The week of 2–9 June 2026 highlighted a dual-track threat environment. While jihadist organisations across Africa and South Asia maintained a steady operational tempo, a series of arrests and counterterrorism investigations in the United States, Europe and the Eastern Mediterranean underscored the continued relevance of external facilitation networks, online radicalisation and low-cost attack planning.

In the operational domain, Africa remained the principal centre of gravity for jihadist activity. Jama’at Nasr al-Islam wal Muslimin (JNIM) sustained pressure across Burkina Faso and Mali. At the same time, the Islamic State continued to prioritise African theatres through operations in Nigeria, the Democratic Republic of Congo, Mozambique, Somalia and the Sahel. Al-Shabaab maintained attacks across multiple regions of Somalia, and Pakistani jihadist actors continued to demonstrate resilience through attacks, sniper operations, IED activity and increasingly sophisticated media messaging.

At the same time, developments outside traditional conflict zones attracted growing attention. Terrorism-related arrests in the United States, Greece and. At the same time, other European jurisdictions reinforced concerns regarding decentralised support networks, online mobilisation and the potential re-emergence of externally inspired attack planning. These developments do not indicate a coordinated global campaign, but they do suggest that the boundary between local insurgencies and transnational security threats remains increasingly blurred.

The broader picture remains one of adaptation rather than escalation. Jihadist organisations continue to preserve operational relevance in their primary theatres while maintaining ideological reach far beyond the areas in which they physically operate.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line

The Shift of the Week

External Reach, Persistent Pressure

The week of 2–9 June 2026 did not produce a single defining event capable of reshaping the global threat environment. Instead, it revealed a more significant and potentially enduring development: the simultaneous persistence of insurgent pressure across established theatres and the continued emergence of external facilitation networks, attack planning and radicalisation activity far beyond active conflict zones.

This dual dynamic has become increasingly visible over the past year. On one side, jihadist organisations continue to operate within familiar battlefields such as the Sahel, Somalia, Pakistan and the Lake Chad region. On the other hand, security services across North America, Europe and the Eastern Mediterranean are confronting a growing number of cases involving online radicalisation, ideological mobilisation, logistical facilitation and suspected attack planning. These developments do not yet constitute a coordinated international campaign. However, they demonstrate that the strategic influence of jihadist movements cannot be measured solely through battlefield activity.

The arrests announced in the United States, involving individuals accused of supporting the Islamic State and discussing potential attacks against military personnel, illustrate how contemporary threat ecosystems increasingly combine virtual spaces, encrypted communications, cryptocurrency-based financing and tactical aspirations. The significance of these cases lies less in the operational sophistication of the suspects and more in their ability to connect ideological commitment with practical planning despite operating thousands of kilometres away from traditional conflict zones.

A similar pattern emerged in the Eastern Mediterranean. The arrest in Crete of a Palestinian suspect reportedly linked to Hamas-related networks highlights the continuing importance of facilitation routes, diaspora connections and transnational support structures. Whether or not individual investigations ultimately reveal operational intent, they reinforce a broader reality: the geographic boundaries separating conflict theatres from external environments are becoming increasingly porous.

At the same time, the operational core of the jihadist landscape remains firmly anchored in Africa and parts of South Asia. JNIM maintained pressure across Burkina Faso and Mali while continuing to position itself as the most resilient al-Qaeda affiliate in the Sahel. The Islamic State once again concentrated much of its messaging and operational reporting on African provinces, particularly Nigeria, Mozambique, the Democratic Republic of Congo and Somalia. Al-Shabaab sustained attacks across multiple Somali regions, while Pakistani militant actors continued to demonstrate persistence through attacks, sniper operations, IED activity and increasingly sophisticated media output.

The strategic lesson from this reporting period is therefore not one of escalation, but of convergence. Local insurgencies remain active, while external networks continue to demonstrate their ability to inspire, facilitate or potentially support activity far beyond the territories where these groups physically operate. The result is a threat environment that is increasingly interconnected, decentralised and difficult to compartmentalise.

Threat Signals

Several developments during the week reinforce the assessment that the global threat landscape is becoming more diffuse rather than more concentrated.

Read more

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• OSINT, IMINT, SOCMINT, and Digital HUMINT integration.

Sources include primary JNIM media channels, open-source reporting, official statements, and local sources, which collectively strengthen the credibility and comprehensiveness of this analysis.

Limitations

• Incomplete or delayed reporting from conflict areas;

• exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — April 2026

3. Number, Targets, and Areas of Attacks in April 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

The operating environment in Mali and across the central Sahel remains characterised by persistent governance deficits, chronic socioeconomic vulnerability, and uneven state presence. These structural conditions, long evident in northern Mali and historically exploited by autonomy-oriented and separatist movements, continue to constitute the primary enabling factors for armed mobilisation. In this context, jihadist recruitment is less a function of large-scale ideological adherence than of the ability to convert local grievance systems into mechanisms of compliance, protection, and mobilisation. Where the state is absent, predatory, or inconsistent, armed actors capable of imposing order, resolving disputes, and regulating daily life retain a decisive advantage. This dynamic, widely documented in international analytical and academic literature on Sahelian insurgencies, remains central to understanding the durability and expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM).

JNIM remains the most capable Salafi-jihadist actor in the central Sahel, though logistical and intelligence limitations constrain its operational capacity. Established in March 2017 through the merger of Ansar Dine, Katibat Macina, al-Mourabitoun, and AQIM’s Sahara branch, the group has evolved into a federated coalition rather than a rigidly hierarchical organisation. It operates primarily in Mali, Burkina Faso, and Niger, while periodically extending operational pressure toward coastal states and peripheral borderlands. Analytically, JNIM is best understood as a hybrid insurgent structure that combines guerrilla warfare, selective governance, and political signalling. Its resilience derives from a decentralised operational architecture, strong social embedding through local intermediaries, and a pragmatic strategic culture that prioritises survivability and influence over symbolic or purely spectacular violence. However, it remains vulnerable to targeted countermeasures.

Over time, JNIM has demonstrated a consistent capacity to instrumentalise local discontent, particularly among marginalised rural populations exposed to insecurity, intercommunal violence, and abuses by state or auxiliary forces. Its traction among segments of Fulani (Peul) communities in central Mali and Burkina Faso, and among Tuareg networks in the north, is better explained by political-economy and security dynamics than by doctrinal mobilisation alone. Protection arrangements, dispute resolution, retaliation logics, and access to livelihoods remain the primary vectors of recruitment and passive support. Where counterinsurgency responses rely on indiscriminate coercion, proxy militias, or collective punishment, they tend to generate strategic blowback, accelerating recruitment and deepening JNIM’s social cover.

Multiple international assessments have repeatedly underlined that the persistence of jihadist violence in the Sahel is rooted in unresolved political and governance failures rather than ideological diffusion. Operationally, JNIM has pursued a sustained and adaptive campaign targeting civilians, national security forces, foreign militaries, and, previously, UN peacekeepers. The group’s operational logic has remained broadly consistent: incrementally degrade state presence, contest transport corridors, impose costs on governance, and convert insecurity into leverage. From an intelligence perspective, two developments matter more than the absolute number of attacks. First, JNIM has demonstrated improved coordination of operations across wide geographic areas within compressed timeframes, indicating maturation in communications, command and control, and tactical mobility. Second, the group has continued to diversify its tactical repertoire, increasingly integrating drones for aerial surveillance and attack facilitation, alongside persistent use of IEDs, ambushes, targeted assassinations, and complex assaults against fixed military installations. Conflict-monitoring organisations have noted that JNIM is now among the most active non-state actors using drone-enabled tactics in the Sahelian theatre, reflecting rapid learning and diffusion within the network.

Leadership dynamics further shape JNIM’s operational behaviour across sub-theatres. While the coalition maintains strategic coherence, different operational styles remain evident. In northern Mali, leadership associated with Iyad Ag Ghali has historically prioritised calibrated violence, elite brokerage, and selective accommodation with local power brokers, including militia, political, and religious figures. In contrast, Amadou Koufa’s operational influence in central Mali and Burkina Faso has relied more heavily on community-level mobilisation and identity-linked grievance narratives, particularly among Fulani populations. These variations do not represent fragmentation but rather flexible adaptation to distinct sociopolitical environments within a common strategic framework.

The escalation cycle observed since mid-2023 reflects a convergence of internal confidence, expanded mobilisation narratives, and favourable opportunity structures. While propaganda messaging alone does not drive operational tempo, it provides insight into intent and organisational self-perception. The broader trendline, higher operational intensity, expanding geographic reach, and increasing tactical sophistication have continued into 2024 and 2025, as documented by international analytical reporting on Sahelian jihadist dynamics.

In 2025, a qualitative shift has become particularly salient: JNIM’s increasing reliance on economic warfare as a deliberate instrument of political coercion. The group has moved beyond opportunistic predation toward systematic disruption and regulation of supply chains, particularly in western Mali. Attacks against industrial facilities, infrastructure projects, and artisanal mining sites have been followed by explicit threats and subsequent action targeting fuel supplies from neighbouring coastal states. The resulting interdiction of logistics corridors, especially around Kayes and Nioro, has transformed economic disruption into a mechanism of political engineering. In a country heavily dependent on imported fuel and goods, such a disruption poses a direct challenge to the state’s functioning. The authorities’ inability to secure long, vulnerable road networks amplifies the impact of relatively small-scale attacks, producing cascading effects on transport, electricity generation, education, and urban services. In this context, JNIM positions itself not merely as a spoiler but as a regulating authority capable of permitting, denying, or conditioning access to essential flows.

As control over supply channels increases, JNIM’s governance practices become more visible and enforceable. Field reporting indicates the imposition of behavioural and social regulations in areas under its influence, including dress codes and public conduct rules, which are enforced through coercive means. These measures should be interpreted less as isolated ideological enforcement and more as signals of authority and rule-setting capacity. By normalising compliance and demonstrating the state’s inability to protect alternative norms, JNIM reinforces its claim to de facto governance.

JNIM’s continued operational effectiveness is closely tied to a tactical model optimised for the Sahelian environment. Small, highly mobile units using motorcycles and pickup trucks can rapidly mass, strike, and disperse in swarm-like manoeuvres that overwhelm static defences. These teams rely on radio and mobile communications, ground observers, and increasingly drone-based surveillance to maintain situational awareness. The attack spectrum remains broad, ranging from IEDs and ambushes against convoys to targeted killings, raids on villages associated with pro-government militias, and complex assaults on bases and checkpoints using suicide vehicle bombs, indirect fire, and direct assaults. This combination of mobility, decentralisation, and technological adaptation continues to complicate prediction and containment efforts.

Despite contradictory official narratives from affected governments, available open-source indicators suggest that JNIM’s territorial influence and operational reach continue to expand. The coalition has demonstrated a new level of confidence by conducting operations hundreds of kilometres apart and probing previously less affected areas in central and western Mali. Emerging activity along border corridors toward Niger, Benin, and Nigeria further suggests a strategy of gradual geographic expansion rather than sudden territorial conquest.

Strategically, JNIM is following a well-established insurgent trajectory: fight to gain leverage, govern to retain influence, and negotiate from a position of accumulated power. This does not imply imminent political talks, but it does indicate that the group’s centre of gravity is increasingly political rather than purely military. The most significant risk posed by JNIM today is therefore not limited to kinetic violence. Still, it lies in the progressive erosion of state authority and the normalisation of armed governance across significant portions of the Sahel.

Activity and Operations Analysis — May 2026

May 2026 should be assessed as the first full month shaped by the strategic aftershock of the late-April JNIM, FLA offensive in Mali. The operational environment did not return to a pre-April baseline. JNIM entered May with elevated confidence, greater political visibility, and a stronger perception of military momentum, especially after the coordinated attacks that exposed the limits of the Malian security apparatus and the operational constraints of Russian Africa Corps support.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 24 and 31 May, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.



No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehreek-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 10 statements and 16 photos, claiming 14 attacks.

The targets of the attacks were: Malian Army, Malian pro-Government militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Benin Army.

The areas of the attacks were :

1) Burkina Faso = 8
- Yatenga province, Sissili province, Loroum province, Mouhoun, Gourma province, Bam province.

2) Mali = 6
- Ségou region, Mopti region.

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), has released a 4-minute 42-second video entitled: “Conquests are a harbinger of victory”.

In the video, JNIM shows numerous attacks carried out by its militants, including direct assaults, IEDs, ambushes, etc., conducted in the Sevaré area, in the #Mopti region of Mali.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 9 statements claiming responsibility for 11 attacks.

The targets of the attacks were:
Somali Intelligence, Somali pro-government militia, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 11

- Bulo Merer area, Janale area, Qoryooley area, Lower Shabelle region; Beledweyne area, Hiiran region; Ba’lad area, Jowhar area, Middle Shabelle region; Baidoa area, Bay region; Bu’ale area, Mifddle Juba; Mogadiscio area.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (550). Issue 550, eight pages long, covers the week of 11 to 17 Dhu al-Hijjah 1447, from 28 May to 3 June 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Somalia, Niger, Mozambique, Iraq and the Democratic Republic of Congo.

IS claims to have conducted 39 operations in all the mentioned areas and to have caused 134 deaths and injuries. (read here).

The Amaq News Agency, the official media of the Islamic State, has released a 15-second video showing an IED attack carried out by militants in the province of Mozambique (ISM) against a Rwandan Army patrol in the district of Mocimboa da Praia, in the province of Cabo Delgado. Mozambique

The Amaq News Agency, Islamic State official media, issued a statement claiming responsibility for an attack by its ISWAP fighters on a Nigerian Army camp in the Gajigana area, in Borno State, Nigeria.

The official media outlets of the Islamic State published several photo reports documenting how its militants celebrated Eid al-Adha.

These reports come from Nigeria (ISWAP), the Democratic Republic of the Congo (ISCAP), Mali and Mozambique.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 11 statements, claiming 14 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, Orakzai district, Bannu district, South Waziristan;
Khyber Pakhtunkhwa Province.

- Diamer district, Gilgit-Baltistan province.

Pakistan

Umar Media, Tehreek-e-Taliban Pakistan (TTP), released a 4:41-minute video showing its militants carrying out attacks using snipers and IEDs against a Pakistani Army camp in the South Waziristan district of Khyber Pakhtunkhwa province in Pakistan.

🔹Weekly Monitoring Notes

The reporting period from 24 to 31 May shows a moderately active propaganda cycle, with a clear divergence between reduced Al-Qaeda-affiliate output and a significant rise in Islamic State reporting. The week is defined by three main elements: JNIM’s continued but lower-volume Sahel activity; Islamic State’s sharp increase in claimed operations through al-Naba issue 550; and persistent Pakistan-based output from IMP and TTP.

Within the Al-Qaeda ecosystem, JNIM remained active but at a lower density than the previous week. Az-Zallaqa Media issued 10 statements and 16 photos, claiming 14 attacks across Burkina Faso and Mali. The targeting profile remained consistent: Malian forces, pro-government militias, Russian Africa Corps, Burkinabé forces, VDP militias, and Beninese forces. The geographic focus remained centred on Burkina Faso, with secondary activity in Ségou and Mopti. The 4-minute 42-second video from Sévaré is the most relevant JNIM product of the week, because it consolidates different attack methods, direct assaults, IEDs and ambushes, into a single battlefield narrative designed to reinforce continuity and local pressure in central Mali.

Al-Shabaab maintained a steady claims-based cycle, with 11 claimed attacks across Somalia. The absence of Kenya-focused claims in this dataset narrows the group’s propaganda frame to the Somali theatre. Activity remained distributed across Lower Shabelle, Hiiraan, Middle Shabelle, Bay, Middle Juba, and Mogadishu. The targeting profile, Somali intelligence and pro-government militias, remained consistent with previous reporting cycles. No major strategic or leadership-level product was observed, indicating a week of routine operational communication rather than narrative expansion.

Islamic State media output increased markedly. Al-Naba issue 550 claimed 39 operations and 134 deaths and injuries across Nigeria, Somalia, Niger, Mozambique, Iraq, and the Democratic Republic of the Congo. This represents the highest volume of propaganda in the week’s dataset. IS messaging remained heavily Africa-centred, with Nigeria, Mozambique, Mali and the DRC reinforced through both operational reporting and symbolic Eid al-Adha photo material. The Amaq video from Mocímboa da Praia and the ISWAP claim from Gajigana kept Mozambique and northeastern Nigeria visible within the official media cycle. The Eid photo reports from ISWAP, ISCAP, Mali, and Mozambique added a layer of cohesion and identity to the otherwise operationally focused output.

