This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This report emphasises threat trend analysis to help analysts and policymakers feel confident in their understanding of the active threat environment and support strategic decision-making.

This publication includes threat assessments and analyses that aim to reassure policymakers of the depth of understanding of groups’ tactics and the dynamic threat landscape.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

This focus on documentation and structured presentation of firsthand material is intended to help analysts and policymakers feel assured of the data’s reliability for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations. Explain how this integration improves overall threat understanding for strategic decision-making.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• AQAP

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Al-Malahim Media, the media wing of Al-Qaeda in the Arabian Peninsula (AQAP), released a series of eight statements by Ibrahim al-Qosi, also known as Khubaib al-Sudani, a senior AQAP figure and former associate of Osama bin Laden, praising Humam al-Hamami following his attempted hijacking of a Flydubai aircraft.

Al-Qosi frames the incident as retaliation for the war in Gaza and invokes the September 11 attacks and Osama bin Laden’s legacy to reinforce his message. Across the statements, he encourages further attacks against American and Israeli interests, including appeals directed at individuals working in civil aviation.

The intervention reflects AQAP’s continued emphasis on inciting violence beyond its immediate operational environment, particularly by encouraging individuals to exploit professional access and opportunities.

While the statements demonstrate explicit ideological endorsement and incitement, they do not establish that AQAP planned, directed or coordinated al-Hamami’s attempted hijacking.

Minbar al-Bayan, a media outlet affiliated with Jama’at Nusrat al-Islam wal-Muslimin (JNIM), released a video statement featuring Kaab al-Ansari, addressing members of the Volunteers for the Defence of the Homeland (VDP) and the wider population of Burkina Faso.

Al-Ansari claims that VDP-controlled towns and villages are increasingly isolated, with residents facing shortages of supplies and difficulties sustaining agricultural activities. He urges militia members to abandon their alignment with President Ibrahim Traoré’s government, offering religious adherence as an alternative to continued participation in the conflict.

The statement also directly criticises Traoré, accusing him of hostility towards Muslims and threatening to revoke the citizenship of Burkinabé students studying Islam in Saudi Arabia. Al-Ansari calls on the population to unite against the government and reconsider who their enemies are.

The video reflects JNIM’s continuing efforts to undermine support for the VDP, exploit the humanitarian and economic consequences of its pressure on rural communities, and frame the confrontation with the Burkinabé authorities in religious and political terms. Burkina Faso.

Read more

Subsequent evaluations by UAE Attorney General Hamad Saif Al Shamsi categorized the event as a premeditated act of terror, directly drawing ideological inspiration from the September 11 attacks. The perpetrator’s intended objective involved incapacitating the primary pilot, maintaining standard air traffic communications to secure landing clearance, and deliberately crashing the aircraft into a passenger terminal at Ben Gurion Airport to maximize casualties. Investigative findings indicate al-Hamami had previously conducted surveillance during earlier assignments, including a June transit through the facility, and had abandoned a similar attempt in July due to the presence of an acquaintance among the flight crew. While he reportedly shouted statements requesting his own death following restraint, initial law enforcement inquiries concluded he operated without direct operational co-conspirators.

Despite sustaining significant injuries to his head and hands, Captain Machchhar succeeded in unlatching the flight deck access door. Israeli passengers, along with cabin staff, then entered the compartment and physically removed the co-pilot from the primary flight controls, allowing additional flight crew to regain control of the aircraft. Public statements by Israeli officials, including Prime Minister Benjamin Netanyahu and Defense Minister Israel Katz, framed the incident as an averted mass-casualty jihadist attack, highlighting online materials and digital footprints reflecting extremist indoctrination and anti-Semitic sentiment. While broader geopolitical connections were posited internationally, analytical consensus continues to view the event primarily through the framework of an individual actor leveraging professional access.

The attempted hijacking of a Flydubai aircraft on September 30, 2026, attributed to Humam al-Hamami, has become the focus of an intensifying propaganda campaign by both Al-Qaeda in the Indian Subcontinent (AQIS), Al-Qaeda in the Arabian Peninsula (AQAP), and pro-AQ networks. While insufficient evidence suggests either organization planned or executed the incident, subsequent publications reveal a clear intent to turn this failed operation into an ideological touchstone and a model for others to emulate. This convergence is particularly significant given the nature of the appeals, which specifically target commercial aviation personnel, and the scope of the proposed targets, ranging from Israeli interests to U.S. military installations.

The cover and content of the AQIS magazine Nawa-e-Ghazwa-e-Hind, a statement released by Al-Malahim Media, and subsequent remarks by veteran Al-Qaeda leaders Saad bin Atef al-Awlaki and Ibrahim al-Qosi all document a process by which the incident is increasingly valorized; its failure is reinterpreted as a psychological and propaganda victory. The recurring invocation of the war in Gaza as justification, the individual glorification of al-Hamami, and the incitement directed at pilots point to a strong narrative alignment between the two branches. However, this does not necessarily imply formal organizational coordination in creating these messages.

This dynamic suggests that Al-Qaeda’s interest lies not merely in a retrospective celebration of the event, but also in the potential to leverage it to encourage acts of individual violence, facilitated by professional access to sensitive infrastructure. The distinction between propagandistic intent and operational capability remains essential: the materials examined document an explicit incitement to emulation, yet they provide no evidence of networks infiltrated within the aviation sector or of preparations for further attacks. The primary concern, therefore, is Al-Qaeda’s regional branches’ ability to rapidly incorporate a high-profile event into a shared transnational narrative, extending its significance well beyond its original context while keeping the door open for subsequent individual mobilization.

AQIS: From Propaganda Endorsement to Incitement

The publication of the September–October 2026 issue of Nawa-e-Ghazwa-e-Hind, an Urdu-language magazine linked to Al-Qaeda in the Indian Subcontinent, serves as one of the first documented instances of propaganda appropriating the attempted hijacking of a Flydubai flight on September 30. By dedicating the cover to this event and depicting an aircraft from the Emirati airline diving toward Ben Gurion Airport, the magazine immediately imbues the act with symbolic significance that transcends its actual outcome. The image does more than reference a recent event; it visually represents the objective the propaganda attributes to the perpetrator, turning a failed attempt into a depiction of what could have happened.

This framing continues into the opening editorial, which situates the incident within a broader narrative regarding the war in Gaza and the necessity, according to the jihadist worldview, of expanding the armed response against Israel and its backers. The mention of Humam al-Hamami serves a purpose that goes beyond mere individual glorification. AQIS uses his example to argue that participation in violence need not depend on membership in an organized militant structure; rather, it can emerge through individual initiatives, facilitated by specific circumstances and the perpetrator’s own professional skills. In this context, the operation’s failure matters less than the intent attributed to the perpetrator and the psychological impact the organization claims the act achieved.

Read more

The most significant developments concern the evolving investigation into suspected Iranian intelligence activity surrounding RAF Fairford in the United Kingdom, the conviction of a Norwegian teenager recruited for a contract killing associated with the Foxtrot criminal network, and further evidence of the use of intermediaries in sabotage operations attributed to Russian intelligence services. These cases differ considerably in their organisational characteristics and evidentiary status. However, they illustrate how access to criminal expertise, local operatives and logistical support can extend the operational reach of actors beyond their immediate organisational structures.

The reporting period also included developments involving suspected white supremacist violence in the United States and investigations into attacks against communications infrastructure in Europe. These incidents demonstrate that the wider security environment remains heterogeneous, with ideologically motivated individuals operating alongside criminal and intelligence networks whose activities may be driven by financial incentives, political objectives or external direction.

The principal analytical finding is that the relationship between operational control and physical execution is becoming increasingly important in assessing contemporary security threats. The involvement of intermediaries can complicate attribution, obscure the origin of instructions and allow hostile actors to exploit capabilities already present within local criminal environments. This does not establish a common operational model across the cases examined. Still, it demonstrates the need to assess the organisational relationships behind individual incidents rather than concentrating exclusively on the individuals who carry them out.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week | Violence Beyond Organisational Boundaries

2. Threat Signals | Terrorism, Proxy Violence and Covert Operations

• United Kingdom | RAF Fairford and the Emerging Iranian Intelligence Dimension

• United Kingdom and Norway | The Foxtrot Network and the Recruitment of Young Contract Killers

• United States | White Supremacist Radicalisation and the Threat of Mass Casualty Violence

• Europe | Iranian Proxy Networks and the Persistence of Operational Coordination

3. Sabotage and Covert Infrastructure | The Operational Role of Intermediaries

• Bulgaria | The Targeting of Satellite Communications Infrastructure

• Ukraine | Russian Intelligence, Explosives Logistics and Compartmentalised Operations

• Ukraine | Railway Sabotage and the Targeting of Military Logistics

4. The Information Battlefield | Recruitment, Concealment and Operational Communication

5. Strategic Assessment | The Expanding Role of Criminal and Covert Intermediaries

6. Threat Signal Matrix | 14–20 October 2026

7. Early Warning Indicators | Next 30 Days

8. Threat Forecast | 30 to 90 Days

9. Executive Intelligence Conclusion

Related Intelligence & Analysis:

1. The Shift of the Week | Violence Beyond Organisational Boundaries

The use of external operatives is not a new feature of terrorism, organised crime or intelligence operations. Its contemporary significance lies in the range of actors capable of providing operational services, the relative accessibility of cross-border communications and the opportunities available to separate planning, financing and execution across different jurisdictions.

Traditional assessments of terrorist and hostile intelligence activity often begin by identifying the organisation responsible for an operation and examining its personnel, capabilities and intended objectives. This approach remains essential when dealing with established militant structures or state intelligence agencies. Still, it becomes less effective when operational tasks are delegated to individuals who may have limited knowledge of the ultimate sponsor or the strategic purpose of their assignment.

Criminal intermediaries can provide access to local environments, recruit individuals willing to undertake violent activities and facilitate the acquisition of resources without requiring the sponsoring actor to deploy its own personnel. The resulting separation may reduce the immediate exposure of those directing an operation. However, it also introduces problems of reliability, operational discipline and control over individuals whose motivations are not necessarily aligned with those of the sponsor.

The distinction between ideological commitment and financial motivation is particularly relevant. An individual recruited to commit violence for payment may possess little interest in the political objectives of the organisation that ultimately benefits from the act. This creates an operational relationship based on incentives and access rather than shared ideology, allowing hostile activities to emerge from environments that conventional terrorism monitoring might not immediately identify as relevant.

Read more

This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This report emphasises threat trend analysis to help analysts and policymakers feel confident in their understanding of the active threat environment and support strategic decision-making.

This publication includes threat assessments and analyses that aim to reassure policymakers of the depth of understanding of groups’ tactics and the dynamic threat landscape.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

This focus on documentation and structured presentation of firsthand material is intended to help analysts and policymakers feel assured of the data’s reliability for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations. Explain how this integration improves overall threat understanding for strategic decision-making.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• AQAP

• JNIM

• Al-Shabaab

• AQIS

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

• People’s Fighters Front

The conclusions include the Weekly Strategic Assessments.

Read more

Document Type: Executive Intelligence Briefing
Scope: Global Jihadist, Insurgent & Hybrid Warfare Threat Assessment
Time Horizon: Rolling Forecast (30–90 Days)
Reference Period: October - December 2026.

This document is an independent analytical product intended for professional use by analysts, policy planners, security practitioners, and decision-makers.

Intended Audience & Use

This Executive Intelligence Briefing is intended for use by intelligence analysts, policy planners, military and security decision-makers, international organisations, and applied academic researchers concerned with the threat dynamics of jihadist, insurgent, and hybrid warfare.

The document supports strategic awareness, forward-looking risk assessment, and prioritising monitoring over a rolling 30–90-day horizon. It is not intended to provide tactical-level tasking, real-time operational guidance, or event-specific prediction. Use the briefing as a decision-support and situational-awareness tool to inform planning, posture adjustment, and analytical focus, not immediate response.

📌 Inside this Executive Intelligence Briefing

This briefing includes:

• Executive Overview: Strategic Context

• Key Judgments

• Global Threat Posture

• Global Structural Assessment

1. Africa and the Sahel

2. Middle East and South Asia

3. Europe and the Western Threat Environment

4. Transnational Networks and Secondary Threats

• Operational Actor Assessment

1. Al-Qaeda and Affiliated Organisations

2. Islamic State and Regional Provinces

3. Pakistan and Baloch Insurgent Movements

4. Iranian-Aligned and Other Armed Non-State Actors

• Cognitive & Hybrid Battlespace

1. Jihadist Media and Operational Narratives

2. Cross-Ecosystem Mobilisation

3. Russia, Iran and State-Linked Hybrid Activity

4. European and NATO Strategic Exposure

• Forward Assessment: 30–90 Days

• Strategic Risk Assessment

• Priority Intelligence Requirements & Early Warning Indicators

Confidence, Assessment & Intelligence Gaps

This assessment is produced with moderate to high confidence regarding structural trends, theatre-level operational logic, tempo modulation patterns, and the most likely 30- to 90-day trajectories, based on systematic analysis of incident data, propaganda monitoring, and pattern continuity across regions to ensure methodological transparency.

Confidence is highest in assessing Africa as the primary kinetic centre of gravity, Pakistan as a high-endurance attrition theatre, and the broader ecosystem’s reliance on below-threshold operational logic, while acknowledging that intelligence gaps in remote or contested areas introduce moderate confidence levels.

Key limitations remain:

• In some theatres, especially remote or contested areas, incident visibility is structurally uneven.

• Quiet months or reduced media output may reflect risk management and force preservation rather than degradation. Conversely, concentrated claim density may serve reputational objectives without a proportional increase in kinetic expansion.

