, the use of the same ideological framework and wording by various groups, or more broadly, the political expression of insurrectionary anarchism, which primarily believes in the "propaganda of the deed" by affinity groups rather than fixed political forms. In line with this framework of informal insurrectionism, most responsibility claims for anti-Tesla acts of sabotage lack a group signature altogether. Instead, they often conclude with traditional calls to action or salutes honoring far-left and anarchist militants currently imprisoned in Europe.

The so-called Vulkangruppe was also responsible for one of the most effective acts of sabotage against the Tesla Gigafactory. In the early morning hours of March 5, 2024, an arson attack was carried out against an electrical pylon in the Gosen-Neu Zittau area near Grünheide. The pylon was crucial for the Gigafactory and the sabotage forced Tesla to halt production completely for several days. According to company calculations, the attack resulted in hundreds of millions of dollars in production losses.

Subscribe now

The "Vulkangruppe Tesla abschalten!" (Volcano Group Shut Down Tesla!) claimed responsibility for the attack in a statement (English translation):

“With our sabotage, we have set ourselves the goal of inflicting the largest possible blackout at the Gigafactory. We have ruled out endangering our lives and the lives of other people. The shutdown of production in the automotive industry is the beginning of the end of a world of destruction.”

“Our gift for March 8 (the International Women’s Day) is to shut down Tesla. Because the complete destruction of the Gigafactory and with it the cutting off of ‘techno-fascists’ like Elend Musk is a step on the path to liberation from the patriarchy”.

The group sarcastically used the name “Elend” (German for “misery”) instead of “Elon” Musk.

The lengthy communiqué emphasized that:

“In addition to the dirty battery factory, Tesla now wants to expand its factory site by a further 100 hectares, including a freight station” and that “‘green capitalism’ stands for colonialism, land theft, and an exacerbation of the climate crisis! Lithium batteries come from toxic mines in Chile and use up other rare metals, which means misery and destruction for those who live where the mines are. The battery factory in Grünheide near Berlin, for example, requires the rare raw material lithium, which is also mined in Bolivia”

Share

Significative was also the claim of anti-surveillance anti-transhumanism sabotage, which asserted that:

“A Tesla vehicle is a surveillance device for public spaces. It is equipped all around with high-resolution cameras from Samsung” and “Artificial intelligence will register every movement and every mistake the driver makes, monetizing these by using the data to train the software for autonomous driving.”

The text continued with personal attacks against the "technofascist" Musk, reaching an almost situationist irony when discussing his space projects:

“our strong extra-planetary allies are already waiting for him; solar storms will crash his rocket, as they have already done to 30% of the satellites he has put in space before. So we will win.”

In another part of the text, the group thoroughly explained the methodology of the arson attack. This was done to ensure that the authorities and the media would quickly recognize the authenticity of the claim of responsibility.

Elon Musk quickly condemned the militants on his X platform, calling them the “dumbest eco-terrorists in the world.”

“Burn a Tesla” and “Fuck AfD”

Direct attacks on Tesla cars became increasingly common in Germany and throughout Europe. Currently, it is difficult to compile complete statistics on these attacks. Car arsons in Germany are not cataloged by brand, not all attacks are reported, and Tesla may not always publicize the fact that it has become such a specific and major target.

One of the first significant attacks on Tesla cars in Germany occurred in Frankfurt on the night of September 10-11, 2023. A claim of responsibility put the act into context within the then recent International Mobility Show (IAA) in Munich:

“That's why we torched a few new Teslas in Frankfurt last night. As a salute to the protests in Munich. As one of many attacks on the destructive automotive industry.”

“According to corporate logic, only a select few are entitled to own such cars. It is a question of class who drives or is allowed to drive these cars.”

Share

The claim was signed “Switch Off – the system of destruction!”, the name of a movement and platform that emerged in 2023 and calls for a broad anti-technology and anti-capitalist revolt. (The "Switch Off" website is also one of the main sources of the communiqués analyzed here. Other sources are Indymedia and other militant websites).

In its latest report, published in May 2025, the German domestic intelligence agency BfV (the Office for the Protection of the Constitution) wrote that: “'Switch Off' is currently the most significant militant campaign in left-wing extremism. It offers violent left-wing extremists an opportunity to make a name for themselves with their actions, place these in a common ideological context and thus attract potential imitators.”

(Verfassungsschutzbericht, p. 161)

In February 2024, two attacks on Tesla in Berlin were promptly followed by a clear claim:

“On February 7, two Teslas were set on fire in Rummelsburg, and on February 8, two Tesla charging stations were set on fire on Vulkanstraße”.

The choice of Vulkanstraße (Volcano Street) in the German capital was hardly a coincidence. Although there is no proof that the same group or individuals were responsible, the communiqués of February 8 and March 5, 2024 (the latter following the aforementioned arson attack on the power pylon) have at least four strong structure similarities: they denounce Starlink as a military tool (for example in Ukraine and by Israel in Gaza), highlight the role of lithium in "green capitalism," criticize the Gigafactory's exploitation and water consumption, and attack Tesla car cameras' surveillance.

On the night of April 22, 2024, two Teslas burned in Alt-Stralau Street in Berlin-Friedrichshain. (In this case, no one claimed responsibility for the attack. This is similar to other cases mentioned in this analysis that remain unattributed and unclear.)

On the night of May 12, 2024, an act of sabotage was then carried out against Tesla vehicles at a dealership in Leipzig. “Unfortunately, technical errors apparently meant that only a few vehicles were hit, limiting the damage” said the unidentified group that claimed responsibility.

