Since early 2026, the Islamic State Central Africa Province (ISCAP) has maintained a steady level of activity across North Kivu and Ituri. Attacks have targeted both civilian populations and security forces, including ambushes on military patrols and incidents affecting economic infrastructure such as mining sites. At the same time, repeated assaults on rural communities, particularly Christian villages, have contributed to ongoing displacement and instability.

These attacks follow recognizable patterns that highlight ISCAP’s tactics and influence, occurring in areas with limited state presence and targeting vulnerable moments like religious gatherings and isolated settlements, which over time weaken local communities and hinder recovery.

Rather than seeking to control territory in a conventional sense, ISCAP relies on repeated disruption. Violence influences local behavior and perceptions, creating a sense of urgency for policymakers to address these social impacts.

The result is a security environment in which instability persists even in the absence of a continuous insurgent presence. Understanding this pattern is essential for assessing current developments and for identifying the limits of existing responses.

ISCAP in Eastern Congo: Organizational Evolution

The organizational evolution from the Allied Democratic Forces to ISCAP reflects a strategic shift that consolidates ideology, gains external validation, and enhances operational adaptability, all of which are crucial for understanding its current resilience and tactics.

The ADF has historically functioned as a localized insurgent actor with hybrid motivations, including political grievances, criminal revenue generation, and religious radicalization. Its pledge of allegiance to the Islamic State marked a transition toward integration within a transnational jihadist ecosystem. This integration did not imply direct command and control from the Islamic State core, but rather alignment within a franchise architecture characterized by branding, media amplification, and selective doctrinal diffusion.

The resulting entity operates as a semi-autonomous node within the broader Islamic State’s global structure. The Congolese theater provides strategic utility by demonstrating geographic reach, sustaining propaganda output, and maintaining the perception of organizational vitality despite territorial losses in Iraq and Syria. Within the eastern DRC, ISCAP retains a dispersed operational footprint concentrated in forested areas of North Kivu and Ituri, leveraging terrain complexity to sustain mobility and concealment.

The organization’s structure appears decentralized at the tactical level, relying on small assault elements capable of rapid movement. Leadership cohesion is maintained through ideological indoctrination, coercive discipline, and the circulation of operational directives that emphasize both lethality and unpredictability.

Recent Trends in ISCAP Activity: A Sustained Increase in Attacks

From late January through April 2026, ISCAP’s sustained and increasing activity across North Kivu and Ituri demonstrates its operational resilience, with continued ambushes, attacks on infrastructure, and assaults on rural communities, emphasizing the ongoing threat in eastern Congo.

This continuity matters. It suggests that the group is not experiencing temporary fluctuations in activity, but rather operating with a degree of consistency that allows it to strike across multiple locations over time. Maintaining such a tempo requires more than tactical initiative. It implies reliable movement routes, access to fighters, and the ability to coordinate attacks without significant disruption.

Patterns observed in recent weeks reinforce this assessment. ISCAP has targeted both civilian and military objectives, including attacks on Christian villages in the Mambasa area and ambushes against Congolese and allied forces. In one instance, the group claimed responsibility for an attack on a convoy protecting a mining site, reporting multiple casualties among soldiers and pro-government militias, as well as the destruction of equipment and infrastructure.

Groups under pressure tend to reduce activity or regroup, but ISCAP continues to operate across different areas without a visible reduction in tempo. This resilience underscores the importance of sustained strategic efforts.

When viewed in a broader context, eastern Congo remains one of the most active environments for Islamic State-linked violence globally. The persistence of attacks over several months indicates that the group is not only present but also able to sustain pressure over time. This has direct implications for local security dynamics and for the broader assessment of Islamic State activity in Africa.

Patterns of Violence: How ISCAP Conducts Its Attacks

Recent attacks attributed to ISCAP show a consistent pattern rather than isolated episodes of violence. The group tends to target rural communities that are difficult to defend, often located along secondary routes or near forested areas that provide cover and easy escape.

This pattern has continued in recent months, with repeated incidents in areas such as Mambasa in Ituri province, where both civilian communities and security forces have been targeted. The choice of location is not random. These are areas where state presence is limited and where response times are slow, allowing attackers to operate with relative freedom.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 16 and 22 April, providing structured situational awareness across multiple organizations and theatres.

This brief underscores the critical operational claims and targets, aiming to make analysts and policymakers recognize the ongoing threat and its relevance to their strategic priorities.

• volume and distribution of official propaganda output,

• organizational and geographic dispersion across theatres,

• This focus on operational claims in West Africa, the Middle East, and South Asia highlights active threat zones requiring strategic attention and planning, ensuring analysts recognize key areas of concern.

• The focus on organizational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers that comprehensive monitoring and understanding of jihadist media strategies are in place.

The purpose of this product is to support systematic monitoring, structured comparison across reporting cycles, and longitudinal trend tracking. It provides an evidentiary baseline for subsequent analytical products and deeper theatre-specific assessments.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda released by a predefined list of jihadist organizations and affiliated groups, selected for operational relevance and threat level, during the reporting period.

The focus is strictly on documentation, classification, and structured presentation of primary-source material, enabling analytical reuse and historical comparison over time.

🔹 Sources & Collection Methodology

The analysis is based exclusively on primary-source propaganda material, including official magazines, videos, photo sets, statements, claims of responsibility, and audio statements, to clarify the scope of sources used.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorized by organization, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.
No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends, helping analysts understand activity patterns without overestimating their significance, thus supporting accurate threat assessment.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analyzed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

• Unofficial IS media channel

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 10 statements and 2 photos, claiming 11 attacks.

The targets of the attacks were: the Malian Army, the Russian PMC Africa Corps, the Burkinabé Army, the VDP militia, and the Niger Army.

The areas of the attacks were :

1) Burkina Faso = 4

- Yatenga province, Mouhoun province.

2) Mali = 6

- Mopti region, Ségou region, Timbuctù region.

3) Niger = 1

- Tillaberi region.

Al-Kataib Media, Harakat al-Shabaab al-Mujahidin, released a 3:54-minute video showing its fighters ambushing a Somali pro-Government militia patrol in the Baidoa area, Bay region. Somalia

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 7 statements claiming responsibility for 10 attacks.

The targets of the attacks were:

Somali army, Kenyan army, Somali pro-government militia.

The areas affected by the attacks were:

1) Somalia = 7

- Qoryooley area, Mubarak area, Afgoye area, Lower Shabelle region; Beled Hawa area, Gedo region; Jowhar area, Middle Shabelle region; Baidoa area, Bay region.

2) Kenya = 3

- Daiso area, Fafi area, Garissa County.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (543). Issue 543, eight pages long, covers the week of 21 to 27 Shawwal 1447, from 9 to 15 April 2026. The main infographic summarises the areas affected by military operations this week, including Nigeria, Niger, Syria, and Pakistan, highlighting key operational zones.

IS claims to have conducted 18 operations in all the mentioned areas and to have caused 44 deaths and injuries.

Al-Azaim Media, the Islamic State Khorasan Province (ISKP), published issue 48 of its magazine “Voice of Khorasan”.
The magazine comprises 79 pages, structured across multiple narrative and thematic levels, combining ideological, geopolitical, and mobilizing content. It features editorials on the United States, the Taliban, and the Bagram base, Turkey, and contemporary geopolitical dynamics, the Bondi Beach attack, the exploitation of the Uyghur issue, and geopolitical narratives aimed at emphasizing divisions between non-Muslim actors. The target audience comprises supporters, sympathizers, and potential recruits, with accessible content in English for an international readership.
The propaganda function aims to reinforce identity, justify violence, construct grievance narratives, and provide an indirect incentive for action.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 21 statements, claiming 21 attacks.

Target: Pakistan Army, Pakistan Police, Frontier Corps,

Area:

- Khyber district; Bannu district, Orakzai district, North Waziristan district, South Waziristan district; Khyber Pakhtunkhwa Province. Pakistan

Umar Media, Tehreek-e-Taliban Pakistan (TTP), published a 2:21-minute video showing the training of its Special Suicidal Forces militants. Pakistan

🔹Weekly Monitoring Notes

The reporting period reflects a stabilization phase in overall propaganda output, with a moderate reduction in volume compared to the previous week, particularly within Al-Qaeda affiliates and Islamic State central channels.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organization’s operational tempo, geographic dispersion, and signaling posture across theatres.

The weekly newsletter reached number 544 last Thursday.

Threat level: Medium–High, stable with episodic operational spikes
Trend: → stable with increased West Africa concentration
Time horizon: 30–90 days
Confidence level: Medium

📌 Inside This Assessment

This intelligence brief provides a structured analysis of the Islamic State’s operational activity, focusing on West Africa, Syria, and Africa theatres, based on al-Naba Issue No. 544, to inform decisions on threat dynamics and strategic planning.

• Examines claimed Islamic State operations by province and theatre, highlighting geographic concentration, targeting priorities, and operational tempo to guide regional focus.

• Analyses tactical patterns and methods, noting increased lethality, to motivate analysts and policymakers to maintain heightened vigilance.

• The analysis identifies specific indicators and warning signs and is essential for early warning, enabling analysts and military planners to anticipate changes in threat activity.

  This analysis provides threat assessments, intelligence evaluations, and forecasts up to 90 days in advance, giving policymakers, military officials, and analysts a comprehensive picture of the threats.

Key Judgments

• Al-Naba continues to function as a reliable indicator of Islamic State operational intent and activity, with persistent alignment between reported operations and observed geographic concentration, despite known inflation in casualty reporting.

• Operational activity remains structurally concentrated in West Africa, with secondary but consistent pressure in the Sahel, Syria, and South Asia, confirming an Africa-centric center of gravity with peripheral persistence.

• The Islamic State maintains a stable attritional model based on repeated low to moderate complexity attacks against security forces, infrastructure, and local collaborators, with no evidence of systemic tactical innovation.

• Targeting patterns show continued prioritization of military and security actors, alongside selective use of coercive violence against civilians accused of collaboration, reinforcing local control mechanisms rather than expanding target categories.

• The media output remains focused on continuity, legitimacy, and persistence, which should reassure policymakers and military officials that there is no sign of imminent escalation or large-scale offensive, fostering confidence in current threat assessments.

• Quantitative fluctuations in weekly activity reflect cyclical operational tempo rather than structural degradation or expansion, emphasizing the organization’s resilience and helping analysts and policymakers feel assured of its stability.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 544, including photographs, statements, and alleged military activities.

The analysis integrates:

• OSINT,

• IMINT,

• SOCMINT,

• Digital HUMINT,

to contextualize reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritize event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

Issue 544, eight pages long, covers the week of 28 Shawwal to 4 Dhul Qi'dah 1447, from 16 to 22 April 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including: Nigeria, Niger, Cameroon, Syria, Mozambique, and the Democratic Republic of Congo.

IS claims to have conducted 23 operations in all the mentioned areas and to have caused 53 deaths and injuries.

On the fourth page, the weekly magazine goes into detail about the types of attacks, operations, and targets of Islamic State fighters, who follow two main strategies: “war of attrition” and “economic warfare”, as well as other methods aimed at targeting Christians and Shiites. Since 20 March 2025, the Islamic State has embarked on a new military campaign, particularly in Africa (in the areas of Nigeria, Niger, Cameroon, and Mozambique) called “Burning Camps”.

Below is a detailed account of the attacks by province/area:

1) West Africa Province: The weekly al-Naba reports 18 operations carried out by ISWAP militants: 17 attacks against camps, barracks, checkpoints, convoys, and patrols belonging to the Nigerian Army, the Nigerian Police, and pro-government militias in the states of Borno, Yobe, and Adamawa, Nigeria; 1 attack against a Cameroonian army camp in the Maroua area, in the Far North region of Cameroon.

2) Central Africa Province: The weekly al-Naba reports on 1 attack carried out by ISCAP militants against a joint Congolese and Ugandan army patrol in Ituri Province, in the Democratic Republic of the Congo.

3) Sham Province: The weekly al-Naba reports on 1 operation carried out by Syrian militants against a government oil tanker convoy in the Deir ez-Zor governorate in Syria.

4) Sahel Province: The weekly al-Naba reports on 1 operation carried out by IS-Sahel militants against the headquarters of the Nigerien National Gendarmerie in the Tillaberi region of Niger.

5) Mozambique Province: The weekly al-Naba reports on 2 operations carried out by ISM militants against two positions held by pro-government militias in the Macomia district of Cabo Delgado Province.

CONCLUSION 1 — Strategic Impact and Operational Implications

Issue 544 confirms the persistence of an Africa-centric operational architecture, with West Africa Province acting as the primary engine of activity and shaping the overall threat posture. The concentration of 18 out of 23 operations in Nigeria and the Lake Chad Basin reinforces the assessment that ISWAP retains both operational depth and tactical continuity, sustaining pressure on military forces, police units, and pro-government militias across multiple states. This level of concentration is not incidental but reflects a mature insurgent ecosystem, characterized by mobility, local support, and adaptive targeting cycles.

The continued emphasis on attacks against camps, convoys, and checkpoints indicates a deliberate strategy aimed at degrading state presence in rural and semi-urban areas, eroding confidence in security provision, and maintaining freedom of maneuver. The extension of activity into Cameroon, albeit limited, signals cross-border elasticity and the ability to exploit weakly coordinated regional security frameworks.

Outside West Africa, activity remains calibrated and opportunistic. In Syria, the targeting of an oil tanker convoy reflects a sustained focus on economic warfare, aimed at disrupting regime-linked logistical and energy networks. In the Sahel, the attack on a gendarmerie headquarters confirms continued pressure on state security infrastructure and demonstrates the group’s intent to challenge authority nodes rather than only tactical units. In Mozambique and the Democratic Republic of Congo, operations remain limited in number but consistent in pattern, reinforcing localized insurgent persistence rather than expansion.