Independent jihadist groups in Pakistan remained active but comparatively controlled. IMP released 11 statements claiming 14 attacks across Khyber Pakhtunkhwa and Gilgit-Baltistan, targeting the Pakistani Army, Police, CTD, Frontier Corps, and local peace structures. The continued inclusion of Diamer district in Gilgit-Baltistan remains relevant as a geographic extension beyond the core Khyber Pakhtunkhwa pattern. TTP contributed a 4-minute 41-second operational video showing sniper and IED attacks against a Pakistani Army camp in South Waziristan, sustaining its use of short battlefield videos to reinforce tactical capability.

Distribution patterns remained stable across established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled), with no observable shifts in dissemination channels or media architecture.

Overall, Weeks 24 to 31 May are characterised by a shift in relative propaganda weight toward Islamic State, while Al-Qaeda-affiliate output remained present but less dominant. JNIM and Al-Shabaab maintained operational continuity, IMP and TTP preserved a steady Pakistan-focused media rhythm, and Islamic State used al-Naba, Amaq, and Eid imagery to project both operational intensity and organisational cohesion across its African provinces.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

What’s changing

The role of cyber within the jihadist ecosystem is shifting. Advanced capabilities are no longer necessary to generate strategic impact. Low-complexity attacks, defacements, and claim-based campaigns are used to construct perceptions of strength, resilience, and global reach and are rapidly amplified through coordinated media output. An example emerges from a recent al-Qaeda Inspire production, which frames the cyber domain as accessible, decentralised, and replicable. The emphasis is not on technical sophistication, but on enabling individual participation through low-cost tools, lowering the barrier to entry and encouraging autonomous mobilisation. A second case involves the “Jihad Cyber Movement” and pro-IS networks that have claimed cyberattacks against Western targets and provided guidance on their execution, supported by synchronised media dissemination. In these cases, the strategic value lies in perception rather than measurable damage.

Artificial Intelligence and the Future of Cyber Jihad

Artificial intelligence is likely to become a significant force multiplier within jihadist cyber ecosystems, not by enabling sophisticated offensive cyber operations, but by lowering the barriers to participation, content production, and audience targeting. The most plausible short-term development is the integration of commercially available AI tools into propaganda, recruitment, and influence activities. Generative AI can accelerate multilingual content production, improve narrative adaptation for local audiences, automate the generation of visual propaganda, and enhance social engineering campaigns through increasingly personalised messaging. These developments may allow low-capability actors to generate disproportionate cognitive effects without acquiring advanced technical expertise. While there is currently limited evidence that jihadist organisations can employ AI for complex cyber operations against critical infrastructure, the growing accessibility of AI-enabled tools is likely to strengthen their ability to influence perceptions, amplify grievances, and sustain mobilisation efforts across digital environments.

Implications for NATO

NATO faces a dual risk. Overestimating technical capabilities may lead to inefficient resource allocation, while underestimating the cognitive dimension can obscure the actual objectives of jihadist actors. The core issue is not system penetration, but the ability to shape perceptions, polarise audiences, and activate individuals through narrative and signalling. This divergence between actual capability and perceived threat poses a concrete risk of strategic misallocation, in which resources are directed toward overstated technical risks. At the same time, the cognitive impact remains insufficiently addressed. These dynamics have direct implications for information resilience, strategic communication, and threat assessment frameworks.

Resilience and Partner-Oriented Implications

Cyber jihad directly affects societal resilience, particularly in fragile or high-exposure environments. Digital platforms are used to exploit vulnerabilities, amplify grievances, and construct alternative narratives to state legitimacy, increasing risks of radicalisation and institutional distrust.

For NATO and its partners, this requires strengthening cognitive resilience alongside technical capabilities, including support to strategic communication, digital literacy, and monitoring capacities. The decentralised nature of these activities also demands enhanced cooperation with partner states and digital platforms to identify and mitigate emerging campaigns.

Threat Matrix: Capability versus Strategic Effect

The contemporary cyber jihadist ecosystem occupies a distinct position within the broader threat landscape. Unlike state-sponsored actors or advanced cybercriminal networks, it does not derive its strategic relevance primarily from technical sophistication.

High Capability – High Strategic Effect

• State-sponsored cyber actors.

• Advanced persistent threat groups.

• National intelligence services.

High Capability – Moderate Strategic Effect

• Organised cybercriminal networks.

• Financially motivated ransomware groups.

Low Capability – High Strategic Effect

• Jihadist cyber ecosystems.

• Ideologically motivated influence networks.

• Decentralised online extremist communities.

Low Capability – Low Strategic Effect

• Isolated online activists.

• Opportunistic amateur hackers.

• Uncoordinated extremist supporters.

This distribution highlights a central analytical challenge. Strategic impact is increasingly disconnected from technical capability. Jihadist actors can generate significant psychological, informational, and societal effects despite possessing limited offensive cyber capacity, creating a persistent risk of threat misperception among policymakers and security institutions.

What to do

Effective response requires a structural reorientation of threat assessment frameworks, distinguishing clearly between technical capability and cognitive impact. NATO and partner resilience frameworks should formally integrate the cognitive domain, moving beyond infrastructure-centric models to account for perception-based threats. Monitoring of non-conventional platforms must be strengthened, and findings systematically fed into shared early-warning mechanisms. Responses should remain proportionate and developed in coordination with partner states, avoiding the strategic overreaction that low-capability actors are designed to provoke.

Early Warning Indicators

1. Increased publication of cyber-related guidance within official and semi-official jihadist media outlets.

2. Growth of dedicated cyber-focused supporter communities across encrypted and decentralised platforms.

3. Expansion of multilingual cyber propaganda targeting Western audiences.

4. Greater integration of cyber narratives into broader mobilisation and recruitment campaigns.

5. Simultaneous dissemination of cyber claims and physical attack reporting.

6. Increased use of artificial intelligence for propaganda production, translation, and audience segmentation.

7. Emergence of collaborations between cyber-oriented supporters and established media dissemination networks.

8. Growing references to critical infrastructure, digital dependence, and societal vulnerabilities within jihadist messaging.

Forecast (12–24 Months)

• Most Likely Scenario

Cyber activity will remain primarily cognitive rather than operational. Jihadist organisations will continue to employ cyber narratives as force multipliers designed to amplify perceived reach, resilience, and relevance. Artificial intelligence will increasingly support propaganda production, translation, and dissemination, enabling more sophisticated influence operations without a corresponding increase in technical cyber capabilities. The cyber domain will become increasingly integrated into broader cognitive warfare strategies targeting Western audiences and vulnerable communities.

• Moderately Likely Scenario

Supporter-driven cyber communities will expand their activities through coordinated low-level attacks, website defacements, distributed denial-of-service campaigns, and information operations. While the direct operational impact of these activities will remain limited, their psychological and media effects may be amplified through the systematic exploitation of propaganda and coordinated online dissemination.

• Low Probability, High Impact Scenario

Jihadist actors could gain access to external technical expertise through cooperation with criminal cyber ecosystems, individual facilitators, or sympathetic specialists. Such developments could enable more sophisticated operations against government networks, private-sector entities, or critical infrastructure. Although current evidence does not indicate an imminent transition toward this model, the strategic consequences would be significant and warrant continued monitoring.

Overall Assessment

The most probable evolution of cyber jihad over the next two years is not a transition toward advanced cyber warfare, but a refinement of cognitive warfare techniques operating through digital channels. The primary challenge for NATO and partner states will therefore be maintaining an accurate distinction between technical capability and cognitive impact, ensuring that threat assessments reflect the strategic objectives of these actors rather than the limited sophistication of their cyber tools.

Conclusion

Cyber jihad is consolidating as a low-cost, high-impact cognitive tool. Its strategic value lies in the ability to shape perception rather than deliver technical disruption. While limited capability development remains possible, the most likely trajectory is toward increasing narrative sophistication and signalling aimed at Western audiences. For NATO, the primary risk is not technical vulnerability but persistent misalignment in threat perception and response, allowing a low-capability actor to generate disproportionate strategic effects over time.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Tehrik-i-Taliban Pakistan (TTP) remains a persistent and adaptable security threat to Pakistan, especially in Khyber Pakhtunkhwa and along the Afghan–Pakistani border areas. Clarifying whether threat levels are high, moderate, or low will help stakeholders feel assured that their concerns are understood and prioritised, fostering confidence in the threat evaluation.

The current threat trajectory is stable to increasing, which is critical for guiding strategic responses and resource allocation over the next 3–6 months. Detailing specific indicators such as attack frequency, operational capacity, and cross-border activity will improve stakeholder confidence in the assessment and inform targeted actions.

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest the potential for tactical escalation or diversification beyond its present operational profile, warranting ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. However, limitations such as potential propaganda bias, disinformation, and incomplete reporting from remote areas must be considered when evaluating the reliability of intelligence. Clarifying how these limitations impact operational decisions will help stakeholders interpret the data appropriately and avoid misjudgments.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

📌 Inside this Assessment

1. Brief overview aof the TTP

2. Activity and Operations Analysis — May 2026

3. Number, Targets, and Areas of Attacks in May 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Brief overview of the TTP

The Tehrik-i-Taliban Pakistan (TTP), formed in 2007 as a coalition of Pashtun militant groups, remains the main jihadist threat to the Pakistani state today. The organisation, led since 2018 by Noor Wali Mehsud, has consolidated its internal structure by reabsorbing several splinter factions and strengthening its strategic communication. Its ideology is rooted in Deobandi jihadism with strong historical ties to the Afghan Taliban and Al-Qaeda. The TTP operates mainly in Khyber Pakhtunkhwa and Balochistan, but maintains selective capabilities in urban areas. The Afghan rear areas are strategically important, providing depth, training, and cross-border mobility. The group’s military campaign is now characterised by a combination of IEDs, ambushes, and complex attacks targeting police, paramilitary forces, and local administrative apparatus, with a more calibrated use of suicide operations than in the past. In 2024–2025, the TTP was consistently ranked among the most lethal groups globally, with increased operational sophistication and organisational resilience.

TTP Activities – May 2026

In May 2026, Tehrik i Taliban Pakistan remained a high-pressure insurgent actor, operating inside a security environment that again moved toward escalation after the partial reduction observed in April. The month was marked by renewed militant momentum across Pakistan, higher casualties, and intensified pressure on security forces, especially in Khyber Pakhtunkhwa. The overall pattern confirms that April’s lower visible tempo did not represent a structural weakening of the TTP but a temporary adjustment under military pressure. By May, the group and associated militant networks had again demonstrated the ability to generate operational pressure across the northwestern theatre, while keeping the Afghan border crisis active as a strategic multiplier.

Targeting and Operational Priorities

May reinforced the TTP’s core targeting logic: security forces first, local intelligence structures second, civilian effects as collateral or secondary consequences. Police, CTD, Frontier Corps, local security committees, and fixed security posts remained central to the campaign. This confirms that the group’s objective is not only to kill personnel but to degrade the mechanisms through which the Pakistani state collects intelligence, protects routes, holds contested districts, and reassures local communities.

Read more

This shift should not be interpreted as the transfer of a central headquarters or command structure. Rather, it reflects a broader transformation in how the organisation generates operational momentum, territorial expansion, propaganda output, recruitment opportunities, and long-term strategic resilience.

Throughout May, Islamic State media highlighted sustained operational activity across Nigeria, the Democratic Republic of Congo, Mozambique, and the Sahel. At the same time, al-Naba devoted unusual attention to Africa, portraying the continent not as a peripheral theatre but as a central pillar of the organisation’s future trajectory. The editorial “Africa Between Yesterday and Today” presented Africa as a successful case study in the Islamic State’s expansion and endurance, underscoring its growing significance within the movement’s strategic narrative.

Meanwhile, on-the-ground developments suggest that African provinces are no longer merely sustaining insurgencies. They are expanding geographically, increasing tactical sophistication, and demonstrating an ability to operate independently while remaining integrated into the broader Islamic State ecosystem.

The significance of this development extends beyond Africa itself. What is emerging is a decentralised jihadist model capable of surviving leadership losses, territorial setbacks, and regional counterterrorism campaigns by distributing operational capability across multiple theatres while preserving ideological coherence and strategic direction.

The Islamic State that existed in 2015 relied heavily on territorial control in Iraq and Syria. The Islamic State in 2026 increasingly relies on a network of semi-autonomous provinces that can generate local momentum while contributing to a global project.

Africa has become the most visible manifestation of this evolution.

📌 Analysis Index

1. The Big Picture: The Africanisation of the Islamic State

2. How the Islamic State Fights Today

3. Inside the System: Leadership, Control, and Cohesion

4. External Operations: The Islamic State Beyond Its Provinces

5. Why Africa Matters Now

6. What to Watch

7. Implications

The Big Picture: The Africanisation of the Islamic State

The most important development observed during May was not a single attack, leadership statement, or propaganda release. It was the cumulative picture emerging from multiple provinces operating across different regions of Africa.

Taken individually, attacks in Nigeria, Congo, Mozambique, and the Sahel appear as local insurgent activity. Taken collectively, they reveal something more significant: Africa has become the organisation’s principal arena for strategic growth.

The clearest example emerged in the Democratic Republic of Congo. Islamic State Central Africa Province (ISCAP) expanded operational activity into Haut-Uélé Province, an area not previously associated with significant Islamic State operations. Al-Naba explicitly described Haut-Uélé as a new battlefield, presenting the expansion as an important milestone for the organisation.

This development matters because it demonstrates that ISCAP is not merely preserving existing areas of influence. It is attempting to expand its operational reach into new geographic areas despite ongoing military pressure from Congolese and Ugandan security forces.

At the same time, Islamic State West Africa Province (ISWAP) maintained a sustained operational tempo across Borno, Yobe, and Adamawa States. Attacks targeted military positions, intelligence informants, local militias, and Christian communities, demonstrating the group’s continued ability to conduct multi-dimensional campaigns across a broad geographic area.

In Mozambique, Islamic State Mozambique (ISM) continued to pressure both Mozambican and Rwandan forces through ambushes, IED attacks, and harassment operations across Cabo Delgado Province. The group’s attacks remain smaller in scale than those observed during the peak insurgency period, but they continue to demonstrate resilience and operational adaptability.

The Sahel presents a slightly different dynamic. While the province receives less media attention than ISWAP, it continues to exploit instability across Mali, Niger, and Burkina Faso, operating within one of the world’s fastest-growing jihadist ecosystems.

Importantly, Islamic State central media increasingly treats these theatres as components of a single strategic narrative. Rather than highlighting Africa as a collection of disconnected insurgencies, official media presents the continent as a unified front within a broader global struggle. This represents a notable departure from the organisation’s earlier focus on Iraq and Syria. The result is a gradual but observable Africanisation of the Islamic State’s strategic identity.

How the Islamic State Fights Today

The Islamic State’s contemporary operational model differs substantially from the territorial warfare that characterised the organisation between 2014 and 2017. The organisation now relies on a hybrid insurgent approach combining guerrilla warfare, intelligence operations, psychological pressure, and selective governance activities.

Several recurring patterns appeared across May operations.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 550 last Thursday.

Trend: → stable with increased West Africa concentration, underscoring the importance of rural insurgency as a key strategic concern for the audience.
Time horizon: 30–90 days
Confidence level: Medium

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 550, including photographs, statements, and alleged military activities, providing a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 550, eight pages long, covers the week of 11 to 17 Dhu al-Hijjah 1447, from 28 May to 3 June 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

Europe is entering a renewed phase of low-threshold jihadist threat, driven less by centrally directed Islamic State attack planning and more by rapid online radicalisation, personal grievance, imitation dynamics, and lightweight operational connectivity through social media and encrypted messaging. The recent cases in Italy, Austria, Spain and Switzerland indicate a threat environment in which the distinction between propaganda consumption, ideological mobilisation, recruitment contact and attack readiness is narrowing. This is the main point: the operational cycle is becoming shorter, less visible and harder to disrupt before the final behavioural shift.