On the night between June 17 and 18, 2024, three Tesla cars burned in the Berlin district of Mitte. Other direct actions during those weeks included less intense attacks, such as spray-painting or acts of minor vandalism.

In July 2024, Elon Musk publicly endorsed Donald Trump, throwing his full support behind the Republican presidential campaign in the U.S. Later, in November of that year, a government crisis hit Germany, and new elections were announced soon after. In December 2024, Musk began heavily supporting the far-right party AfD - Alternative for Germany. A significant portion of Germans consider the AfD to be fully or partially neo-nazi. The domestic intelligence agency BfV has classified the party as an extremist right-wing entity (an appeal by the AfD is currently underway). Musk’s move surprised some liberal-conservatives on the German political spectrum. They used to think, and some still believe, that the Tesla-X-SpaceX entrepreneur is mostly a libertarian capitalist with whom they could discuss deregulation, free speech, and neoconservatism. Conversely, those who were already strongly opposed to Musk - including far-left, ecologist, and anarchist militants - found that their ideological framework was confirmed by their idea that techno-capitalism and techno-fascism are one and the same.

From an analytical point of view, it would be incorrect to conclude that most of the anti-Tesla attacks and sabotage in Germany since 2025 have been anti-AfD. Eco-anarchists and similar groups consider the entire liberal-democratic political spectrum beyond salvaging because of its capitalist foundations and technological logic. Their complete rejection of "green capitalism" has also targeted parties like the Greens (who were in a governing coalition until the end of 2024 and had Robert Habeck, a Green Party leader, as Economy Minister). Nevertheless, starting in 2025, Musk's association with AfD undoubtedly strengthened the most radical anti-Tesla stance within the broader far-left, anarchist, autonomous, and Antifa communities. For these groups, militant antifascism remains a most powerful incentive and a crucial call to action.

Share

Between February 8 and 9, 2025, two Teslas burned in Dresden. In the night between February 11 and 12, 2025, a fire attack sabotaged a Deutsche Bahn railway in Berlin. An unidentified group claimed responsibility for the latter attack, explaining:

“Early this morning, we interrupted the railway line that transports thousands of Tesla workers from the capital to Grünheide every day, as well as freight trains carrying oil and gas from east to west, and set fire to a radio mast in the immediate vicinity of the railway cable shaft.”

The text sharply criticized the police's dismantling of the anti-Gigafactory camps in Grünheide, as well as the granting of permission to expand the factory against the "will of the people", concluding that:

"it goes well for techno-fascist and AfD fan Elon Musk."

The communiqué ended with the message, "Greetings to the anti-fascist Tesla arsonists from the U.S. to Dresden!", alluding to the growing number of anti-Tesla sabotage attacks in Western countries.

Between February 24 and 25, an arson attack occurred at a construction site in Berlin-Marzahn belonging to Strabag, an Austrian construction company involved in expanding the Gigafactory. Two construction cranes and some Deutsche Bahn signal cables were damaged. A new responsibility claim stated:

“No company embodies the new technocratic fascism as much as Tesla. Trump, Musk, and Weidel are the alliance of techno-fascists who give a face to the new patriarchal and colonial totalitarianism”.

Alice Weidel, one of the two leaders of the AfD, was hence mentioned directly, with Musk's AfD support becoming a key element of the attacks. The text added:

“Anyone who drives a Tesla is aligning themselves with Trump, Musk, and Weidel. Anyone who drives a Tesla is, at least indirectly, supporting Starlink, the AfD, the colonization of Mars, military logistics in wars, video surveillance on the streets, greenwashing, the destruction of nature, and fascist and patriarchal propaganda.”

Coinciding with the anniversary of the attack on the electricity pylon in the Gosen-Neu Zittau area on March 5, 2024, a new and comprehensive campaign was then launched in Europe on March 5, 2025, with the publication of a statement called "Welcome Spring, Burn a Tesla!” (in German: “Begrüßt den Frühling, zündet einen Tesla an!). The call was made for a widespread, molecular, and anarchist-spontaneist wave of Tesla car sabotages, declaring that the streets are “teeming” with Teslas that are “just waiting for you to attack them”. The call targeted Trump, Musk, and Tesla as crucial parts of a “connected ‘world’ and internet of things” that “takes away our direct connection to the world around us, while further increasing surveillance and control. Every Tesla has eight cameras and represents the smart city model: another obstacle to freedom”.

Technical suggestions for the sabotage were also provided:

“-In addition to the cameras on the street, a Tesla has eight cameras: don't forget to cover your face!

-Make sure you don't leave any fingerprints or DNA traces behind.

-A fire in an electric vehicle is particularly difficult to extinguish. This can be an advantage, but also a safety risk, if you don't want the fire to spread to the surrounding area.

-Whether you use barbecue lighter fluid or gasoline, a timer fuse or not, is entirely up to you... but above all: take care and have fun!”

On March 12, 2025, at around 1 a.m., a Tesla caught fire at the intersection of Pettenkofer Straße and Rigaer Straße in Berlin-Friedrichshain. On the night of March 13-14, unknown perpetrators set fire to several Teslas: three vehicles burned on different streets in Berlin-Steglitz, and another burned on Neue Krugallee in Berlin-Plänterwald. Then, on the night of March 28–29, seven Teslas burned in front of a car dealership in Ottersberg, Lower Saxony.