Overall, the operational picture reflects a stable attritional campaign, with no indication of systemic escalation but clear evidence of sustained capability to degrade state control in key theatres.

CONCLUSION 2 — Intelligence Evaluation and Outlook

The current reporting cycle reinforces the assessment that the Islamic State remains in a consolidation phase, prioritizing resilience, continuity, and incremental pressure over high-risk escalation. The distribution of 23 operations with relatively low reported lethality suggests a return to standard operational rhythm, characterized by dispersed attacks and controlled exposure.

West Africa continues to function as the strategic center of gravity, supported by resilient logistics, recruitment pipelines, and permissive terrain. The absence of complex or mass-casualty attacks indicates a deliberate avoidance of actions that would trigger concentrated counterterrorism responses, favoring a long-term erosion strategy instead.

Secondary theatres, including Syria, the Sahel, Central Africa, and Mozambique, display stable but limited activity, consistent with decentralized operational autonomy. The attack on economic assets in Syria and institutional targets in Niger indicates that the group retains the capability to target strategic nodes when conditions permit, selectively.

No evidence of doctrinal innovation, external operations planning, or coordinated multi-theatre escalation emerges. The organization’s posture remains defensive in strategic terms, but tactically active and locally disruptive.

Short-term outlook, 30 to 90 days, points toward continued attritional pressure in West Africa, with intermittent tactical spikes in the Sahel and Syria. The risk environment remains stable but structurally persistent, with volatility driven by local conditions rather than central strategic shifts.

Implications for Policy and Counterterrorism

Operational pressure should remain concentrated on West Africa, where the scale and frequency of attacks indicate the highest risk to regional stability. Priority should be given to disrupting ISWAP’s mobility corridors, logistics chains, and cross-border facilitation networks, particularly along the Nigeria-Niger-Cameroon interface.

Force protection measures require immediate reinforcement, especially for fixed positions, patrol routes, and convoy movements. Recurrent targeting patterns indicate exploitable vulnerabilities in perimeter defense, route predictability, and checkpoint resilience.

In the Sahel, targeted operations against institutional nodes such as the gendarmerie and administrative centers highlight the need to secure governance infrastructure, not just military assets. Coordination among regional forces remains insufficient and continues to present exploitable gaps.

In Syria, protection of economic infrastructure, including energy transport and supply routes, should be prioritized, as these assets remain attractive targets within the Islamic State’s economic warfare framework.

Civilian protection remains critical in Central Africa and Mozambique, where attacks against local militias and communities serve both operational and psychological functions. Strengthening local intelligence networks and early warning mechanisms is essential to mitigate coercive control dynamics.

Across all theatres, intelligence fusion, ISR coverage, and rapid response capabilities remain decisive factors in countering dispersed insurgent operations.

Tripwires — Assessment-Changing Indicators (Next 30–60 Days)

1. A shift from dispersed attacks to coordinated multi-target operations within a single theatre, particularly in West Africa, indicates increased command synchronization.

2. A significant increase in attack complexity, including SVBIED use, coordinated assaults on fortified bases, or mass-casualty urban operations, signaling elevated risk acceptance.

3. Expansion of operational activity into new geographic areas or sustained reactivation of dormant theatres, particularly outside Africa.

4. Repeated targeting of high-value economic infrastructure in Syria or elsewhere suggests a broader economic warfare campaign.

5. Increased frequency of cross-border operations between Nigeria, Niger, and Cameroon, indicating enhanced regional operational integration.

6. Evidence of external operations planning, including targeting of international interests or Western-linked assets.

7. A sustained rise in lethality levels over consecutive weeks indicates a transition from attritional pressure to escalation dynamics.

8. Indicators of strengthened alliances or operational coordination with other jihadist actors, particularly in the Sahel, could alter the current competitive landscape.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90 day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specializing in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The 25 April 2026 Jamaʿat Nuṣrat al-Islām wa-l Muslimīn (JNIM) and Azawad Liberation Front (FLA) coordinated offensive marks a significant escalation, raising serious regional security concerns that require urgent attention from stakeholders.

The most significant development is the declared convergence of JNIM and FLA, which underscores their tactical alliance driven by shared opposition to the Malian junta and encourages stakeholders to remain alert to the threat’s evolving and unpredictable nature.

The offensive directly challenges the Malian junta’s narrative, especially with strikes near Bamako and Kati, underscoring the need for heightened vigilance and proactive measures at these critical locations to reinforce regime resilience.

JNIM’s message to Russian forces is strategically important. The statement does not simply frame Russian personnel as battlefield targets. It seeks to separate Russian actors from the Malian state by signaling that future relations may be possible if Russia ceases to support Bamako. This is coercive signaling, not moderation. JNIM is attempting to impose costs on Africa Corps and personnel aligned with Russia while offering them an exit narrative. The objective is to weaken the perceived reliability of external protection for the junta.

The attack should be treated as a strategic warning for the wider Sahel, highlighting the regional security implications and the critical need for coordinated countermeasures among stakeholders to maintain stability.

What Happened, 25 April 2026

On 25 April 2026, a coordinated multi-location offensive attributed to Jama’at Nusrat al Islam wal Muslimin, in declared coordination with the Front de Libération de l’Azawad, targeted military and strategic nodes across Mali. The operational pattern indicates a deliberate attempt to generate simultaneous pressure across the capital area, central regions, and northern theatres, combining symbolic, military, and infrastructural targeting.

In the capital area, armed activity was reported in Bamako with a concentration around sensitive military and security installations. In parallel, Kati, which hosts one of the country’s most critical military complexes and is directly associated with regime protection, was targeted through armed incursions and indirect fire activity. Kati’s choice reflects an intent to challenge the core of the junta’s command-and-control architecture rather than peripheral military assets.

In central Mali, attacks were reported in Sévaré and Mopti, areas that function as logistical and operational gateways between the southern political core and the contested northern and central belts. Engagements in these zones indicate an effort to disrupt military movement corridors, degrade operational continuity, and demonstrate the ability to interfere with internal lines of communication.

In the northern theatres, activity was reported in Gao and Kidal. These areas remain central to the question of Azawad and to the presence of both state and non-state armed actors. Claims of expanded control or territorial penetration were circulated, although full verification remains incomplete. The inclusion of northern targets alongside capital adjacent strikes suggests a synchronized operational design rather than independent local actions.

Aviation-related infrastructure was also reportedly targeted, including areas linked to airport operations. Even limited disruption in this domain carries disproportionate strategic impact, as it signals vulnerability in mobility, logistics, and external support pathways.

The overall attack pattern reflects multi-axis execution, temporal coordination, and diversified target selection. The operation did not aim at immediate territorial seizure at the national level, but rather to demonstrate reach, resilience, and the ability to impose simultaneous security stress across geographically distant nodes.

Following the attacks, the Malian authorities reported that several assaults were contained and that key positions remained under state control. Casualty figures and damage assessments remain incomplete and subject to verification constraints. JNIM’s claim of responsibility explicitly referenced coordination with the FLA, framing the operation as a joint effort against the Malian state and its external partners.

Information flows following the event show rapid dissemination of claims, imagery, and narrative framing designed to emphasize simultaneity, geographic breadth, and proximity to the capital. This indicates that the operational phase was tightly coupled with an immediate cognitive-exploitation phase, aimed at amplifying perceptions of state vulnerability and insurgent capabilities.

Taken together, the events of 25 April should be assessed as a coordinated disruption operation with national scope, designed to challenge regime security, test response capacity, and signal a new level of alignment among anti-state armed actors.

Operational Assessment

The 25 April offensive reflects a coordinated multi-axis operation with characteristics that exceed routine insurgent activity in Mali. The pattern indicates deliberate synchronization across geographically distant theatres, suggesting centralized planning with decentralized execution. The ability to generate near-simultaneous pressure in the capital area, central regions, and northern zones implies a functioning command architecture capable of tasking multiple operational cells while maintaining timing discipline.

Coordination appears to have been achieved through pre-planned attack windows rather than real-time battlefield control. This reduces vulnerability to interception and allows dispersed units to act within defined temporal parameters. The level of synchronization observed indicates prior reconnaissance, pre-positioning of personnel and materiel, and established communication channels, likely combining human couriers, low-signature digital tools, and local relay nodes. The operation does not require a rigid hierarchical command structure, but it does require a coherent operational concept and shared intent across units.

National reach is the central operational message. The offensive demonstrates that JNIM and aligned elements can operate across the full depth of the Malian theatre, from capital proximity zones to northern strongholds. This reach is not only geographic but also functional. The attackers targeted military installations, transport and logistics nodes, and aviation-related infrastructure, indicating awareness of system vulnerabilities rather than opportunistic targeting. The dispersion of attacks forces the state to stretch limited response assets, reduces the effectiveness of force concentration, and exposes gaps in rapid reaction capability.

Target selection reflects a layered logic. First, regime security nodes, particularly in the Bamako and Kati area, were chosen for their symbolic and operational value. Second, central transit hubs such as Sévaré and Mopti were targeted to disrupt internal lines of communication and operational mobility. Third, northern theatres, including Gao and Kidal, were activated to maintain pressure in long-contested zones and to align with separatist dynamics. Fourth, aviation-related infrastructure was included to signal vulnerabilities in strategic mobility and external support channels. This combination indicates a campaign designed to stress the system at multiple levels rather than achieve a single decisive tactical outcome.

Command and control is assessed as a hybrid. Strategic intent and operational design are likely set at a higher leadership level within JNIM, with local commanders retaining autonomy in execution. The integration of FLA elements suggests coordination mechanisms that allow parallel chains of command to operate under a shared operational framework. This does not imply a unified command but rather synchronized intent, facilitated by prior liaison, agreed-upon objectives, and deconfliction measures. Such arrangements are more resilient than formal integration, as they reduce friction and preserve each actor’s internal cohesion.

Timing is a critical indicator of planning maturity. The clustering of attacks within a compressed time window maximizes the shock effect and complicates state response. It also amplifies psychological impact by creating the perception of ubiquity and control. The choice of timing likely took into account routine patterns of military activity, guard rotations, and urban rhythms, indicating the presence of local intelligence support. The absence of immediate, large-scale territorial follow-up suggests that the primary objective was to demonstrate capability and system disruption rather than territorial consolidation at this stage.

Overall, the operation demonstrates an evolution toward coordinated disruption warfare. It combines distributed execution, selective targeting of critical nodes, and temporal synchronization to impose cumulative pressure on a state with limited adaptive capacity. The model is scalable and repeatable, particularly if supported by local networks and tactical partnerships.

Strategic Significance of the JNIM–FLA Convergence

The declared coordination between JNIM and the FLA constitutes the most consequential element of the 25 April offensive. It reflects a pragmatic alignment between actors with divergent ideological foundations but convergent operational interests. This is a tactical alliance, not an ideological merger. The absence of doctrinal integration is precisely what makes it operationally viable, as it allows both actors to cooperate selectively without incurring internal fragmentation or loss of legitimacy within their respective constituencies.

For JNIM, the convergence provides expanded access to northern terrain, local intelligence networks, mobility corridors, and community interfaces that are not uniformly available to jihadist structures alone. Tuareg-led networks maintain an embedded presence across key areas of the Azawad space, including zones where state control is limited and local legitimacy is fragmented. This creates opportunities for JNIM to extend its operational depth, reduce friction in movement and staging, and enhance situational awareness across northern and central theatres.

For the FLA, coordination with JNIM offers immediate military amplification. It provides access to experienced combat units, asymmetric warfare capabilities, and a broader operational network that can sustain pressure on Malian forces beyond localized engagements. The FLA gains the ability to participate in multi-theatre operations that would be difficult to execute independently, while maintaining its political positioning as a non-jihadist separatist actor.

The convergence is driven by overlapping short-term objectives, namely opposition to the Malian junta, rejection of the current security order, and resistance to Russian-backed military operations. These shared objectives create a functional space for cooperation without requiring alignment on long-term political end states. JNIM pursues an Islamist governance project, while the FLA is rooted in territorial and identity-based claims linked to Azawad. The divergence remains structural and unresolved, reducing the likelihood of full integration but not limiting the effectiveness of coordinated action.

Operationally, this alignment enables a division of labor. JNIM elements can focus on high-impact asymmetric attacks, complex assaults, and coordinated disruption. At the same time, FLA components can facilitate access, provide local intelligence, secure movement routes, and support operations in areas where they retain influence. This distributed model increases resilience and complicates counterinsurgency responses by blurring the distinction between jihadist and non-jihadist actors on the ground.

The convergence also has a significant political and cognitive dimension. It signals to local populations that resistance to Bamako is not confined to a single ideological current but can take multiple forms capable of cooperation. This may reduce barriers to collaboration at the local level, increase passive support networks, and weaken the state’s ability to isolate jihadist actors from other opposition groups.

At the strategic level, the alignment challenges the assumption that counterinsurgency efforts can compartmentalize threats along ideological lines. A security approach that treats jihadist groups and separatist movements as distinct and non-interacting risks underestimates the potential for tactical convergence. The current development suggests that under sufficient pressure, actors with divergent end states can coordinate effectively against a common adversary.

The durability of this convergence remains uncertain. It is likely to remain conditional, episodic, and geographically variable. Friction points include competition for influence, divergent governance models, and differing external relationships. However, even a temporary or localized alignment is sufficient to generate disproportionate operational effects, particularly when combined with synchronized attacks across multiple theatres.

