This weekly intelligence brief documents and structures official jihadist propaganda output released between 17 and 24 July, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, reassuring analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehreek-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

Al-Qaeda (AQ)

Az-Zallaqa Media, Jama'at Nasr al-Islam wal Muslimin (JNIM), has issued a statement claiming to have carried out a large-scale ambush in the Gao region against the Malian army and the Russian private military company Africa Corps, in collaboration with the Azawad Liberation Front (FLA). Mali

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 32 statements and 13 photos, claiming 39 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia.

The areas of the attacks were :

1) Burkina Faso = 19

- Yatenga province, Séno province, Loroum province, Boulgou province, Séno province, Gourma province, Bam province.

2) Mali = 20

- Gao region, Sikasso region, Mopti region, Tombouctou region, Segou region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 14 statements claiming responsibility for 20 attacks.

The targets of the attacks were:

Somali Army, Somali Police, Somali pro-government militia, Ugandan Army, Ethiopian Army, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 16

- Afgooye area, Bulunagi area, Janale area, Mubarak area, Shalanbud area, Merca area, Lower Shabelle region; Afmadow area, Lower Juba; Qansahdhere area, Baidoa area, Bay region; Buloburde area, Beledweyne area, Tedan area, Hiiran region; Wajid area, Bakool region; El Wak area, Luuq area, Garbaharey area, Gedo region; Jowhar area, Middle Shabelle region; Masagaway area, Galguduud region, Mogadiscio area.

2) Kenya = 4

- Dadaab area, Garissa County;

- Lafey area, Mandera County.

In the third issue of the weekly Al-Bayan, published by the pro-AQ media outlet al-Yaqin (which has since also launched a dedicated al-Bayan channel on Telegram), which this time runs to 13 pages, features the usual infographic summarising the attacks of the past week, religious messages, reports on the activities of al-Shabaab and JNIM, and an editorial addressing the ongoing conflict between the US and Iran.
In the editorial, al-Qaeda reaffirms the need to wage armed struggle as the only means of defeating its enemies.

2. Islamic State (IS)

The official media of the Islamic State published 2 issues of the weekly al-Naba this week (556 and 557). Issue 556, eight pages long, covers the week of 24 Muharram to 1 Safar 1448, from 9 to 15 July 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Iraq, and the Democratic Republic of Congo.

IS claims to have conducted 21 operations in all the mentioned areas and to have caused 34 deaths and injuries.

Issue 557, eight pages long, covers the week of 2 to 8 Safar 1448, from 16 to 22 July 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Mozambique, and the Democratic Republic of Congo.

IS claims to have conducted 22 operations in all the mentioned areas and to have caused 100 deaths and injuries.

In issue 557, the Islamic State published an infographic regarding its province in Central Africa. ISCAP reportedly carried out 32 attacks, resulting in 184 deaths and injuries, over the past 5 weeks.

Among the targets, in addition to the Congolese army, pro-government militias, and Christian villages, ISCAP claims to have attacked and taken control of three mining sites (thus in line with its economic warfare strategy). The affected areas are the provinces of Haute Uele, North Kivu, and Ituri. DR Congo

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 13 statements, claiming 19 attacks.

The group continues to make extensive use of SVBIED, drones and suicide attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, Khyber district, Hangu district;

Khyber Pakhtunkhwa Province, Pakistan

As-Saif Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising Hafiz Gul Bahadur’s (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), published a video showing a series of drone attacks carried out by militants from Jaish al-Harith, a branch of the IMP, against Pakistani army barracks and bases in the South Waziristan district of Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), has released a 4:39-minute video showing attacks by its militants on Pakistani police and CTD convoy in the Lower Dir district, in the province of Khyber Pakhtunkhwa, Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), has published a photo report showing the training of its militants. Pakistan

🔹Weekly Monitoring Notes

The reporting period from 17 to 24 July reflects a sustained high-volume propaganda cycle across the principal jihadist ecosystems, although the balance of activity shifted slightly from the previous week.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 557 last Thursday.

The weekly newsletter’s increased focus on West Africa aims to underscore its critical role, encouraging the audience to recognize the region’s strategic significance and feel motivated to prioritize region-specific countermeasures.