These attacks occurred in the same weeks as other major anti-Tesla sabotage episodes in different countries. On March 3, an arson in Plaisance-du-Touch, Toulouse destroyed 12 Teslas. An anti-authoritarian group claimed responsibility for the attack. On March 20, 2025, over 80 Tesla cars were damaged at a dealership in Hamilton, Ontario, Canada. On March 31, an arson destroyed 17 Teslas at a dealership in the Torrenova area in Rome. Elon Musk quickly condemned the attack in Italy as “terrorism”. Nearly a month later, on April 25 (Italy's national day of Liberation from nazi-fascism), an anarchist group claimed responsibility for the attack, stating: "The only Tesla we like is the one that burns... And how well it burns!"

In mid-April, Der Spiegel reported that German police, primarily from local Landeskriminalamt (LKA) offices, had started to address the growing number of attacks on Tesla cars.

On April 26, perpetrators attempted to set fire to two Tesla cars in Leipzig by throwing a spray can containing pyrotechnics. The damage was minor, but a police spokesperson said that the can had the following written on it:

"Fuck Tesla" and "Fuck AfD."

Share

In the early morning hours of April 27, a brand new Tesla Model Y burned in Osterholz-Scharmbeck, Lower Saxony.

On April 29, 12 cars caught fire at the Tesla delivery center in Holzgerlingen, Baden-Württemberg.

On April 29, a long text signed "Vulkangruppe Friede den Hütten..." ("Volcano Group Peace to the Huts...") claimed responsibility for fire attacks on a radio mast and a transformer station that supplies power to the Grunewald neighborhood in Berlin. Many of the villas in this area are owned by wealthy and influential families, oligarchs, and foreign embassies. The text promoted slogans such as "Eat the Rich!" and also mentioned Tesla:

“Tesla is finished. Internationally, Tesla is under attack practically every day. #TeslaTakeDown and militant attacks are causing profit losses of over 70%. (If you are a Tesla owner reading this, you should sell your car while it still fetches some money and isn't on fire. Or set it on fire yourself and collect the insurance money. Just don't let your own car film you doing it.)”

The international "Tesla Takedown" protests are nonviolent. However, sabotage militants highlighted here the global impact of an entire and multifaced anti-Tesla movement.

On the night of May 7, another Tesla was burned in Berlin-Karlshorst. After that, other incidents followed. However, the wave of burning Teslas appears to have peaked in Germany in March and April of 2025.

Thus far, German authorities have made few to no arrests in cases of anti-Tesla sabotage and direct actions, especially concerning the most successful attacks.

Starting in June 2025, Elon Musk began to retire from his most vocal political activism, while also straining his relationship with Donald Trump. However, Musk's support for the German AfD appears to remain unchanged. Given the consistent and deeply rooted ideological framework of anti-Tesla saboteurs, it would be shortsighted to expect the attacks to end easily, especially in Germany. Sabotage on Tesla's production, infrastructure, and cars will likely continue and possibly become chronic, albeit sporadic. Waves of attacks may reemerge and intensify quickly in the short and long term.

Subscribe now

On June 2, extremists from militant group Jama'at Nasr al-Islam wal-Muslimin (JNIM) launched a major coordinated attack on Mali’s main military camp in the city of Timbuktu and three checkpoints around the city. The operation involved vehicle-borne improvised explosive devices (VBIEDs), infiltration militants, and a rocket attack on the Timbuktu airport, which is known to host members of the Russian “PMC” Wagner Group — now operating under the Africa Corps umbrella. Reports suggest that up to 30 soldiers were killed, with many others wounded. Images released by JNIM showcased captured weapons, ammunition, and the IDs of soldiers — as part of an ongoing propaganda strategy designed to feature the group’s strength and to wipe out confidence in local forces.

Share

JNIM temporarily took control of several positions/checkpoints before retreating, consistent with its well-established hit-and-run tactics. However, the scale and sophistication of the Timbuktu attack, including the use of multiple units and indirect fire, indicate that JNIM’s operational tempo has increased.

Tactical Gaps and Command Friction

Despite the success that JNIM achieved in the Timbuktu attacks, a local source suggested that the attack was flawed because of internal leadership friction. The operation was allegedly led by Abu Dardar Chenguetti, a Mauritanian national, alongside a local commander, Abu Qotada. According to the same source, the Inghimasi (Arabic for infiltrators) failed to fully achieve their objectives due to poor coordination, limiting the damage inflicted inside the main military base. However, the first assault team succeeded in overrunning outposts around Timbuktu and launched artillery attacks on the airport, creating confusion and panic among government troops and civilians.

Boulkessi: Another Critical Blow to Malian Forces

The Timbuktu assault was preceded by a devastating June 1st attack on a Malian military camp in the strategic garrison town of Boulkessi in the Mopti Region, near the border with Burkina Faso. An estimated 200 fighters from Katibat Macina, a JNIM sub-group, overran the Malian Armed Forces (FAMa) base, which plays a key role in securing the Douentza, a sub-region within Mopti torn by intercommunal violence and insurgency. The camp was looted and destroyed. While JNIM claimed to have killed Russian operatives in the attack, local sources confirmed that a body shown in propaganda material was that of a Tuareg officer in FAMa, which explains his lighter skin tone.

FAMa acknowledged the incident and announced that a search operation had been launched, claiming that several attackers had been neutralised during their retreat. However, with up to 100 soldiers reportedly killed and reports of prisoners being taken, the attack represents a major failure to FAMa’s intelligence.

As the attack happened on the border of Burkina Faso, the country reportedly deployed a Bayraktar TB2 drone to support FAMa. A Sukhoi Su-24 was also reportedly seen over Boulkessi, which is a rare demonstration of aerial response capacity.