• Assessments of intent are based on pattern analysis, target-selection logic, propaganda framing, and behavioural shifts rather than confirmed insider access.

• The dissemination of training material, UAV manuals, and cumulative infographics signals capability socialisation, but the conversion rate from dissemination to operational activation is difficult to measure in advance.

• Attribution ambiguity in decentralised ecosystems complicates the accurate linking of online enablement, local facilitation networks, and offline incidents, particularly in transnational secondary environments.

These gaps do not alter the central assessment of continuity, resilience, and distributed attritional logic. They reinforce the need to prioritise qualitative shifts over quantitative fluctuations, including changes in target class, geographic clustering, claim behaviour, technical enablement signals, and evidence of HUMINT degradation.

Ongoing monitoring should therefore focus less on monthly totals and more on behavioural anomalies, corridor reactivation, escalation in target salience, and the intersection between cognitive signalling and operational execution.

Methodological Note

This briefing is based on:

• systematic monitoring of primary jihadist propaganda (statements, videos, magazines, claims);

• analysis of reports from field sources, local media, and military publications/statements

• analysis of OSINT, IMINT, Digital HUMINT, and SOCMINT

• comparative temporal analysis to distinguish short-term variation from structural trends;

• explicit separation between observation, assessment, and judgment.

Forecasting judgments are probabilistic, not predictive, and are designed to inform preparedness and decision-making rather than to anticipate specific events.

Scope Exclusions

This briefing operates within clearly defined analytical boundaries.

• It does not include classified, law-enforcement–sensitive, or restricted government information, and is based exclusively on open-source intelligence and structured analytical assessment.

• It does not assess domestic extremism in Western states except where relevant to transnational jihadist cognitive and influence dynamics.

• It does not attempt to predict specific attacks, timelines, or targets; instead, it focuses on probabilistic trends, threat configurations, and early warning indicators.

• It does not provide policy prescriptions or normative recommendations, limiting its scope to assessment, implications, and monitoring priorities.

Executive Overview: Strategic Context

Executive Intelligence Briefing | October–December 2026

Intelligence Cut-off: 16 October 2026

The international security environment entering the final quarter of 2026 remains characterised by persistent jihadist and insurgent violence, increasingly differentiated organisational capabilities and the continued use of hybrid instruments by state and non-state actors. The principal development is not the emergence of a uniform escalation across theatres, but the growing strategic significance of how established threats interact with institutional vulnerabilities, economic dependencies and the limitations of national security responses.

Read more

The cases examined this week do not represent a coordinated campaign, nor do they belong to a single ideological or operational framework. Their significance lies in the different ways security barriers can be challenged, through the exploitation of authorised access, the acquisition of sensitive information, the identification of accessible targets or the gradual development of violent intentions into operational preparations. The distinction between these mechanisms is important, particularly when assessing whether a security incident reflects an isolated criminal act, an emerging terrorist capability or a more organised hostile intelligence activity.

The most consequential developments concern investigations involving British military and intelligence facilities, alleged espionage affecting European security institutions, the emergence of additional details surrounding an attempted aviation attack in the Middle East, and the disruption of suspected terrorist preparations in the United States and Europe. Taken together, they suggest that security assessments must increasingly consider the relationship between access, intent and capability, rather than treating physical protection, counterterrorism and counterintelligence as entirely separate challenges.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week | The Security Perimeter

2. Threat Signals: Terrorism, Extremism and Hostile Intelligence

• United States: From Foreign Jihadist Aspirations to Domestic Attack Planning

• Germany: Accelerationist Violence and the Targeting of Schools

• Poland: Political Violence and the Threat to Institutional Continuity

• Türkiye: Counterterrorism Pressure on Suspected ISIS Networks

• Netherlands: Individual Preparation and Uncertain Operational Maturity

3. Aviation Security | The Insider Threat Beyond Conventional Screening

4. Counterintelligence | Access, Influence and the Protection of Sensitive Information

5. The Information Battlefield | Radicalisation, Knowledge and Operational Intent

6. Strategic Assessment | The Limits of Conventional Protection

7. Threat Signal Matrix

8. Early Warning Indicators | Next 30 Days

9. Threat Forecast | 30 to 90 Days

10. Executive Intelligence Conclusion

Related Intelligence & Analysis:

1. The Shift of the Week | The Security Perimeter

The principal development this week concerns the changing meaning of a protected environment. Military installations, intelligence systems, commercial aircraft and major public venues operate under different security arrangements. However, each depends on assumptions about who can gain access, what activities can be detected and how quickly suspicious behaviour can be distinguished from legitimate movement or routine operations.

The investigation at RAF Molesworth in the United Kingdom illustrates the sensitivity of this issue. Two Latvian nationals residing in Britain were arrested on suspicion of entering a prohibited place for a purpose prejudicial to the United Kingdom, an allegation investigated under the National Security Act 2023. The incident’s significance derives partly from the functions of the installation, which supports American and NATO intelligence activities. Although the available information does not establish espionage, sabotage or foreign direction, the involvement of counterterrorism investigators indicates the seriousness with which the authorities are examining the circumstances.

The case should be considered alongside the ongoing RAF Fairford investigation, which had already led to several arrests in the preceding reporting period. These investigations must remain analytically separate, since geographical proximity within the British military infrastructure and the involvement of national security authorities do not demonstrate a common operational network. Their proximity in time nevertheless highlights the importance of perimeter security, suspicious access attempts and the protection of facilities supporting allied military operations.

A different dimension emerges from the proceedings involving Royal Navy sailor Teddy Young, who appeared before a London court on 8 October following allegations concerning sensitive defence and intelligence information. The prosecution says the case involved retaining protected material and conduct consistent with preparations to disclose information to a foreign power. The allegations remain subject to judicial determination, and the authorities have indicated that the investigation is not connected to the RAF Fairford incident.

Read more

The expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM) represents one of the most significant transformations in the West African jihadist landscape, not merely due to the geographical reach the organisation has attained, but above all because of its growing capacity to exert various forms of military, economic, and territorial pressure across vastly different operational environments. Its spread from Mali into Burkina Faso, Niger, and the northern regions of coastal states is frequently interpreted through the lens of rising attack numbers and the widening of violence-affected areas. While important, these indicators do not fully explain the nature of the ongoing shift.

An insurgent organisation can intensify its operations without significantly expanding its area of ​​activity; conversely, it can penetrate new regions through a relatively limited number of attacks by exploiting mobility corridors, facilitation networks, and local vulnerabilities. Similarly, targeting new types of assets does not necessarily imply a transformation in military capabilities, whereas employing established offensive tactics can yield different strategic consequences when directed at economic infrastructure, logistical links, or communities involved in counter-insurgency efforts.

An analysis of an original dataset comprising 170 violent incidents attributed to JNIM between January 2019 and September 2026 highlights precisely this divergence. While the geographical distribution of violence has expanded, the composition of targets has shifted considerably, and certain operations have taken on a more pronounced economic and coercive function, the organization’s core tactical repertoire has remained relatively stable. Direct attacks, complex operations, improvised explosive devices (IEDs), and ambushes continue to be central tools of the organisation’s activity, even as immediate objectives and intended outcomes evolve. The primary result, therefore, is not the emergence of a JNIM that is radically different in military terms, but rather its ability to employ an established set of tools across a broader and more complex geographical area. This evolution can be interpreted as a form of “adaptive diffusion,” in which operational capabilities remain consistent. At the same time, variations occur in target selection, the methods of applying violence, and the functions assigned to operations. The progressive regionalisation of the threat is evident but remains highly uneven: Mali and Burkina Faso still constitute the core, whereas Niger, Benin, Togo, and Côte d’Ivoire exhibit varying levels of penetration, recurrence, and persistence.

Methodological Note

The analysis is based on an original corpus of 170 unique events attributed to JNIM between January 2019 and September 2026, selected according to criteria regarding attribution and evidence quality, and cross-referenced with institutional documentation and independent sources. The corpus does not constitute a probability sample of the organisation’s entire activity; the data therefore describe the characteristics of the included events rather than the total frequency of attacks. Source coverage varies over time and across locations, and the data for 2026 cover only the first nine months.

📌 Inside this Assessment

1. The Changing Geography of JNIM Violence

2. Changing Targets, Persistent Tactics

3. Beyond the Battlefield: Economic Coercion and Territorial Pressure

4. From Spatial Replication to Adaptive Diffusion

5. Strategic Implications and Early Warning Indicators

6. Strategic Outlook

7. Strategic Conclusion

8. Sources and References

Related Intelligence & Analysis:

1. The Changing Geography of JNIM Violence

JNIM’s geographical evolution must be understood in light of a fundamental characteristic: its regional expansion has not entailed abandoning its original Sahelian core. Mali and Burkina Faso remain where the organisation concentrates much of its activity, maintains greater operational continuity, and exerts pressure across a wide range of terrains.

In the analysed dataset, 99 events occurred in Mali and 58 in Burkina Faso, totalling 157 incidents, or 92.4% of the observations. The remaining 13 events were distributed across Togo, Niger, Benin, and Côte d’Ivoire. This concentration does not imply that JNIM’s presence in peripheral states is strategically marginal; rather, it highlights that the group’s expansion has not resulted in a uniform redistribution of violence.

This transformation becomes clearer when the analysis is conducted at the subnational level. In 2019, the events analysed involved five distinct combinations of country and first-level administrative unit; by 2022, this figure had risen to nine, reaching ten in 2023 and 2024, and seventeen in 2025. In the first nine months of 2026, the dataset comprises thirteen units, a figure that must be interpreted in light of the period’s incompleteness and variations in documentation coverage.

The increase in geographical spread does not necessarily align with a rise in the number of observed incidents. For instance, the 2023 dataset contains fewer events than that of 2022, yet shows a slightly broader geographical distribution. This discrepancy highlights a recurring issue in assessing the jihadist threat: using the intensity of violence as a proxy for expansion can obscure territorial shifts that precede, accompany, or unfold independently of any increase in attacks.

The picture becomes even more complex when considering the differences between peripheral theatres. In Côte d’Ivoire, the dataset records a single isolated incident during the initial period, with no subsequent sequence comparable to that observed in the primary countries. Togo and Benin show recurring activity spread across different periods, while Niger appears at multiple stages of the timeframe, albeit with a limited number of recorded incidents. These subsets are too small to support independent statistical conclusions, yet they gain significance when compared against United Nations assessments and regional documentation regarding the organisation’s expansion.

In this context, eastern and southern Burkina Faso take on particular importance. The cross-border areas linked to the W-Arly-Pendjari complex allow for an examination of the relationship between territories with a significant jihadist presence and areas used for mobility, operational projection, and exerting pressure on Benin, Togo, and Niger. Assessments by the United Nations Monitoring Team have documented concentrations of fighters in southern Burkina Faso and the potential for these forces to launch operations into the Gulf of Guinea states, confirming that the regional spread cannot be described solely by the location of past attacks.

Read more

📌 Inside this Assessment

• Overview and Security Threat Assessment

• Activity and Operations Analysis — September 2026

• Number, Targets, and Areas of Attacks in September 2026

• Charts and Statistics

• Analytical and Intelligence Assessments

• Implications for Decision Makers

• Early Warning Indicators

• Threat Forecast, 30 to 90 Days

• Executive Intelligence Conclusion and Risk and Threat Overview.

Scope and Methodology

This Strategic Threat Outlook is based on: systematic monitoring of Islamic State propaganda (videos, photos, statements, claims); reporting from sources in the field;

While integrating OSINT, SOCMINT, IMINT, and Digital HUMINT enhances intelligence breadth, it is crucial to acknowledge their respective reliability, sources-including primary Islamic State media channels and local reports-and limitations to ensure accurate threat assessments.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

Related Intelligence & Analysis:

Provincial Snapshots

• Islamic State West Africa Province (ISWAP)

• Islamic State Sahel Province

• Islamic State Central Africa Province (ISCAP)

• Islamic State Somalia Province

• Islamic State Mozambique Province (ISM)

Overview – Islamic State in Africa

The Islamic State’s presence in Africa is resilient and adaptive, demonstrating high operational continuity despite counterterrorism efforts, reinforcing the importance of sustained strategic focus for security officials to counter this persistent threat. This resilience should reassure the audience that continued vigilance and strategic adaptation are necessary.

In Africa, IS affiliates demonstrate high operational continuity, executing attacks with diverse tactics like assaults, ambushes, kidnappings, and terror campaigns, especially against Christian communities, in recent months.

The epicentre of this dynamic remains sub-Saharan and central-eastern Africa, with particularly worrying developments in the Democratic Republic of Congo and Mozambique, where IS affiliates have demonstrated not only a capacity for sustained violence, but also a growing level of coordination, intermittent territorial control, and integration with local criminal economies. In such contexts, violence is not episodic but part of a strategy of progressive erosion of state authority, exploiting structural fragility, socio-economic marginalisation, inter-community conflicts, and governance vacuums.

On March 20, 2025, the Islamic State officially announced the launch of a new military campaign, called “Burning Camps,” with a stated focus primarily on Africa. This campaign’s implications include heightened regional instability, increased displacement, and the need for enhanced security cooperation among affected nations to counteract these threats.

The strategy remains consistent with the Islamic State’s operating model: creating chronic instability, delegitimising the state, presenting itself as an alternative (or inevitable) actor, and exploiting chaos to facilitate recruitment, logistical support, and territorial entrenchment. In this sense, IS does not aim exclusively at permanent territorial conquest but at fluid, opportunistic control sufficient to maintain freedom of manoeuvre and offensive capability.