Time horizon: 30–90 days

The confidence level is assessed as Medium, reflecting the reliability of sources and verification methods used, which informs the assessment’s credibility and helps decision-makers understand its limitations.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material from al-Naba Issue No. 557, supplemented by OSINT, IMINT, and SOCMINT, which collectively provide a comprehensive and corroborated view of current operations, supporting informed decision-making.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• The claims published in al-Naba are generally reliable regarding the occurrence of attacks; however, casualty and damage figures may be inflated for propaganda purposes, a fact that should be considered when assessing operational impact.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 557, eight pages long, covers the week of 2 to 8 Safar 1448, from 16 to 22 July 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Mozambique, and the Democratic Republic of Congo.

IS claims to have conducted 22 operations in all the mentioned areas and to have caused 100 deaths and injuries.

In this issue, the Islamic State published an infographic regarding its province in Central Africa. ISCAP reportedly carried out 32 attacks, resulting in 184 deaths and injuries, over the past 5 weeks.

Among the targets, in addition to the Congolese army, pro-government militias, and Christian villages, ISCAP claims to have attacked and taken control of three mining sites (thus in line with its economic warfare strategy). The affected areas are the provinces of Haute Uele, North Kivu, and Ituri. DR Congo

On the fourth page, the weekly magazine goes into detail about the types of attacks, operations, and targets of Islamic State fighters, who follow two main strategies: “war of attrition” and “economic warfare”, as well as other methods aimed at targeting Christians and Shiites. Since 20 March 2025, the Islamic State has embarked on a new military campaign, particularly in Africa (in the areas of Nigeria, Niger, Cameroon, and Mozambique), called “Burning Camps”.

Below is a detailed account of the attacks by province/area:

1) Central Africa Province: The weekly al-Naba reports that ISCAP militants carried out 8 attacks against Congolese army patrols and barracks, pro-government militias, and Christian villages in the provinces of Ituri and North Kivu in the Democratic Republic of the Congo.

2) West Africa Province: The weekly al-Naba reports 13 attacks carried out by ISWAP militants against checkpoints, convoys, patrols, and camps belonging to the Nigerian Army, the Nigerian Police, and pro-government militias in the states of Borno and Yobe, Nigeria.

3) Mozambique Province: The weekly al-Naba reports on 1 operation carried out by ISM militants who captured and killed two Christian fighters from pro-government militias in the Ancuabe district of Cabo Delgado province, Mozambique.

CONCLUSION 1 — Strategic Impact and Operational Implications

Issue 557 confirms that the Islamic State’s operational centre of gravity remains concentrated in Africa, with 22 claimed operations and 100 reported deaths and injuries across Nigeria, the Democratic Republic of Congo, and Mozambique. The weekly pattern does not indicate a broad strategic escalation, but it does show sustained pressure in the organisation’s most resilient theatres.

ISCAP represents the most significant development. Eight attacks during the reporting week, combined with the five-week total of 32 operations and 184 reported casualties, indicate a sustained campaign rather than episodic violence. The claimed seizure of three mining sites is particularly relevant. It suggests an effort to translate military access into economic leverage, local taxation, resource capture, and coercive influence over commercial activity. This development is consistent with the Islamic State’s economic warfare doctrine and may provide ISCAP with additional funding, logistical depth, and bargaining power over local communities.

The expansion of activity across Ituri, North Kivu, and Haute Uele also demonstrates that ISCAP retains mobility across a broad and fragmented security environment. Its simultaneous targeting of the Congolese military, local militias, Christian villages, and mining infrastructure reflects a multidimensional insurgent strategy combining attrition, population intimidation, territorial penetration, and resource exploitation.

ISWAP remained the most active affiliate numerically, with 13 attacks against military and police positions across Borno and Yobe. The targeting pattern remains consistent with a campaign designed to degrade mobility, disrupt forward deployments, and exhaust local security forces through repeated pressure on checkpoints, convoys, patrols, and camps. The absence of major tactical innovation does not reduce the strategic significance of this tempo, which continues to impose cumulative operational costs.

Mozambique remained a lower volume theatre, but the capture and execution of pro government militia members illustrates the continued use of selective violence to intimidate local auxiliaries and weaken community based security structures.