Despite these efforts, the Boulkessi death toll appears to be high, with sources confirming around 70 soldiers killed in the assault.

The Boulkessi assault forms part of a broader pattern of JNIM’s escalation of activity across the border between Burkina Faso and Mali, including major offensives in Burkina Faso. In Djibo, Burkina Faso, less than 100km from the Boulkissi military camp, JNIM reportedly killed around 200 Burkinabe soldiers in one of its largest operations this year.

In Burkina Faso’s Est Region, the group temporarily seized control of Diapaga, a provincial capital, for approximately 10 days, releasing prisoners, thereby demonstrating its capacity to disrupt governance and local security structures.

The takeover of Diapaga marked the longest period JNIM has held a major town in Burkina Faso to date. All of these events might suggest a shift in JNIM’s approach and an attempt to move from raids and hit-and-run attacks to testing territorial control, even if only temporarily.

In Dioura, central Mali, another JNIM attack on May 23 was also considered a noticeable advance in JNIM’s operational tactics. The attack, according to a local source, was a joint operation between two JNIM sub-groups, Katibat Macina and the Al-Furqan Brigade, the latter falling under the Timbuktu Wilayah, which is controlled by JNIM. This kind of inter-unit coordination, particularly across wilayah boundaries, possibly indicates growing internal coordination within JNIM’s command structure, likely reinforced by the appointment of a new emir for Timbuktu Wilayah.

Footage from the Dioura attack also showed the use of JNIM drones to film and track FAMa soldiers, indicating an integration of drones for reconnaissance and tactical planning.

Defections and Consolidation

It appears that JNIM’s ranks have been boosted by defectors from former rebel factions, including fighters previously affiliated with Hussein Gholam, a former commander in the Front de Libération de l’Azawad (FLA). Gholam and his men defected last year, bringing with them vehicles and weapons. These men were recently seen fighting alongside JNIM during the Dioura attack.

The spike of JNIM activity and the intensity of attacks seems similar to the dynamics of 2012–2013 in northern Mali, when jihadi groups took advantage of fractures within northern armed movements and the weakness of the Malian authorities in order to consolidate control. However, unlike that period, there is now no major foreign military presence to intervene. With France’s withdrawal and the newly-formed Alliance of Sahel States (AES) overstretched, regional militaries are struggling to respond effectively.

Share

The situation is further complicated by renewed activity from northern rebel groups, which recently conducted a drone strike on FAMa’s Soumpi military camp, also in the Timbuktu region. While the FLA is distinct from JNIM in its agenda and activities, it presents an additional challenge to the authorities in the Mali capital city of Bamako.

The series of attacks in Mali and Burkina Faso in May and early June marks an escalation in both scale and coordination for JNIM. The group is more and more demonstrating tactical flexibility, technological adaptation with the deployment of drones, and internal coordination between JNIM’s sub-groups, which should position it to apply greater control over key territories, particularly in areas where national and regional forces are stretched thin. Slowly, JNIM may begin to assert control over more territory and establish parallel governance structures, while national armies within the AES bloc grow increasingly tired and demoralised, becoming a shadow of their former selves.

Subscribe now

Subscribe now

Juan Carlos Felix Gastelum ('El Chavo Félix’), a financial operator of the ‘La Mayiza’ faction of the Sinaloa Cartel (CDS), and the son-in-law of Ismael Zambada Garcia ‘El Mayo,’ was captured on January 18^th, 2025, during an operation in Culiacan, Sinaloa. According to the Secretariat of Security and Citizen Protection (SSPC), a patrol was traveling through the town of Quilá and identified Gastelum—who, after noticing the presence of authorities—attempted to flee, but was captured at a residence located along Lázaro Cárdenas street.

Share

After a report by the National Detention Registry confirmed Gastelum’s arrest, Omar Hamid García Harfuch, the Secretary of Security and Citizen Protection of Mexico, published images of Gastelum while in custody and stated the operation had been headed by the Secretariat of National Defensa (Defensa) with the involvement of the National Guard (GN), the Navy (SEMAR), the SSPC, and the Attorney General’s Office of the Republic (FGR) as part of an ongoing effort to reduce the violence in Sinaloa.

Once in custody, Gastelum was transferred to the Federal Social Readaptation Center Number 1, or commonly known as the ‘Altiplano’ in Villa de Almoloya de Juárez. This is where he currently remains in preventative custody while facing criminal charges of crimes against health for the intent to trade fentanyl and possessing a firearm exclusively used by the military. A hearing on January 26^th determined Gastelum will remain in custody as a precautionary measure. Additionally, a five-month limit has been placed on the investigation against the criminal figure.

During the National Morning Press Conference on January 28^th, Secretary Harfuch identified Gastelum as a principal source of violence in Sinaloa, who supervised the production and transportation of fentanyl, cocaine, and heroin—stating that during the arrest authorities seized two firearms, two bags containing an unknown amount of fentanyl, and a vehicle.

Misinformation would quickly surround the case as local reports falsely attributed two images of the firearm that was allegedly seized during Gastelum’s arrest. The first image was of a Browning Hi-Power adorned with a figure of the character ‘El Chavo’ from the 1973 Television show ‘El Chavo del Ocho’ along with his iconic phrases ‘Se me chispoteó’ and ‘Es que no me tienen paciencia,’. The second image was a heavily customized 1911 decorated with a skeletal figure of El Chavo and other prominent characters of the 2006 animated television show ‘El Chavo’. The first image of the Browning Hi-Power was originally published on December 4th, 2018, following a shootout between gunmen and State Police in Culiacan, Sinaloa, which resulted in the arrests of two suspects who possessed the firearm and U.S documents. While the second image of the 1911 was edited to remove its placement on an unidentified individual’s lap with no indication it’s related to Gastelum’s arrest.