Currently, the Islamic State is actively and continuously operating in at least eight African countries, with monthly variations in geographical distribution and intensity of activities. During the period under review, the organisation focused its efforts on fewer theatres without reducing overall capacity, indicating a decentralised yet functional structure.

Every significant attack has been followed by intense media activity, with the Islamic State disseminating a significant volume of content through its central channels, notably Amaq and al-Naba, constructing a narrative of success and resilience aimed at both local supporters and a global jihadist audience, which underscores the importance of monitoring propaganda for threat assessment.

In summary, the African picture shows an Islamic State that is not in decline but in a phase of adaptive consolidation, capable of absorbing losses, reorienting priorities, and exploiting the structural weaknesses of local contexts. For intelligence, security, and political and military decision-makers, Africa is not a secondary front but the current centre of gravity of the threat posed by the Islamic State, emphasising the need for sustained vigilance and strategic response.

Developments between January and August 2026 reinforced Africa’s centrality within the Islamic State’s operational system, while revealing increasingly uneven trajectories across its branches. ISWAP maintained pressure on military positions and auxiliary forces in northeastern Nigeria. At the same time, ISCAP’s activity beyond its established North Kivu and Ituri strongholds widened the area exposed to civilian coercion and dispersed insurgent violence. In Mozambique, military pressure disrupted militant concentrations but also contributed to movements toward southern and western operating areas, extending insecurity around rural communities, roads and economic assets. Alongside these developments, central propaganda increasingly presented African operations as evidence of organisational vitality and as a source of ideological mobilisation for wider jihadist audiences. However, media prominence alone does not establish recruitment gains or closer operational coordination between provinces. By August, the decline in recorded attacks indicated a lower aggregate tempo, while continued activity across several theatres suggested that military disruption had not translated into uniform organisational degradation, leaving the preservation of mobility, support networks and local access central to the assessment of subsequent developments.

Activity and Operations Analysis — September 2026

During September 2026, Islamic State activity across Africa reflected different responses to military pressure and local security conditions, with continued attacks on state forces in northeastern Nigeria, persistent civilian exposure in eastern Congo and a widening interaction between militant mobility, abductions and economic insecurity in northern Mozambique. These developments require a differentiated assessment, particularly where the disruption of established positions has been followed by continued activity elsewhere.

Read more

The organisation continues to operate within a post-territorial insurgent model defined by decentralised cells, localised autonomy, and the selective use of violence. Understanding how this decentralisation affects threat levels in key regions such as Syria, Iraq, Pakistan and Afghanistan, and influences operational coordination, is essential for strategic planning and resource allocation.

📌 Inside this Assessment

1. Overview

2. Activity and Operations Analysis — September 2026

3. Number, Targets, and Areas of Attacks in September 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted. However, incomplete or delayed reporting from conflict zones, propaganda bias, and disinformation may affect the precision of threat assessments and require cautious interpretation of available data.

Provincial Snapshots

• Islamic State Sham;

• Islamic State of Iraq;

• Islamic State Khorasan;

• Islamic State Pakistan;

• Islamic State East Asia.

Related Intelligence & Analysis:

Overview

Entering 2026, the Islamic State should no longer be analysed solely through territorial revival scenarios. While current evidence indicates a focus on survival and network preservation, IS’s potential to reconstitute territorial control or adapt tactics remains a concern that warrants ongoing monitoring and strategic foresight.

The structural features identified in 2025 remain intact. IS continues to operate as a decentralised ecosystem of locally embedded nodes, loosely connected by ideological cohesion and brand identity rather than a rigid command hierarchy. Central leadership functions primarily as a symbolic and narrative anchor, while operational initiative remains provincial and context-driven.

What January 2026 clarifies is not a transformation but a consolidation. The organisation has shown it can sustain a calibrated level of violence across multiple theatres without territorial control, reconstituted governance structures, or large-scale operations. This model is inherently sustainable under conditions of fragmented governance, uneven security-sector capacity, and prolonged socioeconomic stress.

Strategically, Syria remains the core geographic anchor, while Afghanistan, through ISKP, and Pakistan, as a sensitive extension zone, are critical for regional stability. Emphasising these areas underscores the importance of regional efforts, fostering a sense of shared responsibility among decision-makers.

From a strategic standpoint, the most significant conclusion entering 2026 is that IS has achieved operational equilibrium. It is not expanding, but it is not eroding, highlighting the need for continued, focused efforts to manage this persistent threat effectively.

For political and military decision-makers, the implication is clear. At the start of 2026, the Islamic State is not a collapsing remnant, nor an imminent territorial challenger. It remains a persistent insurgent actor embedded within fragile security ecosystems, emphasising the importance of sustained intelligence and capacity-building efforts.

Activity and Operations Analysis — September 2026

Islamic State activity during September unfolded under sustained counterterrorism pressure, with developments in Syria, Iraq and the Afghanistan–Pakistan theatre revealing different relationships between operational disruption and network persistence. The available evidence supports an assessment centred on clandestine infrastructure and selective violence. However, neither the survival of individual cells nor the discovery of attack preparations establishes a broader organisational recovery.

Read more

This weekly strategic intelligence report documents and summarises jihadist propaganda and military activities from 1 to 7 October, highlights recent developments in the threat, and provides a structured overview of the situation across various organisations and operational theatres.

This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This report emphasises threat trend analysis to help analysts and policymakers feel confident in their understanding of the active threat environment and support strategic decision-making.

This publication includes threat assessments and analyses that aim to reassure policymakers of the depth of understanding of groups’ tactics and the dynamic threat landscape.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

This focus on documentation and structured presentation of firsthand material is intended to help analysts and policymakers feel assured of the data’s reliability for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations. Explain how this integration improves overall threat understanding for strategic decision-making.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

• People’s Fighters Front

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 9 statements and 9 photos, claiming 14 attacks.

The targets included the Malian Army, the Dozo militia, the Russian PMC Africa Corps, the Burkinabé Army, and the VDP militia.

The areas of the attacks were :

1) Burkina Faso = 8

- Mouhoun province, Sanmatenga province, Yatenga province, Boulgou province, Loroum province.

2) Mali = 4

- Koulikoro region, Mopti region, Segou region;

3) Niger = 1

• Tillabéri Region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 7 statements claiming responsibility for 17 attacks.

The targets of the attacks were:

The targets included the Somali Army, Somali pro-government militias, the Ugandan Army, the Burundian Army, the Ethiopian Army, and the Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 15

• Afgooye area, Lower Shabelle region;

• Wajid area, Hudur area, Bakool region;

• Harardhere–Elhur road, Mudug region;

• Tredishi area, Darussalam area, Aylasha area, Mogadishu outskirts, Banaadir region;

• Bal’ad area, Middle Shabelle region;

• Jalalaqsi area, Hiiraan region;

• El Wak area, Gedo region.

2) Kenya = 2

• Fafi area, Garissa County.

The eleventh issue of the weekly Al-Bayan, published by the pro-Al-Qaeda (AQ) media outlet Al-Yaqin and spanning 17 pages, features the usual infographic summarising the previous week’s attacks, religious messages, and photographic evidence of Al-Shabaab and JNIM activities; however, it also includes editorials that are particularly noteworthy compared to issue No. 10. This issue is of special interest because a significant portion of its analysis focuses on Somalia and the potential scaling back of the international security architecture. In contrast, the editorial revisits the global war against the United States and its allies. The first editorial, titled “Between September 11 and September 30,” draws a parallel between September 11, 2001, and September 30, 2026 (the date of the final withdrawal of US and allied forces from Iraq and and the attempted hijacking of the FlyDubai flight). ). The accompanying image explicitly links three scenes: the United States in September 2001, Iraq in September 2026, and Saudi Arabia in September 2026. The core propaganda argument posits the continuity of the jihadist war against the United States and its partners, twenty-five years after 9/11.

Al-Bayan argues that the United States invaded Iraq and Afghanistan to eliminate jihadism, but achieved the opposite result: jihadist mobilisation expanded in scope, spreading from Afghanistan and Iraq to Africa and other theatres of conflict.

The text explicitly cites historical Al-Qaeda figures such as Abu Musab al-Zarqawi, using them to construct an ideological lineage connecting the post-2003 Iraqi insurgency with contemporary jihadist groups. The fundamental message is therefore one of generational resilience: according to al-Bayan, the United States can eliminate leaders, strike organisations, and wage military campaigns, but it cannot eliminate the ideology and regenerative capacity of jihadism.

This is a significant framing, as the publication attempts to present jihadist activities across different organisations and theatres as components of a single, transgenerational war.

The core of the issue, however, is the second editorial, “The Future of Security in Somalia.” This is the most important section of issue No. 11 and spans several pages. Al-Bayan addresses the future of AUSSOM and the United Nations Support Office in Somalia (UNSOS).

The starting point is the possibility that Washington might reduce or halt its contribution to the UN funding mechanism that provides logistical support for the African mission. UNSOS is not a combat force; rather, it provides essential infrastructure for African forces, including food, fuel, transport, medical care, evacuation, aviation, communications, and technical support. The implications are significant: the crisis concerns not merely the number of African troops remaining in Somalia, but the material capacity to keep them operational. Al-Bayan highlights the progressive scaling back of the international presence: the African contingent has reportedly dropped from approximately 22,000 troops in the middle of the last decade to around 12,000 today, even as financial difficulties mount. The magazine insists that AUSSOM has not achieved full operational capability and that Somali forces, despite growth in both numbers and quality, are not yet capable of rapidly taking over all the functions performed by African forces.

Deficiencies extending beyond mere troop numbers are highlighted: sustained funding, transport, logistics, intelligence, medical evacuation, communications, maintenance, and command-and-control. This is arguably the most analytically significant point in the entire issue: the risk of territorial vacuums that al-Shabaab could exploit. The article argues that an insufficiently coordinated withdrawal could create security vacuums that al-Shabaab could immediately exploit.

Specific attention is drawn to sensitive areas in southern and central Somalia, particularly Lower Shabelle, Middle Shabelle, and Hiraan. Al-Bayan cites past instances where positions abandoned by African forces subsequently fell under al-Shabaab’s control. The issue, therefore, is not merely the loss of bases, but the potential for the group to exploit the withdrawal to increase its freedom of movement, control roads and smaller towns, ramp up pressure on key logistical routes and urban centres, expand taxation systems, and generate new revenue streams. Lower Shabelle is of particular importance, described as an area where a potential vacuum could lead to rapid operational consequences. Al-Bayan naturally emphasises the aspects of the analysis most favourable to al-Shabaab.

The group could benefit from:

1. the abandonment or weakening of certain military positions;

2. reduced logistical capacity among African forces;

3. the difficulty Somali forces face in rapidly replacing them;

4. greater freedom of movement;

5. increased pressure on Lower Shabelle, Middle Shabelle, and Hiraan;

6. the opportunity to expand taxation and control over lines of communication;

7. the fragmentation of the security system among various international partners.

However, the text also implicitly acknowledges a significant limitation: al-Shabaab is not automatically capable of turning every international withdrawal into permanent territorial control. Much will depend on Somali forces’ ability to occupy and hold the positions handed over to them.

2. Islamic State (IS)

The Islamic State’s official media published the weekly al-Naba this week (566). Issue 566, eight pages long, covers the week of 13–19 Rabi al-Thani 1448 AH (24- 30 September 2026). The main infographic summarises the areas affected by military operations this week, including:

• Nigeria, Pakistan, Mozambique, Cameroon and the Democratic Republic of Congo.

IS claims to have conducted 23 operations in all the mentioned areas and to have caused 110 deaths and injuries.

1) West African Province: The weekly al-Naba reports that ISWAP militants carried out 12 attacks: 10 against checkpoints, convoys, patrols, and camps of the Nigerian army and pro-government militias in the states of Borno, Yobe, and Adamawa in Nigeria; 2 attacks against the Cameroonian army in the Maroua area, in the Far North region of Cameroon.

2) Sahel Province: The weekly newspaper al-Naba reports that IS-Sahel militants carried out 2 attacks against a Nigerien army outpost and a convoy in the Tahoua and Tillaberi regions of Niger.

3) Central African Province: The weekly newspaper al-Naba reports that ISCAP militants carried out 2 attacks, one against a Congolese army checkpoint and one against a Christian village, in Ituri Province, in the Democratic Republic of the Congo.

4) Mozambique Province: The weekly al-Naba reports that ISM militants carried out 5 attacks against patrols (including a naval patrol) of the Mozambican Army, patrols of pro-government Christian militias, an attack on a Christian village, and finally an “economic warfare” attack against a Chinese Company (destruction of the company and the burning of four trucks and three pieces of Chinese agricultural machinery). The attacks took place in the districts of Mocímboa da Praia, Balama, Nangade, and Macomia, in the province of Cabo Delgado, Mozambique.

5) Pakistan Province: The weekly al-Naba reports that Pakistani militants carried out 2 attacks against Pakistani intelligence officials and agents in the districts of Bajaur and South Waziristan, in the Khyber Pakhtunkhwa Province, Pakistan.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 8 statements, claiming 10 attacks.

Targets: Pakistan Army, Frontier Corps (FC), Pakistan Police, Gilgit-Baltistan Scouts, Special Security Unit (SSU), and Peace Committee.

Area:

• North Waziristan district, Khyber district, Orakzai district, in Khyber Pakhtunkhwa Province, Pakistan.

Ittehad-ul-Mujahideen Pakistan (IMP) released a 3:01-minute video showing several ambushes on Pakistani Army patrols and convoys in the North Waziristan district of Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting approximately 3 minutes and 50 seconds showing four drone strikes targeting an SSG command post and Pakistani Army positions, and two car bomb attacks targeting a CTD command centre, in the districts of Peshawar and North Waziristan, Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting about 20 seconds showing the killing of a Pakistani police officer in Tank District, Pakistan.