Overall, Issue 557 indicates sustained African insurgent resilience, with ISCAP showing the clearest signs of broadening from military attrition into local economic control.

CONCLUSION 2 — Implications for Policy and Counterterrorism

The most immediate policy concern is the reported ISCAP penetration of mining areas. Counterterrorism planning in eastern Congo should now treat extractive sites, transport corridors, commercial convoys, and local revenue networks as integral components of the operational battlespace. Failure to protect these assets could allow the group to develop more durable financing structures and deeper influence over surrounding communities.

Security responses should prioritise persistent surveillance around mining zones, improved protection of commercial routes, financial intelligence on illicit mineral flows, and closer coordination between military units, local authorities, and private operators. Operations focused exclusively on militant concentrations will remain insufficient if ISCAP retains access to economic resources and coercive taxation mechanisms.

In Nigeria, the continued ISWAP tempo reinforces the need to improve convoy security, checkpoint survivability, intelligence protection, and rapid reinforcement capacity. Repeated tactical losses at isolated positions are not isolated incidents, but part of a deliberate attritional strategy aimed at reducing state reach across contested rural areas.

Civilian protection also remains central. Attacks against Christian villages and local militias create displacement, weaken intelligence cooperation, and facilitate insurgent penetration. Stabilisation measures should therefore accompany kinetic operations, particularly in eastern Congo and Cabo Delgado.

For NATO, EU, UN, and regional intelligence stakeholders, Issue 557 underscores a broader analytical point: the Islamic State threat in Africa is evolving beyond attack frequency alone. The critical indicators are increasingly control over resources, influence over commercial routes, coercion of local populations, and the ability to convert tactical presence into durable territorial and economic leverage.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The third week of July highlighted a recurring pattern that is becoming increasingly visible across Europe and beyond. The most significant security developments were not completed attacks, but the disruption of threats that had already moved beyond ideological sympathy into concrete operational preparation. In several cases, investigators identified individuals who had progressed from consuming extremist material to acquiring technical knowledge, selecting potential targets or preparing the means to carry out violence.

The arrest of a 17-year-old in Italy accused of participating in Islamic State-related activities, together with the prosecution of a 15-year-old in Germany for allegedly preparing an attack against a synagogue, illustrates how the transition from online radicalisation to operational intent is becoming both shorter and more difficult to detect. At the same time, France’s public attribution of a long-running Russian cyber-espionage campaign demonstrates that hostile preparation is not limited to terrorist actors. State-sponsored operations increasingly target government institutions long before any overt confrontation occurs.

Beyond Europe, an ambush jointly claimed by JNIM and the Front de Libération de l’Azawad (FLA) in northern Mali offered another reminder that tactical cooperation between armed groups can rapidly reshape local security dynamics without requiring formal alliances or organisational mergers.

Recognising these indicators early can empower security institutions, reinforcing their confidence in preventing violence before it occurs.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Infographic: Threats Before the Attack

3. Threat Signals

4. The Information Battlefield

5. Why It Matters

6. Watchlist, Next 30 Days

7. Strategic Consequence

8. Final Analytical Line.

The Shift of the Week

Threats Before the Attack

The most important lesson from this reporting period is that modern security threats increasingly reveal themselves long before violence actually occurs. Rather than spectacular attacks dominating the headlines, this week was characterised by investigations that exposed advanced stages of preparation across very different threat environments.

The Italian investigation represents one of the clearest examples of this evolution. Authorities arrested a 17-year-old accused of participating in an Islamic State-related terrorist organisation after identifying prolonged activity inside invitation-only Telegram channels supporting the group. According to investigators, her online activity extended well beyond passive consumption of propaganda. She allegedly shared extremist material, expressed support for martyrdom and downloaded manuals describing the construction of an explosive belt.

Understanding how closed digital communities support radicalisation can help policymakers feel better equipped to influence and manage these environments.

A similar dynamic emerges from Germany, where prosecutors accused a 15-year-old of preparing an attack against a synagogue. According to the investigation, the suspect had accumulated explosive materials and previously experimented with homemade devices, causing serious injuries to himself during one failed detonation. While judicial proceedings remain ongoing and the allegations have yet to be tested in court, the case illustrates another important trend. Technical experimentation is becoming an increasingly visible indicator of operational intent.