Share

Sometime after Gastelum’s arrest, a radio communication circulated through social media where an unidentified member of the rival ‘Los Chapitos’ faction of CDS mocked the arrest of Gastelum and urged a figure identified as ‘El Comanche,’ Head of security for Ismael Zambada Sicairos ‘El Mayito Flaco,’ to come and fight in Culiacan. A translation is as follows:

“You see, you see…fucking group…Where are you? Where’s all that support you boasted of? That everyone was going to come and where are they? How many bullets did you lose for [him]? How many [gunmen] were killed during it?

…Make sure the message reaches that… ‘El Comanche,’ this [message] is for the fat ass Comanche and his friend, come to the Capital you fuckers, you [allegedly] have been winning for months but we don’t see anything, there’s nothing to see.

You keep messing with YouTubers because you can’t [against us]...Look Comanche…bring your ten, fifteen, twenty [armored vehicles], but make sure to bring [armored vehicles]...Come with your [armored vehicles] and the support you allegedly have.

If you want to fight, come down now…be ready, we’ll meet head on…here we don’t retreat…The teams of Juan and Jose Avéndaño are at the entrance and with them you won’t pass, but still come to [fight].

You already know Comanche, let's fight. How do you feel about that? Once and for all…You already know [come fight] or look like a [coward]...Pure Chapiza you already know.”

Sources conflict on the name of ‘El Comanche’ and would identify him as Juan Pedro Gómez López, Manuel de Jesús Gómez López, or Pedro Manuel Vidaña. Regardless, information indicates El Comanche had orchestrated the violence that was unleashed on September 9th, 2024 in Culiacan and maintains the ongoing conflict against Los Chapitos.

Around January 21^st, a wanted poster designed by the Los Chapitos faction circulated through social media where they offered one million pesos in return for the location of El Comanche. They allege he is responsible for the killing of innocent people under the orders of Ismael’s Sicarios and are seeking the criminal figure for “a better Sinaloa.” The translation:

“Notice for the population of Sinaloa, the Sinaloa Cartel - Los Chapitos (ALG) [we] offer a large sum of money of 1 million Mexican pesos for the location you give us of this killer of innocents ‘El Comanche,’ this person is dedicated to killing innocent people; among them women, children, the elderly…He doesn’t care who he affects with his intentions of causing terror under the orders of ‘Mayito Flaco’... In Sinaloa the Mayo’s are not welcomed and never will be. We offer great discretion, if you provide the location of this killer of innocent people, tell us, and take the reward. For a better Sinaloa.

Sincerely, ALG”

The poster would be signed by Alejandro López Guzmán or ‘ALG,’ a family member of Los Chapitos leadership, and the figure who helped arrange an alleged alliance between the ‘Jalisco New Generation Cartel’ (CJNG), and the aforementioned faction, ‘Fuerzas Especiales Unión’ (FEU), whose principal iconography would be an AI produced green logo with a pizza and rooster with its name crudely written. Around October 19^th, 2024 a communication would circulate through social media allegedly confirming the integration of the ‘Cartel de Chiapas y Frontera Guatemala’ into the alliance, although local reports deny the validity of such claims.

It’s unclear when Gastelum had initially involved himself in the criminal organization, but claims indicate he had gained a notable role after the arrest of his father Juan Francisco Félix Ojeda ‘Pancho Félix,’ who was a Sinaloa Cartel member closely associated with the former leader Ismael Zambada. On January 22^nd, 2009, after failing to stop at a security checkpoint in Culiacan, Sinaloa, while traveling aboard a stolen Jeep Liberty alongside José Lamberto Verdugo Calderón ‘El Verdugo’ (CDS Lieutenant), and Sergio Luis Félix, in the Costa Rica region, they were shot at by military personnel, gravely injuring Calderón who would later pass away while receiving medical attention at the Institute of Security and Social Services for State Workers (ISSSTE) and both Félix and Lamberto were detained by soldiers.

Share

Gastelum would further integrate himself into the criminal organization over the years by allegedly heading ‘Los Demonios’ or ‘Los Siete Demonios,’ a criminal cell based in Sonora that would primarily traffic illicit substances such as cocaine and methamphetamines through markets in California, Arizona, and Texas. He continued to develop to the point of being identified as the second successor of the La Mayiza faction behind Ismael Sicarios, son of Ismael Zambada, who took the reins of the criminal faction following his father’s arrest on July 23^rd, 2024, in El Paso, Texas.

While the arrest has been publicized as an important blow against the Sinaloa Cartel, Gastelum was but one of the numerous figures that play a pivotal role in the criminal organization whose violent internal conflict needs to be prioritized to avoid the bloodshed that has affected not only the residents of Sinaloa but the people who live in the many territories contested by both factions throughout Mexico.

Subscribe now

Subscribe now

In the pitch darkness of a January night, a Turkish-backed Syrian National Army (SNA) convoy moves cautiously along the road near Syria's strategic Tishreen Dam. Unknown to them, high above, a modified rotary-wing commercial drone equipped with thermal sensors silently tracks their movement until the column stops at its final staging area. Within minutes, the drone, which is also loaded with repurposed VOG-17 munitions, aligns its payload and strikes with remarkable accuracy. Parked vehicles, visible only as bright thermal signatures moments before, erupt in flames that illuminate the night sky.