The People’s Fighters Front (PFF), also known as Jebhe-ye Mobarezin-e Mardomi (JMM), an Iranian Baluch jihadist coalition, released 4 statements reporting 4 armed incidents, including 2 attacks initiated by the group and 2 engagements following Iranian security-force assaults, between 1 and 7 October 2026.

The targets included Iran’s Islamic Revolutionary Guard Corps (IRGC), IRGC-affiliated Fatemiyoun militia personnel, and Iranian government security forces.

The areas affected by the incidents were:

1) Iran = 4

• Manzelab area, Saravan County;

• Rudmahi area, Zahedan County;

• Parud area, Rask County;

• Bampur–Iranshahr road, Iranshahr County.

All four incidents occurred in Sistan and Baluchestan Province, southeastern Iran.

🔹Weekly Strategic Assessments

The latest monitoring cycle reveals a jihadist operational environment characterised by relative continuity in the principal Al-Qaeda-affiliated insurgencies, renewed geographic concentration within Islamic State’s African provinces, and increasingly differentiated forms of military and political communication among independent jihadist organisations.

Read more

The group continues to prioritise attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signalling operations.

No structural fragmentation or operational collapse is observable, underscoring the group’s resilience and the need for sustained efforts to address the threat.

📌 Inside this Assessment

1. Overview

2. Activity and Operations Analysis — September 2026

3. Number, Targets, and Areas of Attacks - September 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview.

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT, including analysis of propaganda, disinformation, and group claims, is essential to understanding al-Shabaab’s influence operations and countering their narrative effectively.

Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Incomplete or delayed reporting from contested or remote areas;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted in the assessment.

Related Intelligence & Analysis:

Overview

Despite ongoing counterterrorism efforts, al-Shabaab’s resilience is shaped by regional support and international engagement, reinforcing the audience’s confidence in proactive, coordinated regional strategies to maintain security.

Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centres. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly in strategic towns, along supply corridors, and around population hubs.

The operation began on 15 February 2025 with synchronised assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry manoeuvres. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signalling momentum, inevitability, and state weakness.

Beyond kinetic activity, al-Shabaab’s continued consolidation through governance and coercion, including political penetration and narrative control, highlights the importance of sustained efforts to counter its influence and maintain stability.

• Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalise al-Shabaab authority and delegitimise federal institutions.

• Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.

• Systematic taxation and extortion, including collecting zakat in government-controlled zones, underscore the group’s parallel administrative reach.

• Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.

During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.

After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran, areas where al-Shabaab retains deep logistical and social networks, the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.

Assessment: al-Shabaab actively shapes the battlespace through synchronised military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, as al-Shabaab continues to shape the battlespace and impact regional stability. Its ability to synchronise military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. In the absence of sustained territorial control, effective local governance, and disruption to al-Shabaab’s parallel administration, the threat trajectory for 2026 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.

Between January and August 2026, al-Shabaab sustained pressure across southern and central Somalia while maintaining an active cross-border campaign in Kenya, despite continued ground operations and airstrikes against its forces and infrastructure. The first six months showed a fluctuating operational tempo, with monthly attack totals ranging from 48 to 73, followed by a pronounced acceleration to 97 in July and 152 in August. This trajectory indicates that lower activity earlier in the year did not represent a durable reduction in the group’s ability to contest government mobility and security positions. By August, sustained pressure in Lower Shabelle, renewed territorial contestation in Hiraan and attacks across four Kenyan counties demonstrated the breadth of the campaign. However, attack volumes alone cannot establish the extent of territorial control or organisational growth. Throughout this period, military activity remained embedded in a wider system of coercion, taxation and propaganda, with operational messaging reinforcing the portrayal of an enduring insurgent authority. The resulting threat entering September was therefore characterised by rising military pressure alongside persistent mechanisms of influence that continued to complicate the consolidation of government gains.

Activity and Operations Analysis — September 2026

September’s operational picture was shaped by the interaction between Somali efforts to recover and secure contested areas and al-Shabaab’s ability to retain access to the surrounding rural environment.

Read more

The week’s developments were particularly significant in Italy, Germany and the United Kingdom, where investigations involving Islamic State-inspired radicalisation, suspected former IS members and alleged preparations for attacks exposed different stages of the threat cycle. In parallel, proceedings concerning suspected Hamas financing in the United States and France, alongside Latvian investigations into alleged Russian military intelligence activity, highlighted the importance of support structures and information collection in enabling hostile operations. These cases do not constitute evidence of a coordinated threat environment or convergence between the organisations involved. However, they reveal comparable operational requirements, including access to resources, communications, logistical assistance and information about potential targets.

Three developments deserve particular attention. The Italian investigation in Cava de’ Tirreni illustrates the difficulties of distinguishing ideological radicalisation and the acquisition of technical knowledge from preparations indicating a credible intention to commit violence. Recognising these operational links can strengthen confidence in threat assessments and response planning.

The central assessment is that the identification of terrorist threats increasingly depends on reconstructing the relationships between individuals, capabilities, support mechanisms and intended targets. The distinction between ideological commitment, operational preparation and organisational coordination remains essential, particularly when investigations concern different forms of extremism, foreign intelligence activity or alleged terrorist financing.

📌 Inside this Weekly Threat Shift

1. From Digital Radicalisation to Operational Preparation

2. The Islamic State’s Residual Networks and Investigative Legacy

3. Financing, Facilitation, and Transnational Support Structures

4. Espionage, Reconnaissance, and the State-Linked Threat Environment

5. Threat Signal Matrix

6. Weekly Strategic Assessment

7. Early Warning Indicators and Near-Term Outlook

8. Conclusion

Related Intelligence & Analysis:

1. From Digital Radicalisation to Operational Preparation

The arrest of a 21-year-old university student in Cava de’ Tirreni, near Salerno, provides an important illustration of the relationship between online extremist engagement and the potential acquisition of operational capabilities. Italian investigators, acting on information provided by the external intelligence agency AISE, reportedly identified the suspect through his interest in Islamic State-related material and technical documentation concerning weapons and explosives. Searches uncovered instructional material, knives, a machete, blank-firing pistols reportedly modified to discharge projectiles and additional ammunition.

The analytical significance of this investigation lies in the combination of ideological material and potentially usable physical equipment. Possession of extremist propaganda or technical instructions does not independently establish an intention to carry out an attack, particularly when no specific target, operational timetable or completed device has been publicly identified. Nevertheless, the presence of weapons and potentially modified firearms introduces a material dimension that differentiates the case from investigations involving exclusively online expressions of support for terrorism.

The available information therefore suggests a potential movement beyond ideological consumption toward capability acquisition, although the extent of practical experimentation, technical competence and operational intent remains uncertain. The case also shows the importance of intelligence-led intervention when investigators may have identified concerning behavioural indicators without necessarily having evidence of a fully developed attack plan.

A more advanced form of alleged preparation emerged from the British proceedings involving Salam Ahmadyan and Rahman Salehi, two Iranian nationals accused of preparing terrorist acts targeting members of the Jewish community in the Manchester area. Prosecutors have described activities involving encrypted communications, searches for explosive-related components, the acquisition of materials and the collection of information about potential targets. The allegations also include contact with an individual believed possibly to be outside the United Kingdom.

Unlike cases in which investigators primarily identify ideological material, the alleged Manchester activities encompass several distinct elements associated with operational preparation, including target research, procurement and communication with a potential external contact. Their combination is significant because it suggests a progression from hostile intent toward practical preparations, although the prosecution must still establish the defendants’ conduct and intentions.

The reported external contact adds an investigative dimension, but nationality and possible communication with an individual in Iran do not establish direction by the Iranian state. The distinction between an independently organised plot, external facilitation and state-directed activity remains unresolved on the publicly available evidence.

Read more

Kohat offers a revealing case of how militant targeting intentions may persist even after an earlier plot has been disrupted, without necessarily implying continuity between the perpetrators.

📌 Inside this Assessment

• The Kohat Attack: Event Overview

• A Target already Identified in 2025

• Investigative Findings and Suspected Militant Cooperation

• Contested Attribution and AQIS Response

• Intelligence Assessment and Early Warning Indicators

Related Intelligence & Analysis:

The Kohat Attack: Event Overview

On 18 September 2026, a coordinated suicide bombing and armed assault against the Old Police Lines compound in Kohat, Khyber Pakhtunkhwa, resulted in one of the deadliest attacks against Pakistan’s security infrastructure that month. The operation, which began during Friday prayers and continued into the following day, combined an explosives-laden vehicle with a sustained armed confrontation involving police and counterterrorism personnel. According to subsequent reporting based on Pakistani security officials, 23 people were killed, including 17 police personnel and six civilians, while more than 100 others were injured. The confrontation continued for approximately 21 hours before security forces declared the compound secured.

The initial explosion struck the mosque located within the Police Lines complex, causing extensive destruction and casualties among those gathered for Friday prayers. Armed militants subsequently engaged security personnel in a prolonged confrontation that extended into 19 September, requiring a substantial security response before the remaining attackers were neutralised. Although the mosque bombing accounted for a significant proportion of the immediate casualties, the broader operation involved an assault against an installation housing elements of Pakistan’s police and counterterrorism apparatus, including facilities associated with the Counter-Terrorism Department (CTD) and Special Branch.

The distinction between the location of the initial explosion and the wider target of the assault is central to understanding the incident. The destruction of the mosque cannot be treated simply as collateral damage, particularly given the subsequent statements concerning its targeting. However, the continuation of the operation against the security compound indicates that the attackers’ objectives were not necessarily confined to the religious facility. Kohat therefore presents a case in which the targeting of security institutions and the deliberate or foreseeable exposure of individuals attending communal prayers became intertwined within a single operation, producing consequences that extended beyond the immediate confrontation.

The attack also differed from an isolated suicide bombing in its duration and apparent coordination. The prolonged engagement required security forces to respond to an evolving incident inside a sensitive installation. At the same time, the combination of multiple attackers and successive phases of violence suggested a level of preparation extending beyond the initial detonation. Such methods are not unprecedented in Pakistan’s militant environment. Still, their application against a compound containing counterterrorism facilities is particularly significant given that the same installation had previously appeared in an investigation into a disrupted militant plot.

This earlier history is essential to the assessment. The central question raised by Kohat is not simply how militants were able to conduct a complex assault against a protected facility, but why an installation already identified as a potential target in an earlier counterterrorism investigation remained the focus of a subsequent, successful attack. The recurrence does not establish that the same network was responsible for both plots. However, it adds a dimension of persistent targeting largely absent from accounts that focus exclusively on the September 2026 operation.

A Target Already Identified in 2025

In August 2025, Pakistani authorities announced the disruption of a militant plot against security installations in Kohat, including the mosque within the Police Lines compound and facilities associated with the CTD. The investigation resulted in the arrest of two brothers, identified as Siraj and Faridoon, who were reportedly employed within the police and counterterrorism apparatus respectively and were accused of facilitating the planned attacks. Contemporary reporting also described alleged communications with militant handlers based in Afghanistan and the collection of information concerning the intended targets. The Express Tribune associated the suspects with a network linked to Tehrik-e-Taliban Pakistan (TTP), while Dawn reported the disruption of the plot and the alleged facilitation activities without conclusively establishing the same organisational attribution.

The importance of this earlier investigation lies in the specificity of the reported targeting. The militants were not merely considering attacks somewhere in Kohat or against Pakistani security personnel in general; the Police Lines mosque and CTD facilities were among the locations explicitly identified during the investigation, corresponding to installations subsequently affected by the September 2026 assault. This overlap provides a documented basis for examining the persistence of militant interest in the compound, even though the available evidence does not demonstrate that the perpetrators of the later attack had participated in, inherited or directly benefited from the earlier plan.

Three explanations remain plausible. The September assault may have involved individuals or facilitators who retained information developed during the 2025 preparations; a broader militant network may have survived the earlier arrests and continued to regard the installation as a priority target; or a separate group may have independently identified the same compound as an attractive objective because of its concentration of security personnel and counterterrorism facilities. These scenarios would have different implications for the effectiveness of the 2025 disruption, and none can presently be established as the definitive explanation.

The suspected involvement of serving security personnel in the earlier plot adds an important institutional dimension. If the allegations reported in 2025 were accurate, the case demonstrated that militants had attempted to exploit individuals positioned within the very institutions they intended to attack. Such access could potentially provide information unavailable through external observation, although there is no verified evidence that comparable insider assistance contributed to the September 2026 assault. The analytical relevance of the earlier arrests therefore concerns the existence of a previously identified insider-facilitation risk, rather than any presumed continuation of that specific arrangement.

The significance of the 2025 investigation increased following reporting published after the September attack. On 24 September, Dunya News, citing CTD investigators, indicated that the inquiry had also examined the earlier plan against the Kohat Police Lines, suggesting that the potential relationship between the two episodes had become relevant to the authorities’ reconstruction of the assault. This development strengthens the case for treating the recurrence as an investigative issue rather than a coincidence identified solely through retrospective analysis, while leaving unresolved whether any individuals, communications or logistical arrangements connected the two operations.

Kohat’s history also extends beyond these two episodes. In September 2010, a suicide bombing struck the Police Lines area, causing numerous casualties and demonstrating that the location had previously attracted militant attention. The 2010 attack, the disrupted 2025 plot and the September 2026 assault should not be interpreted as evidence of a continuous campaign conducted by the same organisation, since no such connection has been established. Their significance instead lies in the repeated selection of the same security environment across different periods of Pakistan’s insurgency.