Italy is directly exposed. The recent arrests in Brianza, Bologna/Reggio Emilia and the earlier Modena case show a pattern that should not be treated as isolated. The recurring indicators are young male suspects, Moroccan or broader North African background in several cases, open support for Islamic State, online glorification of martyrdom, contact with suspected recruiters or ideological facilitators, and references to low-complexity attacks using vehicles or knives. The tactical profile is not sophisticated, but that is precisely the problem. Low-tech plots require minimal preparation, limited logistics, no formal cell structure and very short mobilisation windows.

At the European level, the same pattern is visible. Spain has reported a significant number of jihadist arrests in 2026, including multi-province networks and young suspects allegedly fascinated by mass-casualty attacks. Austria’s recent operation suggests continued pressure on Islamist communication spaces and propaganda ecosystems. Switzerland’s Winterthur stabbing shows the persistence of lone-actor or near-lone-actor violence around known radicalisation environments. The Netherlands case involving alleged ISIS propaganda on TikTok reinforces the platform shift: jihadist exposure is no longer confined to Telegram, Rocket. Chat or legacy encrypted spaces. It is increasingly blended into mainstream attention economies, especially TikTok, Instagram and short-form video ecosystems.

The threat should be assessed as tactically elevated but strategically fragmented. There is no evidence, based on the available information, of a coordinated Islamic State campaign in Europe comparable to the 2015–2017 external operations architecture. The more accurate assessment is that the Islamic State’s residual brand, global propaganda, and online supporter ecosystems are enabling dispersed mobilisation among vulnerable or ideologically receptive individuals. This creates a persistent attack surface across European urban environments, especially transport hubs, public squares, religious sites, police or military targets, Jewish and Christian targets, and crowded civilian spaces.

For Italy, the key risk is not the emergence of a large organised jihadist network in the short term. The key risk is a successful micro-attack conducted by an already visible but only partially understood radicalised subject, possibly after online encouragement, imitation of another incident, or perceived personal humiliation. The Brianza and Reggio Emilia/Bologna cases are particularly relevant because they combine propaganda, personal signalling, willingness to act and potential external encouragement. That combination is often more important than formal organisational membership.

The operational warning is clear: the European jihadist threat is shifting toward compressed radicalisation-to-action pathways. Preventive policing remains effective, but the margin for disruption is shrinking. Monitoring must therefore prioritise behavioural acceleration indicators: sudden martyrdom language, farewell-style posts, fixation on recent attacks, direct references to knives or vehicles, requests for religious justification, contact with recruiters, deletion of accounts, creation of backup channels, and public statements about “doing the right thing” or “making the country better.” These are not generic signs of radical opinion. In this context, they may indicate a shift from ideological consumption to operational intent.

📌 Inside This Assessment

• Why This Matters Now

• Italy as a Near-Term Exposure Zone

• European Pattern, Spain, Austria, Switzerland, Netherlands

• Modus Operandi, knives, vehicles, social media, Telegram, martyrdom framing

• The Online Acceleration Problem

• Forecast 30–60 Days

• Indicators to Watch

• Policy and Security Implications

• Final Analytical Line.

Why This Matters Now

This matters now because the current threat picture is moving faster than the traditional counter-terrorism categories used to describe it. The recent cases in Italy and Europe do not point to a single coordinated campaign. Still, they do show a convergence of risk factors that, taken together, increase the probability of a successful low-tech attack. The pattern is not spectacular operational sophistication. It is repetition, speed, imitation and low entry cost.

The first factor is the compression of the radicalisation-to-action cycle. In several recent cases, suspects were young, highly active online, exposed to Islamic State material, and moved quickly from ideological signalling to apparent operational intent. This is a different threat environment from the foreign fighter mobilisation phase of 2013–2017, when travel to Syria or Iraq often created a more visible logistical footprint. Today, the operational pathway can remain domestic, digital and fragmented. A subject can consume propaganda, declare allegiance, interact with recruiters or sympathisers, select a low-tech method and signal intent within days or weeks. That reduces the window available to intelligence and law-enforcement agencies.

The second factor is the normalisation of low-threshold attack methods. Knives, vehicles and improvised targeting do not require training camps, weapons procurement networks or cross-border facilitation. This makes the threat less dependent on formal Islamic State command structures. A failed or partially disrupted plot can still inspire another individual elsewhere. The operational ecosystem becomes cumulative: every arrest, attack, video, martyrdom post, or media report can serve as raw material for imitation. This is especially relevant for Italy after the Modena, Brianza, and Reggio Emilia/Bologna cases, because the domestic environment now includes recent reference points that online supporters can reinterpret as proof of momentum.

The third factor is the platform shift. Jihadist mobilisation is no longer confined to Telegram channels, password-protected forums or closed encrypted groups. Those spaces remain important, but the early-stage radicalisation layer increasingly interacts with mainstream platforms, especially TikTok, Instagram and short-form video ecosystems. This matters because mainstream platforms reward emotional intensity, repetition, identity performance and visual simplification. A user does not need to enter a jihadist archive to encounter grievance narratives, martyrdom aesthetics, anti-Western messaging or glorified violence. The pathway can begin in semi-open content environments and then move toward private chats, encrypted channels, or direct contact with recruiters.

The fourth factor is the age profile. The repeated presence of teenagers and men in their early twenties is operationally significant. Younger suspects can be more vulnerable to identity fusion, status-seeking, grievance amplification and performative radicalisation. They also tend to live in high-visibility digital environments, where ideological commitment is often expressed through posts, stories, reposts, memes, captions and short videos. This creates more open-source warning signals, but also more noise. The analytical challenge is distinguishing provocation, fantasy and ideological theatre from actual attack trajectory. The cases now emerging suggest that some of these signals are not empty performance. In specific contexts, they can be pre-operational leakage.

The fifth factor is the weakening of the boundary between the lone actor and the networked actor. Many suspects appear operationally isolated, but ideologically and psychologically connected. They may not belong to a structured cell, yet they can receive encouragement, validation, tactical suggestions or symbolic framing from online contacts. This creates a grey zone between autonomous radicalisation and remote facilitation. From a threat assessment perspective, this grey zone is more important than the label. A subject who receives encouragement from a recruiter, discusses target-country options, requests financial support, or records a pledge-style video is no longer simply an isolated consumer of propaganda. He has entered a more dangerous stage of mobilisation, even if no formal command-and-control relationship exists.

For Italy, the timing is particularly relevant because recent incidents show three concurrent vulnerabilities.

First, there is a domestic pool of young radicalised individuals already visible to law enforcement. Second, there are online pathways linking Italian-based suspects to broader Islamic State supporter ecosystems. Third, there is an emerging environment of imitation, in which one case can provide narrative fuel for another. Italy remains less exposed than France, Germany, Belgium or the United Kingdom in terms of historical jihadist attack volume, but lower historical exposure should not be misread as structural immunity. The current threat is not built around large cells requiring deep local infrastructure. It is built around small, fast, low-cost mobilisation.

At the European level, the issue is broader than Italy. Spain’s recent arrests indicate persistent jihadist activity across multiple provinces. Austria’s operation points to active Islamist communication spaces and networks for the dissemination of propaganda. Switzerland’s Winterthur attack demonstrates that known radicalisation milieus can still generate violence after years of monitoring pressure. The Netherlands case involving TikTok propaganda shows the relevance of mainstream digital platforms in supporter mobilisation. These are not identical cases, but they belong to the same threat environment. The common denominator is not organisational uniformity. It is decentralised jihadist activation under the residual Islamic State brand.

The strategic implication is that the Islamic State does not need to rebuild its former external operations architecture to pose a risk in Europe. It only needs to keep its brand alive, maintain a basic propaganda tempo, circulate examples of individual action, and preserve enough online connectivity among supporters to validate would-be attackers. That is a lower requirement than command-directed terrorism. It is also harder to eliminate. Even when the organisation is degraded territorially, its symbolic utility remains operationally relevant.

This matters for security policy because prevention cannot rely only on detecting weapons acquisition, travel plans or structured cells. The warning indicators are now more behavioural and digital: abrupt escalation in language, martyrdom framing, fascination with previous attacks, direct or indirect pledge-making, search for religious justification, operational fantasies involving knives or vehicles, contact with external facilitators, and public statements that resemble farewell messaging. The problem is that many of these indicators appear in open digital environments before becoming actionable for criminal purposes. This creates a narrow space between early warning and legal intervention.

The near-term risk is therefore not a mass-casualty campaign, but a sequence of attempted or disrupted low-tech plots, with a persistent probability of one successful attack. The most likely targets are soft, symbolic and accessible: transport nodes, streets around nightlife areas, police or military personnel, churches, synagogues, Christian or Jewish community sites, public events and crowded civilian spaces. The highest-risk profile is a young male already consuming jihadist content, socially unstable or personally frustrated, digitally expressive, attracted to martyrdom status, and connected either directly or indirectly to online Islamic State sympathisers.

The core assessment is straightforward: Europe is not facing a return to the 2015 model. It is facing a more diffuse, faster and less structured jihadist risk environment. That makes the threat less strategically spectacular but more operationally persistent. For Italy, the question is no longer whether the threat exists. It does. The question is whether the next case is disrupted before the final move from signalling to action.

Italy as a Near-Term Exposure Zone

Italy should be treated as a near-term exposure zone for low-complexity jihadist violence. Not because there is evidence of a mature Islamic State operational network on Italian territory, but because the recent cases show a concentration of warning indicators that are difficult to dismiss: young suspects, open pro-ISIS signalling, online propaganda activity, contact with suspected facilitators, references to knives or vehicles, and a visible move from ideological expression toward possible operational availability.

The central risk is not a large cell. The central risk is the individual or micro-cluster that moves quickly from online radicalisation to action, with limited preparation and limited need for external support. This is exactly the type of threat that can survive even when formal jihadist networks are degraded. Italy’s exposure is therefore tactical, urban and time-sensitive.

The recent Italian cases suggest three layers of risk.

The first layer is domestic radicalisation. The Brianza case shows the relevance of open-platform propaganda, especially Instagram and TikTok, where pro-ISIS narratives, martyrdom glorification and hostility toward Christians and the West can circulate in simplified, emotionally charged formats. These platforms are not only dissemination tools. They are identity environments. A young radicalised subject can use them to signal belonging, test reactions, escalate rhetoric, and construct a public self-image as a future actor. When this is combined with references to recent attacks or statements resembling pre-attack justification, the risk profile changes.

The second layer is remote facilitation. The Reggio Emilia/Bologna case is more concerning because it reportedly includes communication with a suspected ISIS-linked recruiter or intermediary through messaging applications. This does not automatically prove command direction, but it does indicate movement beyond passive consumption of propaganda. Once a subject discusses possible action, receives encouragement, considers target geography, requests or expects support, or records a pledge-style video, the case enters a higher-risk category. The operational significance is not the sophistication of the plot. It is the transition from ideological sympathy to availability for violence.

The third layer is imitation. The Modena vehicle attack, regardless of the final judicial classification and operational depth, has already become part of the domestic reference environment. When a later suspect celebrates or invokes a recent local incident, the incident acquires secondary operational value. It becomes an example, a script, a proof of feasibility. This is the mechanism that matters. In the current information ecosystem, even a crude or failed attack can become a model for another subject, especially if framed online as courage, martyrdom, revenge or religious duty.

Italy’s vulnerability is also geographic and social. The highest-risk areas are not necessarily those with the largest Muslim communities, a crude and analytically weak indicator. The relevant exposure points are major urban corridors, transport hubs, symbolic targets, crowded pedestrian zones, religious sites, police or military presences, and cities with recent law-enforcement activity. Milan, Bologna, Rome, Turin, Naples, Reggio Emilia and other northern or central urban nodes deserve attention because they combine mobility, population density, digital connectivity, symbolic visibility and accessible targets.

The likely attack profile in Italy remains low-tech. The most plausible scenarios are knife attacks, vehicle ramming, attempted assaults against police or soldiers, threats against Christian or Jewish sites, or attacks on crowded civilian areas. Firearms-based plots remain less likely because they require higher access capability and a more visible procurement chain. Explosives are possible but have a lower probability in the near term, unless there is stronger evidence of technical guidance, precursor acquisition, or external facilitation. The realistic concern is a fast, improvised act by a subject already visible online but not necessarily embedded in a structured network.

The Italian security services and Digos have so far shown strong preventive capacity. The recent arrests demonstrate surveillance, digital monitoring and early intervention capability. But preventive success should not produce complacency. The problem with this threat category is that the gap between warning and action can be very narrow. A subject can move from online declaration to physical attack with a knife or vehicle in hours. That compresses the operational decision cycle and increases dependence on behavioural detection, platform monitoring, community reporting and rapid legal thresholds for intervention.

The demographic profile is also relevant. Several recent cases involve young men of North African origin or mixed European-North African background. This should be handled carefully but not avoided. The analytical point is not ethnicity. The analytical point is the intersection between identity conflict, social marginality, online ideological exposure, grievance narratives, and the Islamic State’s continuing ability to offer a simplified heroic role to isolated or unstable individuals. Some cases may include mental instability, personal frustration or criminal background. These factors do not negate terrorism. They can accelerate it. In contemporary jihadist mobilisation, ideology and personal dysfunction often reinforce each other.

Italy also has a specific symbolic profile. It is a NATO member, a central Mediterranean state, host to the Vatican, an important logistical node for European security, and a country involved in counter-terrorism, migration control, Middle East diplomacy and military missions. For Islamic State supporters, Italy offers multiple symbolic frames: Christianity, Rome, Western military alignment, perceived hostility to Islam, and proximity to Mediterranean migration narratives. This does not mean Italy is the top European target. It means Italy is targetable within the Islamic State ideological universe.

The European context increases the near-term exposure. Arrests and incidents in Spain, Austria, Switzerland and the Netherlands show that Italy is not facing an isolated domestic problem. The same digital currents cross borders. A young suspect in Italy can be influenced by an attack in Switzerland, an arrest in Spain, propaganda from Syria, an ISIS supporter in Turkey, or a TikTok ecosystem hosted elsewhere. National threat assessments must therefore treat the online layer as transnational by default. The operational actor may be local, but the ideological environment is not.

For Italian policymakers, the key issue is early disruption before operational crystallisation. Monitoring should focus less on formal membership and more on escalation indicators: sudden increase in pro-ISIS content, martyrdom language, direct praise for recent European attacks, fixation on knives or vehicles, statements about imminent action, private-channel migration, contact with recruiters, requests for money, pledge-style videos, and abrupt behavioural changes. These indicators should be weighted cumulatively. One signal may be noise. Five signals in sequence may be pre-attack leakage.

For site readers and security stakeholders, the judgment should be clear: Italy is not in a panic scenario but in a warning phase. The number of successful attacks does not define the threat level. It is defined by the number of interrupted trajectories and their similarity to one another. When multiple cases show comparable online behaviour, ideological reference points and low-tech attack interest, the correct assessment is elevated exposure.

The most likely short-term development is more arrests, more preventive measures and more cases involving online ISIS support. The most dangerous short-term development is a successful knife or vehicle attack by a young self-radicalised or remotely encouraged subject, especially in a northern or central Italian urban area. The greatest concern is not the sophisticated operative. It is the visible, unstable, digitally expressive sympathiser who decides to act before authorities can close the gap.

European Pattern, Spain, Austria, Switzerland, Netherlands

The European picture does not point to a single, centralised, and fully coordinated campaign by the Islamic State. It points to something less visible but more persistent: a sequence of jihadist micro-trajectories, often youth-based, digital, and fragmented, with rapid transitions from propaganda to action or operational readiness. The issue is not ISIS’s organisational strength in Europe. The issue is the residual capacity of the ISIS brand to generate mobilisation, imitation, and a willingness to engage in violence, even without a territorial or logistical structure comparable to that of the 2014-2017 cycle.

Spain is currently one of the most significant indicators. The operation at the end of May 2026, with at least ten arrests in Alicante, Malaga, Barcelona, ​​Murcia, and Madrid, reveals a network spread across multiple provinces, with a radicalised profile and violent orientation. This is significant because it is not a single, isolated individual but a broader constellation, consistent with an environment of radicalisation, contact, propaganda, and potential facilitation. The case of the eighteen-year-old arrested in Tarifa, Cadiz, also falls within the same ecosystem. He was described as having pledged allegiance to ISIS and was obsessed with mass jihadist attacks in Europe. Furthermore, Spain has already recorded dozens of arrests for jihadism in 2026, a sign of heightened investigative pressure but also of the persistence of the militant or sympathising base.