This and other similar scenes played out repeatedly in recent weeks around the Tishreen Dam, exemplifying how the largely Kurdish-led Syrian Democratic Forces (SDF) have adapted the now-familiar patterns of small drone warfare to their specific strategic needs. Following a path launched by the Islamic State (IS), blazed by Ukrainian forces, and refined by groups like jihadi-led HTS (Hay’at Tahrir al-Shame) in Syria, the SDF has developed a methodical approach to drone operations that emphasizes persistent attacks on the cheap, through the widespread adoption of commercial unmanned aerial vehicles (UAVs).

The numbers show rapid integration of proven techniques that have made headlines over and over in the past few years.

Open-source imagery released by SDF-linked outlets and analyzed by this author indicates a steep increase in drone operations in recent weeks, with more than twice the number of observed attacks in January 2025 (135) compared to the previous month (61). But (incomplete) numbers are not the only interesting indicator. The SDF has also improved its targeting choices and tactical employment, which reveal the most about its evolving capabilities.

Share

Proven Technologies, Refined Tactics

Like most non-state and proto-state armed actors, the SDF relies primarily on modified commercial platforms for its air operations. Their arsenal mirrors what's become standard in contemporary drone warfare: easily accessible DJI and Autel drones for intelligence, surveillance, and reconnaissance (ISR) operations, cheap weaponized first-person view (FPV) drones for kamikaze-style kinetic strikes, and modified commercial rotary-wing UAVs for munitions delivery.

FPV drones are typically assembled from 7-inch Chinese carbon frames and other cheap components. They usually function with an analog video signal, which is cheaper than its digital counterpart.

Given the rapidly increasing number of attacks, the SDF seems to have established a robust and resilient supply chain that allows its Martyr Haroun Units to conduct relatively high-tempo operations. Interestingly, the SDF is also benefitting from crowdfunding initiatives, a phenomenon that emerged in Ukraine and has quickly turned into an essential lifeline for both Ukrainian and Russian forces.

The typical weapons are similarly familiar: adapted PG-7 pattern HEAT grenades attached to the FPV frame and repurposed 60mm mortar rounds, 40mm M433 or 30mm VOG-17 high-explosive munitions with 3D-printed stabilizing fins for dropping strikes. This combination of commercial platforms and repurposed munitions has become standard practice in conflicts from Ukraine to Sudan to Myanmar.

Overall, collected data reveal a clear prevalence of FPV attacks (63,7%), followed by explosive drops (36,3%).

Vehicle Trashers

What distinguishes the SDF's approach, thus, is not their technology but their targeting strategy. Analysis of their operations reveals a carefully considered focus on mobility denial. The statistics are telling: 57% of the strikes observed by this author are aimed at vehicles, which are more vulnerable compared to hardened structures and buildings and easier to strike compared to personnel.

This emphasis on vehicle targeting by the SDF likely reflects a sober understanding of their strategic situation, in which the Turkish-backed Syrian National Army enjoys greater capabilities and can rely on heavier, more advanced pieces of military equipment, as well as robust intelligence and drone support from Ankara. Rather than attempting to hold territory through conventional means, the SDF uses drones to deny the SNA freedom of movement and disrupt their logistics, affecting their ability to both establish a secure footprint in contested territory and launch major offensive operations.

Share

The remaining target distribution - 26% personnel, 17% buildings, and 1% fixed equipment – seems to corroborate this emphasis on mobility denial. As a result, the SDF can level the battlefield or at least try to fight on less unfavorable terms against the SNA.

Operational Implementation

The SDF's concept of drone employment follows what has become standard practice in today’s small drone warfare. Commercial ISR drones operating at 150-300 meters above ground provide target acquisition, while follow-on strike platforms such as weaponized FPV UAVs or explosive-dropping drones conduct the attacks. At the same time, ISR platforms typically remain on station during and after strikes, enabling immediate battle damage assessment and rapid re-attack if necessary.

This combination of tactics, pioneered by the Islamic State in 2014-15, used on an industrial scale in Ukraine and then mimicked by various factions in Syria, Myanmar, and elsewhere, has proven remarkably effective, and above all, affordable. The SDF has employed drones worth between a few hundred and a few thousand dollars to destroy or damage expensive military equipment, including armored vehicles, counter-battery radars, and – recently – a Turkish Firtina T-155 self-propelled artillery system.

Their ground control infrastructure similarly follows established patterns. Semi-fixed situation rooms with multiple screens and ground support equipment located several kilometers behind the frontline coordinate the operations and build a comprehensive situational picture, while rapid deployable drone teams with portable ground-control stations provide tactical flexibility.

In general, this distributed approach is also meant to provide resilience to enemy countermeasures while ensuring a minimum degree of command and control capabilities in most situations. A key factor is the group’s use of tunnels, that allow drone operators (and other units) to move and transport equipment undetected and perform missions from concealed and secure locations.

The Tishreen Dam Drone Battleground

The concentration of operations around the Tishreen Dam and Manbij countryside is also indicative of the SDF's strategic priorities. The dam's critical importance to regional infrastructure makes it a key strategic asset, while the nearby hills and elevated terrain offer a favorable view over the surroundings.

In recent weeks, multiple locations under SNA control and even Turkish military outposts have experienced recurrent attacks, sometimes several times per day.