Taken together, these developments raise a broader question concerning the durability of counterterrorism disruption. The arrest of suspects may prevent a particular operation while leaving unresolved the wider threat to the intended target, especially where information, local relationships or organisational interest extend beyond the individuals detained. In Kohat, the available evidence supports the conclusion that the installation remained a recurrent militant objective; whether this persistence reflected surviving operational relationships or independently renewed targeting remains an important unresolved issue.

Investigative Findings and Suspected Militant Cooperation

Investigative developments reported during the final week of September introduced further indications that the Kohat assault involved preparation and support extending beyond the militants who directly participated in the attack. On 24 September, Dunya News reported, citing CTD investigators, that two militant organisations were suspected of cooperating in the planning of the operation. The same reporting indicated that the attackers had remained in Kohat for several days before the assault and that investigators had identified a suspected accommodation site, detained individuals believed to have facilitated the operation and recovered material considered relevant to the inquiry.

These findings, while still dependent on information attributed to investigators, are significant because they suggest the possible involvement of a wider support network. The organisation of an extended armed assault against a sensitive security installation may require assistance from individuals who do not participate directly in the attack, and the reported identification of accommodation arrangements and local facilitators provides a basis for examining whether the operation relied on relationships already established within the area. The existence, composition and organisational affiliations of such a network remain matters for investigation, rather than independently verified conclusions.

A potentially more consequential detail concerns the attackers’ alleged intention to enter the CTD facility and release detained militants. According to the investigative account published on 24 September, the operation may have involved an objective directed at freeing associates held within the compound. If substantiated, this would alter the interpretation of Kohat by suggesting that the attack combined the infliction of casualties and the targeting of security infrastructure with an attempt to recover personnel from detention.

The distinction matters because an operation intended partly to release prisoners would have a different organisational significance from an attack designed exclusively to inflict casualties or produce a propaganda effect. It could indicate an effort to preserve or restore militant personnel resources while simultaneously challenging the authority of Pakistan’s counterterrorism institutions. The available reporting does not establish whether prisoner release was the principal objective, a secondary consideration or an investigative hypothesis subsequently revised by the authorities, making it necessary to retain this interpretation as provisional.

Further reporting published on 27 September indicated that investigators were examining repeated reconnaissance, the movements of suspected participants and individuals believed to have provided local assistance. These developments are consistent with an operation involving preparatory activity over an extended period. However, the precise duration of the planning process and the division of responsibilities among participants have not been independently established.

The reported involvement of two militant organisations introduces an additional layer of uncertainty. Pakistan’s militant environment includes organisations and factions that may retain separate leadership structures while sharing personnel, maintaining informal relationships or cooperating around specific objectives. Such arrangements can complicate attribution, particularly when an operation involves participants from more than one network or when public claims do not reflect the full range of actors involved in its preparation.

The Kohat investigation has not yet provided sufficient publicly verifiable information to identify the two organisations reportedly suspected of cooperation or to establish their respective roles. Consequently, the allegation should not be treated as confirmation of a joint IMP–TTP operation, nor as evidence of direct involvement by al-Qaeda in the Indian Subcontinent (AQIS). Its principal significance is that investigators have raised the possibility of an operation involving more than one militant network, a finding that requires careful differentiation between temporary cooperation, overlapping facilitation structures and formal organisational integration.

This uncertainty is especially relevant when considered alongside the August 2025 investigation. The earlier case demonstrated that the Police Lines compound had already been subjected to militant planning, while the September 2026 inquiry identified possible local facilitation and cooperation between militant actors. These findings do not establish a continuous network connecting the two episodes. Still, they provide complementary reasons to examine whether the security threat surrounding the installation was more persistent and organisationally complex than the disruption of an individual plot might initially suggest.

Contested Attribution and AQIS Response

Responsibility for the Kohat assault has remained complicated by competing statements and inconsistencies between militant communications and subsequent media reporting. TTP denied involvement shortly after the attack, while several Pakistani outlets attributed responsibility to Ittihad-ul-Mujahideen Pakistan (IMP), the coalition associated with Hafiz Gul Bahadur. The initial First Information Report (FIR) was registered against unidentified attackers, reflecting the absence of a formally established organisational attribution at that stage of the investigation.

The distinction between reported responsibility and independently authenticated organisational claims is important in this case. Pakistani reporting has repeatedly identified IMP as the organisation responsible for the assault, and its association with Hafiz Gul Bahadur makes that attribution relevant to the broader militant landscape of northwestern Pakistan. Nevertheless, the material examined for this assessment does not establish the provenance of a primary IMP statement sufficient to resolve the attribution independently. The reported involvement of two cooperating organisations further complicates any interpretation that assigns the entire operation to a single group without clarifying the roles of other participants.

An additional development occurred on 19 September, when AQIS issued a statement through As-Sahab Media, The Subcontinent, addressing the destruction of the mosque during the assault. The statement, distributed in Urdu and English under the title Regarding the Martyrdom of a Mosque in the Kohat Attack, expressed regret that a mosque had been targeted during an operation directed against the CTD and Police Lines compound. AQIS criticised attacks against mosques and other public locations, arguing that such actions were religiously impermissible and harmful to the objectives and public legitimacy of the militants involved.

The language of the statement is significant because AQIS distinguished the broader attack against Pakistan’s security institutions from the targeting of the mosque, rather than rejecting the operation in its entirety. It referred to the perpetrators as militants within the wider jihadist environment and framed its criticism around the consequences of their target selection. This indicates an attempt to influence the conduct and legitimacy of militant violence, although it does not establish that AQIS exercised authority over the attackers or possessed a direct role in the operation.

The statement also illustrates the reputational consequences that attacks involving Muslim civilian casualties can generate within jihadist circles. Militant organisations may present operations against police or counterterrorism facilities as attacks against state institutions, but the destruction of a mosque and the killing of individuals attending Friday prayers introduce a separate controversy over the legitimacy of the methods employed. AQIS’s intervention demonstrates that such controversies can produce criticism from actors ideologically sympathetic to anti-state militancy, even when those actors do not publicly identify the perpetrators or claim organisational responsibility.

No direct operational relationship between AQIS and the Kohat attackers can be inferred from this statement alone. The group’s description of the attack could have relied on publicly available information or communications circulating within militant environments, and the available material does not establish which sources informed its position. The statement is therefore best understood as evidence of AQIS’s public response to the operation and its attempt to shape the interpretation of the mosque’s destruction, rather than as proof of involvement in planning or command.

Taken together, TTP’s denial, the reported IMP attribution, the investigative references to cooperation between two organisations and AQIS’s subsequent intervention demonstrate the limitations of relying exclusively on public claims to reconstruct responsibility for complex attacks. The organisations involved in Pakistan’s militant environment may share ideological reference points or maintain relationships without operating under a single command structure. In co-responsibility for an individual operation may involve distinctions between planning, facilitation and direct participation that are not reflected in media attribution.

For Kohat, IMP remains the principal organisation identified in subsequent Pakistani reporting, although the evidence available in the public domain does not yet permit a definitive reconstruction of the wider network responsible for the assault.

Intelligence Assessment and Early Warning Indicators

The Kohat Police Lines assault illustrates the interaction between persistent militant targeting, possible local facilitation and the increasing complexity of organisational attribution in Pakistan’s insurgent environment. Its significance does not rest exclusively on the number of casualties or the duration of the confrontation, but on the fact that the attacked installation had already appeared in a disrupted militant plot approximately thirteen months earlier. This recurrence provides a concrete basis for examining whether counterterrorism disruption adequately addresses the wider threat surrounding a target after the immediate operational cell has been neutralised.

The evidence currently supports a distinction between the persistence of a target and the persistence of a specific network. The first is documented by the overlap between the August 2025 investigation and the September 2026 attack; the second remains unproven because the publicly available information does not establish shared planners, facilitators or communications between the two episodes. The subsequent CTD investigation may eventually clarify this relationship, particularly if evidence emerges connecting the suspected support network identified after the September assault with individuals or arrangements associated with the earlier plot.

The reported presence of local facilitators and the possibility of cooperation between two militant organisations also suggest that the operational environment surrounding Kohat may have been more complex than an attack conducted by a single, self-contained cell. If confirmed, these findings would reinforce the importance of examining the relationships between direct perpetrators and supporting networks, rather than treating organisational attribution as sufficient to explain the preparation and execution of the assault. The alleged prisoner-release objective is similarly relevant, since its confirmation would indicate that the attackers sought outcomes extending beyond immediate casualties and damage to security infrastructure.

From an intelligence perspective, several developments would materially affect the assessment. Evidence linking the 2025 and 2026 investigations through common personnel, communications or facilitation relationships would support the hypothesis that elements of the earlier network survived the disruption. Confirmation of the identities and respective contributions of the two organisations reportedly suspected by CTD investigators would help determine whether Kohat reflected temporary cooperation or a more established relationship. Further findings concerning the alleged prisoner-release objective would clarify the operation’s intended outcomes, while an authenticated organisational claim containing independently verifiable information could strengthen the attribution currently reported in Pakistani media.

The absence of such evidence should not be interpreted as proof of deliberate concealment by the perpetrators, just as the lack of a verified connection between the two plots does not establish that they were independently organised. The available information supports a narrower conclusion: the same security installation was repeatedly identified as a militant target, and the September 2026 operation appears to have involved preparatory activity and possible support relationships that remain incompletely understood.

Kohat therefore raises an important distinction between preventing a planned attack and reducing the longer-term threat to the intended target. The disruption of a cell may remove immediate perpetrators without necessarily eliminating the information, relationships or organisational interest that contributed to the original planning. Whether this occurred in Kohat remains to be established, but the recurrence of the target and the investigative findings reported after the assault make it a relevant case for assessing the durability of counterterrorism disruption.

The principal warning emerging from the incident is that the successful disruption of a militant plot does not necessarily mean that the threat to its intended target has been neutralised. Establishing whether the September assault reflected surviving elements of the earlier plan, cooperation among distinct militant networks or a separately organised operation against a repeatedly identified installation will be essential to understanding both the attack and the wider vulnerabilities it exposed.

Sources and primary material

• Dawn, 19 August 2025 — Reporting on the disrupted Kohat plot and alleged facilitation by police and CTD personnel.

• The Express Tribune, August 2025 — Investigation into the earlier plot and reported TTP-linked network.

• Reuters, 18 September 2026 — Initial attack reporting and attribution uncertainty.

• Associated Press, September 2026 — Attack developments and TTP denial.

• Dawn, 20 September 2026 — Casualty updates, operational developments and reported attribution.

• Dunya News, 24 and 27 September 2026 — CTD investigative findings, suspected cooperation, local facilitation and reported prisoner-release objective.

• AQIS / As-Sahab Media, The Subcontinent, Regarding the Martyrdom of a Mosque in the Kohat Attack, statement AQS 12_003, 19 September 2026 — Primary-source English statement supplied by the author.

🔒Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Daniele Garofalo is an independent researcher and analyst specialising in Intelligence, Jihadist Terrorism, Islamist insurgencies, Non-State Armed Groups (NSAG), Cognitive Warfare, and Hybrid Warfare.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

Share

Leave a comment

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — September 2026

3. Number, Targets, and Areas of Attacks in September 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest the potential for tactical escalation or diversification beyond its present operational profile, warranting ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. However, limitations such as potential propaganda bias, disinformation, and incomplete reporting from remote areas must be considered when evaluating the reliability of intelligence. Clarifying how these limitations impact operational decisions will help stakeholders interpret the data appropriately and avoid misjudgments.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

Related Intelligence & Analysis:

Overview and Security Threat Assessment

Ittehad ul Mujahidin Pakistan, IMP, emerged in April 2025 as a new jihadist coalition bringing together the Hafiz Gul Bahadur Group, Lashkar e Islam, and Harkat Inqilab e Islami Pakistan. The alliance was formally announced on 11 April through the official media structures of its constituent organisations and was presented as a unified framework for armed jihad under a common ideological, organisational, and communications architecture.

The founding declaration appointed Mahmood ul Hasan as official spokesperson and established Sada e Ghazwat ul Hind as the alliance’s central media structure. The subsequent transfer of attack claims and propaganda production under the IMP identity was strategically important. It indicated an attempt to move beyond tactical coordination and create a recognisable insurgent brand capable of aggregating previously autonomous militant networks.

Since its formation, IMP has developed from an emerging coalition into an increasingly structured actor within Pakistan’s jihadist landscape. Its significance derives less from numerical strength alone than from the combination of experienced commanders, established militant infrastructure, historical knowledge of the tribal belt, access to cross border sanctuary, and an increasingly diversified tactical repertoire. The group has demonstrated the ability to employ suicide attacks, SVBIEDs, improvised explosive devices, indirect fire, sniper teams, RPGs, and commercially adapted unmanned aerial systems.

This tactical diversification has been accompanied by deliberate capability signalling. Training footage, battlefield imagery, multilingual propaganda, and selective presentation of operational successes indicate an organisation seeking to demonstrate discipline, technological adaptation, and military professionalism. At the same time, IMP has repeatedly limited or suppressed public attribution of attacks when visibility could generate excessive political or operational costs. Consequently, public claims provide only a partial representation of its actual activity.

The group’s centre of gravity remains Khyber Pakhtunkhwa, particularly the southern districts and former tribal areas where the Hafiz Gul Bahadur network and Lashkar e Islam possess longstanding organisational roots. These environments offer difficult terrain, experienced facilitation networks, local intelligence, weapons access, and connectivity with Afghanistan. The widening militant footprint observed across Pakistan since early 2026 increases the possibility that IMP can exploit existing militant corridors to extend activity beyond its traditional core.