The Spanish case is useful for Italy because it highlights two parallel levels. First, the network level: loose networks, contacts, propaganda, and radicalised environments in multiple cities. Second, the individual level: young people attracted by the idea of ​​a lone attack, a copycat massacre, and symbolic loyalty to ISIS. This combination is dangerous because it allows the jihadist ecosystem to function even without a single command. A network can radicalise, normalise, validate, and push; the individual can act with minimal means.

Austria confirms another element: the connection between public events, youth radicalisation, and mainstream platforms. The recent nationwide operation against Islamist groups, involving six suspects, searches, and the seizure of phones, laptops, knives, extremist-themed written materials and clothing, indicates an investigative focus on communication, propaganda, incitement, and glorification rather than on a fully developed attack plan. This is important because it demonstrates a logic of preemptive intervention: targeting communication spaces before they become operational spaces.

Austria had already demonstrated vulnerabilities in 2024 and 2025. The plot against Taylor Swift’s concerts in Vienna, which subsequently resulted in a 15-year sentence for a 21-year-old Austrian, remains one of the most revealing cases: radicalisation, swearing allegiance to ISIS, propaganda, instructions for explosives, and interest in attacks with a high symbolic impact. Furthermore, in 2025, Austrian authorities arrested a 14-year-old suspected of planning to attack Vienna’s Westbahnhof station. He was radicalised online and active on TikTok and carried a knife, extremist material, attack sketches, and bomb instructions. These precedents are not marginal: they show that Austria is already in the European cycle of accelerated radicalisation, whether among minors or young people, digital or low-tech.

Switzerland adds the most disturbing step: the failure of final prevention. The Winterthur attack on May 28, 2026, in which three people were stabbed at the train station, was classified by authorities as a terrorist act. The suspect, a 31-year-old Swiss-Turkish citizen, had already been identified in 2015 for spreading Islamic State propaganda. He had lived in Turkey for approximately two years and had been released from a psychiatric facility the previous day after being deemed not dangerous. This case contains almost all contemporary dilemmas: previous radicalisation, possible mental instability, return from abroad, stabbing, accessible target, minimal execution time.

Winterthur is also relevant to Swiss jihadist memory. The city had already been associated, during the Syrian peak, with radicalisation networks and departures for ISIS. The operational fact is not that Winterthur is now a structured jihadist hub, but that some local environments can maintain symbolic and relational value over time. This confirms a useful lesson for Italy as well: places of radicalisation do not necessarily disappear after the acute phase. They may remain dormant, fragmented, and less visible, but can be reactivated by personal triggers, international propaganda, or imitation.

The Netherlands, on the other hand, demonstrates the transformation of the information domain. On February 10, 2026, Dutch police arrested 15 people suspected of spreading propaganda of the Islamic State on TikTok and attempting to persuade others to commit terrorist crimes. This case is crucial. It’s not just about “online propaganda.” It’s about a mainstream platform being used as a space for incitement, soft recruitment, and the normalisation of violence. Dutch police confirmed that the suspects used TikTok to push others toward terrorist crimes.

The European pattern is therefore composed of four converging dynamics.

The first dynamic is the youthification of the threat. Spain, Austria, the Netherlands, and Italy show subjects in their teens or early twenties. This is not a demographic detail; it is an operational variable. Young subjects are more exposed to status seeking, performative identity, imitation, dependence on online validation, and the rapid transition from violent fantasy to action. In this environment, violent acts can be perceived as an identity shortcut.

The second dynamic is the platformization of radicalisation. TikTok, Instagram, Telegram, and other apps do not perform the same function. TikTok and Instagram can trigger the phases of exposure, aesthetics, outrage, belonging, and imitation. Telegram and encrypted messaging can serve for contact, ideological reinforcement, instructions, pledges, requests for support, and the transition to more closed channels. The trajectory is not linear, but the pattern is recognisable: open platforms for attraction and performance, closed spaces for consolidation and potential facilitation.

The third dynamic is the centrality of low-tech. Knives, vehicles, stations, public events, crowded streets, and religious symbols are at the heart of the threat because they lower operating costs. Reducing costs increases the potential number of actors. An arsenal is not necessary. A cell is not necessary. Extensive preparation is not necessary. All that’s needed is sufficient conviction, a trigger, an accessible target, and a few minutes of operational freedom.

The fourth dynamic is the hybridisation of personal distress, instability, and ideology. Some cases involve psychological fragility or marginalisation. This does not automatically reduce the terrorist element. In many cases, it reinforces it because ideology provides language, justification, and a heroic framework for already unstable or frustrated individuals. The rigid distinction between “mental illness” and “terrorism” is often analytically flawed. The correct question is whether jihadist ideology has guided, justified, or made the violence imitable.

For Italy, these European cases are a direct warning. The threat doesn’t come only from a potential internal network. It also comes from European information synchronisation. An arrest in Spain, a stabbing in Switzerland, a conspiracy in Austria, and a wave of propaganda on TikTok in the Netherlands can fuel radicalised individuals in Italy. The contagion isn’t organisational; it’s narrative and behavioural.

The operational assessment is clear: Europe is not returning to the complex attacks model of 2015, but is entering a phase in which multiple micro-trajectories can produce a high volume of alerts, arrests, and attempted attacks. Authorities’ capacity remains high, but the window for disruption is narrower. The success of prevention will depend less and less on detecting large networks and more and more on the ability to read weak signals, behavioural patterns, and digital pathways before they become physical actions.

Modus Operandi, Knives, Vehicles, Social Media, Telegram, Martyrdom Framing

The modus operandi emerging from recent cases in Italy and across Europe is consistent with a low-complexity jihadist threat, characterised by rapid decision-making and low logistical dependence. A structured cell is not required. Military training is not required. Access to explosives or firearms is not required. The most realistic operational profile is that of the individual actor, or micro-cluster, who moves from digital radicalisation to physical violence through common tools, knives, vehicles, social media platforms, and an ideological framework centred on martyrdom, revenge, and imitation.

The knife remains the most likely vector. It is accessible and inexpensive, does not require a procurement network, does not necessarily raise alarms before an attack, and can be used against random or symbolic targets. In terms of urban security, it is the most difficult method to prevent when the perpetrator has not yet committed any obvious preparatory acts. The attack can be decided very quickly and carried out in ordinary places: stations, streets, squares, markets, pedestrian areas, places of worship, and military or police stations. The damage may be limited compared to an explosives attack, but the psychological, media, and political impact remains high, especially if the action is claimed, glorified, or linked to ISIS.

The vehicle is the second most significant vector. Here, too, the key is not sophistication, but availability. Cars, vans, or work vehicles can be transformed into weapons of attack without the need for complex criminal or terrorist networks. The Modena case fits this logic as a domestic reference: the vehicle becomes an immediate weapon, with strong imitative value. For a radicalised individual, a local precedent lowers the psychological threshold for action. He doesn’t have to invent anything. He simply has to replicate a previously seen model, perhaps reinterpreted as an act of courage or sacrifice.

Knives and vehicles are not fallback options. They are the operational core of this phase. The Islamic State, in its propaganda cycle following the loss of territory, has repeatedly emphasised individual action conducted with simple means. The implicit operational message is clear: don’t wait for orders, don’t wait for capabilities, don’t wait for perfect conditions. Act with what you have, where you are. This logic shifts the threat’s focus from technical capacity to psychological availability.

The role of social media is crucial because it precedes, accompanies, and, in some cases, replaces organisational structure. TikTok, Instagram, Facebook, and other open platforms are not just propaganda channels. They are environments for exposure, selection, and self-representation. A radicalised individual can consume jihadist content, interact with anti-Western narratives, build a public identity, test their language, gain approval, and progressively increase the level of radicalism of shared content. This produces a form of performative radicalisation, where jihadist identity is also constructed through visibility.

The critical transition occurs when open propaganda is combined with more closed channels. Telegram remains central, not because it is the only jihadist platform, but because it allows for continuity, archiving, redistribution of material, direct contact, backup channels, and rapid migration after removals or bans. In many cases, mainstream platforms serve as surfaces of attraction, while Telegram and other messaging apps become spaces of consolidation. The typical path is not necessarily linear, but the sequence is recognisable: exposure on open platforms, increased radicalisation, contact with more extreme content or individuals, migration to closed channels, possible discussion of action, pledges, support, instructions, or encouragement.

This hybrid architecture makes the concept of the “lone wolf” increasingly less useful. Many actors act alone physically, but they are not alone cognitively, emotionally, and digitally. They may be autonomous in execution, yet connected in radicalisation. They may not receive direct orders, but they do receive validation, encouragement, examples, religious formulas, martyrdom narratives, and operational models. For threat analysis, this distinction is fundamental: an actor can be logistically solitary yet ideologically networked.

Martyrdom framing is the ideological multiplier. Without a martyrdom framework, the gesture can remain individual anger, deviance, or disorganised violence. With the jihadist framework, violence becomes mission, sacrifice, purification, revenge, and belonging. This is the shift that makes some digital signals dangerous. When a subject begins to speak of martyrdom, paradise, revenge against unbelievers, defence of the Ummah, the blood of Muslims, the punishment of Christians, or the need to “do something,” it isn’t necessarily planning an attack. Still, it’s entering a language that can justify the action.

Martyrdom reduces the psychological cost of violence. It allows the individual to reinterpret their death, arrest, or marginalisation as a success. Particularly for vulnerable, isolated, or frustrated young people, martyrdom offers a shortcut to identity: from peripheral individual to fighter, from personal failure to religious proof, from social invisibility to symbolic recognition. This doesn’t mean that all radicalised individuals are psychologically unstable. It does mean that the jihadist framework can exploit personal vulnerabilities and convert them into operational readiness.

The most dangerous sequence occurs when these elements combine: intensive consumption of propaganda, public escalation on social media, interactions with sympathisers or facilitators, praise of recent attacks, the language of martyrdom, the choice of a low-tech method, and ambiguous or explicit declarations of imminence. At this stage, the gap between ideation and action can be minimal. A family argument, a humiliation, news from Gaza, an arrest in Europe, an ISIS video, a discussion with a recruiter, or seeing a previous attack can act as triggers.

Operationally, the most likely pattern involves five stages.

• First, exposure. The individual comes into contact with jihadist or para-jihadist content, often through open platforms, re-shared accounts, short videos, memes, sermons, content about Muslim suffering, anti-Western or anti-Christian narratives.

• Second, identification. The individual no longer simply watches. They begin sharing, saving, commenting, imitating aesthetics, using symbols, editing bios, following extremist accounts, and expressing religious or political hostility.

• Third, consolidation. The trajectory shifts toward more closed channels—Telegram, private groups, direct chats, propaganda channels, and contacts with more radical individuals. Here, ideological density increases and exposure to dissent decreases.

• Fourth, availability. The individual begins to speak of action, martyrdom, attack, defence of Islam, revenge, targeting Christians, police, military, Jews, Western civilians, or symbolic places. They may ask for advice, search for material, record videos, prepare messages, erase traces, or purchase trivial tools.

• Fifth, action or disruption. The attack is carried out with a knife, vehicle, or other simple means, or is interrupted by the authorities in the immediately preceding phase.

The critical point is that the first three stages can appear ambiguous and glossed over by freedom of expression, provocation, immaturity, or discomfort. But in the fourth stage, the remaining time can be very short. The challenge for intelligence and law enforcement is therefore to construct cumulative, not atomistic, assessments. A single post can be noise. A post, plus a Telegram contact, plus a praise of martyrdom, plus a reference to a knife, plus a remark of imminence, plus account deletion, is another matter.

In Italy, this reading is essential. Recent cases should not be interpreted merely as separate judicial episodes. They should be read as indicators of a possible normalisation of low-tech repertoire in the domestic radicalised pool. The risk is not that all online sympathisers will take action. That would be an incorrect conclusion. The risk is that, within a broader audience of propaganda consumers, a small but sufficient number develop intent, target selection, and timing.

The communicative dimension of the attack is just as important as the physical dimension. A stabbing or a car crash doesn’t just seek victims. They seek visibility, fear, polarisation, imitation, and recognition. Even an attack with limited damage can have a strategic effect if it is absorbed by the jihadist information ecosystem and relaunched as proof that ISIS is still alive in Europe. In this logic, every action also involves content. Every arrest can become propaganda. Every trial can become narrative martyrdom.

This is why the state’s communicative response matters. Media overexposure, excessive detail about the attacker’s methods and profile, sensational headlines, and repetition of the attacker’s name can increase the potential for imitation. At the same time, minimising or dismissing the ideological motive too quickly can prevent a proper understanding of the risk. The best response is sober, precise, and factual: recognise the underlying cause when there are elements involved, avoid amplification, protect sensitive operational details, and explain the risk without panic.

The assessment for the next 30-60 days is that the most likely modus operandi in Europe remains knife attacks or vehicle ramming, with possible opportunistic targets.

The Online Acceleration Problem

The central problem is not simply that radicalisation occurs online. This has been known for years. The current problem is that the digital environment compresses time, lowers thresholds, shortens the distance between propaganda and action, and makes it more difficult to distinguish promptly among ideological consumption, provocation, symbolic belonging, and operational availability.

Online acceleration works because it combines three elements: continuous exposure, algorithmic reinforcement, and migration to closed spaces. TikTok, Instagram, and mainstream platforms act as entry surfaces. Telegram, private chats, and encrypted channels act as spaces of consolidation. The individual is not necessarily born within an extremist channel. They can arrive there after a progressive trajectory made up of content about war, Muslim victimisation, Gaza, anti-Westernism, images of martyrdom, militant aesthetics, sermons, memes, short videos, and approving comments.

This is the most important point: contemporary radicalisation no longer requires prolonged ideological immersion in traditional jihadist environments. It can start with emotionally powerful, politically ambiguous, or seemingly inoperative content. The shift from anger to jihadist identification occurs when the individual finds a framework that organises everything: the world is hostile to Islam, the West is the enemy, Muslims are under attack, violent action becomes defence, martyrdom becomes success. From that moment, propaganda no longer needs to convince from scratch. It simply needs to address an already active frustration.

European data confirms this transformation. Jihadism remains the most dangerous form of terrorism in the EU, and the majority of terrorism arrests still involve jihadism. The most relevant data for this analysis are the combination of lone actors, digital propaganda, and young individuals, because it reduces dependence on structured networks and increases the difficulty of prevention.

The Dutch case of February 2026 is a very concrete indicator. Authorities arrested 15 people suspected of spreading Islamic State propaganda on TikTok, inciting terrorist crimes, and, in some cases, participating in a terrorist organisation. Some posts reportedly exceeded 100,000 views, and even minors were among the suspects. This shows that the platform is not just a place for consumption but also for amplification, soft recruitment, and imitative pressure.

The dynamic is dangerous because TikTok and Instagram don’t function like old jihadist forums. They don’t require active research, passwords, trust networks, or prior ideological affiliation. Content is delivered based on user affinity, emotion, engagement, and behaviour. If a young person watches videos about war, humiliation, religion, violence, or identity, the ecosystem can push them toward increasingly extreme content. A recruiter isn’t needed in the initial phase. The algorithm can act as a cognitive accelerator. The recruiter, or the most radical sympathiser, comes later.

This evolution is documented in the European context, linking platforms like TikTok and Instagram to the radicalisation of lone attackers after October 7, 2023. These platforms accelerate exposure, imitation, belonging, and the normalisation of violence, especially among young people already vulnerable to narratives of revenge or victimisation.

The second component is platforms like Telegram, Signal, and similar. They should not be described as simple propaganda channels. They are an infrastructure of continuity. They enable the archiving of materials, reposting after removals, the creation of backup channels, direct contact, micro-communities, transfer to private chats, and the dissemination of videos, claims, manuals, manipulated religious texts, nasheeds, posters, and behavioural instructions. Where TikTok and Instagram attract, Telegram and other platforms stabilise. Where short-form content generates emotion, Telegram and similar platforms provide ideological density.