Read more

Africa remains the Islamic State’s primary global theatre of operations, surpassing the Middle East and Asia in attack volume and organisational strength, underscoring the critical need for vigilance among security and policy leaders to address this evolving threat.

Scope and Methodology

This Strategic Threat Outlook is based on:

systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

reporting from sources in the field;

Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

• Overview and Security Threat Assessment

• Activity and Operations Analysis — June 2026

• Number, Targets, and Areas of Attacks in June 2026

• Charts and Statistics

• Analytical and Intelligence Assessments

• Implications for Decision Makers

• Early Warning Indicators

• Threat Forecast, 30 to 90 Days

• Executive Intelligence Conclusion and Risk and Threat Overview.

Provincial Snapshots

• Islamic State West Africa Province (ISWAP)

• Islamic State Sahel Province

• Islamic State Central Africa Province (ISCAP)

• Islamic State Somalia Province

• Islamic State Mozambique Province (ISM).

Overview – Islamic State in Africa

The Islamic State’s presence in Africa is resilient and adaptive, demonstrating high operational continuity despite counterterrorism efforts, which should reinforce the importance of sustained strategic focus for security officials to counter this persistent threat.

In Africa, IS affiliates demonstrate high operational continuity, executing attacks with diverse tactics like assaults, ambushes, kidnappings, and terror campaigns, especially against Christian communities, in recent months.

The epicentre of this dynamic remains sub-Saharan and central-eastern Africa, with particularly worrying developments in the Democratic Republic of Congo and Mozambique, where IS affiliates have demonstrated not only a capacity for sustained violence, but also a growing level of coordination, intermittent territorial control, and integration with local criminal economies. In such contexts, violence is not episodic but part of a strategy of progressive erosion of state authority, exploiting structural fragility, socio-economic marginalisation, inter-community conflicts, and governance vacuums.

On March 20, 2025, the Islamic State officially announced the launch of a new military campaign, called “Burning Camps,” with a stated focus primarily on Africa. This campaign’s implications include heightened regional instability, increased displacement, and the need for enhanced security cooperation among affected nations to counteract these threats.

The strategy remains consistent with the Islamic State’s operating model: creating chronic instability, delegitimising the state, presenting itself as an alternative (or inevitable) actor, and exploiting chaos to facilitate recruitment, logistical support, and territorial entrenchment. In this sense, IS does not aim exclusively at permanent territorial conquest but at fluid, opportunistic control sufficient to maintain freedom of manoeuvre and offensive capability.

Currently, the Islamic State is actively and continuously operating in at least eight African countries, with monthly variations in geographical distribution and intensity of activities. During the period under review, the organisation focused its efforts on fewer theatres without reducing overall capacity, indicating a decentralised yet functional structure.

A central and often underestimated element is the propaganda dimension. Every significant attack has been followed by intense media activity. In the month analysed, the Islamic State disseminated a significant volume of content, photographs, videos, and press releases through its central channels, in particular the Amaq news agency and the weekly al-Naba. Propaganda is not limited to claims of responsibility but constructs a narrative of success, resilience, and inevitability, aimed at both local supporters and a global jihadist audience.

In summary, the African picture shows an Islamic State that is not in decline but in a phase of adaptive consolidation, capable of absorbing losses, reorienting priorities, and exploiting the structural weaknesses of local contexts. For intelligence, security, and political and military decision-makers, Africa is not a secondary front but the current centre of gravity of the threat posed by the Islamic State, emphasising the need for sustained vigilance.

Islamic State in Africa - Activities — June 2026

Islamic State activity across Africa remained geographically dispersed during June, with operational continuity recorded across the Lake Chad Basin, eastern Democratic Republic of the Congo, northern Mozambique, western Niger and Puntland.

Read more

As of June 2026, the Islamic State remains a resilient and decentralised insurgent actor operating across the Middle East and South Asia, capable of sustaining operational relevance despite a contained overall attack volume.

The organisation continues to operate within a post-territorial insurgent model defined by decentralised cells, localised autonomy, and the selective use of violence. There is no indication of an attempt to reconstitute territorial governance or to rebuild proto-state structures. Instead, IS prioritises survivability, targeted disruption, and the gradual erosion of state authority through low-visibility, high-impact actions.