The security threat posed by IMP is therefore best understood as an insurgent threat with escalation potential rather than as a conventional terrorist organisation primarily oriented toward indiscriminate civilian mass casualty attacks. Its principal target set has remained the Pakistani security architecture, including the Army, Police, Frontier Corps, Counter Terrorism Department, intelligence personnel, and local security intermediaries. This targeting logic seeks to erode state presence, degrade intelligence collection, intimidate local collaborators, restrict security force mobility, and create greater freedom of action within contested districts.

• Ideological Competition with Tehreek-e-Taliban Pakistan

The establishment of IMP challenged the organisational primacy that Tehreek e Taliban Pakistan has attempted to maintain over the Pakistani jihadist movement. TTP’s early response emphasised unity under a single emir, a single command structure, and a single organisational banner, invoking the Afghan Taliban as evidence that disciplined centralisation produces strategic success.

Although much of this messaging avoided direct confrontation with IMP, the underlying competition was clear. The emergence of a separate coalition incorporating experienced militant factions created an alternative pole for fighters, commanders, donors, and local networks unwilling to operate under Noor Wali Mehsud’s leadership.

This competition should not be interpreted as necessarily leading to open armed conflict between the organisations. The more plausible dynamic is simultaneous rivalry and selective coexistence, with both movements exploiting overlapping operational environments while competing for legitimacy, recruits, influence, and territorial access.

Developments during 2026 have made this organisational competition more important. Fragmentation inside the broader TTP ecosystem, particularly developments surrounding Jamaat ul Ahrar, creates potential opportunities for IMP to attract dissatisfied cadres or develop tactical relationships with factions seeking greater autonomy. Any such realignment would improve IMP’s manpower, operational experience, and potentially its access to urban attack networks.

• Al Qaeda Linkages and Emerging Militant Nexus

The relationship between IMP and Al Qaeda in the Indian Subcontinent has become an increasingly important component of the threat assessment. Initial accusations that AQIS had encouraged the creation of a parallel militant structure originated largely from pro TTP circles and therefore required caution. Subsequent indicators, however, have strengthened the assessment that AQIS exercises meaningful ideological and organisational influence within the IMP environment.

Recent analytical reporting describes AQIS as having played an important supporting role in the development of the alliance and notes that AQIS propaganda has incorporated IMP operations into its broader presentation of Al Qaeda aligned militant activity. This does not establish that AQIS exercises direct operational command over IMP. It does, however, increase confidence that the relationship extends beyond rhetorical sympathy and includes ideological, media, facilitation, or organisational connectivity.

The potential convergence of AQIS, IMP, and Jamaat ul Ahrar linked networks represents the most consequential medium term development to monitor. JuA retains a history of high impact and urban terrorism, while IMP provides an increasingly coherent insurgent platform and AQIS can contribute ideological guidance, strategic networking, and transnational legitimacy. A durable nexus among these actors could broaden the threat beyond IMP’s current predominantly northwestern security focus.

Afghanistan remains central to this assessment. Pakistani militant networks continue to benefit from geographic depth across the border, while Islamabad increasingly treats Afghan sanctuary as a core driver of domestic insecurity. IMP’s leadership and constituent networks have strong historical connections to this cross border environment. This provides resilience and operational depth but also creates a political vulnerability, since highly visible IMP activity increases pressure on the Afghan Taliban and raises the risk of Pakistani military retaliation.

As of August 2026, IMP should therefore be assessed as an established and adaptive insurgent coalition rather than an experimental militant alliance. Its immediate threat remains concentrated primarily in northwestern Pakistan, but its organisational trajectory, tactical sophistication, AQIS connectivity, and ability to exploit fragmentation within the Pakistani jihadist ecosystem give it credible expansion potential.

The principal intelligence concern is not simply whether IMP increases its monthly attack volume. It is whether the alliance succeeds in transforming current operational resilience into a broader militant network capable of absorbing additional factions, expanding beyond its established geography, and integrating insurgent warfare with the urban attack capabilities historically associated with other Pakistani jihadist actors.

IMP Activity and Operations — September 2026

September unfolded within a broader deterioration of Pakistan’s militant security environment, particularly across Khyber Pakhtunkhwa, where jihadist networks continued to operate despite sustained counterterrorism pressure and repeated security-force operations. Within this environment, Ittehad-ul-Mujahideen Pakistan (IMP) remained an operationally relevant component of the insurgency, demonstrating that the coalition retains the ability to sustain activity while also concentrating resources on more complex and consequential attacks.

The most significant development occurred on 18 September in Kohat, where IMP claimed the coordinated assault against the Old Police Lines complex. The operation combined an explosives-laden vehicle with a subsequent armed penetration of the compound, where militants engaged security personnel and attempted to reach police, Counter-Terrorism Department and Special Branch facilities. The resulting confrontation continued through an extended clearance operation, illustrating a level of preparation that went considerably beyond the more routine forms of militant violence affecting Khyber Pakhtunkhwa during the month.

Operationally, Kohat is important because the attack integrated several components within a single assault sequence: a high-yield initial breach, multiple attackers, subsequent penetration of a hardened security location and prolonged armed resistance once inside the target area. This combination is consistent with IMP’s demonstrated preference for attacks against security infrastructure while showing that the coalition can still assemble personnel, explosives, weapons and reconnaissance into coordinated operations despite continuing Pakistani counterterrorism activity. It therefore provides a more useful indicator of capability than attack frequency alone.

Read more

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — September 2026

3. Number, Targets, and Areas of Attacks in September 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary JNIM media channels, open-source reporting, official statements, and local sources, which collectively strengthen the credibility and comprehensiveness of this analysis.

Limitations

• Incomplete or delayed reporting from conflict areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where verification is not possible, this is explicitly noted.

Related Intelligence & Analysis:

Previous Strategic Threat Outlook:

Overview and Security Threat Assessment

The operating environment in Mali and across the central Sahel remains characterised by persistent governance deficits, chronic socioeconomic vulnerability, and uneven state presence. These structural conditions, long evident in northern Mali and historically exploited by autonomy-oriented and separatist movements, continue to constitute the primary enabling factors for armed mobilisation. In this context, jihadist recruitment is less a function of large-scale ideological adherence than of the ability to convert local grievance systems into mechanisms of compliance, protection, and mobilisation. Where the state is absent, predatory, or inconsistent, armed actors that can impose order, resolve disputes, and regulate daily life retain a decisive advantage. This dynamic, widely documented in international analytical and academic literature on Sahelian insurgencies, remains central to understanding the durability and expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM).

JNIM remains the most capable Salafi-jihadist actor in the central Sahel, though logistical and intelligence limitations constrain its operational capacity. Established in March 2017 through the merger of Ansar Dine, Katibat Macina, al-Mourabitoun, and AQIM’s Sahara branch, the group has evolved into a federated coalition rather than a rigidly hierarchical organisation. It operates primarily in Mali, Burkina Faso, and Niger, while periodically extending operational pressure toward coastal states and peripheral borderlands. Analytically, JNIM is best understood as a hybrid insurgent structure that combines guerrilla warfare, selective governance, and political signalling. Its resilience derives from a decentralised operational architecture, strong social embedding through local intermediaries, and a pragmatic strategic culture that prioritises survivability and influence over symbolic or purely spectacular violence. However, it remains vulnerable to targeted countermeasures.

Over time, JNIM has demonstrated a consistent capacity to instrumentalise local discontent, particularly among marginalised rural populations exposed to insecurity, intercommunal violence, and abuses by state or auxiliary forces. Its traction among segments of Fulani (Peul) communities in central Mali and Burkina Faso, and among Tuareg networks in the north, is better explained by political-economy and security dynamics than by doctrinal mobilisation alone. Protection arrangements, dispute resolution, retaliation logics, and access to livelihoods remain the primary vectors of recruitment and passive support. Where counterinsurgency responses rely on indiscriminate coercion, proxy militias, or collective punishment, they tend to generate strategic blowback, accelerating recruitment and deepening JNIM’s social cover.

Multiple international assessments have repeatedly underlined that the persistence of jihadist violence in the Sahel is rooted in unresolved political and governance failures rather than ideological diffusion. Operationally, JNIM has pursued a sustained and adaptive campaign targeting civilians, national security forces, foreign militaries, and, previously, UN peacekeepers. The group’s operational logic has remained broadly consistent: incrementally degrade state presence, contest transport corridors, impose costs on governance, and convert insecurity into leverage. From an intelligence perspective, two developments matter more than the absolute number of attacks. First, JNIM has shown improved coordination across wide geographic areas within compressed timeframes, indicating maturation in communications, command and control, and tactical mobility. Second, the group has continued to diversify its tactical repertoire, increasingly integrating drones for aerial surveillance and attack facilitation, alongside persistent use of IEDs, ambushes, targeted assassinations, and complex assaults against fixed military installations. Conflict-monitoring organisations have noted that JNIM is now among the most active non-state actors using drone-enabled tactics in the Sahelian theatre, reflecting rapid learning and diffusion within the network.

Leadership dynamics further shape JNIM’s operational behaviour across sub-theatres. While the coalition maintains strategic coherence, different operational styles remain evident. In northern Mali, leadership associated with Iyad Ag Ghali has historically prioritised calibrated violence, elite brokerage, and selective accommodation with local power brokers, including militia, political, and religious figures. In contrast, Amadou Koufa’s operational influence in central Mali and Burkina Faso has relied more heavily on community-level mobilisation and identity-linked grievance narratives, particularly among Fulani populations. These variations do not represent fragmentation but rather flexible adaptation to distinct sociopolitical environments within a common strategic framework.

The escalation cycle observed since mid-2023 reflects a convergence of internal confidence, expanded mobilisation narratives, and favourable opportunity structures. While propaganda messaging alone does not drive operational tempo, it provides insight into intent and organisational self-perception. The broader trendline, higher operational intensity, expanding geographic reach, and increasing tactical sophistication have continued into 2024 and 2025, as documented by international analytical reporting on Sahelian jihadist dynamics.

In 2025, a qualitative shift has become particularly salient: JNIM’s increasing reliance on economic warfare as a deliberate instrument of political coercion. The group has moved beyond opportunistic predation toward systematic disruption and regulation of supply chains, particularly in western Mali. Attacks against industrial facilities, infrastructure projects, and artisanal mining sites have been followed by explicit threats and subsequent action targeting fuel supplies from neighbouring coastal states. The resulting interdiction of logistics corridors, especially around Kayes and Nioro, has transformed economic disruption into a mechanism of political engineering. In a country heavily dependent on imported fuel and goods, such disruption directly challenges the state’s functioning. The authorities’ inability to secure long, vulnerable road networks amplifies the impact of relatively small-scale attacks, producing cascading effects on transport, electricity generation, education, and urban services. In this context, JNIM positions itself not merely as a spoiler but as a regulating authority capable of permitting, denying, or conditioning access to essential flows.

As control over supply channels increases, JNIM’s governance practices become more visible and enforceable. Field reporting indicates the imposition of behavioural and social regulations in areas under its influence, including dress codes and public conduct rules, which are enforced through coercive means. These measures should be interpreted less as isolated ideological enforcement and more as signals of authority and rule-setting capacity. By normalising compliance and demonstrating the state’s inability to protect alternative norms, JNIM reinforces its claim to de facto governance.

JNIM’s continued operational effectiveness is closely tied to a tactical model optimised for the Sahelian environment. Small, highly mobile units using motorcycles and pickup trucks can rapidly mass, strike, and disperse in swarm-like manoeuvres that overwhelm static defences. These teams rely on radio and mobile communications, ground observers, and increasingly drone-based surveillance to maintain situational awareness. The attack spectrum remains broad, ranging from IEDs and ambushes against convoys to targeted killings, raids on villages associated with pro-government militias, and complex assaults on bases and checkpoints using suicide vehicle bombs, indirect fire, and direct assaults. This combination of mobility, decentralisation, and technological adaptation continues to complicate prediction and containment efforts.

Despite contradictory official narratives from affected governments, available open-source indicators suggest that JNIM’s territorial influence and operational reach continue to expand. The coalition has demonstrated a new level of confidence by conducting operations hundreds of kilometres apart and probing previously less affected areas in central and western Mali. Emerging activity along border corridors toward Niger, Benin, and Nigeria further suggests a strategy of gradual geographic expansion rather than sudden territorial conquest.

Strategically, JNIM is following a well-established insurgent trajectory: fight to gain leverage, govern to retain influence, and negotiate from a position of accumulated power. This does not imply imminent political talks, but it does indicate that the group’s centre of gravity is increasingly political rather than purely military. The most significant risk posed by JNIM today is therefore not limited to kinetic violence. Still, it lies in the progressive erosion of state authority and the normalisation of armed governance across significant portions of the Sahel.