The operational problem arises when the subject shifts from consumption to relationship. Watching propaganda is one thing. Another is searching channels, commenting, saving material, requesting contacts, migrating to Telegram, speaking with a facilitator, receiving encouragement, discussing an attack, registering a pledge, or preparing a message. The transition can be rapid and not always visible from the outside. This is the heart of acceleration: the time between identification and operational readiness can become too short for a standard response.

The problem doesn’t just concern adults already involved in militant networks. Still, adolescents and young people with rapid digital trajectories are often oriented towards low-tech methods and a strong imitative component.

Young people are particularly vulnerable for four reasons: greater digital immersion, greater susceptibility to social validation, a still-unstable identity, and a reduced ability to assess real consequences. Jihadist propaganda exploits these factors precisely: it offers belonging, status, a mission, an enemy, moral purity, and the promise of recognition. For an isolated, frustrated, or marginalised individual, this can be more powerful than lengthy doctrinal indoctrination.

The transition from content to behaviour often occurs through digital leaks. Before the action, many individuals leave traces: praise of previous attacks, martyrdom language, farewell phrases, allusions to “doing something,” images of knives, references to vehicles, sudden changes in bio, deletion of content, opening new accounts, sharing nasheeds, hostility toward Christians, Jews, the police, the military, or “unbelievers.” Taken individually, these signals can be noise. In sequence, they become a risk profile.

The most serious analytical error would be to wait for a formal operational order. At this stage, the order may never arrive. The actor can activate himself after sufficient exposure, validation, and imitation. Contemporary digital jihadism doesn’t always need to be directed. It can suggest, legitimise, celebrate, and allow the actor to complete the final stretch on his own. This produces a more resilient threat model because it doesn’t depend on a single chain of command.

For Italy, this point is crucial. Recent cases show that the risk doesn’t arise only from deep clandestine channels. It also arises from the combination of open platforms, ISIS propaganda, messaging contacts, references to martyrdom, and the availability of simple methods. A radicalised young person can be intercepted on Instagram or TikTok in the expressive phase, but becomes much more dangerous when he migrates to Telegram or private chats. The challenge is recognising the moment when ideological expression becomes an operational trajectory.

The Israeli-Palestinian conflict, and the Gaza narrative more generally, acts as a thematic accelerator. Not because every pro-Palestinian mobilisation is jihadist—that would be false and analytically incorrect. But because the jihadist ecosystem exploits images of civil suffering, moral outrage, and anti-Western polarisation to channel anger into a violent religious framework. The same image can be used in different political environments, but in the jihadist circuit, it is reinterpreted as evidence of the obligation to seek revenge.

Jihadist propaganda works precisely on this conversion: from victim to avenger. The subject must not only feel anger. They must be convinced that anger has a sacralized solution. This is the breaking point. When the narrative shifts from “Muslims suffer” to “I must strike here,” radicalisation is no longer merely ideological. It is pre-operational.

Online acceleration also changes the concept of target selection. In the past, a target could be chosen based on strategic value, planning, accessibility, and instructions received. Today, for a low-tech actor, the target can be opportunistic: a station, a patrol car, a church, a synagogue, a crowded street, a public event, a club, a shopping mall. Propaganda provides the general framework, but the location can be chosen at the last minute. This increases unpredictability.

The imitative dimension is equally central. An arrest, an attack, a claim of responsibility, a news item, or a video can produce a replication effect. The perpetrator doesn’t need detailed instructions. It’s enough to see that someone else has acted. Imitation lowers the psychological threshold, especially when the gesture is interpreted as martyrdom or a demonstration of loyalty. In this sense, every European case becomes potentially transnational. An attack in Switzerland can influence a perpetrator in Italy. An arrest in Spain can become a narrative of persecution. A Dutch video on TikTok can reach users in multiple countries.

The problem for authorities is that platforms generate volume: too much content, too many accounts, too many languages, too many ambiguous signals. The point is not simply to remove content. Removal is necessary but insufficient. We need to understand trajectories: those who move from consumption to production, from production to contact, from contact to pledge, from pledge to preparation. The unit of analysis should not be the single post, but the behavioural sequence.

The public response must avoid two opposing errors. The first is digital panic: treating every radical piece of content as an imminent threat. This saturates the system and produces false positives. The second is underestimation, that is, viewing online content as adolescent outbursts or propaganda with no physical impact. European cases demonstrate that some digital trajectories reach the attack threshold. Not all, but enough to make the problem a priority.

For analysts, the most relevant indicators are cumulative. A sudden increase in the frequency of extremist content. A shift from generic content to explicit jihadist content. Use of martyrdom vocabulary. Praise for recent attacks. Interest in knives, vehicles, stations, police, or places of worship. Searching for contacts on Telegram. Changing accounts or migrating to closed channels. Phrases of imminence. Recording videos. Requests for religious justification. Breaking up with family or school and preparing final messages. None of these signals is decisive in itself. Their sequence is the data.

The key point is that online is not a dimension separate from the attack. It is part of the attack before the attack. It constructs the perpetrator’s identity, selects the audience, provides language, normalises the method, offers precedents, produces validation, and prepares the post-event narrative. A knife attack or vehicle ramming does not necessarily begin the moment the perpetrator picks up the weapon or gets into the car. They often begin when the perpetrator publicly or privately accepts the idea that the act is right, necessary, and salvific.

The assessment for Italy and Europe is therefore clear: online risk is no longer a subset of propaganda. It is a structural component of the threat. Propaganda isn’t just used to recruit fighters for a foreign theatre. It’s used to transform local individuals into minimal operational vectors. ISIS mustn’t directly control every actor. It must maintain an ecosystem capable of generating availability.

The final verdict is clear. The Online Acceleration Problem is the true multiplier of the European threat. Without this acceleration, many individuals would remain marginal consumers of propaganda. With this acceleration, some of them could become operational risks in a short time. Therefore, in the short term, prevention must focus less on targeting large networks and more on the timely identification of digital trajectories that are entering the phase of availability for violence.

Forecast 60 – 90 Days

Over the next 60 to 90 days, the most likely scenario in Italy and Europe is a continuation of preventive arrests, searches, expulsions, precautionary measures, and investigations of individuals radicalised online, especially young people, linked to jihadist propaganda, TikTok/Instagram content, and martyrdom rhetoric.

The main risk is not a coordinated 2015-2017-style campaign. The main risk is a sequence of jihadist micro-trajectories that are difficult to predict, with individuals rapidly transitioning from consuming propaganda to becoming operationally available. The threat remains tactical, urban, decentralised, and low-tech.

The most likely scenario is this: more similar cases in Brianza, Reggio Emilia/Bologna, Spain, Austria, and the Netherlands. Young individuals, jihadist propaganda, encrypted messaging, martyrdom content, contacts with sympathisers or facilitators, interest in knives, vehicles, public places, police, military, Christians, Jews, or Western civilians. Many will be intercepted before the attack. This does not reduce the risk. Indeed, it confirms the mobilisation pool.

The most dangerous scenario is a successful knife or vehicle attack in a European city. In Italy, the most plausible profile is an individual actor, radicalised online, already visible for extremist content, who decides to attack an accessible target: a military or police patrol, a station, a square, a church, a synagogue, a pedestrian zone, a public event, a tourist site, or a commercial space. The physical damage may be limited, but the psychological and media impact would be significant.

The probability of complex attacks involving explosives or firearms remains lower in the short term, unless more robust indicators emerge: procurement, technical contacts, money transfers, operational instructions, precursor materials, criminal connections, or experienced facilitators. Today, the core of the threat remains simpler: a bladed weapon, a vehicle, an opportunistic target, a message of martyrdom, and online amplification.

Italy should be considered to be in a phase of high exposure, but not in a systemic emergency. The point is not that the country is the main European target. The point is that Italy today presents three simultaneous vulnerabilities: the presence of recent cases, the accessibility of symbolic and urban targets, and exposure to transnational digital radicalisation. Rome, Milan, Bologna, Turin, Naples, Reggio Emilia, and the metropolitan areas of the North deserve priority attention, not because they are “jihadist zones,” but because they concentrate mobility, visibility, symbols, infrastructure, communities, and soft targets.

In the next two to three months, the risk will increase in conjunction with public events, religious holidays, political demonstrations, high-tension pro-Palestine protests, news stories perceived as anti-Muslim, military operations in the Middle East, new jihadist propaganda campaigns, or successful attacks in other countries. The trigger may be local, but the mobilisation can be transnational.

The operational judgment is clear: the most likely risk is disruption, the most serious risk is a successful low-tech attack. The decisive variable will be time. If the subject shifts from propaganda to action within hours or days, even an efficient prevention system can be too late.

Indicators to Watch

The indicators to monitor should not be read individually. The analytical value comes from the sequence. An extremist post can be noise. An extremist post followed by a Telegram contact, martyrdom language, praise of a recent attack, and references to knives or vehicles is a different profile.

The first indicator is linguistic escalation. A shift from general religious or political content to explicit hostility against Christians, Jews, “unbelievers,” the police, the military, Italy, Europe, the West, or “enemies of Islam.” The critical factor is the change in intensity, not the individual phrase.

The second indicator is martyrdom framing. References to shahada, paradise, sacrifice, revenge, the blood of Muslims, religious duty, the need to “do something,” the desire to die a martyr, farewell phrases, video testaments, images of ISIS flags, or content celebrating previous attackers.

The third indicator is imitation. Praise for Modena, Winterthur, the French attacks, Vienna, London, Brussels, the Bataclan, Nice, or other European cases. When someone doesn’t simply comment on an attack but presents it as an example to follow, the risk changes.

The fourth indicator is digital migration. The shift from TikTok, Instagram, or Facebook to Telegram, WhatsApp, Signal, and Rocket.Chat, Element, or other closed channels. Migration is not evidence of an attack, but rather indicates a desire to enter a more protected, ideologically dense space, less exposed to moderation.

The fifth indicator is the relationship with facilitators. Contacts with individuals who encourage, validate, offer advice, request videos, solicit pledges, promise money, suggest targets, discuss travel, or talk about “action.” This is one of the most sensitive indicators. The individual is no longer just a consumer of propaganda.

The sixth indicator is interest in low-tech methods. Knives, cars, vans, stations, crowded places, churches, synagogues, patrols, barracks, institutional headquarters, public events. Even banal searches can take on value when combined with ideology, timing, and declarations of intent.

The seventh indicator is temporal compression. Phrases like “soon,” “the time has come,” “I’ll do what I have to,” “I can’t wait any longer,” “everything changes today,” or sudden cancellations, account closures, family isolation, drastic changes in routine. Here, the risk is the imminent transition.

The eighth indicator is polarisation over Gaza or other Muslim theatres transformed into a local operational obligation. Not every mobilisation in Gaza is jihadist radicalisation. But when the narrative becomes “strike here to avenge there,” the ideological shift is serious.

The ninth indicator is behavioural disruption. Sudden abandonment of school, work, or family, isolation, aggression, radical change in friendships, militant religious obsession, violent rejection of the social environment, increased digital secrecy, use of multiple accounts or secondary devices.

The tenth indicator is the independent production of propaganda. Not just sharing, but also the creation of videos, posters, messages, translations, subtitles, repost accounts, celebratory content, or threats. Those who produce propaganda are often more involved than those who consume it.

Policy and Security Implications

The first implication is that prevention must shift from the logic of the cell to the logic of the trajectory. Targeting only structured groups is no longer enough. The most likely threat comes from small, mobile, digital, hybrid actors, with weak ties but sufficient to generate action.

The second implication is that online monitoring must become more behavioural and less content-based. Counting extremist posts isn’t enough. We need to understand the sequence: exposure, identification, migration, contact, martyrdom, method, target, imminence. Individual evidence says little. The chain says a lot.

The third implication concerns platforms. TikTok, Instagram, and Telegram must be treated as different parts of the same ecosystem. Open platforms are often the gateway. Telegram and private chats are often the consolidation. The response must address both phases: removal, tracking, preservation of evidence, identification of relaunch networks, and faster cooperation with authorities.

The fourth implication concerns Italy. Greater integration is needed between intelligence, DIGOS (Italian Special Operations Unit), postal police, counterterrorism, prosecutors, schools, local services, and local communities. The point is not to engage in indiscriminate surveillance. The point is to build early-warning channels when serious signs emerge: martyrdom, ISIS, contacts, threats, interest in bladed weapons or vehicles, and behavioural disruptions.

The fifth implication concerns public communication. We must avoid both minimisation and hysteria. Minimisation weakens understanding of the risk. Hysteria amplifies the jihadist message. The correct approach is: precise information, few operational details, no glorification of the attacker, no spectacularization of the method, and clear recognition of the origins when the evidence allows.

The sixth implication concerns soft targets. Transportation, religious sites, public events, tourist areas, patrols, and pedestrian areas must be viewed as opportunistic targets. There is no point in militarising cities. We need to increase visible deterrence capacity, behavioural control, rapid response, training for both public and private personnel, and simple procedures for reporting anomalous behaviour.

The seventh implication concerns the management of radicalised minors and young adults. Here, a purely repressive response often comes too late. Hybrid tools are needed: monitoring, family intervention, psychological support, selective deradicalisation, judicial oversight when necessary, expulsion where applicable, preventive measures for non-citizens, and effective follow-up after the initial intervention.

The seventh implication concerns the management of radicalised minors and young adults. Here, a purely repressive response often comes too late. Hybrid tools are needed: monitoring, family intervention, psychological support, selective deradicalisation, judicial oversight when necessary, expulsion where applicable, preventive measures for non-citizens, and effective follow-up after the initial intervention.

The eighth implication concerns the relationship between mental health and terrorism. The presence of psychological fragility should not automatically rule out ideological factors. In contemporary cases, ideology and instability can coexist. The correct question is: has jihadist propaganda provided language, a target, justification, or a model for action? If so, the terrorist dimension remains relevant.

The ninth implication concerns the risk of imitation. After every arrest or attack, a 7- to 21-day window of vulnerability should be expected, during which others may react, celebrate, threaten, or attempt to emulate them. This is especially true when the case receives heavy media coverage or circulates through jihadist channels.

The tenth implication concerns European cooperation. These cases are not national. They are local in their execution, transnational in their ecosystem. Italy, Spain, Austria, Switzerland, the Netherlands, France, Germany, and the United Kingdom must interpret these events as interconnected signals. The same narrative, video, channel, or facilitator can span multiple jurisdictions.

The final verdict is clear: in the next 60-90 days, the priority is not to seek out the “large jihadist conspiracy.” The priority is to intercept the small actor before it becomes operational. The threat is lower in sophistication, but higher in speed. This is the real problem for Italy and Europe.

Final Analytical Line

The reemergence of a large-scale external operational structure of jihadism does not define the current jihadist threat environment in Europe. It is defined by the persistence of an ideological ecosystem capable of generating mobilisation without direct command, operational intent without organisational affiliation, and violence without sophisticated preparation.

Recent cases in Italy, Spain, Austria, Switzerland, and the Netherlands point to the same underlying reality. The centre of gravity has shifted from structured networks to accelerated individual pathways. Radicalisation is increasingly digital, mobilisation is increasingly personal, and attack planning is increasingly compressed. The operational challenge is no longer identifying large-scale conspiracies, but recognising when a seemingly fragmented process is approaching the threshold of violence.

For Italy, the primary concern is not the existence of a nationwide clandestine jihadist infrastructure. The primary concern is the convergence of three factors: a persistent online propaganda environment, the availability of low-tech attack methods, and a pool of young people exposed to narratives of martyrdom, resentment, and ideological vengeance. In this context, even a small number of mobilised actors can generate disproportionate security, political, and psychological effects.

The most significant development observed in recent months is the growing role of digital acceleration. Social media platforms, encrypted messaging apps, and transnational ecosystems of supporters are narrowing the gap between ideological exposure and operational readiness. The result is a threat landscape in which warning indicators may still exist, but the time available to identify, assess, and counter them is shrinking.

This does not indicate an imminent wave of large-scale attacks across Europe. The available evidence does not support such an assessment. What it does indicate is a continuing risk of low-complexity but high-impact incidents, perpetrated by individuals requiring minimal resources, limited logistical support, and only a short window of opportunity to decide whether to act.