Share

Overall, the rapid scaling of SDF drone operations - doubling in just one month - suggests a remarkable learning curve and successful absorption of lessons from other conflicts. As in other contexts, constant operational experimentation has been instrumental to this process and confirms the critical importance of integrating any given technology into a tailored and tested concept of operations to achieve maximum effects.

In this respect, the creation of specialized drone units follows the examples of HTS and, more generally, Ukrainian and Russian forces. According to recent reports, these units have received training and technical advice from former US special forces individuals.

SDF’s information warfare approach also follows established patterns. Quick release of strike footage serves both propaganda purposes and helps shape adversary behavior, a tactic refined by various forces in several recent conflicts.

So far, it appears the SDF has avoided the temptation to reinvent drone warfare, instead focusing on implementing proven tactics with increasing efficiency.

Implications

Rather than technological innovation, the SDF's drone program, and use represents yet another example of effective implementation of what's becoming an increasingly widespread and common practice in modern warfare.

Their success lies less in absolute technical advances and more in meticulous target selection, mission planning, and tactical adaptation. Nevertheless, it is worth noting that the SDF has also been quicker than the SNA to rapidly adopt cheap drones, particularly FPV systems, at scale and to integrate them into its combat operations. In a recent interview, an SDF commander revealed that their use of small drones started in 2015 and that SDF has invested significant resources to build its drone capabilities and train its specialized personnel over the last decade. This indicates a longer more articulated and more committed process than the easily digestible and frenetic one shown by published footage.

Along with the structural lack of C-UAS capabilities on the part of the SNA, this has created a temporary tactical advantage that has allowed the SDF to disrupt adversarial operations and cause more than a headache to the SNA but also ushered in tactical imitation as the latter begins to deploy its own FPV drones.

As the conflict around the Tishreen Dam and adjacent territories continues, the SDF's approach offers insights into the maturation of drone warfare in low-intensity contexts. The peculiar focus on mobility denial, rather than territory control, may also be a preview of how other forces might adapt proven technologies and tactics to their specific strategic requirements. This process seems to follow a trend of growing technological sophistication among insurgents and non-state armed actors whose origins date back to the early 20^th century.

The SDF case, along the HTS’s and that of others, also seems to reflect a broader trend: the standardization of small drone warfare tactics across different conflicts and forces. As commercial drone technology and basic weaponization techniques become widely understood and shared across social media and other information channels, the technical advantage may become increasingly short-lived and would depend not only on new technological leaps but also on tactical sophistication, perhaps more combined arms tactics employing other more conventional weapons systems and tactics and adaptation to the local context.

Subscribe now

The news that the M23 Movement (March 23rd Movement) has captured the city of Goma in the North Kivu province of the Democratic Republic of the Congo (DRC) on January, 28, 2025 caught many people by surprise.

However, there are several key data points to unpack regarding the situation. The first that needs to be addressed is that this is not the first time M23 has captured the city. M23 first occupied the city back in 2012. After concluding a peace deal with the government of the DRC in 2013 the group would disappear for a period of time before reemerging in 2022. It was also in this time frame where M23 once again threatened to capture Goma, but were driven away by a combined force of the Congolese Army, UN Peacekeepers and the FDLR which is comprised of the former Rwandan Military that was responsible for the 1994 Genocide.

So, what events led to the fall of Goma? There has to be one thing to be taken into consideration. In a long campaign both combatants are constantly seeking for a breakthrough so that a new phase can be initiated. The capture of the town of Minova on January 20th may have been the break that M23 desired. Occupying positions in a couple of other towns and in the hills around Minova has effectively given M23 control of Lake Kivu.

The defense of Goma was poorly coordinated. The entities that were entrusted with the defense of the city were the Congolese Army (FARDC) with support from Romanian mercenaries, and UN Peacekeepers bolstered by a contingent of South African troops acting under the auspices of the Southern Africa Development Council (SADC). But things unraveled quickly and within one week M23 was in control of Goma, FARDC had taken serious losses along with several deaths of UN Peacekeepers mostly from South Africa and hundreds of the Romanians captured and being repatriated to their home country by Rwanda.

The chaos of the situation has not been confined to the Congo. On January 27th protestors took to the streets in the Congolese capital of Kinshasa. These protests grew violent and several embassies including that of the United States were attacked by demonstrators. This incident does not bode well for the Congolese government as it likely will be seen as President Tshisekedi may be in a weakened position.

Share

What has been interesting is the reaction in South Africa to the deaths of the South African peacekeepers. The administration of President Cyril Ramaphosa was silent for two full days after the deaths of the peacekeepers was announced. During this time controversy emerged as several reports criticized the South African government for the peacekeepers not being adequately equipped. However, the main factor that was lacking was air support. Previously, the South Africans used the Rooivalk attack helicopter in support of their mission. But this platform has not been used in the DRC since 2022. One of the great “what ifs” that is currently being asked right now is whether the presence of this airframe in the area would have been able to prevent the fall of Goma. Another question that could be asked was whether air cover was a priority. Several senior leaders of the South African Air Force created additional controversy yet again as they were seen having a golf outing during the chaotic final days before Goma was captured.

One of the major concerns is what happens next. The international community has galvanized, calling upon Rwanda to cease supporting M23. However, it is interesting to see pundits speculate over whether or not Rwanda and South Africa will come into direct conflict themselves.

Shortly after the fall of Goma, M23 fighters advanced towards the city of Bukavu, south of Goma, and the group has been issuing press releases stating that they have the goal of marching on Kinshasa. Yet, as of February 4, the group announced a ceasefire as regional leaders negotiate an unsteady peace.