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted. However, the limitations posed by incomplete or delayed reporting from conflict zones, propaganda bias, and disinformation may affect the precision of threat assessments, necessitating cautious interpretation of available data.

Provincial Snapshots

• Islamic State Sham;

• Islamic State of Iraq;

• Islamic State Khorasan;

• Islamic State Pakistan;

• Islamic State East Asia.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — June 2026

3. Number, Targets, and Areas of Attacks in June 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

Entering 2026, the Islamic State should no longer be analysed through the lens of territorial revival scenarios. The organisation has conclusively transitioned to a post-territorial insurgent configuration that prioritises survival, network preservation, and selective destabilisation over overt expansion.

The structural features identified in 2025 remain intact. IS continues to operate as a decentralised ecosystem of locally embedded nodes, loosely connected by ideological cohesion and brand identity rather than a rigid command hierarchy. Central leadership functions primarily as a symbolic and narrative anchor, while operational initiative remains provincial and context-driven.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 9 and 16 July, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehreek-e-Taliban Pakistan

• People’s Fighters Front

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), released a 5:07-minute video showing an ambush on a Malian Army convoy in the Ségou region of Mali.

Az-Zallaqa Media, Jamaat Nusrat al-Islam wal-Muslimin (JNIM), has released a two-minute video showing an attack on the headquarters of pro-government militias in the Tiara area, in Houet province, Burkina Faso.

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 23 statements and 20 photos, claiming 51 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia.

The areas of the attacks were :

1) Burkina Faso = 20

- Yatenga province, Séno province, Sourou province, Gourma province, Poni province, Mouhoun province, Banwa province, Passoré area, Namentenga province, Yagha province.

2) Mali = 29

- Kayes region, Koulikoro region, Mopti region, Tombouctou region, Segou region; Bamako area.

3) Niger = 2

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 10 statements claiming responsibility for 23 attacks.

The targets of the attacks were:

Somali Army, Somali Intelligence, Somali pro-government militia, Ethiopian Army, Ugandan Army.

The areas affected by the attacks were:

1) Somalia = 23

- Bulomarer area, Bulunagi area, Janale area, Mubarak area, Lower Shabelle region; Qansahdhere area, Bardale area, Bay region; Buloburde area, Beledweyne area, Tedan area, Hiiran region; Wajid area, Bakool region; El Wak area, Luuq area, Garbaharey area, Gedo region; Jowhar area, Middle Shabelle region; Masagaway area, Galguduud region, Mogadiscio area.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (555). Issue 555, eight pages long, covers the week of 17 to 23 Muharram 1448, from 2 Jul8 to 8 July 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Pakistan, Somalia, and the Democratic Republic of Congo.

IS claims to have conducted 32 operations in all the mentioned areas and to have caused 113 deaths and injuries.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 13 statements, claiming 21 attacks.

The group continues to make extensive use of SVBIED, drones and suicide attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, South Waziristan district, Khyber district, Bannu district, Orakzai district;
Khyber Pakhtunkhwa Province, Pakistan

As-Saif Media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising Hafiz Gul Bahadur’s (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), has released a 12-minute video showing the training of its militants. Pakistan

Umar Media, Tehrik-i-Taliban Pakistan (TTP), published a photo report showing the training of the Special Istishhadi Force. Pakistan

Umar Media, Tehrik-i-Taliban Pakistan (TTP), has released a 9-minute video showing attacks by its militants on Pakistani police posts in the Quetta area, in the province of Balochistan, Pakistan.

The jihadist organisation in Sistan and Baluchistan, the “People’s Fighters Front”, released a video threatening the Iranian regime and the IRGC with further attacks. Iran.

🔹Weekly Monitoring Notes

The reporting period from 9 to 16 July reflects a marked increase in propaganda output across nearly all major jihadist organisations. Compared with the previous week, both Al-Qaeda affiliates and the Islamic State expanded the volume of official operational reporting. At the same time, Pakistani jihadist groups continued to consolidate a sophisticated media strategy centred on military professionalism, force generation and technological adaptation. Overall, the reporting cycle was characterised by a high operational tempo, particularly across the Sahel, Somalia and Pakistan, accompanied by sustained visual documentation of battlefield activity.