The strategic danger lies precisely in this asymmetry. A weakened organisation can still inspire violence. A broken network can still spawn imitators. A failed plot can still become a model. The cumulative effect of repeated arrests in several European countries suggests that security services are successfully intercepting a significant number of trajectories before execution. At the same time, these interventions reveal a broader mobilisation context that remains active, adaptable, and geographically dispersed.

The central intelligence assessment is therefore clear: Europe is entering a phase in which the jihadist risk is becoming less hierarchical, less visible, and more behaviorally driven. The threat is less organizationally complex than it was ten years ago, but potentially more difficult to predict tactically. For Italy, the decisive variable in the coming months will not be the strength of the Islamic State as an organisation, but rather the authorities’ ability to identify and stop the next individual who moves from online engagement to physical action before that transition is complete.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The reporting period from 26 May to 1 June was characterised by continuity rather than major escalation. Jihadist and insurgent actors across Africa and South Asia maintained operational activity, propaganda output and tactical adaptation despite a moderate decline in overall media volume.

The most significant development was the Islamic State’s increasing emphasis on IS-Sahel operations in northwestern Nigeria, particularly in Sokoto and Kebbi, suggesting a broader effort to expand the perceived geography of its African campaign. JNIM sustained pressure across Burkina Faso, Mali and Benin, while Al-Shabaab maintained cross-border attacks in Kenya alongside its insurgency in Somalia. Pakistani jihadist groups, particularly Ittehad-ul-Mujahideen Pakistan (IMP), continued highlighting drone-enabled attacks as part of an evolving operational identity.

Beyond traditional jihadist theatres, European counterterrorism services intensified preventive actions against radicalisation networks. They suspected attack planning, while governments increasingly treated armed criminal organisations and hybrid threat actors as strategic security challenges.

The overall picture remains one of organisational resilience, geographic diffusion and gradual adaptation. The principal threat is not a single major attack, but the normalisation of persistent instability across interconnected jihadist, insurgent, proxy and criminal ecosystems.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line

The Shift of the Week

Continuity, Not Escalation, Is the Real Warning

The reporting period from 26 May to 1 June did not show a dramatic strategic rupture. It showed something more durable: the consolidation of persistent threat ecosystems across Africa, South Asia and Europe.

Compared with the previous week, the volume of propaganda declined. But this is not a sign of strategic cooling. The principal actors remained active, geographically distributed and operationally coherent.

JNIM continued pressure across Burkina Faso, Mali and Benin. Al-Shabaab shifted part of its media focus back toward Kenya. Islamic State reduced the number of claimed operations but kept Africa at the centre of its global messaging. IMP sustained tactical signalling in Pakistan, especially through drone-focused material. AQIS released a 143-page ideological and analytical magazine, suggesting that al-Qaeda’s South Asian branch still sees itself as a strategic communications platform, not only a regional propaganda actor.

The key shift this week, therefore, is not escalation. It is continuity under pressure.

This distinction matters. Modern jihadist and insurgent ecosystems do not need constant spectacular attacks to remain strategically relevant. They need continuity, geographic spread, media persistence and enough tactical innovation to show that they are adapting faster than the security environment around them.

JNIM remains the clearest example in the al-Qaeda ecosystem. Its output dropped compared to the previous reporting cycle, but it still claimed 15 attacks across 10 statements and 10 photo reports. The operational geography remained important: Burkina Faso, Mali and Benin. The Benin component is particularly relevant because it confirms that the group continues to treat the northern coastal belt as a pressure zone rather than merely a peripheral area.

Al-Shabaab also deserves attention. Ten claimed attacks are not exceptional by the group’s standards, but the geographic balance is relevant. Six of the ten were claimed inside Kenya, particularly in Garissa and Mandera counties. This suggests that the group is maintaining pressure on Nairobi while preserving operational rhythm inside Somalia. The signal is clear: Al-Shabaab does not need to choose between internal insurgency and cross-border pressure. It can sustain both at a manageable tempo.

Islamic State’s week was less voluminous but still strategically meaningful. Al-Naba issue 549 claimed 21 operations and 85 casualties across Nigeria, Somalia, Niger, Mozambique, Iraq and the Democratic Republic of Congo. The central point is not the number itself, but the geographic message. Africa remains the core propaganda theatre.

The most important Islamic State signal came from northwestern Nigeria. Al-Naba highlighted IS-Sahel activity in Sokoto and Kebbi, presenting it as the first official claim in those areas and framing it as a new field expansion in the African Sahel. The article claimed 19 Nigerian soldiers were killed and three vehicles were burned in two attacks, while also referring to additional casualties among Nigerien pro-government militias in Tillaberi.

This is not a minor propaganda detail. Sokoto and Kebbi sit outside the classic Lake Chad mental map through which many observers still interpret Islamic State activity in Nigeria. If this messaging reflects a sustained operational pattern, it indicates a widening threat arc between Sahelian instability, northwestern Nigerian insecurity and the Islamic State’s effort to reposition African provinces as a single strategic continuum.

In South Asia, IMP again used media to project tactical maturity. The group claimed 16 attacks across Khyber Pakhtunkhwa and Gilgit-Baltistan and released multiple videos, including drone attacks against Pakistani military sites. The persistence of drone imagery is now part of the group’s operational identity. It is no longer an occasional media accessory. It is becoming a recruitment, intimidation and capability-signalling tool.

The European dimension adds another layer. Italy arrested a 22-year-old Italian citizen of Moroccan origin accused of terrorism-related recruitment, after investigators found indications of an intended knife attack in a city centre and contacts with a suspected Daesh supporter. Spain recorded at least ten jihadism-related arrests across several provinces. Austria carried out a broad preventive operation against Islamist-extremist environments, with six arrests, 14 searches and more than 40 risk-prevention interventions. At the same time, an Austrian court sentenced a man to 15 years for the foiled Islamic State-linked plot against a Taylor Swift concert in Vienna.

These European cases do not indicate a single coordinated campaign. They point to something different: a persistent radicalisation and micro-plot environment in which online exposure, personal grievance, symbolic targeting and low-complexity attack concepts remain difficult to eliminate.

The week also showed that “terrorism” as a policy category is widening beyond jihadism. The planned U.S. designation of Brazil’s PCC and Comando Vermelho as foreign terrorist organisations reflects the growing securitisation of strategic criminal networks in Latin America. This does not make cartel violence identical to jihadist militancy. Still, it shows that states are increasingly treating armed criminal ecosystems as strategic security actors rather than only law-enforcement problems.

The central assessment is direct: the threat environment is not driven only by escalation. It is driven by continuity, diffusion and adaptation.

Threat Signals

• Signal 1: The Islamic State is widening its African narrative.

The most important development in al-Naba issue 549 was the emphasis on IS-Sahel activity in Sokoto and Kebbi. If confirmed as a sustained pattern, this would expand the operational and propaganda map of Islamic State-linked activity in Nigeria beyond the traditional northeastern frame. It also strengthens the idea of an African jihadist corridor connecting Sahelian instability, northwestern Nigeria and Lake Chad.

• Signal 2: JNIM’s lower volume does not mean lower relevance

JNIM claimed fewer attacks than in the previous week, but the group retained geographic spread across Burkina Faso, Mali and Benin. Benin’s continued appearance in the reporting cycle matters because it reinforces the coastal spillover problem. The group is still positioning itself as the central insurgent actor confronting local states, militias and foreign security partners across the Sahelian belt.

• Signal 3, Al-Shabaab is keeping Kenya inside the pressure zone

Al-Shabaab claimed ten attacks, six of them inside Kenya. The focus on Garissa and Mandera indicates that cross-border activity remains a standing feature of the group’s operational posture, not a temporary deviation from Somalia-focused insurgency.

• Signal 4: European counterterrorism pressure is intensifying around micro-plots and radicalisation spaces.

Italy, Spain and Austria all recorded significant counterterrorism activity during the reporting window or in the immediately adjacent period. The common denominator is not large hierarchical cells but smaller radicalisation environments, suspected attack intentions, online influence, and preventive disruption.

• Signal 5, Pakistan remains a tactical innovation theatre

IMP’s continued emphasis on drone footage confirms that low-cost aerial systems are becoming part of the militant toolkit in Pakistan. This is important beyond Pakistan itself because drone normalisation in one insurgent theatre can accelerate imitation elsewhere.

• Signal 6, criminal armed networks are entering the strategic security frame.

The planned U.S. designation of PCC and Comando Vermelho reflects a wider shift in how states classify organised criminal violence. The main implication is not semantic. It affects sanctions exposure, financial disruption, diplomatic friction, and the threshold for treating criminal armed groups as national security threats.

The Information Battlefield

The information environment this week was defined by continuity rather than novelty.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 24 and 31 May, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• AQAP

• AQIS

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, a Jama’at Nasr al-Islam wal Muslimin (JNIM) affiliate, published a 2- to 13-minute video showing an ambush of a Malian army patrol in the Ségou region. Mali

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 10 statements and 10 photos, claiming 15 attacks.

The targets of the attacks were: Malian Army, Malian pro-Government militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Benin Army.

The areas of the attacks were :

1) Burkina Faso = 7

- Yatenga province, Sissili province, Loroum province, Mouhoun province.

2) Mali = 5

- Ségou region, Kidal region.

3) Benin = 3

- Atakora department.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 5 statements claiming responsibility for 10 attacks.

The targets of the attacks were: Somali Intelligence, Somali pro-government militia, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 4

- Merca area, Lower Shabelle region; Beledweyne area, Hiiran region; Jowhar area, Middle Shabelle region.

2) Kenya = 6

- Dadaab area, Dayo area, Igari area, Garissa County;

- Sheikh Baru area, Mandera County.

Ansar al-Sharia Correspondent, Al-Qaeda in the Arabian Peninsula (AQAP), published a photo report documenting its members’ celebration of Eid al-Adha in various parts of Yemen (likely Abyan and Shabwa).

Al-Qaeda in the Indian Subcontinent (AQIS) published the May 2026 issue of its magazine “Nawa'i Ghazwat al-Hind”.

The magazine runs to 143 pages and includes a collection of doctrinal, political and organisational articles relating to Al-Qaeda’s narrative, focusing on:

• Criticism of Western policies and the international role of the United States and its allies.

• Analysis of the political and security situations in Pakistan, Afghanistan and South Asia from a pro-Al-Qaeda perspective.

• Publication of proselytising and ideological articles inciting armed jihad and justifying the organisation’s activities.

• Highlighting of figures and leaders associated with the jihadist movement in the region.

• Inclusion of material relating to security and military developments in Pakistan and Afghanistan.

• Publication of a statistical infographic analysing the results of operations conducted by groups affiliated with al-Qaeda (Al-Shabaab, JNIM, Ittihad al-Mujahideen Pakistan) during the period February–March–April 2026.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (549). Issue 549, eight pages long, covers the week of 4 to 10 Dhu al-Hijjah 1447, from 21 to 27 May 2026.

The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Somalia, Niger, Mozambique, Iraq and the Democratic Republic of Congo.

IS claims to have conducted 21 operations in all the mentioned areas and to have caused 85 deaths and injuries.

The Islamic State’s official media outlets have published a photo report showing the attack carried out by fighters from the Sahel province (IS-Sahel) against a Nigerian army patrol in Sokoto State, Nigeria.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), released a 4:27-minute video showing several drone attacks against the Pakistan Army barracks, checkpoints and military bases in the province of Khyber Pakhtunkhwa, Pakistan.

Al-Mansur Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), released 3 videos showing several attacks against the Pakistani police checkpoints and patrols in the district of Bannu, in the province of Khyber Pakhtunkhwa, Pakistan.

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 14 statements, claiming 16 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, South Waziristan district, Bannu district, Bajaur district, Khyber district, Orakzai district;

Khyber Pakhtunkhwa Province.

- Diamer district, Gilgit-Baltistan province.

Pakistan

🔹Weekly Monitoring Notes

The reporting period from 24 to 31 May reflects a moderate reduction in overall propaganda volume compared with the previous week.

Read more

For years, the conflict in Mali has largely been understood through a familiar lens. Military bases attacked in remote regions, ambushes against security forces, clashes between jihadist factions, and territorial competition across the country’s vast northern and central areas. Those dynamics remain important, but they no longer tell the whole story.

Over the past year, a different pattern has gradually emerged. Fuel convoys have been destroyed, transport corridors have come under increasing pressure, and commercial routes connecting Bamako to western Mali have become recurring targets of jihadist activity. What initially appeared as isolated incidents now looks increasingly like part of a broader strategic design.

The significance of this trend lies not in the number of attacks themselves, but in what those attacks are trying to achieve. JNIM increasingly appears less interested in controlling territory for its own sake and more interested in disrupting the systems that allow the Malian state and economy to function.

From Territorial Control to Economic Pressure

Insurgencies evolve when they identify vulnerabilities that produce greater strategic returns. For much of the last decade, territorial expansion represented the primary measure of success for armed groups operating across the Sahel. Capturing villages, overrunning military positions, and extending influence into new regions offered both operational and symbolic value.

Today, the strategic calculus appears to be changing. The destruction of a military outpost may generate headlines for a few days. The disruption of fuel supplies can affect an entire country for weeks.

By repeatedly targeting fuel convoys and commercial arteries, JNIM is applying pressure where modern states are often most vulnerable: logistics, mobility, and economic continuity. Rather than confronting the government exclusively through direct military confrontation, the group is increasingly seeking to raise the political and economic costs of governance itself.

This approach reflects a more mature understanding of how power functions. Governments derive legitimacy not only from security, but also from their ability to ensure movement, trade, access to services, and a degree of economic normality. When those functions begin to deteriorate, public confidence often erodes long before military defeat occurs.

Why Western Mali Matters More Than Before

One of the most notable aspects of this evolution is its geographical dimension. Historically, international attention has focused on northern Mali and the tri-border area linking Mali, Niger, and Burkina Faso. These regions remain critical theatres of jihadist activity, but recent developments suggest that western Mali is becoming increasingly important.

This matters because western Mali occupies a different position within the country’s strategic landscape. The region connects Bamako to key commercial routes, trade corridors, and supply networks extending toward Senegal and the Atlantic coast. Disruption in these areas produces consequences that extend far beyond local security conditions.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 549 last Thursday.

Trend: → stable with increased West Africa concentration, underscoring the importance of rural insurgency as a key strategic concern for the audience.
Time horizon: 30–90 days
Confidence level: Medium

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 549, including photographs, statements, and alleged military activities, providing a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 549, eight pages long, covers the week of 4 to 10 Dhu al-Hijjah 1447, from 21 to 27 May 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

These releases emerged amid an unusual operational pause by AQAP inside Yemen. AQAP has not formally claimed attacks since January 2026, following the collapse and partial withdrawal of the UAE-backed Southern Transitional Council (STC) from several southern governorates. Rather than indicating strategic decline, the propaganda activity suggests AQAP is recalibrating its priorities, shifting from sustained local insurgent pressure toward strategic positioning, ideological influence operations, and long-term reconstitution.

The messaging is significant for three reasons. First, it reflects AQAP’s attempt to remain ideologically relevant within the broader al-Qaeda ecosystem despite reduced operational visibility in Yemen. Second, it highlights the growing centrality of the Sahel within al-Qaeda’s global narrative. Third, it demonstrates that AQAP continues to preserve external operations rhetoric and incitement capabilities even during periods of reduced domestic military activity.

Strategic Signal Rather Than Tactical Silence

The significance of AQAP’s latest propaganda releases lies not primarily in their content, but in the strategic timing and dual-direction messaging architecture behind them. While the group has dramatically reduced its claimed attacks inside Yemen since January 2026, it is simultaneously amplifying transnational jihadist messaging, reconnecting itself to al-Qaeda’s broader ecosystem, and reactivating narratives tied to external operations against Western targets.

This divergence between reduced operational visibility and intensified ideological messaging is analytically significant. Historically, AQAP has often used periods of operational recalibration not as indicators of collapse, but as phases of strategic adaptation, network preservation, and asymmetric repositioning. The group’s latest media outputs suggest an attempt to maintain relevance across multiple dimensions simultaneously: locally in Yemen, regionally through alignment with Sahelian jihadist momentum, and globally through renewed incitement narratives aimed at Western audiences.