In practical terms, the JNIM-FLA convergence represents a shift toward a more complex conflict ecosystem in Mali. It increases the adaptive capacity of anti-state actors, expands the battlespace, and reduces the effectiveness of strategies that rely on adversaries’ fragmentation and isolation. For decision makers, this requires reassessing threat categorization, force allocation, and engagement strategies across both the northern and central regions.

Russian Factor: Africa Corps, PMC exposure, coercive signaling, future bargaining space.

The 25 April offensive places Russian personnel and assets at the center of the operational and political equation in Mali. The exposure of Africa Corps and associated private military structures is no longer an indirect consequence of support to Bamako; it is becoming an explicit feature of the conflict environment. The attack pattern and subsequent messaging indicate that Russian-aligned forces are being treated as both a military target set and a strategic variable to be manipulated.

From an operational perspective, Russian elements are vulnerable along several axes. Their deployment is concentrated around regime protection, training functions, and selected operational support roles, with limited force density across the broader territory. This creates predictable patterns of presence, movement, and dependency on fixed sites such as bases, airfields, and logistics hubs. The 25 April events demonstrate that coordinated insurgent pressure can stress these nodes indirectly by targeting the surrounding security architecture, degrading perimeter control, and complicating reinforcement timelines.

The reliance on local forces for area security increases exposure. Russian personnel depend on Malian units for outer-layer protection, intelligence collection, and terrain control. Where Malian forces are stretched or disrupted, the protective envelope around Russian assets becomes thinner. This layered dependency creates exploitable seams, particularly in central regions and in corridors linking the capital to contested zones. It also limits the ability of Russian elements to operate independently at scale without increasing their own visibility and risk profile.

The messaging directed at Russian forces reflects coercive signaling rather than purely kinetic intent. JNIM is attempting to shape Russian decision calculus by presenting a conditional threat environment. The implicit proposition is that continued support for Bamako entails increasing operational costs, while disengagement or reduced involvement could reduce direct targeting. This is not an offer of accommodation; it is an attempt to introduce uncertainty into Russian risk assessment and to weaken the perceived credibility of their security guarantee.

This signaling has a broader informational dimension. By highlighting Russia’s exposure and linking it to Mali’s inability to secure key areas, JNIM seeks to erode the narrative of effective external protection. The objective is to undermine confidence among local populations, regional observers, and potentially within the Malian security apparatus itself. If Russian presence is perceived as unable to prevent high-profile coordinated attacks, its deterrent value declines.

At the same time, the creation of a notional future bargaining space is deliberate. By avoiding absolute language and by framing Russian forces as actors that could, under certain conditions, be separated from the Malian state, JNIM preserves optionality. This does not indicate a readiness for formal negotiation, but it does signal an awareness that external actors can be influenced through calibrated pressure and selective messaging. The group is positioning itself as a rational actor capable of both escalation and conditional restraint.

For the Russian strategy, this creates a dilemma. Increasing force protection measures and expanding the operational footprint can mitigate immediate risks but also raise costs, reduce visibility, and increase the potential for confrontation. Maintaining the current posture risks a gradual erosion of deterrence and incremental exposure to coordinated attacks. A reduction in engagement would weaken support for the Malian junta and potentially alter regional perceptions of Russia as a reliable security partner.

In the near term, Russian elements are likely to prioritize base security, movement discipline, and intelligence enhancement, while avoiding large-scale independent operations that could increase exposure. However, the structural vulnerabilities linked to limited force density, reliance on host-nation forces, and contested terrain will persist. The 25 April offensive demonstrates that insurgent actors can exploit these constraints through synchronized operations targeting the system rather than isolated units.

Overall, the Russian factor is transitioning from a background enabler of state security to a contested component of the battlefield. JNIM is not only engaging Malian forces but also actively shaping the environment in which Russian actors operate, seeking to impose costs, create doubt, and expand its own strategic room for maneuver.

Implications for Bamako and the Malian Junta

The 25 April offensive exposes structural vulnerabilities in regime security and challenges the credibility of the junta’s control narrative. The ability of coordinated hostile elements to generate pressure in the capital area and around Kati indicates that protective layers around the political and military core are permeable. Even where physical control was maintained, the fact that attacks reached these zones carries a disproportionate strategic effect.

Kati is central to regime continuity. It hosts key command functions, elite units, and elements directly linked to the leadership’s security. Activity in or near Kati signals that adversaries can contest spaces assumed to be secure. This forces the junta to reallocate forces toward regime protection, reducing availability for operations in central and northern theatres. The resulting trade-off degrades offensive capacity and increases reliance on static defense.

Bamako’s vulnerability is not defined by occupation risk in the near term, but by disruption risk. The offensive demonstrates that insurgent networks can penetrate or influence capital adjacent environments, conduct attacks or support actions, and withdraw without decisive engagement. This erodes public confidence, affects elite perceptions of safety, and introduces uncertainty into routine governance and military planning cycles.

Symbolic degradation is a core outcome. The junta’s legitimacy rests in part on claims of restored sovereignty and improved security following the departure of Western forces and the integration of Russian support. Coordinated attacks across multiple regions, including proximity to the capital, undermine this narrative. The regime is compelled to emphasize tactical containment, while adversaries shape the perception of strategic initiative.

The convergence between JNIM and FLA amplifies pressure on Bamako by expanding the range of actors capable of coordinating against the state. This complicates the negotiation space and reduces the effectiveness of divide-and-contain approaches. It also increases the probability of simultaneous crises across different regions, forcing the regime into a reactive posture and limiting its ability to set operational tempo.

In the near term, the junta is likely to prioritize capital and regime security, intensify internal control measures, and rely more heavily on Russian support for force protection and targeted operations. This may stabilize key nodes, but it will not address the underlying dispersion of threat networks or the emerging pattern of coordinated disruption.

Implications for the Sahel

The offensive has direct implications for the broader Sahelian security environment, particularly within the Alliance of Sahel States framework. The demonstration of coordinated multi-theatre attacks combined with cross-actor convergence suggests a shift toward more complex threat configurations that can transcend national boundaries.

If the JNIM-FLA model proves repeatable, it introduces a template for selective cooperation between jihadist and non-jihadist actors across the region. Similar dynamics could emerge in Burkina Faso and Niger, where local grievances, armed groups, and weak state control create conditions for pragmatic alignments. This would complicate regional counterinsurgency strategies that rely on isolating jihadist actors from other opposition forces.

Spillover risk is elevated. Northern Mali remains interconnected with southern Algeria, northern Niger, and parts of Burkina Faso. Enhanced mobility and coordination in these areas can facilitate the transfer of tactics, personnel, and resources. Central Mali’s role as a corridor linking southern political centers to northern conflict zones means that disruption there has cascading effects on regional stability.

The perception of success reinforces regional jihadist momentum. Coordinated attacks with national visibility, combined with messaging that highlights state vulnerability, can serve as a model for other affiliates and aligned groups. This does not necessarily translate into immediate replication, but it contributes to a shared operational logic that emphasizes synchronization, diversified targeting, and cognitive impact.

For Alliance of Sahel States (AES) states, the event underscores limitations in current security architectures. Reliance on centralized military responses, external support, and territorial control strategies may be insufficient against distributed, adaptive, and occasionally convergent adversaries. The need for improved intelligence integration, rapid-response capabilities, and local engagement mechanisms becomes more acute.

Implications for Europe and NATO

The developments in Mali carry implications beyond the immediate theatre, particularly for European security interests and NATO strategic assessment. While the offensive does not indicate an immediate external attack trajectory, it contributes to a broader pattern of instability that can generate secondary effects relevant to Europe.

First, the consolidation of jihadist operational capacity in the Sahel increases the resilience of networks that have historically maintained links, direct or indirect, to external facilitation structures. A more stable or expanding insurgent ecosystem in Mali and neighboring states can provide space for training, resource generation, and ideological propagation, even if external operations are not the primary focus.

Second, migration and displacement dynamics are likely to be affected. Increased insecurity, disruption of local economies, and erosion of state authority can drive population movements toward coastal West Africa and, potentially, toward North Africa and Europe. These flows are complex and multi-causal, but security deterioration in the Sahel is a recognized contributing factor.

Third, the erosion of state control in Mali and potential spillover into neighboring countries affects European interests in regional stability, counterterrorism cooperation, and maritime security in the Gulf of Guinea. Inland instability can translate into pressure on coastal states that are partners in European security frameworks.

Fourth, the growing role of Russian actors in the Sahel, combined with their exposure to insurgent pressure, introduces an additional layer of strategic competition. The effectiveness or perceived failure of Russian security support influences regional alignments and can affect European influence, access, and partnerships. The current trajectory suggests a contested environment in which external actors are both participants and targets.

For NATO, the key implication lies in the need for continuous monitoring of the Sahel as a source of indirect security challenges. The combination of adaptive insurgent groups, fragile state structures, and competing external actors creates a dynamic environment with potential long-term implications for European security, even in the absence of immediate, direct threats.

Propaganda and Cognitive Warfare Assessment

The 25 April operation was designed for immediate cognitive exploitation alongside its military effects. The information phase was not sequential; it was integrated into the operational plan. The speed of claim dissemination, the framing of simultaneity across multiple locations, and the emphasis on capital proximity indicate pre-prepared messaging packages aligned with the attack timeline. The objective is to shape perception before the state can consolidate a coherent counter-narrative.

The core narrative being constructed is threefold. First, the state cannot protect the capital or its key military nodes. Second, insurgent forces can operate across the full national depth with coordination and intent. Third, external support, specifically Russian presence, does not guarantee regime security. These messages are simple, repeatable, and compatible with existing grievance frameworks, which increases their absorption across different audiences.

Audience segmentation is evident. Local populations are targeted with messages emphasizing state weakness, the selective inevitability of insurgent presence, and the costs of cooperation with authorities. Security forces are targeted indirectly through demonstrations of reach and timing, intended to induce uncertainty about force protection and response reliability. Regional observers and external actors are targeted with messaging that frames the conflict as moving toward a new balance of power, in which insurgent actors can impose national-level disruption.

The inclusion of FLA in the narrative serves an additional cognitive function. It broadens the perceived coalition against Bamako, signaling that opposition is not limited to jihadist actors. This reduces the effectiveness of state messaging that frames the conflict purely in counterterrorism terms. It also lowers psychological barriers for local actors who may reject jihadist ideology but share opposition to the central government.

Visual and textual elements associated with the claims emphasize dispersion and simultaneity rather than detailed tactical success. The focus is on where attacks occurred, not necessarily on precise outcomes. This supports a perception of ubiquity. Even where damage or control is limited, the cognitive effect is achieved by demonstrating presence and intent across multiple nodes within a compressed timeframe.

The messaging directed toward Russian forces is calibrated. It combines threat and conditional positioning, suggesting that continued involvement carries risk while disengagement could alter targeting logic. This introduces ambiguity into the operating environment of external actors and aims to influence decision-making beyond the battlefield. It also reinforces the narrative that foreign support is neither decisive nor without cost.

State counter-messaging is structurally at a disadvantage in the immediate phase. It must rely on confirmation, casualty reporting, and reassurance, which are slower processes and less adaptable to rapid narrative shifts. Even accurate statements of control can be perceived as reactive if issued after widespread insurgent claims. This creates a temporal asymmetry in which insurgent narratives dominate the initial perception window.

Over time, repeated operations of this type can accumulate into a persistent perception of state fragility, even if individual attacks are contained. The cognitive objective is not a single decisive shift, but a gradual normalization of the idea that the state cannot ensure security across its territory. This has implications for local cooperation, recruitment dynamics, and the willingness of external actors to commit resources.

The current assessment is that JNIM and aligned elements are applying a structured cognitive warfare approach, integrating operational activity with narrative shaping, audience targeting, and disciplined timing. The effectiveness of this approach does not depend on territorial gains, but on the ability to continuously influence perceptions of control, legitimacy, and inevitability.

Executive Intelligence Conclusion

The 25 April offensive marks a transition point in the Malian conflict. The significance lies not in territorial gains but in demonstrated capability, coordination, and intent. JNIM has shown that it can operate across the national depth, synchronize attacks, and align tactically with non-jihadist actors when operationally advantageous. This combination increases pressure on a state already constrained by limited resources and reliance on external support.

The convergence with FLA introduces a more complex threat environment in which ideological distinctions do not prevent operational cooperation. This reduces the effectiveness of strategies that rely on isolating jihadist actors and increases the adaptive capacity of anti-state forces.

The Russian factor is becoming increasingly central. External support is no longer a stabilizing background element, but a contested and exposed component of the battlefield. JNIM is actively shaping this dimension through both kinetic and cognitive means.

In the near to medium term, the conflict is likely to evolve toward sustained coordinated disruption rather than decisive confrontation. The Malian state will retain control of key urban centers, but will face growing difficulty in projecting authority across its territory. The balance is shifting from localized insurgency toward systemic pressure, with implications that extend beyond Mali into the wider Sahel and European strategic environment.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90 day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specializing in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Document Type: Executive Intelligence Briefing

Scope: Global Jihadist, Insurgent & Hybrid Warfare Threat Assessment

Time Horizon: Rolling Forecast (30–90 Days)

Reference Period: May- July 2026

This document is an independent analytical product intended for professional use by analysts, policy planners, security practitioners, and decision-makers.

Intended Audience & Use

This Executive Intelligence Briefing is intended for use by intelligence analysts, policy planners, military and security decision-makers, international organizations, and applied academic researchers concerned with jihadist, insurgent, and hybrid warfare threat dynamics.

The document supports strategic awareness, forward-looking risk assessment, and prioritizing monitoring over a rolling 30–90-day horizon. It is not intended to provide tactical-level tasking, real-time operational guidance, or event-specific prediction. The briefing should be used as a decision-support and situational-awareness tool, informing planning, posture adjustment, and analytical focus rather than immediate response.