Within the Al-Qaeda ecosystem, Jama’at Nusrat al-Islam wal-Muslimin (JNIM) recorded one of its most active weeks of the year. Az-Zallaqa Media released 23 statements, 20 photo reports and two operational videos, documenting 51 attacks across Mali, Burkina Faso and Niger. Nearly sixty per cent of the claimed operations occurred in Mali, with activity extending from the Kayes and Koulikoro regions through central Mali to the Bamako area. At the same time, Burkina Faso continued to experience persistent pressure across eleven provinces. The operational distribution illustrates JNIM’s ability to sustain simultaneous offensive activity across multiple theatres while maintaining pressure on Malian forces, Russian PMC Africa Corps elements, Burkinabé forces and local militias. The accompanying videos continue to prioritise IED attacks and mobile ambushes, reinforcing JNIM’s emphasis on asymmetric warfare and tactical mobility rather than positional engagements.

Al-Shabaab maintained a comparable operational rhythm. Through ten official communiqués, Shahada News Agency claimed responsibility for twenty-three attacks targeting Somali security forces, intelligence services, pro-government militias and regional military contingents from Ethiopia and Uganda. Operations were dispersed across nearly every major insurgency theatre in southern and central Somalia, including Lower Shabelle, Bay, Hiiran, Gedo, Bakool, Middle Shabelle, Galguduud and Mogadishu. The breadth of geographic coverage confirms the group’s continued ability to generate persistent military pressure while sustaining a stable propaganda cycle that closely mirrors battlefield activity.

The wider Al-Qaeda media ecosystem remained comparatively stable. While no major strategic communiqués were released, the continuation of regular battlefield documentation through Az-Zallaqa, Shahada and associated media channels demonstrates a mature information architecture that prioritises operational credibility, frequent reporting and visual evidence over ideological innovation. This reinforces the long-term trend whereby Al-Qaeda’s propaganda increasingly serves as an extension of military campaigning rather than as a platform for strategic doctrinal messaging.

Islamic State also increased its operational reporting compared with the previous week. Al-Naba issue 555 claimed thirty-two operations resulting in 113 deaths and injuries across Nigeria, Niger, Mozambique, Pakistan, Somalia and the Democratic Republic of the Congo. Unlike recent editions that concentrated primarily on individual provinces, this reporting cycle reflected a broader geographic dispersion of operational claims. Nevertheless, Africa remained the organisation’s principal propaganda focus, confirming the continued shift of Islamic State’s operational centre of gravity away from Iraq and Syria. Although no major leadership messages or strategic editorials accompanied this issue, the increase in claimed operations suggests renewed operational momentum across several African wilayat.

Independent jihadist organisations in Pakistan continued to display a high level of organisational maturity. Ittehad-ul-Mujahideen Pakistan claimed twenty-one attacks while simultaneously releasing a twelve-minute training video highlighting the preparation of its fighters. The organisation continues to emphasise the integration of suicide operations, SVBIEDs, drones and conventional assaults, reflecting an increasingly diversified tactical repertoire. Rather than focusing exclusively on individual attacks, the media strategy increasingly projects institutional resilience, force generation and sustained military capability.

Tehreek-e-Taliban Pakistan complemented this trend by releasing a detailed video documenting attacks against Pakistani police positions in Balochistan alongside new imagery of its Special Istishhadi Force. The continued visibility of dedicated suicide units reinforces the central role assigned to specialised assault capabilities within the organisation’s military doctrine while simultaneously serving recruitment and deterrence objectives.

Outside the principal theatres, the People’s Fighters Front in Iran continued its gradual media evolution through the publication of a new video threatening the Iranian regime and the Islamic Revolutionary Guard Corps. Although its operational footprint remains limited compared with larger jihadist organisations, the group’s increasingly structured propaganda output indicates a deliberate effort to strengthen organisational identity and maintain visibility within the broader militant ecosystem of Sistan and Baluchistan.