The timing is particularly notable given the evolving security environment in southern Yemen following the fragmentation and withdrawal of key STC-linked counterterrorism structures. Rather than immediately escalating to large-scale violence, AQAP appears to be prioritising strategic patience, recruitment, propaganda synchronisation, and the exploitation of emerging security vacuums.

AQAP and the Sahelification of al-Qaeda’s Narrative

AQAP’s statement congratulating JNIM represents more than symbolic solidarity. It reflects an observable shift in al-Qaeda’s strategic discourse, in which the African Sahel is increasingly occupying the role once held by Afghanistan, Iraq, or Syria as the movement’s primary theatre of momentum and perceived success.

Recent JNIM offensives across Mali, Burkina Faso, and Niger have strengthened the perception among jihadist circles that the Sahel has become the most viable arena for gradual territorial erosion of state authority. AQAP’s explicit reference to the Taliban’s “liberation of Kabul” is particularly important because it frames Sahelian insurgency not as a localised conflict, but as a model for future jihadist state-building. JNIM’s growing military pressure and rural influence, particularly in central and northern Mali and across Burkina Faso’s border regions.

This rhetorical positioning also serves AQAP’s internal needs. Since at least 2022, the group has faced sustained counterterrorism pressure from UAE-backed STC forces in southern Yemen, particularly through the “Arrows of Righteousness” campaign. The weakening and fragmentation of the STC in early 2026 temporarily removed AQAP’s primary domestic adversary, contributing to the decline in claimed attacks. However, the absence of operations also risks perceptions of stagnation among supporters and rival jihadist actors.

By aligning itself rhetorically with JNIM’s battlefield momentum, AQAP appears to be compensating for its reduced operational tempo while reaffirming its continued relevance within al-Qaeda’s transnational architecture. The statement effectively projects the image of a unified global insurgent ecosystem, linking Yemen and the Sahel under a common narrative of gradual strategic victory against regional governments and Western-backed security structures.

Why the Sahel Matters to AQAP

AQAP’s endorsement of JNIM also reflects a broader structural evolution within al-Qaeda’s global strategic outlook. The African Sahel increasingly represents for al-Qaeda what Afghanistan represented during the 1990s and what parts of Syria represented after 2011: a long-war environment characterised by fragmented state authority, overstretched security forces, weak territorial governance, and gradual insurgent penetration into rural and semi-urban areas.

For al-Qaeda affiliates, the Sahel currently offers several strategic advantages. Unlike Syria or Iraq during the peak years of the Islamic State, the region remains politically fragmented, internationally under-resourced, and operationally permissive for insurgent manoeuvre warfare. JNIM’s ability to sustain attacks across Mali, Burkina Faso, and Niger while simultaneously expanding local influence has likely reinforced perceptions within AQAP that the Sahel constitutes the most viable contemporary model for gradual jihadist expansion.

AQAP’s explicit reference to the Taliban’s seizure of Kabul is therefore not rhetorical symbolism alone. It reflects an effort to frame the Sahel as a theatre where prolonged insurgency, cumulative state exhaustion, and territorial attrition could eventually generate strategic collapse scenarios comparable, in jihadist perception, to Afghanistan in 2021.

This narrative also serves an internal organisational function. By associating itself with JNIM’s momentum, AQAP compensates for its reduced operational tempo in Yemen while reaffirming its ideological alignment with a broader, increasingly interconnected al-Qaeda network stretching from the Arabian Peninsula to West Africa.

External Operations Messaging and the Persistence of Inspire

The May 10 “Inspire, Open Source Jihad” video indicates that AQAP continues to preserve an external operations narrative despite its operational restructuring inside Yemen. The production reiterated longstanding AQAP themes emphasising “individual jihad,” lone-actor attacks, and economic and psychological warfare against Western states.

Read more

This week demonstrated the importance of understanding that jihadist and insurgent groups are maintaining persistent pressure across multiple theatres, which should reinforce the audience’s confidence in the ongoing threat landscape.

Operational Saturation Is Becoming the New Threat Pattern.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line

The Shift of the Week

During the reporting cycle from 19 to 25 May, the threat environment showed a significant shift: the emergence of simultaneous operational saturation across multiple theatres, indicating a broader and more resilient insurgent landscape.

From the Sahel and Somalia to Pakistan and Central Africa, armed groups continued to maintain pressure not through spectacular territorial offensives, but through persistent attacks, propaganda density, assassinations, drone-enabled operations and continuous media output. The result is a threat environment that is becoming broader, more resilient and increasingly normalised.

The most notable indicator was Jama’at Nasr al-Islam wal Muslimin’s (JNIM) sustained activity, with 29 statements and 32 photos claiming responsibility for 32 attacks across Burkina Faso, Mali, and Niger, demonstrating its ability to maintain pressure across multiple fronts and to evolve into a complex operational ecosystem.

This matters because JNIM is no longer operating as a localised insurgency focused on isolated rural warfare. The group is increasingly combining military attacks, logistical disruption, propaganda output, and governance pressure into a sustained operational ecosystem. Its attacks against Malian forces, pro-government militias, Russian Africa Corps personnel and Islamic State-linked actors show a movement attempting to position itself simultaneously as an insurgent force, a territorial actor and an anti-IS competitor.

Islamic State media’s focus on Africa as a main strategic theatre should make the audience feel the critical importance of this region in the global jihadist landscape.

The Somalia coverage was particularly revealing. Islamic State Somalia framed recent clashes in Puntland not as defensive survival, but as operational recovery. Al-Naba repeatedly emphasised that militants had “shifted from defence to offence” in the Ali Maskad mountains, portraying Puntland’s campaign as exhausted and ineffective. This narrative is strategically important because it attempts to transform a peripheral branch into proof of long-term insurgent endurance against state-backed military campaigns.

The same pattern emerged in Central Africa and Mozambique. Islamic State propaganda heavily emphasised attacks against Christian communities, militia structures and Congolese military positions in Ituri, Beni and Cabo Delgado. The operational value of some attacks may be limited, but the cumulative messaging objective is clear: permanence, intimidation and territorial persistence.

This emphasis on drones signals the insurgent ecosystem’s growing technological sophistication, which should reassure the audience about the evolving threat environment.

The deliberate emphasis on drones reflects a broader evolution evident across multiple theatres: insurgent movements are increasingly integrating low-cost technological adaptations into their operational identities. Drone footage, attack videos and training imagery are no longer only recruitment tools. They are demonstrations of technical relevance.

Meanwhile, Tehreek-e-Taliban Pakistan (TTP) continued emphasising symbolic lethality through a suicide-attack video targeting a Pakistani military camp in Bajaur. Together, IMP and TTP activity suggest that Pakistan’s insurgent ecosystem is becoming simultaneously more fragmented and more operationally diverse.

This week, therefore, confirms a broader trend already visible for months: many insurgent and jihadist actors are no longer trying to shock the system through one decisive escalation. Instead, they are attempting to exhaust it through persistent multi-theatre pressure.

Threat Signals

• Signal 1, JNIM maintains strategic depth across the Sahel.

JNIM’s operational tempo across Burkina Faso, Mali and Niger continues demonstrating geographic flexibility and sustained command cohesion. The group’s simultaneous targeting of state forces, militias, Russian-linked personnel and Islamic State elements reflects an insurgent ecosystem increasingly capable of shaping local security environments beyond isolated attacks.

• Signal 2, Africa remains central to the Islamic State’s global messaging

Al-Naba issue 548 again concentrated heavily on African provinces, especially Somalia, Mozambique and Central Africa. This reinforces the long-term shift of Islamic State activity toward theatres where governance gaps, mobility corridors and weak territorial control continue to favour insurgent resilience.

• Signal 3: Drone-enabled insurgency is expanding in Pakistan

IMP’s emphasis on drone-enabled attacks is one of the most important operational developments of the week. The repeated use of drones indicates growing tactical adaptation among Pakistani jihadist ecosystems and reflects wider global diffusion of low-cost aerial capabilities.

• Signal 4, Somalia remains a battlefield of attrition

Both Islamic State Somalia and al-Shabaab continue operating inside fragmented and overstretched security environments. Puntland operations highlighted by al-Naba and al-Shabaab’s continued attack rhythm across Lower Shabelle, Bay, Gedo and Hiiran demonstrate that Somali insurgent theatres remain structurally unresolved.

• Signal 5, Pakistan’s insurgent environment is widening

Alongside jihadist activity, Pakistan also experienced broader insurgent pressure, including high-casualty attacks linked to separatist actors. The cumulative effect is a widening security environment where jihadist groups, separatist insurgencies and anti-state militant ecosystems increasingly overlap geographically and operationally.

The Information Battlefield

The information dimension remained highly active throughout the week, but the dominant pattern was not innovation. It was saturated.

JNIM, Islamic State media and Pakistani jihadist groups all maintained dense operational output through statements, photo reports, attack videos and statistical infographics. The objective was less about announcing isolated victories and more about reinforcing continuity, reach and permanence.

Islamic State propaganda continued emphasising endurance, attrition and decentralised warfare. Al-Naba issue 548 strongly framed Somalia, Mozambique and Central Africa as active fronts where insurgent pressure remains sustainable despite military campaigns. The Somalia coverage was especially notable for its repeated narrative of Puntland’s operational exhaustion and the Mujahideen’s return to offensive activity.

At the same time, IMP’s drone-focused messaging represented a more technical form of propaganda. The group is increasingly using visual material not only to claim attacks but also to demonstrate tactical modernisation and operational sophistication. This reflects a broader trend across insurgent ecosystems: propaganda is becoming a tool of capability projection as much as ideological messaging.

Distribution patterns remained stable across Telegram, Element, and Rocket. Chat, Signal and semi-encrypted dissemination ecosystems. No major platform migration was observed during the reporting period, suggesting that existing dissemination architectures remain functional despite continued moderation pressure.

Why It Matters

For Europe and NATO, the main issue is not the immediate probability of a spectacular attack. It is the growing normalisation of persistent instability across multiple connected theatres.

The Sahel remains the clearest example. JNIM’s sustained operational rhythm across Burkina Faso, Mali and Niger continues to increase long-term pressure on regional states while gradually expanding insecurity toward coastal West Africa. This has implications not only for regional military stability but also for migration routes, trafficking corridors, foreign investments, and European strategic interests in the region.

For counterterrorism agencies, the continued centrality of Africa in Islamic State propaganda is strategically significant. Africa is no longer a secondary extension of the organisation’s global project. In several areas, especially the Sahel, Lake Chad, Somalia and Central Africa, it is becoming one of its main operational reservoirs.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 16 and 23 May, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

• volume and distribution of official propaganda output,

• organisational and geographic dispersion across theatres,

• This focus on operational claims in West Africa, the Middle East, and South Asia highlights active threats. It underscores the need for analysts and policymakers to understand and address these regional dangers.

• The focus on organisational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers that monitoring channels remain stable and dependable, strengthening their confidence in threat awareness.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), published a 2-to 13-minute video showing an ambush on the Malian army Patrol in the Ségou region. Mali

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 29 statements and 32 photos, claiming 32 attacks.

The targets of the attacks were: Malian Army, Malian pro-Government militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Islamic State militia, and Niger Army.

The areas of the attacks were :

1) Burkina Faso = 15

- Yatenga province, Sissili province, Séno province, Boulgou province, Gourma province, Loroum province, and Comoé province.

2) Mali = 12

- Timbuctù region, Mopti region, Ségou region, Kidal region, Sikasso region.

3) Niger = 5

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 13 statements claiming responsibility for 19 attacks.

The targets of the attacks were:

Somali Army, Somali Intelligence, Ethiopian Army, Ugandan Army, Somali pro-government militia.

The areas affected by the attacks were:

1) Somalia = 19

- Janale area, Bariire area, Qoryooley area, Mubarak area, Barawe area, Lower Shabelle region; Baidoa area, Dinsor area, Bay region; Bardhere area, Garbaharey area, Balad Hawa area, Burdubow area, Gedo region; Kismayo area, Lower Juba region; Beledweyne area, Hiiran region; Jowhar area, Middle Shabelle region.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (548). Issue 548, eight pages long, covers the week of dal 26 Dhu al-Qa’dah al 3 Dhu al-Hijjah 1447, from 14 to 20 May 2026. The main infographic summarises the areas affected by military operations this week, including: Nigeria, Somalia, Pakistan, Mozambique, and the Democratic Republic of Congo.

IS claims to have conducted 32 operations in all the mentioned areas and to have caused 150 deaths and injuries.

The Amaq News Agency has issued a statement claiming responsibility for an attack carried out by ISM militants against pro-government militias, civilians and Christian villages in the district of Chiúre, in the province of Cabo Delgado. Mozambique.

The Islamic State’s official media published a photo report of its fighters from the Central Africa Province (ISCAP) attacking a Congolese Army barracks in the Beni area, North Kivu province, DR Congo.

The Islamic State’s official media published a photo report of its fighters from the Central Africa Province (ISCAP) attacking a Congolese Army barracks in the Haut-Uélé province, DR Congo.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), has released an infographic detailing the targets of operations carried out over the last 10 days (9 - 18 May). Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 11 statements, claiming 24 attacks.

Target: Pakistan Army, Pakistan Police, Frontier Corps, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, Orakzai district, Bannu district, Khyber Pakhtunkhwa Province. Pakistan

16 attacks were carried out using drones.

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), published a photo report showing its fighters conducting military training in the Khyber Pakhtunkhwa area. Pakistan

Al-Mansur Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), released 3 videos showing several attacks against the Pakistani Police checkpoint and patrol in the districts of Bannu, in the province of Khyber Pakhtunkhwa, Pakistan.

Umar Media, Tehreek-e-Taliban Pakistan (TTP) released a 7:37-minute video showing its militants carrying out a suicide attack against a Pakistani Army camp in the Bajaur district of Khyber Pakhtunkhwa province in Pakistan.

🔹Weekly Monitoring Notes

The reporting period from 16 to 23 May shows a high-intensity propaganda cycle, with strong output across Al-Qaeda affiliates, Islamic State official media, and Pakistan-based jihadist networks.

Read more

Document Type: Executive Intelligence Briefing
Scope: Global Jihadist, Insurgent & Hybrid Warfare Threat Assessment
Time Horizon: Rolling Forecast (30–90 Days)
Reference Period: June- August 2026.

This document is an independent analytical product intended for professional use by analysts, policy planners, security practitioners, and decision-makers.

Intended Audience & Use

This Executive Intelligence Briefing is intended for use by intelligence analysts, policy planners, military and security decision-makers, international organisations, and applied academic researchers concerned with the threat dynamics of jihadist, insurgent, and hybrid warfare.

The document supports strategic awareness, forward-looking risk assessment, and prioritising monitoring over a rolling 30–90-day horizon. It is not intended to provide tactical-level tasking, real-time operational guidance, or event-specific prediction. The briefing should be used as a decision-support and situational-awareness tool, informing planning, posture adjustment, and analytical focus rather than immediate response.

📌 Inside this Executive Intelligence Briefing

This briefing includes:

• Regional Strategic Snapshots

  • Africa: ISWAP, IS-Sahel, IS-Somalia, ISM, ISCAP, JNIM, al-Shabaab, Boko Haram, Lakurawa.

  • Middle East & Asia: IS Syria/Iraq, AQAP, Ajnad Beit al-Maqdis, AQIS, ISKP, ISPP, ISEAP, TTP, Ittehad-ul-Mujahidin Pakistan, Ansar al-Furqan.

• Cognitive & Information Domain – Key Signals: This section highlights critical threat signals and propaganda trends, reinforcing the need for continuous vigilance and analytical awareness among security professionals.
  Propaganda trends, narrative targeting, mobilisation signals, Cognitive Warfare dynamics, and Cognitive Control assessment.

• Transnational Networks & Secondary Threat Environment

  Monitoring the spread of external threats.

• Forward Threat Forecast (30–90 Days) & Escalation Triggers Matrix
  Baseline and alternative scenarios, early warning indicators, and escalation triggers.

• Implications & Monitoring Priorities
  Decision-relevant implications for intelligence, policy, military planning, and security practitioners.

• Monitoring Checklist, Executive “So What?” & Strategic Risk Hierarchy
  A structured checklist for the next 30–90 days and a final executive-level synthesis.