Subscribe now

When examined in general, Kalashnikov variant (AK-47 and AKM-pattern) assault rifles, PK variant 7.62x54mmR general-purpose machine guns and RPG-7 Launchers constitute a large part of the contemporary Islamic State’s (ISIS) arsenal.

Read more

Last month, Indian police claimed that at least 10 Maoists were killed in an operation in the state of Chhattisgarh, a hotspot for what is termed “left-wing extremism” in India. The Maoist (or, as it is locally known, the “Naxal” insurgency) sparked off in 1967 in the village of Naxalbari, in the state of West Bengal. Workers from mainly tea plantations launched a rebellion against landowners, setting off an armed conflict that is today India’s longest-running insurgency. Conflict intensified in parts of India for decades thereafter. Today, the Naxal movement has been significantly weakened and does not pose the security threat to India that it did in prior decades. However, it is far from insignificant; the insurgency continues to evolve and remains one of the largest internal security issues in India.

Read more

There is a little-known militant group currently operating in Nigeria which has been around since about 2016-2017. They are known as the Lakurawa, which officials in Abuja are taking quite seriously and trying to stamp out before the group has an opportunity to form lasting roots, as have other insurgencies in the country. Their name is derived from the French phrase “La Recru” meaning “the recruit”. They are known to operate in both the Nigerian states of Sokoto and Kebbi. They were first identified in 2018, and according to more recent reporting they have since expanded their reach into Niger State and Kaduna. There is additional evidence that suggests the group was founded to fill a void left by Nigerian state agencies to protect from armed bandits operating out of Zamfara State.

The question regarding the sudden impact of the group upon Nigerian state security is worthy of both discussion and investigation. It appears that the military and media outlets have agreed on a similar message: “The Lakurawa are affiliated with terrorists organizations operating in the Sahel, particularly from Mali and Niger Republic.” The threat has been defined by these state instututions as being external rather than being an internal situation of which the current leadership in Nigeria has lost control. Another assessment finds that the group has had success “exploiting weak intelligence frameworks, porous borders, and socio-economic vulnerabilities to wreak havoc on communities in mainly parts of Kebbi and Sokoto State.”

In recent weeks the Nigerian military has claimed a victory over the group in Tangaza, part of the Augie Local Government Area (LGA) in Kebbi State. How did they define this victory? Were the Nigerian military able to prevent the group from capturing a population center? In either such context it may be practical to declare victory by military force, however, how the group reacts and where their next operation takes place may indicate if the strategy currently being employed against the them will ultimately prevail, or if they are simply playing whack-a-mole.

The operation at Tangaza relied heavily upon government airpower, highlighting a significant flaw within their general strategy. Often we hear of a Nigerian airstrike that killed dozens or hundreds of fighters belonging to either Boko Haram or the Islamic State’s West Africa Province (ISWAP). However, these strikes do not seem to deter or hinder the major operations of these groups, as they often launch reprisal raids and attacks. This fact alone begs the question of whether the Nigerian military has conducted proper Battle Damage Assessments (BDA) to accurately calculate the number of casualties that they have inflicted, particularly via air support.

When it comes to nations having serious domestic security issues, they often emanate from either one of two sources: poor governance within their own borders, or they are neighbors to a country that is suffering itself from an insurgency, a common feature of which being a certain porosity of borders, and even the exploitation of such conflicts by other hostile states to the advantage of armed groups. Nigeria currently finds itself in a precarious situation where both of these are contributing factors to its overall security landscape.

Share

We have known for some time now that the Nigerian government has struggled against both Boko Haram and ISWAP. These militant organizations have spread into neighboring Cameroon and Chad. Add to this whole picture of destabilization the coups that have taken place in Mali, the Niger Republic and Burkina Faso, and this presents a complex of milieu of security challenges with which West African governments are currently faced.

So, how is there current leadership in Nigeria faring? The answer depends on who you are asking. The military is stating that it is responding to all threats, however we see banditry and more militancy spreading across the country, to include the growing influence of groups like the Lakurawa. The government has been slow to designate and respond to threats, perhaps due to issues of capability, leaving internal states in the lurch. It appears that this dynamic will not be resolved anytime soon.

At the very least, Nigeria will require leaders that are willing to work with their neighbors on their internal security to reduce the threats to itself and the region as a whole, as well as remain open to cooperating with neighboring states on their own security issues, all of which seem to affect and interact with one another.

Subscribe now

Subscribe now

On September 19, in the weekly 'Al-Naba' newsletter, Islamic State (IS) militants announced their first attacks in Azerbaijan.

The organization said in a statement that clashes broke out between IS militants and Azerbaijani security forces in Qusar, on the Russian border. Allegedly, eight Azerbaijani security forces members were killed and/or wounded during the firefight.

Although IS militants have released videos from Azerbaijan in previous years, the attack in Qusar is the first to be carried out by the group in Azerbaijani territory.

When the group's weapons were examined, two militants were seen carrying an AKM pattern assault rifle with an East German-style folding stock and an AK-74 assault rifle with a 45-round Molot magazine.

The militant on the left in the above photo (carrying an AKM pattern rifle) also has two Bulgarian-made Dunarit RGD-5 hand grenades on his waist.

Other militants participating in the attack appear to be armed with standard pump-action shotguns.

In general, the weapons and grenades used by the militants are widely available in both Azerbaijan and Russia. Although the organization’s small branch in the country has a limited arsenal, this attack may be a sign that its militants may soon launch more attacks in Azerbaijan after recent attacks in Russia.