📌 Inside this Executive Intelligence Briefing

This briefing includes:

• Regional Strategic Snapshots

  • Africa: ISWAP, IS-Sahel, IS-Somalia, ISM, ISCAP, JNIM, al-Shabaab, Boko Haram, Lakurawa.

  • Middle East & Asia: IS Syria/Iraq, Ajnad Beit al-Maqdis, AQAP, AQIS, ISKP, ISPP, ISEAP, TTP, Ittehad-ul-Mujahidin Pakistan, Ansar al-Furqan, People’s Fighters’ Front.

• Cognitive & Information Domain – Key Signals

  
  Propaganda trends, narrative targeting, mobilization signals, Cognitive Warfare dynamics, and Cognitive Control assessment.

• Transnational Networks & Secondary Threat Environment

  Monitoring the spread of external threats.

• Forward Threat Forecast (30–90 Days) & Escalation Triggers Matrix
  
  Baseline and alternative scenarios, early warning indicators, and escalation triggers.

• Implications & Monitoring Priorities
  
  Decision-relevant implications for intelligence, policy, military planning, and security practitioners.

• Monitoring Checklist, Executive “So What?” & Strategic Risk Hierarchy
  
  A structured checklist for the next 30–90 days and a final executive-level synthesis.

Executive Overview – Strategic Context

Entering the May–July 2026 window, the defining characteristic of the global jihadist and insurgent threat environment is not escalation, but structured persistence under constraint. Across Africa, the Middle East, South and Central Asia, and the transnational layer, armed non-state actors continue to operate within a stable yet permissive configuration that favors endurance, decentralization, and cumulative pressure over rapid transformation.

The operational system remains active across multiple theatres, yet it is not converging toward a unified strategic offensive. Instead, actors such as Islamic State affiliates, al-Qaeda networks, TTP, al-Shabaab, JNIM, and a growing set of hybrid and emerging groups are sustaining parallel campaigns shaped by local conditions, corridor dynamics, and opportunity structures. The result is a distributed threat environment where violence is continuous, geographically dispersed, and strategically calibrated.

Africa remains the global center of gravity for kinetic jihadist activity. The Sahel, Lake Chad Basin, Somalia, and eastern Democratic Republic of Congo continue to generate the highest operational volume, driven by permissive structural conditions, weak governance, and entrenched insurgent ecosystems. These theatres function as pressure generators, reinforcing the credibility of global jihadists and sustaining narrative legitimacy.

The Middle East and South Central Asia remain strategically relevant despite lower attack volume. Syria, Iraq, Afghanistan, Pakistan, and Yemen form a symbolic and operational backbone, where insurgent actors maintain survivability, exploit political fragmentation, and generate disproportionate strategic signaling relative to their kinetic output. Pakistan, in particular, represents a high-intensity insurgent system, while Syria remains a permissive transition space for residual Islamic State activity and emerging actors.

The transnational layer is increasingly relevant as a secondary threat environment, not because of large-scale operational capability, but because of its role in facilitation, inspiration, hybrid activity, and cognitive amplification. Europe, Turkey, and parts of North America are exposed to low-complexity plots, proxy operations, and hybrid influence campaigns, often characterized by attribution ambiguity and symbolic targeting.

The most significant structural evolution concerns the integration of the cognitive and operational domains. Propaganda is no longer a supporting function. It is an operational enabler, facilitating capability transfer, lowering thresholds for violence, shaping perceptions, and sustaining mobilization. The emergence of technical dissemination ecosystems, simplified operational guidance, and resilient communication infrastructures indicates a shift toward decentralized, scalable threat models.

Strategic risk is therefore not driven by singular events. It is driven by the continuous interaction between insurgent activity, cognitive mobilization, and hybrid dynamics, which together produce cumulative degradation of security, governance, and institutional legitimacy.

Key Judgments

1. The global jihadist and insurgent threat environment for May–July 2026 is characterized by operational continuity, decentralized execution, and structural resilience, rather than by coordinated escalation.

Read more

This assessment provides a structured dissection of the Inspire magazine as a multi-layered instrument operating across narrative, cognitive, and operational domains. The analysis begins with a detailed characterization of the source, positioning the document within AQAP’s broader media ecosystem and historical use of Inspire as a vehicle for external operations.

It then develops a set of Key Judgments and Key Assumptions that define the analytical baseline, followed by Key Findings that isolate the most relevant patterns emerging from the content, including narrative construction, emotional triggers, and operational enablement mechanisms.

A dedicated section examines the methodological approach, clarifying how the analysis integrates open-source intelligence, visual interpretation, and structured qualitative frameworks, including cognitive warfare and behavioral activation models. Particular attention is paid to the distinction among narrative messaging, ideological legitimization, and operational guidance.

The assessment also addresses structural limitations, including the inherent bias of jihadist propaganda and the challenges of evaluating real-world impact from primary-source material.

Finally, the document outlines intelligence gaps and provides a calibrated confidence assessment, identifying areas where further collection and analysis are required to refine threat assessment.

📌 Inside This Assessment

• Structural Decomposition of the Magazine
  Breakdown of the magazine into its core components, narrative layer, ideological layer, visual layer, and operational layer, to isolate how each element contributes to the overall mobilization architecture and enables the transition from messaging to action.

• Cognitive Warfare Architecture
  Analysis of the cognitive targeting framework, including audience segmentation, cognitive entry points, emotional activation, identity reinforcement, moral disengagement, and influence on decision-making pathways, with specific reference to the integration of real-world attack narratives and visual stimuli.

• Cognitive Control Assessment
  Evaluation of how the magazine establishes control over perception, interpretation, and moral reasoning, creating a closed cognitive environment that aligns identity, grievance, and behavioral intent within a self-reinforcing framework.

• Counter-Narrative Vulnerability Analysis
  Identification of structural weaknesses within the messaging architecture, including theological simplifications, operational overstatements, and narrative inconsistencies that can be exploited for counter-radicalization and disruption purposes.

• Operational Enablement Assessment
  Evaluation of the presence, accessibility, and usability of operational guidance, including level of complexity, required resources, preparation timelines, and replication potential across different attack modalities.

• Operationalization Bridge Analysis
  Assessment of the transition from exposure to attempted execution, including estimated timelines, likely actor profiles, operational failure points, and the gap between theoretical instructions and real-world capability.

• Strategic Intent and Operational Logic
  Assessment of the underlying strategic objectives, including saturation of security systems, imposition of costs on States, multiplication of decentralized actors, and the shift from hierarchical organization to an adaptive ecosystem.

• Attack Pathway Model
  Reconstruction of the operational sequence from initial exposure to execution, mapping the stages of cognitive activation, radicalization acceleration, planning, material acquisition, preparation, and attack implementation.

• Threat Assessment
  Evaluation of the current threat environment, including the likelihood of lone actor activation, expected attack typologies, target selection patterns, and short-term risk trajectory, supported by prioritization of immediate, probable, and high-impact risks.

• Early Warning Indicators
  Identification of observable indicators that may signal increased mobilization or operationalization, including dissemination patterns, behavioral signals, and shifts in online activity within relevant digital ecosystems.

• Detection and Disruption Windows
  Analysis of temporal phases in which intervention is most effective, from content consumption and cognitive engagement to material acquisition and pre-operational behavior, enabling targeted intelligence and law enforcement action.

• Forward Outlook 30–90 Days
  Projection of likely developments over the short term, including baseline scenario, alternative scenario, and low probability high impact contingencies based on dissemination dynamics and behavioral activation patterns.

• Implications for Decision Makers
  Assessment of operational and strategic implications for intelligence services, military actors, and policy makers, including monitoring priorities, resource allocation, integration of cognitive analysis, and early-stage prevention strategies.

Source Description and Context

Organization: Al-Qaeda in the Arabian Peninsula (AQAP)

Ecosystem: al-Qaeda

Format: Digital magazine, Inspire Guide, Open Source Cyber Jihad, The Lone Jihad Guide, Inspire Series, 16 pages.

Language: Arabic, English

Period: March 2026

Type: Official propaganda and operational guidance publication

Distribution platforms: Telegram, Signal, Chirpwire, RocketChat.

Platform Dynamics

The dissemination of Inspire content is characterized by initial release on encrypted platforms such as Telegram, Chirpwire, RocketChat, and Signal, followed by secondary distribution through smaller, closed communities. The speed of propagation is influenced by network density and the presence of dedicated dissemination nodes.

Cross-platform migration is highly probable, with content being reposted, translated, and adapted for different linguistic audiences. This increases reach and extends the material’s lifespan.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organization’s operational tempo, geographic dispersion, and signaling posture across theatres.

The weekly newsletter reached number 543 last Thursday.

Threat level: Medium–High, remains stable with episodic operational spikes, providing reassurance of no immediate escalation.

Trend: → stable with increased West Africa concentration, underscoring the ongoing need for vigilant monitoring and border security cooperation.

The forecast covers a 30- to 90-day time horizon, providing a medium-term outlook for threat assessment and resource allocation.

Confidence level: Medium

📌 Inside This Assessment

This intelligence brief provides a structured analysis of the Islamic State’s operational activity, based on al-Naba Issue No. 543, to inform decisions on threat dynamics, regional operational patterns, and strategic intent, with particular attention to West Africa, Syria, and Africa theatres.

• Examines claimed Islamic State operations by province and theatre, highlighting geographic concentration, targeting priorities, and operational tempo to guide regional focus.

• Analyses tactical patterns and methods, noting increased lethality, to motivate analysts and policymakers to maintain heightened vigilance.

• The analysis identifies specific indicators and warning signs and is essential for early warning, enabling analysts and military planners to anticipate changes in threat activity.

  This analysis provides threat assessments, intelligence evaluations, and forecasts up to 90 days in advance, giving policymakers, military officials, and analysts a comprehensive picture of the threats.

Read more

Saraya Ansar al-Sunnah has emerged since early 2025 as a low-visibility, high-impact jihadist micro-insurgency operating primarily in central Syria, with a concentration of activity in Homs and adjacent provinces. The group combines targeted sectarian violence, structured propaganda, and decentralized cellular organization to generate effects disproportionate to its size.

Recent reporting from Syrian and Arabic local sources, combined with jihadist primary propaganda, indicates a dual dynamic. On one side, the group sustains a campaign of intimidation and selective violence against Alawite communities and perceived regime affiliates. On the other, emerging intelligence, including UN-linked reporting, suggests that Saraya Ansar al-Sunnah may in some instances function as a cover or facilitating structure for operations aligned with the Islamic State, particularly in the domain of high-value targeting.

The group does not pose a conventional military threat to state survival. Its relevance lies in its capacity to exacerbate sectarian fractures, undermine post-Assad transition dynamics, and potentially act as a convergence node for more structured jihadist actors. Over the next 90 to 120 days, the most likely trajectory is continued low-intensity, high-symbolic-value violence, with a non-negligible risk of escalation in the form of targeted assassinations or attacks against religious or political figures.

Threat level: Medium
Trend: Stable with potential for selective escalation
Time horizon: 90–120 days
Confidence level: Moderate

Key Judgments

1. Saraya Ansar al-Sunnah operates as a decentralized micro-insurgency, optimized for survivability and narrative impact rather than territorial control.

2. The group’s primary operational function is sectarian destabilization, particularly targeting Alawite communities in Homs, Hama, and Latakia.

3. Propaganda is a central pillar of its strategy, used to amplify operational effects, intimidate local populations, and construct a perception of persistent presence.

4. There is no confirmed formal affiliation with the Islamic State, however multiple indicators support a growing likelihood of functional convergence, and in some cases potential use as a front or proxy structure.

5. Attribution of specific attacks remains partially uncertain due to inconsistent verification from local sources and the group’s own propaganda practices.

6. The group’s most dangerous trajectory is not military expansion but integration, partial or episodic, into broader jihadist operational frameworks.

Scope, Methodology, Source Base, Verification Limits

This assessment covers the period from early 2025 to March 2026, with a focus on developments in the last three to four months.

The analysis is based on a combination of primary and secondary sources. Primary sources include official and semi-official propaganda released by Saraya Ansar al-Sunnah through Telegram channels, including claims of responsibility, communiqués, and visual material. Secondary sources include Syrian local media, Arabic-language reporting, and open-source intelligence from regional and international outlets.

All propaganda material has been treated as a primary source reflecting the group’s intent, narrative framing, and claimed activity, but not automatically as verified evidence of operational reality.

Verification has been conducted through cross-referencing with local Syrian reporting, where available. However, significant limitations remain. In multiple cases, attacks claimed by the group could not be independently confirmed. Conversely, some incidents reported locally lack clear attribution.

There is also divergence among local sources regarding the nature of the group itself, with some describing it as an emerging jihadist formation, and others questioning its organizational coherence or suggesting possible instrumentalization.

Confidence levels in this assessment vary by section and are explicitly stated where relevant.

📌 Inside This Assessment

• Group Overview
  Profile of Saraya Ansar al-Sunnah, including its emergence, ideological framework, organizational characteristics, and operational environment, with particular focus on central Syria and Homs.

• Incident Chronology and Attribution Matrix
  Reconstruction of key incidents, distinguishing between claimed, verified, and partially corroborated attacks, with an assessment of attribution reliability.

• Operational Patterns and Areas of Activity
  Analysis of the group’s tactical behavior, geographic distribution, target selection, and operational tempo, supported by structured quantification of claimed versus verified activity.

• Propaganda, Threat Signalling, and Sectarian Incitement
  Examination of the group’s communication strategy, including its use of Telegram, narrative construction, and the role of propaganda in amplifying operational impact and shaping behavior.