Executive Overview – Strategic Context

Entering the June–August 2026 window, the global jihadist, insurgent, and hybrid threat environment is best assessed as persistent, fragmented, and escalation-sensitive, rather than strategically expansive. No assessed actor currently demonstrates the capacity to generate a coordinated global escalation or restore large-scale territorial control. The dominant pattern remains distributed pressure, sustained through localised insurgency, selective attacks, cognitive mobilisation, and hybrid activity below conventional escalation thresholds.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 548 last Thursday.

The threat level, categorized as ‘Medium–High,’ is based on specific indicators such as attack frequency, geographic spread, and operational capacity, helping security professionals gauge the immediacy and severity of Islamic State activities.

Trend: → stable with increased West Africa concentration, underscoring the importance of rural insurgency as a key strategic concern for the audience.

Time horizon: 30–90 days

Confidence level: Medium

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 548, including photographs, statements, and alleged military activities, providing a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritize intelligence, rural security, and stabilization, empowering the audience to take targeted action.

Issue 548, eight pages long, covers the week of dal 26 Dhu al-Qa’dah al 3 Dhu al-Hijjah 1447, from 14 to 20 May 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

This week’s security picture highlights a broader transformation across the global threat environment. In West Africa, the reported killing of Abu-Bilal al-Minuki during a joint U.S.-Nigerian operation reinforced the growing strategic importance of African jihadist theatres. At the same time, continuing instability in Gaza and the arrest in Türkiye of Mohammad Baqer Saad Dawood al-Saadi, an alleged Kata’ib Hezbollah figure accused by U.S. prosecutors of involvement in external attack planning, pointed to the expanding transnational dimension of modern militant and proxy networks.

Taken together, these developments reflect a larger shift. Armed movements are becoming harder to contain, not because they are territorially stronger everywhere, but because they are increasingly decentralized, locally embedded, and operationally adaptable. From the Sahel and Lake Chad to Gaza and transnational proxy ecosystems, the issue is no longer only the survival of individual groups. It is the persistence of fragmented insecurity across multiple connected theatres.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line

The Shift of the Week

Africa Is Becoming the Center of Gravity of Persistent Insurgency

The reported killing of Abu-Bilal al-Minuki in northeastern Nigeria during a joint U.S.-Nigerian operation was one of the most significant counterterrorism developments of the week. Nigerian and U.S. officials described al-Minuki as a senior Islamic State-linked figure associated with ISWAP activity across the Lake Chad region.

But the importance of the operation goes beyond removing a single commander.

What matters is what the case reveals about the broader trajectory of global jihadist violence. Africa’s rise as the ‘center of gravity’ indicates a shift in strategic focus, emphasizing the need for long-term regional countermeasures and resource allocation to address persistent insurgency across Nigeria, the Sahel, and Central Africa.

From Nigeria and the Sahel to Somalia and parts of Central Africa, jihadist organizations continue to exploit weak governance, porous borders, economic fragility, and uneven military control. These environments allow insurgent networks not only to survive but to maintain long-term operational pressure despite leadership losses and sustained counterterrorism campaigns.

ISWAP itself illustrates this evolution. The group has repeatedly endured military pressure, factional competition, and leadership attrition while maintaining attack capability, taxation systems, mobility corridors, and local recruitment structures. Its resilience does not depend exclusively on charismatic leadership. It depends on embedded insurgent infrastructure.

The second major event was the killing of Izz al-Din al-Haddad, identified by Israel and confirmed by Hamas sources as the head of Hamas’s armed wing in Gaza. Reuters described him as the most senior Hamas official killed since the U.S.-backed ceasefire began in October, while Israeli officials framed him as one of the architects of the 7 October 2023 attacks.

Here again, the operational achievement is significant, but the strategic outcome remains uncertain. Removing a senior commander can degrade decision-making, disrupt command continuity, and intensify internal pressure. But Gaza remains a fragmented battlespace, and Hamas’s residual military and political capacity cannot be measured only through leadership survival. The real indicator to watch is whether the killing accelerates Hamas’s command fragmentation, pushes remaining cadres toward more clandestine cells, or hardens the group’s position in ceasefire and disarmament negotiations.

The third development is different but equally important. U.S. prosecutors unsealed a complaint against Mohammad Baqer Saad Dawood al-Saadi, described as an Iraqi Kata’ib Hezbollah commander. The complaint alleges that al-Saadi helped direct attacks and attempted attacks against U.S., Israeli, and Jewish targets across Europe, Canada, and the United States, under the name Harakat Ashab al-Yamin al-Islamiya, described in the complaint as a component of Kata’ib Hezbollah. These are allegations, not convictions, but the document points to a serious concern: Iran-aligned proxy activity may be moving beyond regional deterrence and into external attack networks targeting civilian and symbolic sites abroad.

This is the real weekly shift: leadership targeting is intensifying, but threat diffusion is as well.

In Africa, Islamic State-linked networks continue to exploit weak governance and cross-border sanctuaries. In Gaza, Hamas faces leadership attrition but not necessarily immediate strategic collapse. In the Iran-linked proxy environment, the alleged al-Saadi network suggests a possible externalization of conflict pressure into Europe and North America. These are different actors, different ideologies, and different theatres, but the pattern is similar: networks survive by dispersing, embedding locally, and operating through layered structures.

While killing leaders and disrupting cells are vital, recognizing that the system persists despite these actions should reinforce the need for continuous, adaptive security strategies for professionals and policymakers.

Recent Islamic State propaganda output, including recurring messaging in al-Naba and affiliated dissemination ecosystems, continues to emphasize endurance, attrition, and operational continuity rather than immediate territorial conquest. This reflects a broader strategic adaptation visible across multiple theatres, especially in Africa, where insurgent groups increasingly prioritize sustained pressure over symbolic expansion.

Threat Signals

• Signal 1: Africa is no longer a secondary jihadist theatre.

The al-Minuki case reinforces the growing centrality of Africa in the Islamic State’s global architecture. West Africa, the Sahel, Central Africa, and Somalia now provide the movement with operational depth, propaganda material, recruitment space, and long-term insurgent viability. The risk is not only more attacks. The risk is normalization of jihadist governance pressure in areas where state authority is already thin.

• Signal 2, Gaza remains a leadership attrition battlefield

The killing of al-Haddad removes a senior Hamas military figure, but it does not automatically resolve the Gaza problem. The key indicator is whether Hamas loses command and coherence, or adapts by becoming smaller, more compartmentalized cells. If the latter happens, the conflict becomes less visible but harder to terminate.

• Signal 3: Iran-linked proxy activity may be testing external reach.

The al-Saadi complaint highlights a concerning trend: Iran-linked proxy activity may be expanding beyond regional conflicts into external attack planning in Europe and North America. Clarifying potential escalation pathways can better inform strategic threat mitigation efforts.

• Signal 4, counterterrorism cooperation is becoming more kinetic

The U.S.-Nigerian operation in Borno indicates a more active U.S. role in targeting Islamic State-linked nodes in Africa. If sustained, this could improve short-term disruption. It could also increase jihadist propaganda opportunities if militant media ecosystems exploit civilian harm, sovereignty narratives, or anti-Western framing.

• Signal 5: The threat is becoming harder to explain to general audiences

The same week includes IS in Nigeria, Hamas in Gaza, Kata’ib Hezbollah-linked allegations, European attack planning, and wider instability across jihadist theatres. This is exactly why Weekly Threat Shift is needed: the public sees disconnected headlines, but the strategic picture is one of networked, adaptive, and persistent insecurity.

The Information Battlefield

The information dimension continues to evolve alongside physical insurgency. Over the past weeks, pro-IS dissemination ecosystems remained active on Telegram and smaller encrypted platforms, while al-Qaeda-aligned narratives increasingly focused on legitimacy, endurance, and local embedding. The objective is no longer only recruitment. It is narrative persistence: maintaining ideological continuity despite territorial fragmentation and leadership losses.

Why It Matters

For Europe, the most relevant issue is not whether every external plot succeeds. It is whether hostile networks are increasingly willing to use European territory as a pressure space. The al-Saadi case, if proven in court, would indicate a serious intent to operationalize external attacks against Jewish, Israeli, and U.S.-linked targets beyond the Middle East.

For NATO and Western security institutions, Africa remains the most underestimated theatre. The killing of a senior Islamic State figure in Nigeria is not just a Nigerian counterterrorism story. It reflects the strategic weight of Lake Chad and the wider African jihadist arc, where local insurgencies are increasingly taking on global relevance.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organization’s operational tempo, geographic dispersion, and signaling posture across theatres.

The weekly newsletter reached number 547 last Thursday.

The threat level remains Medium–High, with episodic operational spikes indicating periods of increased activity that require close monitoring.
Trend: → stable with increased West Africa concentration
Time horizon: 30–90 days
Confidence level: Medium

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material in al-Naba Issue No. 547, including photographs, statements, and alleged military activities, providing a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualize reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• Where claims cannot be corroborated, this is explicitly noted in the analysis.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritize event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism

Issue 547, eight pages long, covers the week of 19 to 25 Dhul Qi’dah 1447, from 7 to 13 May 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 9 and 15 May, providing structured situational awareness across multiple organizations and theatres.

This brief underscores the critical operational claims and targets, emphasizing their relevance to threat recognition and strategic priorities, helping analysts and policymakers recognize the ongoing threat and its impact on their strategic priorities.

• volume and distribution of official propaganda output,

• organizational and geographic dispersion across theatres,

• This focus on operational claims in West Africa, the Middle East, and South Asia highlights active threats and underscores the need for analysts and policymakers to understand and address these regional dangers.

• The focus on organizational and media analysis, including new branding and campaign framing, aims to reassure analysts and policymakers that monitoring channels remain stable and dependable, strengthening their confidence in threat awareness.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and their efforts are crucial in threat understanding.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda released by a predefined list of jihadist organizations and affiliated groups, selected for operational relevance and threat level, during the reporting period.

The focus on documentation, classification, and structured presentation of primary-source material aims to instill confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis is based exclusively on primary-source propaganda material, including official magazines, videos, photo sets, statements, claims of responsibility, and audio statements, to clarify the scope of sources used and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorized by organization, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends, which analysts should interpret within a broader context to support accurate threat assessment and avoid overestimating significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analyzed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• AQAP

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

• Jamāʿat Ahl as-Sunna li-daʿwa wa l-Jihād

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Al-Malahem Media, Al-Qaeda in the Arabian Peninsula (AQAP), published a statement entitled: “Congratulations and blessings to our brothers in the African Sahel”.

The statement congratulates Jama’at Nusrat al-Islam wal-Muslimin (JNIM) on its recent military operations in the African Sahel, hailing its operations as a model for confronting “the enemies of the faith” and local government forces.

The statement urges members and supporters of jihadist groups to remain steadfast and continue fighting.

The text directly alludes to the possibility of replicating the Taliban’s “liberation of Kabul” in the cities and towns of the African Sahel as well.

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 19 statements and 10 photos, claiming 22 attacks.

The targets of the attacks were: the Malian Army, the Russian PMC Africa Corps, the Burkinabé Army, the VDP militia, the Niger Army, and the Benin Army.

The areas of the attacks were :

1) Burkina Faso = 14

- Yatenga province, Sissili province.

2) Mali = 6

- Ségou region, Timbuctù region.

3) Benin = 1

- Korga area, Atakora department.

4) Niger = 1

- Tillaberi region.

Al-Fatah Media and Jama’at Nasr al-Islam wal Muslimin (JNIM) released a video message from Abu Huzayfa al-Bambari.

In the video, he denies any foreign involvement in the coordinated attacks of 25 April across Mali.

Abu Huzayfa also mentioned the involvement of civilians in the clashes in Bamako, Kati, and Ségou, threatening ‘severe punishment’ through a complete blockade of the capital, which would affect both food supplies and fuel.

However, he adds that certain measures could be relaxed for people requiring urgent medical assistance, having received several complaints from citizens stranded inside or outside Bamako. Mali

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), published a 1-20 minute video showing an attack on the Malian army Patrol in the Niono district of the Ségou region. Mali

Al-Kataib Media, Harakat al-Shabaab al-Mujahidin (AS), released a statement from its military command announcing violent clashes between its militants and the Somali armed forces.

In the statement, AS emphasizes that it will continue the struggle “for the establishment of Islamic Sharia law” and the expulsion of foreign forces from Somali territory, urging civilians to stay away from the bases, headquarters, and facilities of foreign forces and the local forces supporting them. Somalia

Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 10 statements claiming responsibility for 17 attacks.

The targets of the attacks were:
Somali army, Ugandan Army, Somali pro-government militia.

The areas affected by the attacks were:

1) Somalia = 17

- Beledweyne area, Hiiran region; Musgaway area, Galguduud region; Janale area, Mubarak area, Barawe area, Bariire area, Afgoye area, Lower Shabelle region; Baidoa area, Bay region; Mogadishu area.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (547). The main infographic summarises the areas affected by military operations this week, including: Nigeria, Cameroon, Syria, Somalia, Pakistan, Mozambique, and the Democratic Republic of Congo.

IS claims to have conducted 26 operations in all the mentioned areas and to have caused 158 deaths and injuries.

In this issue of the weekly magazine al-Naba, Islamic State published an infographic showing the terrorist attacks carried out over the past seven days by ISCAP militants against civilians and Christian villages in the provinces of Ituri and North Kivu.

ISCAP claims to have carried out 6 attacks and killed 87 people. DR Congo

In this issue of the weekly al-Naba, Islamic State also published an infographic showing the terrorist attacks carried out over the past 7 days by ISWAP militants against the Nigerian army (particularly against military camps) in the states of Borno and Yobe. ISWAP claims to have carried out six attacks and killed 32 soldiers. Nigeria

The Amaq news agency, the official media of the Islamic State, released a 27-second video showing an IED attack carried out by militants in the province of Mozambique (ISM) against a Rwandan army patrol in the district of Macomia, in the province of Cabo Delgado.

The Amaq News Agency, the official media of the Islamic State, has released a 59-second video showing militants from the West Africa Province (ISWAP) carrying out two large-scale attacks on two Nigerian army camps in the Buni Yadi area, in Yobe State. Nigeria

The Amaq news agency, the official media of the Islamic State, published a lengthy statement claiming responsibility for multiple nighttime attacks carried out by militants from the West Africa Province (ISWAP) against a Nigerian army camp in the Magumeri area, Borno State. Nigeria

The Amaq News Agency, the official media of the Islamic State, published a lengthy statement claiming that militants from the West Africa Province (ISWAP) have launched 2 major attacks on 2 Nigerian army camps in the Buni Yadi area, in Yobe State. Nigeria

Amaq News Agency, the Islamic State’s official media, published a lengthy statement claiming an ambush on a Syrian Army patrol in the area of al-Hasaka governorate. Syria

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 17 statements, claiming 17 attacks.

Target: Pakistan Army, Pakistan Police, Frontier Corps,

Area:

- Hangu district, Mohmand district, North Waziristan district, South Waziristan district, Orakzai district, Bannu district;

Khyber Pakhtunkhwa Province. Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organization comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam, and Harkat Inqilab-e-Islami Pakistan (HIIP), has released an infographic detailing the targets of operations carried out over the last 10 days (28 April – 8 May). Pakistan

Mohammad Khorasani, spokesperson for Tehrik-e-Taliban Pakistan (TTP), announced in a statement that jihadist groups from the area of Kurram district pledged allegiance to Tehreek-e-Taliban Pakistan and its emir, Abu Mansoor Asim Mufti Noor Wali Mehsud Hafizullah. Pakistan

Jamāʿat Ahl as-Sunna li-daʿwa wa l-Jihād, also known as Boko Haram, released a video lasting around four minutes showing an attack on a Chadian army base in the Bara Tolorom area, in the Lake Chad basin, using armed boats. Chad

🔹Weekly Monitoring Notes

The reporting period from 9 to 15 May shows a sustained high-output propaganda cycle, with strong activity across Al-Qaeda affiliates, Islamic State official media, and Pakistan-based jihadist networks. The week is defined by four main features: AQAP’s public endorsement of JNIM’s Sahel campaign, JNIM’s continued coercive messaging around Bamako, the Islamic State’s renewed emphasis on ISCAP and ISWAP, and persistent operational consolidation by IMP and TTP in Pakistan.

Read more