Between January and August 2026, JNIM’s operational trajectory reflected a progressive consolidation of its military, territorial, and coercive capabilities across the Central Sahel, accompanied by a growing capacity to challenge state authority beyond its traditional areas of influence. In Mali, the continued and intensifying pressure on strategic transport corridors, fuel supplies, military installations, and economically significant locations showed how the organisation increasingly integrated conventional insurgent operations with economic disruption and efforts to undermine government legitimacy. The coordinated offensive launched on 25 April, followed by further operations in July, represented a particularly significant development, revealing the potential operational advantages of cooperation between JNIM and the Front de Libération de l’Azawad (FLA), especially in northern Mali, where their convergence against government forces and Russian military personnel contributed to a more complex security environment. This cooperation should nevertheless be understood primarily as a convergence of military and territorial interests rather than evidence of ideological integration or a unified political project. At the same time, JNIM maintained pressure on military and security forces, local militias, and communities perceived as supporting government authorities, while its activities in Burkina Faso and neighbouring border areas continued to demonstrate the insurgency’s regional dimensions. The military campaign was accompanied by an increasingly important cognitive and informational component, through which the organisation sought to amplify the perceived effectiveness of its operations, exploit government vulnerabilities, influence local perceptions of security and authority, and reinforce its position as an alternative source of coercive power and territorial regulation. Taken together, developments during the first eight months of 2026 suggest that JNIM’s strategic approach was not limited to increasing the frequency or geographical distribution of attacks, but increasingly involved combining military pressure, selective territorial control, economic coercion, local political arrangements, and information operations to progressively weaken state authority and constrain the operational freedom of its adversaries.

Activity and Operations Analysis — September 2026

Throughout September 2026, JNIM maintained a sustained military campaign across the Central Sahel, combining attacks against government security forces and their local and foreign partners with operations intended to disrupt military movements, undermine territorial security, and increase pressure on strategically important locations.

Read more

The threat remains high and persistent, underscoring the need for stakeholders to stay vigilant and allocate resources effectively over the next 3–6 months to maintain operational effectiveness. Emphasizing adaptability can reassure stakeholders about the threat’s evolving nature and the importance of flexible responses.

📌 Inside this Assessment

1. Brief overview of the TTP

2. Activity and Operations Analysis — September 2026

3. Number, Targets, and Areas of Attacks in September 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties highlight the importance of ongoing monitoring to ensure readiness against tactical escalation or diversification. Stressing continuous vigilance can make stakeholders feel assured that the threat is being actively managed and understood.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. Clarifying how limitations-such as potential propaganda bias and delayed reporting-affect operational decisions will help stakeholders interpret the data accurately and trust the assessment.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

Brief overview of the TTP

The Tehrik-i-Taliban Pakistan (TTP), established in 2007 as an umbrella organisation of predominantly Pashtun militant factions, remains a major insurgent threat to the Pakistani state. Under Noor Wali Mehsud, who assumed leadership in 2018, the movement has rebuilt organisational cohesion through factional reunification, internal restructuring and a more consistent political and media strategy. Its ideological foundations lie in militant Deobandism, reinforced by longstanding relationships with the Afghan Taliban and Al-Qaeda. However, its immediate campaign remains directed principally against Pakistan’s security forces and system of government.

By September 2026, the TTP’s resilience is best understood through its ability to sustain pressure across multiple districts while surviving repeated counterterrorism operations. Khyber Pakhtunkhwa remains the centre of gravity of its insurgency, encompassing both the former tribal areas and southern districts such as Bannu, Lakki Marwat and Dera Ismail Khan. Activity elsewhere in Pakistan extends the security burden, but should not obscure this concentration. Operational reach also needs to be distinguished from territorial control: the capacity to attack, intimidate local communities or temporarily interfere with movement does not, by itself, establish durable control over an area.

The campaign combines attacks on military and Frontier Corps personnel with sustained pressure on police, checkpoints, patrols and the local networks supporting state authority. Tribal elders, suspected informants and members of anti-militant formations remain exposed to targeted violence. This broader selection of targets gives the insurgency a coercive function beyond inflicting security-force casualties, potentially weakening intelligence collection and discouraging cooperation with the authorities. The leadership’s emphasis on security-related targets should therefore not be interpreted as an absence of civilian victimisation.

Tactical adaptation is increasingly relevant to the threat assessment. IEDs, direct-fire attacks and ambushes remain central to the campaign. At the same time, material circulated by Umar Media in September presented attacks against Army and Frontier Corps convoys in Swat involving both explosives and drones. These releases indicate an effort to publicise a wider tactical repertoire, but the available material does not establish the frequency, effectiveness or distribution of drone capabilities across TTP units. Likewise, activity in Swat warrants attention but does not automatically demonstrate a restoration of the group’s former territorial position there.

The Afghan dimension remains critical. Access to sanctuary and cross-border networks complicates Pakistan’s efforts to translate tactical successes into sustained reductions in violence. During 2026, the dispute over militants operating from Afghanistan has also contributed to repeated interstate escalation, including renewed confrontation in September. Pakistani allegations and Afghan denials remain sharply contested; the analytical question is whether military and diplomatic pressure materially restricts militant movement, organisational support and operational recovery.

The resulting threat is persistent and geographically uneven. The TTP’s capacity to combine recurring attacks with selective intimidation places continuing demands on security forces and local administration. Its trajectory should be assessed through changes in targeting, geographic persistence and recovery after operations, alongside attack frequency. These indicators will provide a firmer basis for judging whether the movement is merely sustaining violence or developing a more durable challenge to state authority.

Related Intelligence & Analysis:

TTP Activities – September 2026

During September, Tehrik-i-Taliban Pakistan remained active across its established operating areas in Khyber Pakhtunkhwa, against a backdrop of continuing Pakistani counterterrorism operations and renewed tensions along the Afghan border. The month’s reporting and propaganda releases covered attacks on security personnel, confrontations involving local armed opponents and military efforts to disrupt militant movement. These developments unfolded within a fragmented security environment in which TTP operations, the activity of other militant organisations and interstate border incidents require careful separation.

The group’s operational messaging continued to emphasise confrontation with the Pakistan Army, Frontier Corps and police. Alongside claims of individual attacks, Umar Media circulated material presenting operations against military convoys in Swat, including direct attacks, IEDs and the purported use of drones. Such releases formed part of the movement’s account of its continuing campaign and its presence beyond the southern districts most closely associated with the insurgency. Their publication dates do not necessarily establish when every depicted operation occurred, a distinction that remains relevant when reconstructing the month’s activity.

Security operations and reported attempts to cross the Afghan–Pakistani border also featured prominently in September’s reporting. Renewed exchanges between Pakistan and Afghanistan brought the question of militant sanctuary back into the immediate security agenda, with Islamabad reiterating accusations that Afghan territory was being used to support attacks inside Pakistan and Kabul rejecting those allegations.

Read more

This weekly strategic intelligence report documents and summarises jihadist propaganda and military activities from 24 to 30 September, highlights recent developments in the threat, and provides a structured overview of the situation across various organisations and operational theatres.

This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This product helps analysts and policymakers track threat trends in depth, supporting their work in shaping strategic responses and maintaining awareness of the active threat environment.

This publication includes brief threat assessments and analyses of operational intentions or forecasts, correlating propaganda content like attack claims and ideological messages with recent activities to help analysts understand groups’ adaptive tactics and the dynamic threat environment.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

The emphasis on documentation, classification, and structured presentation of firsthand material aims to instil confidence in analysts and policymakers in the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

• People’s Fighters Front

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 18 statements and 37 photos, claiming 18 attacks.

The targets included the Malian Army, the Dozo militia, the Russian PMC Africa Corps, the Burkinabé Army, and the VDP militia.

The areas of the attacks were :

1) Burkina Faso = 12

- Mouhoun province, Sanmatenga province, Yatenga province, Boulgou province, Loroum province.

2) Mali = 6

- Koulikoro region, Mopti region, Segou region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 13 statements claiming responsibility for 16 attacks.

The targets of the attacks were:

The targets included the Somali Army, Somali pro-government militias, the Ugandan Army, the Burundian Army, the Ethiopian Army, and the Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 12

• Harardhere area, Mudug region;

• Janale area, Qoryooley area, Bulo Marer area, Afgoye area, Lower Shabelle region;

• Jowhar area, Middle Shabelle region;

• Baidoa area, Bay region;

• Bardhere area, Gedo region;

2) Kenya = 4

• Hulugho area, Garissa County;

• Saretho area, Harisukow area Fino area, Mandera County.

The 10th issue of the weekly Al-Bayan, published by the pro-Al-Qaeda (AQ) media outlet Al-Yaqin, and spanning 14 pages this time, features, alongside the usual infographic summarising the previous week’s attacks, religious messages, and photographic evidence of Al-Shabaab and JNIM activities, several editorials of significant interest. These include a strongly ideological piece on Yemen and the United States, as well as an extensive analysis of the crisis facing the African Union mission in Somalia.

The editorial titled “Between the War of Proxies and the Killing of the Confused” begins with an incident in Hadramawt, where a young man reportedly opened fire on foreign teachers at a US-linked facility while a US drone was simultaneously flying overhead.

Al-Bayan uses this incident to construct an ideological contrast between Sunni jihadists, the United States, and the Houthis. The central argument is that, according to the magazine, Washington and the Houthis may be formal adversaries but pursue converging interests against Sunni jihadism. The text asserts that the Houthis maintain an opportunistic relationship with Washington and that their anti-American and anti-Israeli rhetoric masks a convergence in the suppression of jihadists.

The article also emphasises the Houthis’ relationship with Iran, portraying them as part of Iran’s projection of power in Yemen, and argues that the conflict between Washington and the Houthis does not alter their shared hostility toward Sunni jihadists.

The conclusion is explicitly designed to mobilise: the author presents the young man’s attack in Hadramawt as an example of the need to fight both the United States and its alleged regional allies.

The second editorial is more polemical: “Did Uncle Sam Rule Among You with Justice?!” Al-Bayan criticises the Houthis, described as an Iran-linked Shiite movement, and other Islamist factions that, according to the author, have adopted inconsistent stances toward the United States.

The propaganda argument posits that these actors, despite declaring themselves enemies of Washington or Israel, ultimately accept, albeit implicitly, a US-dictated political order. Al-Bayan thus seeks to portray its own jihadist milieu as the only one consistently hostile to the US, Iran, the Houthis, and regional political systems alike.

Finally, an editorial addresses Somalia and the financial crisis facing the African Union mission. Al-Bayan draws on analyses and statements about the mission’s financial crisis (ATMIS/AMISOM), arguing that it faces a significant funding shortfall that could jeopardise its operational sustainability.

The text specifically cites assessments by the International Crisis Group, noting that insufficient funding could strain African forces and indirectly benefit al-Shabaab. It also discusses the UN funding model and the challenges involved in securing a stable funding mechanism for the mission.

Al-Bayan thus leverages a genuine issue, the mission’s funding and sustainability, to construct a narrative suggesting that al-Shabaab is increasingly benefiting from the structural weakening of the international presence in Somalia.

2. Islamic State (IS)

The Islamic State’s official media published the weekly al-Naba this week (566). Issue 566, eight pages long, covers the week of 6–12 Rabi al-Thani 1448 AH (17-23 September 2026). The main infographic summarises the areas affected by military operations this week, including:

• Nigeria, Iraq, Pakistan, Mozambique, Somalia and the Democratic Republic of Congo.

IS claims to have conducted 27 operations in all the mentioned areas and to have caused 74 deaths and injuries.

1) West Africa Province: The weekly al-Naba reports that ISWAP militants carried out 9 attacks against checkpoints, convoys, patrols, and camps belonging to the Nigerian army and pro-government militias in the State of Borno, Nigeria.

2) Iraq Province: The weekly al-Naba reports on 3 attacks carried out by Iraqi militants: 1 attack (as part of the economic warfare strategy) against the Iraqi government’s electrical infrastructure, and 2 attacks against patrols of the Tribal Mobilisation Forces and the Iraqi Army, in Anbar, Kirkuk, and Salah al-Din governorates, Iraq.

3) Central Africa Province: The weekly al-Naba reports that ISCAP militants carried out 6 attacks against patrols and checkpoints of the Congolese Army and against a Christian village (70 Christian houses burned), in Ituri Province, in the Democratic Republic of the Congo.

4) Mozambique Province: The weekly newspaper al-Naba reports that ISM militants carried out 5 attacks against checkpoints, convoys, and patrols of the Mozambican and Rwandan armies, as well as against Christian villages, in the districts of Mocímboa da Praia, Muidumbe, and Palma, in the province of Cabo Delgado, Mozambique.

5) Somalia Province: The weekly newspaper al-Naba reports that Somali militants carried out 3 attacks against convoys and patrols of the Puntland Security Forces in the Bari region of the autonomous federal state of Puntland, Somalia

6) Pakistan Province: The weekly al-Naba reports that Pakistani militants carried out 1 attack against a Pakistani police patrol in the province of Balochistan, Pakistan.

Amaq News Agency, the official news agency of the Islamic State, issued a lengthy statement claiming responsibility for two major attacks carried out by militants of the Islamic State’s Sahel Province against Nigerien forces. The first attack was an armed assault followed by a firefight against a Nigerien army camp near Birni N’Konni, in the Tahoua region, which, according to the statement, resulted in the deaths of 20 Nigerien soldiers.

The second attack was carried out against a Nigerien gendarmerie convoy near the village of Abala in the Tillabéri region, resulting in 19 deaths among Nigerien security forces. Niger

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 8 statements, claiming 8 attacks.

Targets: Pakistan Army, Frontier Corps (FC), Pakistan Police, Gilgit-Baltistan Scouts, Special Security Unit (SSU), and Peace Committee.

Area:

• North Waziristan district, Khyber district, Orakzai district, and Bannu district, in Khyber Pakhtunkhwa Province:

• Ghizer District, in Gilgit-Baltistan Autonumus Region;

Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting approximately 3 minutes and 10 seconds showing an istishadi (suicide) attack carried out by a member of the TTP’s “Istishadi” Special Force, in the name of Allah, against a joint command centre of the Pakistani Army, the Pakistani police, and the Counter Terrorism Department (CTD) in the Der Islam Khan district of Pakistan.