• Competing Hypotheses on the Relationship with the Islamic State
  Evaluation of alternative analytical scenarios regarding the group’s relationship with Islamic State, ranging from ideological convergence to potential operational linkage or proxy function.

• Threat Assessment
  Assessment of risks posed by the group across multiple dimensions, including threat to minority communities, political transition, state stability, and external actors.

• Intelligence Assessment
  Evaluation of confidence levels across key analytical areas, identification of intelligence gaps, and assessment of the reliability of available information.

• Key Intelligence Questions
  Identification of priority intelligence requirements to guide ongoing collection and refine understanding of the group’s structure, activity, and external linkages.

• Early Warning Indicators
  Operational indicators designed to detect shifts in the group’s behavior, escalation patterns, or potential convergence with broader jihadist networks.

• Time Horizon and Key Assumptions
  Clarification of the analytical timeframe and the underlying assumptions shaping the assessment, including stability of territorial control and counterterrorism pressure.

• Forecast, 90–120 Days
  Scenario-based projection of the group’s likely evolution, including baseline, escalation, and low-probability high-impact scenarios.

• Implications for Decision-Makers
  Operationally oriented recommendations focused on intelligence collection, protective measures, and integration of propaganda monitoring into early warning systems.

• Executive Conclusion
  Strategic interpretation of the group’s significance within the evolving Syrian jihadist landscape, highlighting its role as both a localized threat and a potential indicator of broader adaptive dynamics.

• Assessment of Source Reliability
  Evaluation of the strengths and limitations of primary jihadist propaganda, Syrian local sources, and international reporting, with emphasis on the need for continuous triangulation.

Group Overview

Saraya Ansar al-Sunnah emerged publicly in early 2025 within the fragmented and volatile environment of post-Assad Syria. Its formation reflects a broader trend of radicalization among jihadist elements dissatisfied with the perceived pragmatism and political accommodation of dominant armed actors in northwestern Syria.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 8 and 15 April, providing structured situational awareness across multiple organizations and theatres.

This brief underscores the critical operational claims and targets, aiming to make analysts and policymakers recognize the ongoing threat and its relevance to their strategic priorities.

• volume and distribution of official propaganda output,

• organizational and geographic dispersion across theatres,

• This focus on operational claims in West Africa, the Middle East, and South Asia aims to highlight active threat zones requiring strategic attention and planning.

• The focus on organizational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers that comprehensive monitoring and understanding of jihadist media strategies are in place.

The purpose of this product is to support systematic monitoring, structured comparison across reporting cycles, and longitudinal trend tracking. It provides an evidentiary baseline for subsequent analytical products and deeper theatre-specific assessments.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda released by a predefined list of jihadist organizations and affiliated groups, selected for operational relevance and threat level, during the reporting period.

The focus is strictly on documentation, classification, and structured presentation of primary-source material, enabling analytical reuse and historical comparison over time.

🔹 Sources & Collection Methodology

The analysis is based exclusively on primary-source propaganda material, including official magazines, videos, photo sets, statements, claims of responsibility, and audio statements.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorized by organization, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends, helping analysts understand activity patterns without overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analyzed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Ajnad Beit al-Maqdis

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), released a 3-minute 36-second video showing a massive attack on a VDP militia base in the Yatenga province. Burkina Faso

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM) released a video lasting 1 minute and 31 seconds documenting the attack carried out by its fighters against a Nigerien army convoy in the Tillaberi region. Niger

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 18 statements and 18 photos, claiming 22 attacks.

The targets of the attacks were: the Malian Army, the Russian PMC Africa Corps, the Burkinabé Army, the VDP militia, and the Niger Army.

The areas of the attacks were :

1) Burkina Faso = 17
- Yatenga province, Sissili province, Boulgou province.

2) Mali = 2
- Sikasso region, Kidal region.

3) Niger = 3
- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 10 statements claiming responsibility for 15 attacks.

The targets of the attacks were: the Kenyan Army, the Somali pro-government militia.

The areas affected by the attacks were:

1) Somalia = 9

- Balad area, Middle Shabelle region; Qoryooley area, Barire area, Bulo Marer area Mubarak area, Lower Shabelle region; Beled Hawa area, Bardhere area, Gedo region; Gelib area, Middle Juba; Buulo Fulaay area, Dinsor area, Baidoa area, Bay region.

2) Kenya = 1
- Daisu area, Garossa County.

The new Syrian-Iraqi jihadist group, Ajnad Beit al-Maqdis, which recently pledged allegiance to al-Qaeda, has released its second video, lasting 2 minutes and 21 seconds.

The video opens with a speech by Saad bin Atif al-Awlaki, emir of AQAP. The central message is aimed at mobilizing the mujahideen in Iraq and Syria, with an explicit call for operational and religious support for the Palestinian cause.

The group declares the launch of operations against American and Israeli targets and announces that the attacks will continue.

Attacks claimed in the video:

– Syria, al-Hasaka Governorate, al-Shaddadi base, attack against US forces using Katyusha rockets.

– Syria, Palmyra area, Tadmur military airport, an attack against US forces using Grad rockets.

– Syria, Quneitra area
attack against Israeli forces using Katyusha rockets.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (542). The main infographic summarises the areas affected by military operations this week, including Nigeria, Niger, Cameroon, Syria, the Philippines, and the Democratic Republic of Congo, highlighting key operational zones.

IS claims to have conducted 23 operations in all the mentioned areas and to have caused 145 deaths and injuries.

The Amaq news agency, the official media of the Islamic State, published a lengthy statement claiming responsibility for multiple nighttime attacks carried out by militants from the West Africa Province (ISWAP) against Nigerian army camps and positions in Borno State. Nigeria

The Amaq News Agency, Islamic State official media, issued a statement claiming responsibility for an attack by its ISWAP fighters on a Nigerian army convoy in the Monguno area, in Borno State, Nigeria.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 30 statements, claiming 30 attacks.

Target: Pakistan Army, Pakistan Police, Frontier Corps,

Area:

- Khyber district, Mohmand district, Kohistan district, North Waziristan district, Bannu district, Khyber Pakhtunkhwa Province. Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and Harkat Inqilab-e-Islami Pakistan (HIIP), has released an infographic detailing the targets of operations carried out over the last 10 days (5 April – 15 April). Pakistan

As-Saif Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and Harkat Inqilab-e-Islami Pakistan (HIIP), released a 1-minute 26-second video showing a series of mortar attacks against the Pakistani army in Khyber District, Pakistan.

Mohammad Khorasani, spokesperson for Tehrik-e-Taliban Pakistan (TTP), announced in a statement that jihadist groups from the area of #Pishin pledged allegiance to Tehreek-e-Taliban Pakistan and its emir, Abu Mansoor Asim Mufti Noor Wali Mehsud Hafizullah. Pakistan

Umar Media, Tehreek-e-Taliban Pakistan (TTP) released a 3:29-minute video showing its militants ambushing a Pakistani Army convoy (Sniper and IED) in the Tank district of Khyber Pakhtunkhwa province in Pakistan.

🔹Weekly Monitoring Notes

The reporting period reflects a renewed increase in propaganda density, driven primarily by Al-Qaeda affiliates in the Sahel and by a marked intensification of output from Pakistani jihadist networks. The information environment shows a rebalancing toward operational documentation and expansion signaling, with limited but relevant ideological messaging events.

Read more

Africa remains the primary theatre for the Islamic State’s global operational activity, increasingly surpassing the Middle East in attack volume, geographic dispersion, and organisational durability. The Islamic State continues to sustain at least five active provinces on the continent, operating through a decentralised but functionally coherent architecture that enables simultaneous pressure in non-contiguous theatres without requiring a single, unified escalation campaign.

Operational activity remains concentrated in core nodes, with Nigeria and the Lake Chad Basin retaining centre-of-gravity status, followed by the Democratic Republic of the Congo as a stable high-violence theatre. Mozambique and Somalia, particularly Puntland, continue to demonstrate durable, if variable, operational capability. At the same time, Niger, Mali, Burkina Faso, and Cameroon underline the organisation’s ability to maintain peripheral pressure and exploit governance gaps, multi-actor conflict ecosystems, and porous borders. Targeting patterns remain consistent with a strategic blend of war of attrition against state security forces and pro-government militias, selective competition with rival armed actors, and high-impact violence against civilians, including Christian communities, designed to amplify fear, displacement, and political delegitimisation.

No continent-wide surge is observed as a single coordinated escalation. However, the cumulative pattern confirms an enduring structural threat characterised by resilient core theatres, adaptive local strategies, and expansion potential through episodic spikes and regional spillover, particularly across Sahelian and transborder environments.

Threat level: High
Trend: ↑ / → (stable with expansion potential)
Primary risk areas: Lake Chad Basin, Central Africa, Sahel, Somalia (Puntland), Mozambique (Cabo Delgado)
Time horizon: 3–6 months
Confidence level: Medium–High

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

Provincial Snapshots

• Islamic State West Africa Province (ISWAP)

• Islamic State Sahel Province

• Islamic State Central Africa Province (ISCAP)

• Islamic State Somalia Province

• Islamic State Mozambique Province (ISM).

Overview – Islamic State in Africa

The Islamic State (IS) maintains a structured, resilient, and adaptive presence on the African continent, despite pressure from national and international counterterrorism operations. Africa remains the Islamic State’s main global theatre of operations, both in terms of frequency of attacks and capacity for territorial expansion, recruitment, and propaganda production, underscoring the persistent threat.

In Africa, IS affiliates demonstrate high operational continuity, executing attacks with diverse tactics like assaults, ambushes, kidnappings, and terror campaigns, especially against Christian communities, in recent months.

The epicentre of this dynamic remains sub-Saharan and central-eastern Africa, with particularly worrying developments in the Democratic Republic of Congo and Mozambique, where IS affiliates have demonstrated not only a capacity for sustained violence, but also a growing level of coordination, intermittent territorial control, and integration with local criminal economies. In such contexts, violence is not episodic but part of a strategy of progressive erosion of state authority, exploiting structural fragility, socio-economic marginalisation, inter-community conflicts, and governance vacuums.

On March 20, 2025, the Islamic State officially announced the launch of a new military campaign, called “Burning Camps,” with a stated focus primarily on Africa. The areas of reference include Nigeria, Niger, Cameroon, and Mozambique. Still, the narrative and timing of the attacks suggest a broader campaign, conceived as a tool for simultaneous pressure on multiple theatres. The campaign is characterised by the systematic destruction of villages, farmland, and subsistence infrastructure to destabilise the social fabric, causing forced displacement and amplifying discontent toward central governments.

Read more

The group continues to prioritize attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signaling operations.

No structural fragmentation or operational collapse is observable. Counterterrorism pressure, including airstrikes and intelligence-led operations, has imposed costs but has not disrupted al-Shabaab’s regenerative capacity, rural embedment, or cross-border facilitation networks. This highlights the need for sustained, coordinated efforts to maintain regional stability and reinforce collective commitment.

Threat level: High
Trend: → Stable overall, with increased cross-border pressure toward Kenya
Primary risk areas: Southern and Central Somalia, cross-border counties in northeastern and coastal Kenya
Time horizon: 3–6 months
Confidence level: Medium–High

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT, including analysis of propaganda, disinformation, and group claims, is essential to understanding al-Shabaab’s influence operations and countering their narrative effectively.

Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Incomplete or delayed reporting from contested or remote areas;

• exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted in the assessment.

Overview and Security Threat Assessment

Despite ongoing counterterrorism efforts, external influences such as regional support and international engagement continue to impact al-Shabaab’s resilience, underscoring the need for comprehensive regional strategies.

Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centers. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly along strategic towns, supply corridors, and population hubs.

The operation began on 15 February 2025 with synchronized assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry maneuvers. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signaling momentum, inevitability, and state weakness.

Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance-and-coercion model, even in areas nominally held by the government. This includes:

• Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalize al-Shabaab authority and delegitimize federal institutions.

• Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.

• Systematic taxation and extortion, including the collection of zakat in government-controlled zones, underscore the group’s parallel administrative reach.

• Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.

During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.

After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran—areas where al-Shabaab retains deep logistical and social networks—the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.

Assessment: al-Shabaab actively shapes the battlespace through synchronized military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, actively shaping the battlespace and impacting regional stability. Its ability to synchronize military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. In the absence of sustained territorial control, effective local governance, and disruption to al-Shabaab’s parallel administration, the threat trajectory for 2025 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.

Al-Shabaab Activities – March 2026

In March 2026, Harakat al-Shabaab al-Mujahideen maintained an operational posture consistent with the adaptive insurgency pattern observed in previous months, combining sustained ground pressure in Somalia with a selective regional deployment capability. Activity was primarily concentrated in the southern and central regions, particularly along the Lower Shabelle, Bay, Hiraan, and Middle Shabelle axes, which continue to represent the group’s operational core for mobility, logistics, and influence over local communities.

Read more

Executive Intelligence Summary

As of March 2026, the Islamic State remains a resilient and decentralized insurgent actor operating across the Middle East and South Asia, capable of sustaining operational relevance despite a contained overall attack volume. The monthly operational picture confirms continuity rather than escalation, with activity concentrated primarily in Syria and limited but strategically meaningful incidents in Pakistan. This distribution reinforces the assessment that IS retains a multi-theatre presence while deliberately calibrating its operational tempo.

The organization continues to operate within a post-territorial insurgent model defined by decentralized cells, localized autonomy, and the selective use of violence. There is no indication of an attempt to reconstitute territorial governance or to rebuild proto-state structures. Instead, IS prioritizes survivability, targeted disruption, and the gradual erosion of state authority through low-visibility, high-impact actions. This approach reduces exposure to sustained counterterrorism pressure while preserving operational networks and maintaining future escalation potential.