The People’s Fighters Front (PFF), an Iranian jihadist organisation operating in Sistan and Baluchistan, released a 4-minute-and-10-second video in which Zakir Sheikhzadeh, the group’s military commander, describes the clashes between the PFF and IRGC members in Bukshan and Jahadabad, Saravan.

The speaker focused on two incidents that took place during the last week of September in Jahadabad, Saravan. Topics included the outbreak of hostilities, how the Front’s command was informed of its forces’ status, the condition of the besieged troops, communication between field units and command, and decisions on deploying reinforcements.

In the video, Zakir Sheikhzadeh explains how the Front’s forces prepared in Jahadabad before the clashes and how the command responded to the incident in Bukshan. He also discusses dispatching support teams to assist the engaged forces and break the siege. Subsequently, the speaker describes the arrival of jihadist reinforcements and the withdrawal of IRGC military forces from the area.

Zakir Sheikhzadeh then provided details regarding casualties among the military forces as well as the number of Front members killed. He went on to review the specifics of the clashes near the Jame Madani Mosque in Bukshan and the arrival of two support teams to break the siege and evacuate the trapped fighters. Sheikhzadeh recounted how six Front members managed to escape the siege, while four other members of the group were killed. Zakir Sheikhzadeh then explained the Front’s approach over the past few months, the deaths of group members, the presence of the People’s Fighters Front in Baluchistan, and the movement’s social composition, emphasising that the group considers itself a movement born of Baluch society and that its struggle stems from the people’s demands.

🔹Weekly Strategic Assessments

The reporting period presents a jihadist operational environment characterised less by uniform escalation than by the simultaneous consolidation of several distinct theatres.

Read more

The threat picture between 23 and 29 September was defined less by the emergence of a single dominant actor than by a series of investigations revealing the infrastructure that can connect hostile intent to operational capability. The cases were geographically dispersed and involved fundamentally different threat environments, ranging from far-right youth radicalisation in Italy and Islamic State-linked activity in North Macedonia and Canada to organised weapons trafficking in the Balkans and possible state-linked sabotage activity in Europe. They should not be interpreted as components of a common threat system. What makes them analytically relevant when considered together is the recurring presence of enabling structures that can provide individuals and small networks with resources they would struggle to generate independently.

In Italy, an investigation involving 17 people, 14 of them minors, exposed online far-right and white-supremacist environments where ideological radicalisation reportedly coexisted with the glorification of previous mass killers, discussion of potential targets and circulation of material concerning weapons and explosives. Italian reporting indicates that members discussed attacks against a school, a mosque and a synagogue, while investigators seized weapons, extremist material and electronic devices. The significance of the case lies less in the size of the network than in the role the digital environment around it played. What might initially appear to be a radicalisation space had acquired characteristics of an operational learning environment in which ideological reinforcement, violent role models, technical material and target discussion could coexist.

A different version of this problem emerged in North Macedonia, where authorities detained several individuals suspected of terrorism-related activity and illegal weapons trafficking. Searches reportedly produced automatic weapons, pistols, ammunition, communications equipment, cash and Islamic State material. One of the principal suspects is alleged to have been involved for several years in extremist activity and in the indoctrination or recruitment of younger individuals. The case remains subject to further investigation, particularly regarding the precise organisational relationship between the suspects and Islamic State. Still, the combination of ideological mobilisation, recruitment and access to weapons is significant because it illustrates how terrorist capability can develop through an environment that overlaps with existing illicit markets rather than through a self-contained terrorist logistical structure.

In Canada, the Royal Canadian Mounted Police charged 24-year-old Louay Angoud with terrorism-related offences after investigators concluded that he intended to conduct at least one attack on behalf of Islamic State. According to the RCMP, he communicated online with members of a terrorist organisation and collected information concerning the construction of a chemical weapon intended to poison Canadians. There is an important distinction between researching such a capability and possessing it, and the publicly available evidence does not indicate that Angoud had successfully constructed a chemical device. The case is nevertheless useful because it captures an intermediate stage of mobilisation in which ideological commitment begins to generate deliberate capability exploration.

The most ambiguous development occurred in the United Kingdom. Five British men were arrested near RAF Fairford after police received reports of three suspicious vehicles travelling towards the airbase. They were initially detained under the Explosives Act and subsequently on suspicion of preparing a terrorist act. Later examination reportedly identified petrol rather than explosives in the vehicles, and all five men were released on conditional bail while the investigation continued. Neither an ideological motive nor foreign direction has been publicly established. The incident therefore requires considerably more caution than some initial reporting suggested. However, the strategic importance of RAF Fairford means that the investigation remains relevant to the wider question of how military and defence infrastructure is being incorporated into the European threat environment.

Further east, investigations in Germany, Slovakia and Bosnia and Herzegovina exposed another layer of the problem. European authorities continue to examine networks capable of connecting locally recruited operatives with sabotage activity against defence-industrial and Ukraine-related infrastructure. At the same time, an organised crime investigation in Bosnia resulted in the seizure of firearms, ammunition and extensive weapons documentation. Reporting surrounding the Bosnian case has raised possible connections to wider Balkan criminal networks, including environments associated with Foxtrot, the Swedish criminal organisation previously accused by Western governments of conducting operations on behalf of Iran. The evidence does not establish that weapons uncovered in Bosnia were destined for an Iranian-directed operation, but the case illustrates the broader vulnerability created when criminal infrastructure becomes accessible to political or state-linked actors.

Taken together, these developments point towards a layer of the threat environment that sits between motivation and action. Violence rarely emerges from intent alone. Individuals and small networks require information, weapons, social reinforcement, recruitment, logistics, financing or access, while state actors seeking deniability require intermediaries capable of separating strategic direction from operational execution. These enabling structures can be digital, criminal, organisational or covert, and their importance grows as violent actors themselves become increasingly fragmented.

The shift this week therefore lies not primarily in the actors that appeared, but in the infrastructure surrounding them.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week #20

2. Threat Signals

   • Italy: Youth Extremist Networks Become Operational Learning Environments

   • North Macedonia: IS-Linked Network Combines Recruitment and Weapons Access

   • Canada: IS-Inspired Mobilisation Moves Into Capability Exploration

   • United Kingdom: RAF Fairford Moves Threat Attention Toward Strategic Military Infrastructure

   • Germany and Slovakia | Russian Sabotage Models Rely on Disposable Operational Layers

   • Bosnia: Illicit Arms Pipelines Connect Criminal Markets to Wider Security Threats

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

Final Analytical Line

Related Intelligence & Analysis:

The Shift of the Week #20

How digital networks, weapons pipelines and proxy systems turn fragmented actors into operational threats

Recent editions of Weekly Threat Shift have progressively examined different stages of contemporary threat development. Issue #17, The Distributed Threat, focused on the diffusion of violent potential towards smaller networks, individuals and proxies. Issue #18, The Capability Threshold, examined the point at which ideological intent begins to acquire the weapons, logistics, expertise and access necessary to become operationally meaningful. Issue #19, The Accessibility Gap, moved the analysis towards target selection, examining how actors with very different motivations can converge on environments where symbolic significance, civilian exposure and physical vulnerability overlap.

This week exposes the connective layer running between these stages. An actor may possess motivation, but motivation must still be translated into capability, and that process rarely occurs in complete isolation. Even highly autonomous individuals depend to varying degrees on resources generated elsewhere, whether extremist communities providing ideological reinforcement, digital archives supplying technical information, criminal markets providing weapons, intermediaries facilitating logistics or handlers connecting disposable operatives to a state sponsor. What differs between threat environments is the sophistication, durability and degree of organisation of this infrastructure, rather than the basic requirement for some mechanism capable of connecting intent with practical means.

Traditional terrorist infrastructure was comparatively easy to conceptualise. It consisted of training camps, safe houses, weapons depots, facilitators, financiers, couriers and command structures belonging to recognisable organisations. Those systems continue to exist, particularly within insurgencies and territorial conflict zones. Still, the infrastructure surrounding contemporary violence in Europe and North America is frequently more dispersed and less visibly organisational. A private online group can simultaneously function as an ideological community, recruitment pool, social reinforcement mechanism and repository of technical material. A weapons trafficker can provide capability without sharing any ideological connection with the buyer. A criminal intermediary can perform a logistical function for a state intelligence service without becoming part of that service. At the same time, a locally recruited proxy may carry out an operation with only partial knowledge of the wider strategic objective.

Read more

This weekly strategic intelligence report documents and summarises jihadist propaganda and military activities from 17 to 23 September, highlights recent developments in the threat, and provides a structured overview of the situation across various organisations and operational theatres.

This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This product helps analysts and policymakers track threat trends in depth, supporting their work in shaping strategic responses and maintaining awareness of the active threat environment.

This publication includes brief threat assessments and analyses of operational intentions or forecasts, correlating propaganda content like attack claims and ideological messages with recent activities to help analysts understand groups’ adaptive tactics and the dynamic threat environment.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

The emphasis on documentation, classification, and structured presentation of firsthand material aims to instil confidence in analysts and policymakers in the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 11 statements and 17 photos, claiming 18 attacks.

The targets included the Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, and Niger Army.

The areas of the attacks were :

1) Burkina Faso = 9

- Gourma province, Sanmatenga province, Yatenga province, Houet province, Bam province.

2) Mali = 7

- Koulikoro region, Sikasso region, Mopti region, Segou region.and

3) Niger = 1

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 11 statements claiming responsibility for 13 attacks.

The targets of the attacks were:

The targets included the Somali Army, Somali pro-government militias, Somali intelligence, the Ethiopian Army, and the Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 10

• Mubarak area, Lower Shabelle region;

• Buloburde area, Hiiran region;

• Balad area, Middle Shabelle region;

• Bariire area, Afgooye area, Lower Shabelle region;

• Jowhar area, Middle Shabelle region;

• Farjuma area, Lower Juba region;

• Beledweyne area, Hiiran region.

2) Kenya = 3

• Damsi area, Lafey area, Mandera County;

• Qorof Harar area, Wajir County;

• Sheikh Hussein–Hili area, Garissa County.

The nineth issue of the weekly Al-Bayan, published by the pro-Al-Qaeda (AQ) media outlet al-Yaqin, this time 20 pages, in addition to the usual infographic summarising last week's attacks, religious messages, and photographic accounts of al-Shabaab and JNIM activities, features a highly interesting two-page editorial.

2. Islamic State (IS)

The Islamic State’s official media published the weekly al-Naba this week (565). Issue 565, eight pages long, covers the week of 28 Rabi al-Awwal to 5 Rabi al-Akhir 1448 AH (10 to 16 September 2026). The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Iraq and the Democratic Republic of Congo.

IS claims to have conducted 9 operations in all the mentioned areas and to have caused 12 deaths and injuries.

1) West Africa Province: The weekly al-Naba reports that ISWAP militants carried out 7 attacks against checkpoints, convoys, patrols, and camps belonging to the Nigerian army and pro-government militias in the State of Borno, Nigeria.

2) Iraq Province: The weekly al-Naba reports on 1 attack carried out by Iraqi militants that destroyed a thermal camera at an Iraqi Army camp in the Kirkuk governorate, Iraq.

3) Central Africa Province: The weekly al-Naba reports that ISCAP militants carried out 1 attack against patrols of the Congolese Army in Ituri Province, in the Democratic Republic of the Congo.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 13 statements, claiming 13 attacks.

Target: Pakistan Army, Frontier Corps.

Area: Kurram district, North Waziristan district, Hangu district and Orakzai district, in Khyber Pakhtunkhwa Province, Pakistan

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting about 2:51 minutes to show several major attacks carried out by its militants, including direct assaults, IED and drone attacks against the Pakistani Army and Frontier Corps convoys in the Swat district, Khyber Pakhtunkhwa Province, Pakistan.

🔹Weekly Strategic Assessments

The reporting period presents a fragmented operational picture, with short-term trajectories diverging considerably across the jihadist organisations monitored.

Read more

Taken individually, these incidents remain limited in scale and tactical complexity. Taken together, however, they indicate that residual Islamic State cells can conduct reconnaissance, access selected operating areas, and translate clandestine presence into intermittent kinetic activity. September’s significance therefore lies less in the number of attacks than in what their geography, targeting, and tactical characteristics reveal about the organisation’s remaining operational capacity.

📌 Inside this Assessment

1. Signal: A Limited Increase from a Low Baseline

2. September Operational Picture

3. Tactical Pattern: IEDs, Mobility and Low-Signature Operations

4. Kirkuk and Anbar: Persistent Operating Spaces

5. Targeting Surveillance: A Small but Relevant Indicator

6. Assessment: Persistence, Not Yet Recovery

7. Indicators to Watch | Next 30–60 Days

8. Analytical Outlook

Related Intelligence & Analysis:

1. Signal: A Limited Increase from a Low Baseline

Activity claimed by the Islamic State in Iraq increased slightly in September 2026 compared to the particularly low levels observed in previous months. Between the beginning of the month and September 23, the organisation’s official propaganda revealed at least four distinct operations, concentrated in the Kirkuk and Anbar provinces. Three involved the use of improvised explosive devices (IEDs) against Iraqi security force vehicles or patrols, while a fourth action, subsequently documented by al-Naba Newspaper, targeted an Iraqi army position, destroying a thermal surveillance camera used to monitor the area.

The quantitative data remains low and, viewed in isolation, is insufficient to support the claim of a structural resurgence of the Islamic State insurgency in Iraq. However, the signal becomes more significant when considering the geographic distribution of incidents in Kirkuk and Anbar, the choice of targets, and operational methods employed. This geographic focus suggests that residual cells are maintaining specific operational footholds, which is critical for security planning.

Read more