Threat level: Medium
Trend: → Stable with persistent insurgent activity and potential for selective escalation
Primary risk areas: Eastern Syria, particularly Deir ez Zor and Aleppo, Balochistan and Khyber Pakhtunkhwa in Pakistan, with continued latent risk linked to ISKP dynamics in the Afghanistan-Pakistan corridor
Time horizon: 3–6 months
Confidence level: Medium–High

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

Provincial Snapshots

• Islamic State Sham;

• Islamic State of Iraq;

• Islamic State Khorasan;

• Islamic State Pakistan;

• Islamic State East Asia.

Overview

Entering 2026, the Islamic State should no longer be analyzed through the lens of territorial revival scenarios. The organization has conclusively transitioned into a post-territorial insurgent configuration that prioritizes survival, network preservation, and selective destabilization over overt expansion.

The structural features identified in 2025 remain intact. IS continues to operate as a decentralized ecosystem of locally embedded nodes, loosely connected by ideological cohesion and brand identity rather than a rigid command hierarchy. Central leadership functions primarily as a symbolic and narrative anchor, while operational initiative remains provincial and context-driven.

What January 2026 clarifies is not a transformation, but consolidation. The organization has demonstrated that it can sustain a calibrated level of violence across multiple theatres without requiring territorial control, reconstituting governance structures, or relying on large-scale operations. This model is inherently sustainable under conditions of fragmented governance, uneven security-sector capacity, and prolonged socioeconomic stress.

Strategically, Syria remains the core geographic anchor, while Afghanistan, through ISKP, and Pakistan, as a sensitive extension zone, are critical for regional stability. Emphasizing these areas directs focus to the most impactful regions.

From a strategic standpoint, the most significant conclusion entering 2026 is that IS has achieved operational equilibrium. It is not expanding, but it is not eroding, demonstrating the value of sustained, patient efforts to manage this persistent threat.

For political and military decision makers, the implication is clear. The Islamic State at the start of 2026 is not a collapsing remnant, nor an imminent territorial challenger. It is a persistent insurgent actor embedded within fragile security ecosystems. Managing this threat will require sustained intelligence integration, partner capacity development, and governance stabilization measures rather than episodic kinetic surges.

Islamic State Activities — March 2026

In March 2026, Islamic State activity across the Middle East and Asia remained consistent with the organization’s post-territorial insurgent logic, but the month also reinforced a more important strategic point. The group is not expanding in a conventional military sense, yet it continues to benefit from political fragmentation, security overstretch, and conflict spillover in key theatres. Syria remained the most important operational anchor in this regional framework. At the same time, the Afghanistan-Pakistan corridor continued to provide a volatile environment in which ISKP could preserve relevance, exploit state friction, and operate within a broader ecosystem of militant competition and cross-border escalation.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organization’s operational tempo, geographic dispersion, and signaling posture across theatres.

The weekly newsletter reached number 542 last Thursday.

Threat level: Medium–High, stable with episodic operational spikes
Trend: → stable with increased West Africa concentration
Time horizon: 30–90 days
Confidence level: Medium

📌 Inside This Assessment

This intelligence brief provides a structured analysis of the Islamic State’s operational activity, based on al-Naba Issue No. 542, to inform decisions on threat dynamics, regional operational patterns, and strategic intent, with particular attention to West Africa, Syria, and Africa theatres.

• Examines claimed Islamic State operations by province and theatre, highlighting geographic concentration, targeting priorities, and operational tempo to guide regional focus.

• Analyses tactical patterns and methods, noting increased lethality, to motivate analysts and policymakers to maintain heightened vigilance.

• This assessment highlights the targeting of economic infrastructure, underscoring the need for policymakers and analysts to stay vigilant to emerging threat vectors.

• Identifying specific indicators and tripwires is crucial for early warning, equipping analysts and military planners to anticipate shifts in threat activity.

• This assessment highlights the importance of regional cooperation and early warning indicators, inspiring policymakers and analysts to stay proactive in threat mitigation.

Key Intelligence Question (KIQ): Does the Islamic State’s current operational activity suggest a strategic shift toward escalation, or is it a deliberate phase of consolidation aimed at maintaining long-term resilience? Clarifying this informs strategic decision-making and resource allocation.

Is the Islamic State’s current operational activity indicative of a strategic shift toward escalation, or does it reflect a deliberate phase of consolidation aimed at preserving long-term operational resilience?

This assessment evaluates operational reporting, geographic dispersion, targeting patterns, and propaganda signaling to encourage proactive threat monitoring and strategic planning for analysts and policymakers.

Key Judgments

• Al-Naba continues to serve as a key indicator of Islamic State operational intent and activity, despite known exaggerations, aiding threat assessment.

• The geographic dispersion of reported attacks confirms the Islamic State’s ability to sustain multi-theatre operational pressure, underscoring the importance of ongoing vigilance for analysts and policymakers.

• No systemic innovation in tactics is evident, though limited expansion in target selection suggests selective experimentation rather than doctrinal change.

• Media output prioritizes continuity and legitimacy over signaling escalation.

• Quantitative trends remain consistent with previous weekly patterns.

Key Assumptions

• Reporting published in al-Naba remains a consistent indicator of Islamic State operational activity, despite systematic exaggeration of casualty figures and material impact.

• Weekly patterns of attack claims are assessed as reflective of near-term strategic intent rather than random or purely opportunistic fluctuations.

• The geographic dispersion of reported operations implies the continued functionality of a decentralized but coherent command-and-control structure across multiple wilayat.

• African provinces retain sufficient tactical autonomy to conduct operations independently while remaining strategically aligned with central Islamic State guidance.

• Local support networks, recruitment pipelines, and logistical facilitation in African theatres remain sufficiently intact to sustain low-intensity operations in the short to medium term.

• High-impact attacks against strategic infrastructure are assessed as opportunistic or theatre-specific rather than indicative of a coordinated escalation strategy at the global level.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 542, including photographs, statements, and alleged military activities.

The analysis integrates:

• OSINT,

• IMINT,

• SOCMINT,

• Digital HUMINT,

to contextualize reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritize event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

Issue 542, eight pages long, covers the week of 14 to 20 Shawwal 1447, from 2 to 8 April 2026.

Read more

Tehrik-i-Taliban Pakistan (TTP) remains a persistent and adaptable security threat to Pakistan, especially in Khyber Pakhtunkhwa and along the Afghan–Pakistani border areas, which should reinforce confidence in the ongoing threat evaluation.

The current threat trajectory is stable to increasing, which is critical for guiding strategic responses and resource allocation over the next 3–6 months.

Threat level: High

Trend: → / ↑ stable with escalation potential

Primary risk areas: Khyber Pakhtunkhwa, former tribal districts, Afghan-Pakistani border belt, Peshawar corridor

Time horizon: 3–6 months

Confidence level: Medium to Medium High

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest a potential for tactical escalation or diversification beyond the present operational profile, which warrants ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. However, limitations such as potential propaganda bias, disinformation, and incomplete reporting from remote areas must be considered when evaluating the reliability of intelligence, which affects the confidence level of medium to medium-high.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

Brief overview of the TTP

The Tehrik-i-Taliban Pakistan (TTP), formed in 2007 as a coalition of Pashtun militant groups, remains the main jihadist threat to the Pakistani state today. The organization, led since 2018 by Noor Wali Mehsud, has consolidated its internal structure by reabsorbing several splinter factions and strengthening its strategic communication. Its ideology is rooted in Deobandi jihadism with strong historical ties to the Afghan Taliban and Al-Qaeda. The TTP operates mainly in Khyber Pakhtunkhwa and Balochistan, but maintains selective capabilities in urban areas. The Afghan rear areas are strategically important, providing depth, training, and cross-border mobility. The group’s military campaign is now characterized by a combination of IEDs, ambushes, and complex attacks targeting police, paramilitary forces, and local administrative apparatus, with a more calibrated use of suicide operations than in the past. In 2024–2025, the TTP was consistently ranked among the most lethal groups globally, with increased operational sophistication and organizational resilience.

TTP Activities – March 2026

In March 2026, Tehrik i Taliban Pakistan, TTP, maintained a high level of operational relevance. Still, the month was defined less by a single spectacular spike than by the consolidation of a broad, persistent insurgent campaign across Pakistan’s northwestern theater. The wider security environment deteriorated during the month, with Pakistani monitoring showing a sharp increase in militant attacks nationwide compared with February, even as overall lethality declined, pointing to a wider spread of lower intensity operations rather than a complete reduction in militant capability. That pattern is important because it suggests that the TTP and associated militant actors remained able to sustain pressure across multiple districts while adjusting the intensity and form of violence to a more distributed model.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 1 and 7 April, providing structured situational awareness across multiple organizations and theatres.

This brief underscores the critical operational claims and targets, aiming to make analysts and policymakers recognize the ongoing threat and its relevance to their strategic priorities.

• volume and distribution of official propaganda output,

• organizational and geographic dispersion across theatres,

• This focus on operational claims in West Africa, the Middle East, and South Asia aims to highlight active threat zones requiring strategic attention and planning.

• The focus on organizational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers that comprehensive monitoring and understanding of jihadist media strategies are in place.

The purpose of this product is to support systematic monitoring, structured comparison across reporting cycles, and longitudinal trend tracking. It provides an evidentiary baseline for subsequent analytical products and deeper theatre-specific assessments.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda released by a predefined list of jihadist organizations and affiliated groups, selected for operational relevance and threat level, during the reporting period.

The focus is strictly on documentation, classification, and structured presentation of primary-source material, enabling analytical reuse and historical comparison over time.

🔹 Sources & Collection Methodology

The analysis is based exclusively on primary-source propaganda material, including official magazines, videos, photo sets, statements, claims of responsibility, and audio statements.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorized by organization, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.
No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends, helping analysts understand activity patterns without overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analyzed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 12 statements, 12 photos, claiming 18 attacks.

The targets of the attacks were: Malian Army, Russian PMC Africa Corps, Burkinabé Army, VDP militia, al-Qaeda militia.

The areas of the attacks were :

1) Burkina Faso = 14

- Yatenga province, Mouhoun province, Séno province, Gourma province.

2) Mali = 4

- Ségou region, Timbuktu region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 12 statements claiming responsibility for 18 attacks.

The targets of the attacks were:
the pro-government Somali militias, the Ugandan Army, the Kenyan Army, the Ethiopian Army, and the Somali Army.

The areas affected by the attacks were:

1) Somalia = 15

- Bardhere area, Gedo region; Afgoye area, Qoriyoley area, Mubarak area, Afgoye area, Wanlaweyn area, Janale area, Lower Shabelle region; Bur Acaba area, Baidoa area, Bay region; Beledweyne area, Hiiran region.

2) Kenya = 3

- Fafi area, Garissa County; El Galo area, Mandera County.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (541). Issue 541, eight pages long, covers the week of 7 to 13 Shawwal 1447, from 26 March to 1 April 2026. The main infographic summarises the areas affected by military operations this week, including Nigeria, Niger, Syria, Pakistan, and the Democratic Republic of Congo, highlighting key operational zones.

IS claims to have conducted 15 operations in all the mentioned areas and to have caused 60 deaths and injuries.

The Amaq news agency, the official media of the Islamic State, issued a lengthy statement claiming responsibility for numerous attacks carried out by ISCAP against Christian villages in the Mambasa area, in Ituri province, in the Democratic Republic of Congo.

The statement claims that ISCAP militants killed 60 Christian civilians.

3. Independent Jihadist Groups

Al-Mansur Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur (HBG) group, Lashkar-e-Islam, and Harkat Inqilab-e-Islami Pakistan (HIIP), has released a 1:45-minute video showing an attack against the Pakistani Army checkpoint in the districts of North Waziristan, in the province of Khyber Pakhtunkhwa, Pakistan.

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 9 statements, claiming 9 attacks.

Target: Pakistan Army, Frontier Corps,

Area:

- Khyber district, Kohistan district, North Waziristan district, Bannu district; Khyber Pakhtunkhwa Province. Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), published its usual infographic summarising the attacks conducted in the previous month.
In March, the TTP claimed 385 attacks.

The attacks affected 22 different Pakistani districts. Pakistan

🔹Weekly Monitoring Notes

The reporting period confirms sustained operational and media continuity across the jihadist ecosystem, with a moderate increase in activity compared to the previous week, particularly within the al-Qaeda network in the Sahel and the Horn of Africa.

Read more

A propaganda statement attributed to the Cyber Jihad Movement, disseminated on Telegram and Signal on 4 March 2026, signals the emergence of a low-capability but strategically framed digital mobilization node within the pro-al-Qaeda ecosystem. The document combines cognitive activation, opportunistic alignment with ongoing geopolitical tensions, and an explicit call for participation in cyber activities targeting state and financial entities. It does not indicate advanced cyber capabilities, but it reflects an adaptive attempt to position jihadist actors within the cyber domain as a supplementary arena of engagement. The artifact should be assessed as a positioning signal rather than a capability indicator, with relevance primarily to narrative evolution, recruitment logic, and potential convergence with broader hacktivist environments.

Assessment Focus

This assessment emphasizes the narrative construction and strategic framing of the Cyber Jihad Movement statement within the jihadist digital ecosystem, helping readers understand its positioning rather than focusing solely on operational capabilities.

📌 Inside This Assessment

1. Nature and classification of the Cyber Jihad Movement within the pro-al-Qaeda digital ecosystem

2. Analysis of narrative construction and strategic framing linked to current geopolitical tensions

3. Assessment of mobilization and recruitment logic targeting digitally capable sympathizers

4. Evaluation of the gap between declared intent and likely operational capabilities

5. Positioning of the node within the wider jihadist and hybrid cyber ecosystem

6. Implications for information environment dynamics and low-level cyber threat activity

7. Early indicators and short-term outlook for monitoring and intelligence purposes.

Source Document and Context

Organization: Cyber Jihad Movement (CJM)

Ecosystem/Alignment: al-Qaeda

Format: Statement

Language: English

Period: Ramadan 1447H (March 4, 2026)

Type: Strategic propaganda, cognitive warfare-oriented

Distribution channels: Telegram, Signal.

The analyzed document, released on 4 March 2026 during Ramadan, was disseminated through jihadist channels on Telegram and Signal, underscoring its role in strategic propaganda within the Salafi-jihadist media ecosystem.

The issuing label, Cyber Jihad Movement, does not correspond to a known centralized organization or to an officially recognized media wing of al-Qaeda. It should be assessed as a decentralized or loosely structured digital node operating within the broader pro-al-Qaeda online environment. Such entities typically function as informal aggregators of sympathizers, facilitators of content dissemination, and amplifiers of mobilization narratives, rather than as operational cyber units with structured command-and-control.

The document is written primarily in English, with religious references in Arabic, indicating an intended transnational audience. The messaging aligns with established jihadist propaganda patterns, including religious legitimization, identification of multiple adversaries, and calls for participation framed as accessible and globally relevant.

Key Judgments

1. The Cyber Jihad Movement statement represents a low-capability but deliberate attempt to position jihadist actors within the cyber domain as part of a broader hybrid engagement strategy.

2. The document reflects opportunistic strategic alignment with ongoing geopolitical tensions, particularly Iran–United States dynamics and the Afghanistan–Pakistan theatre, to increase perceived relevance and legitimacy.

3. The primary objective is mobilization rather than execution, targeting individuals with limited or moderate technical skills and lowering barriers to entry into jihadist participation through digital means.

4. There is no evidence within the material of advanced cyber capabilities or coordinated operational planning, indicating a significant gap between declared intent and realistic execution capacity.

5. The reference to potential cooperation with pro-Iranian hacker groups suggests a narrative of tactical convergence based on shared adversaries, although structural or sustained collaboration remains unlikely.

Key Assumptions

• The Cyber Jihad Movement does not constitute a structured or centralized cyber unit within the al-Qaeda ecosystem.

• The analyzed material reflects intent signaling and mobilization efforts rather than evidence of operational planning or execution capability.

• Observed behavior aligns with patterns typical of decentralized jihadist digital nodes operating with limited coordination and low technical sophistication.

Key Findings

1. The document employs a standardized propaganda architecture that combines religious invocation, global-threat framing, and a direct call to action in the cyber domain.

2. The messaging expands the concept of jihad into the digital space, presenting cyber activities as a legitimate and necessary extension of armed and informational struggle.

3. The identification of multiple state adversaries, including the United States, Israel, Pakistan, India, and Arab governments, reinforces a broad conflict narrative aimed at maximizing resonance across different audiences.

4. The explicit mention of support to Tehrik-e-Taliban Pakistan and the Islamic Emirate of Afghanistan indicates alignment with the Afghanistan–Pakistan jihadist theatre and reinforces integration within the al-Qaeda-aligned ecosystem.

5. The framing of cyber operations as capable of generating financial damage and systemic disruption reflects aspirational objectives rather than demonstrated capabilities.

6. The overall structure and language indicate an intent to attract decentralized participation, rather than to signal imminent or coordinated cyber operations.

Scope and Methodology

This assessment is based on direct analysis of primary jihadist propaganda material disseminated through Telegram and Signal channels associated with the pro-al-Qaeda digital ecosystem.

The analytical approach focuses on the exploitation of content, narrative deconstruction, and contextualization within broader jihadist communication patterns and strategic behavior.

The assessment integrates qualitative analysis of messaging, identification of the target audience, and comparison with established trends in jihadist media production and digital mobilization practices.

No reliance has been placed on secondary reporting for core analytical judgments, ensuring that conclusions are grounded in direct evaluation of sources.

Limitations

The decentralized nature of the Cyber Jihad Movement label limits the ability to attribute the material to a defined organizational structure or to assess internal command dynamics.

The absence of verifiable operational data prevents precise evaluation of technical capabilities or intent beyond the narrative level.

Propaganda material inherently reflects exaggeration, aspirational framing, and strategic signaling, which may not correspond to actual capabilities or planned activities.

Intelligence Gaps

• The actual size, composition, and geographic distribution of the network associated with the Cyber Jihad Movement remain unknown.

• There is no visibility on the presence or involvement of individuals with advanced cyber capabilities within this node.

• Potential links, formal or informal, with established hacktivist groups or pro-Iranian cyber actors cannot be verified at this stage.

• The persistence, evolution, or replication of this label across platforms and timeframes remains uncertain.

Narrative and Strategic Framing

The document adopts a structured propaganda architecture designed to maximize accessibility, legitimacy, and perceived operational relevance within the cyber domain. The messaging opens with religious invocation and symbolic references to Ramadan, establishing immediate doctrinal legitimacy and framing participation as both timely and religiously sanctioned. It then transitions into a global threat narrative, identifying a broad set of adversaries and portraying the international environment as a unified front against Islam. This framing reduces complexity and creates a binary conflict structure, enabling rapid cognitive alignment for the target audience. The final layer introduces a direct call to action, presenting cyber activity as a viable, low-risk, and impactful form of participation, effectively lowering the threshold for engagement and expanding the potential recruitment base.

The strategic dimension of the message is centered on the opportunistic exploitation of ongoing geopolitical tensions. The reference to confrontation dynamics involving the United States and Iran, alongside tensions in the Afghanistan–Pakistan theatre, functions as a narrative multiplier rather than an analytical assessment of those conflicts. The document seeks to insert the Cyber Jihad Movement into these contexts by framing cyber activity as a complementary tool to support broader anti-state efforts. This reflects a pattern of parasitic positioning, in which weak or emergent actors seek relevance by attaching themselves to higher-visibility crises without the capability to shape those dynamics directly.

Within this framework, the document advances a claim of functional utility. Cyber operations are presented as capable of generating economic disruption, targeting financial systems, and imposing indirect pressure on state structures. This claim serves a dual purpose. It legitimizes the role of digitally oriented actors within the broader jihadist ecosystem, and it reframes cyber participation as strategically meaningful rather than auxiliary. The emphasis is not on demonstrated capability but on perceived impact, which is sufficient to support mobilization and reinforce the idea of contributing to a collective effort.

The construction of a multi-front conflict narrative is a central component of the messaging. The document identifies multiple state adversaries across different regions, including Western states, regional governments, and South Asian actors, and integrates them into a single operational and ideological framework. This aggregation of targets expands the message’s relevance across geographically dispersed audiences and supports the creation of a transnational mobilization space. It also aligns with established al-Qaeda communication patterns, in which decentralization is combined with a unifying narrative of global confrontation.

Overall, the document does not introduce new ideological elements, but it adapts existing jihadist narratives to the cyber domain and current geopolitical conditions. The strategic objective is not to signal capability, but to establish presence, relevance, and potential utility within an evolving hybrid conflict environment.

Targeting Logic

The document implicitly defines a broad targeting framework focused on state institutions, financial systems, and politically symbolic entities. This targeting logic prioritizes visibility and perceived systemic impact over technical feasibility, reinforcing the narrative of cyber operations as a strategic equalizer accessible to low-capability actors.

Cognitive Control Assessment

• The target audience is composed primarily of digitally literate sympathizers, individuals within diaspora networks, and younger cohorts already exposed to pathways to online radicalization. The use of English as the main language, combined with simplified religious references, indicates a deliberate effort to reach a transnational audience with varying levels of ideological depth but sufficient digital familiarity. The absence of complex doctrinal argumentation suggests that the message is calibrated for accessibility rather than ideological consolidation.

• The main cognitive entry points are built around the concept of cyber empowerment and operational accessibility. The document frames participation in cyber activities as achievable without specialized training or physical exposure, positioning digital engagement as a low-risk alternative to traditional forms of jihad. This reduces perceived barriers to entry and aligns with behavioral patterns observed in online radical milieus, where ease of participation directly influences mobilization rates.

• Emotional activation remains controlled and functional rather than intense. The message does not rely on graphic content or high emotional triggers; instead, it emphasizes utility, contribution, and strategic relevance. This creates a rationalized form of engagement, where individuals are encouraged to act not out of immediate emotional impulse but through a perceived sense of purpose and effectiveness within a broader conflict framework.

• Identity reinforcement is constructed at a global level. The individual is positioned as part of a wider, borderless community engaged in a shared struggle against multiple adversaries. This reduces the importance of local context and strengthens alignment with a transnational jihadist identity. The framing supports decentralized participation while maintaining coherence through a unified narrative of global confrontation.

• Moral disengagement is facilitated through the exclusive focus on state actors, institutions, and economic systems as legitimate targets. By avoiding direct reference to civilian harm, the message lowers ethical resistance and reframes cyber activity as a legitimate form of conflict targeting impersonal systems. This aligns with established mechanisms of cognitive justification observed in both jihadist and hacktivist environments.

• The decision pathway is intentionally simplified. The document does not require formal affiliation, advanced skills, or structured commitment. Participation is presented as immediate, individual, and digitally mediated, allowing for rapid transition from exposure to potential action. This low-threshold model increases the probability of spontaneous or uncoordinated engagement, particularly among loosely connected individuals.

• Mobilization potential remains limited in terms of immediate operational impact but retains scalability under specific conditions. In the absence of enabling infrastructure or technical guidance, activity is likely to remain symbolic or low-level. However, the model can expand if linked to external triggers, such as major geopolitical events, viral propaganda cycles, or interaction with more capable hacktivist actors.

• Confidence Assessment
  Confidence is assessed as medium due to reliance on a single primary-source artifact, the decentralized nature of the ecosystem, and limited visibility on network depth, coordination mechanisms, and downstream behavioral outcomes.

Mobilization and Recruitment Logic

The call to action is direct, simplified, and intentionally inclusive. The message does not define specific operational tasks, but invites participation in generic cyber activities framed as impactful against state and financial systems. This ambiguity is functional; it allows for broad interpretation and lowers the cognitive and technical barriers to engagement.

The implicit target is individuals with basic digital literacy rather than specialized operators. The absence of explicit technical requirements, tools, or structured pathways indicates a mass mobilization approach rather than selective recruitment. The objective is to activate a distributed pool of sympathizers capable of contributing at different levels, including low-skill actions such as content amplification, basic intrusion attempts, or symbolic targeting.

The messaging emphasizes potential economic and systemic impacts, portraying cyber activity as capable of generating disproportionate effects relative to the effort invested. This framing reinforces perceived utility and encourages participation by linking individual action to broader strategic outcomes. The recruitment logic is therefore based on scalability, accessibility, and perceived relevance, rather than capability concentration.

Operational Reality vs Claimed Intent

There is a clear gap between declared intent and realistic operational capacity. The document projects ambitions related to economic disruption and systemic targeting, but provides no evidence of technical capability, organizational structure, or operational planning required to achieve such outcomes.

Observed patterns within similar jihadist digital nodes indicate that activities are typically limited to low-level operations, including defacement of unsecured websites, basic doxing, opportunistic exploitation of weak targets, and propaganda dissemination. There is no indication that the Cyber Jihad Movement possesses the expertise or coordination required for sustained or high-impact cyber operations.

As a result, the probability of structural or critical infrastructure impact remains low in the short to medium term. The primary effect of such initiatives is symbolic and informational, rather than operational. The messaging should therefore be interpreted as aspirational and signaling intent, not as an indicator of imminent capability.

Strategic Positioning within the Jihadist Ecosystem

The Cyber Jihad Movement should be assessed as a peripheral and non-central node within the broader pro-al-Qaeda ecosystem. It does not display characteristics of an official media wing or an integrated operational unit, and there is no evidence of formal affiliation with central command structures.

Its function appears to be supportive and complementary. It contributes to the expansion of the jihadist narrative into the digital domain, reinforces mobilization dynamics, and attempts to create additional channels of engagement for sympathizers unable or unwilling to participate in kinetic activities.

This positioning is consistent with al-Qaeda’s long-term decentralization strategy, in which loosely connected actors operate under a shared ideological framework without direct command and control. The explicit references to the Afghanistan–Pakistan theatre, including alignment with Tehrik-e-Taliban Pakistan and the Islamic Emirate of Afghanistan, further situate this node within a geographically and operationally relevant cluster of the al-Qaeda-aligned environment.

Cross-Ecosystem Dynamics

The document introduces a narrative of potential alignment with actors associated with pro-Iranian cyber activity. This reflects an opportunistic attempt to bridge traditionally distinct ecosystems by identifying shared adversaries, primarily Western states and allied governments.

Hacktivism represents the primary space of interaction. It provides a low-threshold environment in which ideological boundaries can be temporarily reduced in favor of tactical convergence. The adoption of hacktivist language and objectives indicates an effort to integrate into this broader digital confrontation space.

The presence of al-Qaeda leadership elements in Iran and the longstanding pattern of pragmatic, non-ideological arrangements with Iranian structures, including suspected links of convenience with elements of the IRGC, provide contextual grounding for this narrative. However, any form of sustained or structured cooperation remains unlikely due to enduring doctrinal divergences and strategic mistrust.

The risk of limited, opportunistic cooperation cannot be excluded. This would likely take the form of parallel or loosely coordinated actions rather than integrated operations, particularly in response to high-visibility geopolitical events.

Implications

From an informational perspective, the emergence of this type of node contributes to increased noise within the digital information environment. It amplifies propaganda output, introduces additional mobilization narratives, and supports the diffusion of low-level cyber activity across a broader audience. This can complicate attribution and increase the volume of minor incidents.

This development aligns with a broader trend within the jihadist ecosystem, in which cyber activity is increasingly normalized as an auxiliary domain, with participation-driven models replacing capability-driven approaches.

From a security perspective, the immediate technical threat remains limited. There is no indication of advanced capability or targeting of critical infrastructure. However, the emphasis on symbolic and economic targets suggests a potential increase in low-impact but visible actions, including defacement, disruption of minor services, and reputational targeting.

For decision-makers and security actors, the key development is the continued expansion of the jihadist operational concept into the digital domain. The reduction of entry barriers increases the potential for participation, while the decentralized model complicates detection and response. In the short term, the impact is likely to remain reputational and informational rather than structural.

Early Warning Indicators

1. The emergence of new Telegram or Signal channels explicitly linked to the Cyber Jihad Movement label or its variants.

2. The release of technical material, including guides, toolkits, or operational instructions related to cyber activity.

3. The appearance of coordinated or repeated cyber claims associated with the same branding across multiple platforms.

4. Observable interaction, endorsement, or content sharing between this node and known hacktivist groups or pro-Iranian cyber actors.

Short -Term Outlook 60–90 days

• The narrative is likely to persist, with continued attempts to position cyber activity as a legitimate and accessible component of jihadist engagement.

• The probability of escalation in technical capability remains low, given the absence of enabling structures and expertise.

• An increase in symbolic or low-level cyber activity is possible, particularly in response to major geopolitical developments or periods of heightened tension, where such actions can be leveraged for visibility and narrative reinforcement.

Analytical Note

This type of artifact holds limited value as a direct indicator of operational threat, but significant value as an early signal of adaptive behavior within the jihadist ecosystem. This reflects our ongoing efforts to expand engagement domains, lower participation thresholds, and align with evolving forms of hybrid conflict.

Monitoring these signals allows identification of trajectory shifts before they materialize into more structured or capable forms. The relevance is therefore longitudinal and analytical, rather than immediate and operational.

Why This Matters Now

The circulation of this material, amid current geopolitical tensions, increases the likelihood that the narrative will be amplified and exploited opportunistically. Although the operational impact remains limited, the convergence of timing, narrative framing, and accessibility reinforces the digital domain’s role as an expanding space for low-threshold engagement within the jihadist ecosystem.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90 day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specializing in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
ORCID Code: 0009-0006-5289-2874

Jama’at Nasr al-Islam wal Muslimin (JNIM) remains one of the most capable and strategically adaptive jihadist actors in the Sahel, representing a persistent and evolving threat to state authority across Mali and Burkina Faso, with sustained operational pressure extending into western Niger and early indicators of spillover toward coastal West Africa.

The group’s activity reflects a deliberate strategy of institutional attrition rather than episodic escalation. JNIM’s operations are designed to degrade state mobility, hollow out local security architectures, and impose sustained pressure on economically and politically significant corridors, particularly in Mali and Burkina Faso. The parallel expansion of operations into western Niger, alongside continued probing toward Benin and Togo, suggests a widening operational horizon aimed at stretching state response capacity and exploiting cross-border depth rather than seeking immediate territorial conquest. This underscores the need for continued regional vigilance and adaptive strategies for the audience.

At the strategic level, JNIM’s campaign remains closely aligned with al-Qaeda’s regional doctrine: prioritizing longevity, local embedding, and political relevance over symbolic mass-casualty attacks. The group’s consistent use of propaganda, local-language messaging, and rapid claim attribution further reinforces its posture as a durable insurgent actor seeking to normalize de facto authority and compel local accommodation.

The persistence and breadth of activity point to a high, structurally embedded threat environment. The trajectory is best described as gradual expansion and consolidation, not volatility-driven spikes, warranting sustained vigilance and adaptive countermeasures rather than short-term crisis responses. This emphasizes the need for the audience to remain alert and flexible in their strategic approach.

Threat level: High
Trend: → Stable at elevated intensity
Primary risk areas: Mali, Burkina Faso, western Niger; emerging pressure toward Benin and Togo
Time horizon: 3–6 months
Confidence level: Medium–High

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• OSINT, IMINT, SOCMINT, and Digital HUMINT integration.

Sources include primary JNIM media channels, open-source reporting, official statements, and local sources, ensuring a comprehensive and credible basis for analysis.

Limitations

• Incomplete or delayed reporting from conflict areas;

• exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where verification is not possible, this is explicitly noted.

Overview and Security Threat Assessment

The operating environment in Mali and across the central Sahel remains characterised by persistent governance deficits, chronic socioeconomic vulnerability, and uneven state presence. These structural conditions, long evident in northern Mali and historically exploited by autonomy-oriented and separatist movements, continue to constitute the primary enabling factors for armed mobilisation. In this context, jihadist recruitment is less a function of large-scale ideological adherence than of the ability to convert local grievance systems into mechanisms of compliance, protection, and mobilisation. Where the state is absent, predatory, or inconsistent, armed actors capable of imposing order, resolving disputes, and regulating daily life retain a decisive advantage. This dynamic, widely documented in international analytical and academic literature on Sahelian insurgencies, remains central to understanding the durability and expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM).

JNIM remains the most capable Salafi-jihadist actor in the central Sahel. Established in March 2017 through the merger of Ansar Dine, Katibat Macina, al-Mourabitoun, and AQIM’s Sahara branch, the group has evolved into a federated coalition rather than a hierarchically rigid organisation. It operates primarily in Mali, Burkina Faso, and Niger, while periodically extending operational pressure toward coastal states and peripheral borderlands. Analytically, JNIM is best understood as a hybrid insurgent structure combining guerrilla warfare, selective governance, and political signalling. Its resilience derives from a decentralised operational architecture, strong social embedding through local intermediaries, and a pragmatic strategic culture that prioritises survivability and influence over symbolic or purely spectacular violence.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organization’s operational tempo, geographic dispersion, and signaling posture across theatres.

The weekly newsletter reached number 541 last Thursday.

Threat level: Medium–High, stable with episodic operational spikes
Trend: → stable with increased West Africa concentration
Time horizon: 30–90 days
Confidence level: Medium

📌 Inside This Assessment

This intelligence brief provides a structured analysis of the Islamic State’s operational activity, based on al-Naba Issue No. 541, to inform decisions on threat dynamics, operational patterns, and strategic intent.

• Examines claimed Islamic State operations by province and theatre, highlighting geographic concentration, targeting priorities, and operational tempo to guide regional focus.

• Analyses tactical patterns and methods, including attrition-focused attacks, economic warfare activities, selective high-impact strikes, and coercive violence against civilian populations, particularly religious minorities.

• This assessment highlights the targeting of economic infrastructure, underscoring the need for policymakers and analysts to stay vigilant to emerging threat vectors.

• Identifying specific indicators and tripwires is crucial for early warning, equipping analysts and military planners to anticipate shifts in threat activity.

• Derives policy-relevant implications for counterterrorism, partner-force support, civilian protection, and early warning.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 24 and 31 March, providing structured situational awareness across multiple organizations and theatres.

This brief underscores the critical operational claims and targets, aiming to make analysts and policymakers recognize the ongoing threat and its relevance to their strategic priorities.

• volume and distribution of official propaganda output,

• organizational and geographic dispersion across theatres,

• The focus on operational claims in West Africa, the Middle East, and South Asia is designed to help analysts and policymakers stay alert to active threat zones requiring their attention and strategic planning.

• The focus on organizational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers of comprehensive monitoring and understanding of jihadist media strategies.

The purpose of this product is to support systematic monitoring, structured comparison across reporting cycles, and longitudinal trend tracking. It provides an evidentiary baseline for subsequent analytical products and deeper theatre-specific assessments.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda released by a predefined list of jihadist organizations and affiliated groups, selected for operational relevance and threat level, during the reporting period.

The focus is strictly on documentation, classification, and structured presentation of primary-source material, enabling analytical reuse and historical comparison over time.

🔹 Sources & Collection Methodology

The analysis is based exclusively on primary-source propaganda material, including:

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorized by organization, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.
No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends, aiding analysts in understanding activity patterns without overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analyzed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Tehrik-e-Taliban Pakistan

• Ittehad Mujahidin Pakistan

• JAS/Boko Haram

The conclusions are included in the Weekly Monitoring Notes.

Read more

Al-Naba Newspaper editorial no. 541 introduces a direct and time-bound call to action against synagogues and Jewish communities during Passover. The message is not descriptive but prescriptive, designed to activate individuals or micro-cells in the very short term. The call for the Bondi Beach stabbing attack December 2025 provides a replicable operational model, already validated in the jihadist narrative as an effective and low-cost action.

The picture suggests a shift from ideological propaganda to immediate opportunistic mobilization, with a high probability of attempted attacks within the April 3–9 window, without the need for central coordination.

Executive Risk Matrix

Threat type: inspired attacks, lone actor or micro-cell

Likelihood: high

Impact: medium to high

Time horizon: 0–7 days

Geographic distribution: global, concentration in Western urban contexts

Primary targets: synagogues, community centers, religious events

Confidence Level: moderate.

Key Judgments

1. High probability of low-complexity attack attempts within 7 days

2. The dominant vector is the lone actor with simple weapons, knives, vehicles, and arson

3. The narrative uses a real event to lower the threshold for action and normalize individual attacks

4. The narrow time frame indicates opportunistic intent, not a structured campaign

5. The main risk arises from the replicability and predictability of targets.

Strategic Risk Hierarchy

• Threat 1

Attack with a knife, vehicle, or firearm against entrances or traffic areas of synagogues

• Threat 2

Arson or sabotage of community infrastructure

• Threat 3

Failed attempts with strong media coverage and subsequent imitation

Threat Assessment

The threat level is high in the very short term. The operational capacity required is minimal and does not require advanced logistical support. The global distribution of targets, combined with the predictability of religious events, reduces complexity for the attacker.

The risk lies not in sophistication, but in the potential frequency and difficulty of preventing isolated actors.

Operational Indicators

1. Increase in pro-IS content that revisits and reinterprets editorial 541

2. Explicit references to Passover, religious vengeance, and the Gaza narrative

3. Sharing rudimentary instructions for improvised attacks

4. Online searches for times, locations, and access to places of worship.

Escalation Chain

• Phase 1

Editorial publication with a call to action

• Phase 2

Amplification in the pro-IS digital ecosystem

• Phase 3

Self-radicalization and identification with the message

• Phase 4

Individual mobilization and minimal planning

• Phase 5

Attack or attempted attack

• Phase 6

Media coverage and propaganda exploitation

• Phase 7

Copyright effect within 24–72 hours.

Tripwires — Assessment of Changing Indicators

1. Successful attack in Europe or North America

2. Quick claim via Amaq News Agency

3. Dissemination of detailed operational instructions on closed platforms

4. Preventive arrests directly linked to al-Naba’s call 541.

Early Warning Indicators

1. Surveillance activities near synagogues

2. Presence of isolated individuals exhibiting unusual behavior during religious events

3. Increase in localized chatter in specific countries

4. Reports of the purchase or preparation of incendiary materials.

Vulnerabilities

• Uncontrolled entrances or limited security

• Predictable routines related to prayer times

• Public events with high concentrations of people

• Low perception of threat at the local level.

Cognitive Domain Assessment

• Target audience

Inactive sympathizers, marginalized individuals, and those already exposed to jihadist propaganda

• Cognitive triggers

Religious revenge, identity defense, polarization related to the Israeli-Palestinian conflict

• Activation pathway

Emotional stimulus → ideological legitimacy → simple operational model → individual action

• Mobilization potential

High in the very short term, rapidly decaying without further stimulation

• Information effect

Maximum propaganda yield even with low-lethality attacks.

Key Intelligence Questions

Which channels are most amplifying Editorial 541?

Are there geographic clusters with a significant increase in online activity?

Are there any signs of pre-operational surveillance?

Are there known individuals showing behavioral acceleration?

Intelligence Gaps

Actual number of individuals activated or in the process of being mobilized

Level of coordination between pro-IS channels

Ability to transform the message into concrete action

Actual geographic distribution of risk.

Protective Posture Recommendations

• Visible presence of security forces at sensitive targets

• Temporary access control during religious events

• Direct coordination with community security

• Activation of rapid reporting channels

• Increased patrols in high-density urban areas

Implications for Decision-Makers

The critical window is immediate, with the initial 72 hours crucial

Visible deterrence reduces the likelihood of opportunistic attacks

The main risk remains unpredictable and decentralized

The response must be rapid, visible, and coordinated.

Forecast 0–7 Days

• Most likely scenario

Isolated or failed attempts with high media coverage

• Alternative scenario

A successful attack in a Western urban context with rapid copycat effect

• Low probability scenario

Multiple uncoordinated but temporally close events.

Confidence Assessment

High confidence on intent and timing

Moderate confidence on execution

Low confidence on scale and distribution of attacks.

Executive Intelligence Conclusion

The current threat environment is defined by a narrow and immediate activation window, driven by direct incitement from Islamic State messaging aligned with a high-visibility religious event. The risk is not rooted in organisational capability, but in the speed and accessibility of individual mobilisation.

The most credible threat scenario involves low-complexity attacks against exposed and predictable targets, particularly synagogues and community gatherings, where symbolic value and operational feasibility intersect.

Over the next 72 hours, deterrence posture and visible security measures will play a decisive role in reducing attack probability. The primary risk remains the unpredictability of self-activated individuals, operating without detectable coordination but within a clearly defined narrative and temporal framework.

Operational focus must remain on immediate protection, rapid information sharing, and early detection of behavioural anomalies. Delay in response directly increases exposure.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90 day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
ORCID Code: 0009-0006-5289-2874