Overall, the reporting period demonstrates a significant increase in propaganda intensity across the global jihadist landscape. JNIM emerged as the dominant media actor of the week, reflecting both expanding operational activity and an increasingly sophisticated reporting cycle. Islamic State maintained broad geographic coverage while continuing to prioritise African theatres, whereas Pakistani organisations further consolidated their emphasis on military professionalism, training and technological adaptation. Collectively, these trends indicate that official propaganda continues to function primarily as an operational instrument, designed to reinforce perceptions of organisational resilience, territorial persistence and sustained offensive capability across multiple theatres simultaneously.

Distribution patterns remained stable across established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled), with no observable shifts in dissemination channels or media architecture.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Share

This assessment draws upon recent investigations, arrests and disrupted plots across Italy, Spain, France, Germany, Austria, Belgium, the Netherlands, Switzerland and other Western countries. Considered individually, these cases may appear isolated. Analysed collectively, however, they reveal consistent behavioural patterns that point towards the maturation of a transnational mobilisation environment characterised by shortened radicalisation pathways, algorithmically amplified propaganda, behavioural acceleration and low-complexity attack planning.

Current evidence does not indicate the imminent re-emergence of the coordinated external operations architecture that enabled the attacks in Paris, Brussels, Manchester or Barcelona. The more plausible threat trajectory is different. Organisational capability has declined, while behavioural unpredictability has increased. Contemporary jihadist violence is increasingly produced by individuals operating with limited logistical requirements but within a shared digital ecosystem that provides ideological legitimacy, operational inspiration and psychological reinforcement.

The principal intelligence judgement is therefore that Europe has entered a new phase of the jihadist threat in which the centre of gravity has shifted from terrorist organisations towards behavioural mobilisation. Counterterrorism strategies designed primarily to dismantle hierarchical networks remain essential, but they are no longer sufficient. The decisive challenge increasingly lies in identifying behavioural escalation early enough to interrupt mobilisation before it crystallises into violence.

Key Judgments

• The probability of large-scale, centrally directed jihadist attacks in Europe remains lower than during 2015 to 2017, although it cannot be excluded.

• The principal threat has shifted towards decentralised actors, self-activating individuals, and micro-networks that operate with minimal logistical requirements.

• Digital ecosystems have become the primary infrastructure of jihadist mobilisation, replacing many of the organisational functions previously performed by hierarchical terrorist networks.

• Radicalisation timelines appear to be shortening, particularly among adolescents and young adults exposed to algorithmically amplified extremist content.

• Recent investigations across Europe reveal consistent behavioural indicators despite significant national differences, suggesting the emergence of a common transnational mobilisation environment.

• Behavioural mobilisation has become a more useful analytical indicator than formal organisational membership when assessing contemporary terrorist risk.

• Low-complexity attacks remain the most likely operational scenario during the next 12 to 24 months.

• Counterterrorism capabilities should increasingly prioritise behavioural intelligence, digital ecosystems, multidisciplinary prevention and early detection rather than exclusively focusing on organisational disruption.

The Structural Transformation of the European Jihadist Threat

The European jihadist threat should no longer be assessed through the analytical framework that dominated between 2015 and 2017. The operational structures responsible for the coordinated attacks in Paris, Brussels, Nice and Manchester have been substantially degraded by sustained counterterrorism pressure, international intelligence cooperation and the collapse of the Islamic State's territorial project. However, the absence of comparable large-scale attacks should not be interpreted as evidence that the strategic threat has diminished. Instead, it signals the emergence of a different threat architecture in which organisational control has given way to decentralised mobilisation, digitally enabled radicalisation and autonomous low-complexity violence.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 556 last Thursday.

The weekly newsletter’s increased focus on West Africa aims to underscore its critical role, encouraging the audience to recognize the region’s strategic significance and feel motivated to prioritize region-specific countermeasures.

Time horizon: 30–90 days
The confidence level is assessed as Medium, reflecting the reliability of sources and verification methods used, which informs the assessment’s credibility and helps decision-makers understand its limitations.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material from al-Naba Issue No. 556, supplemented by OSINT, IMINT, and SOCMINT, which collectively provide a comprehensive and corroborated view of current operations, supporting informed decision-making.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• The claims published in al-Naba are generally reliable regarding the occurrence of attacks; however, casualty and damage figures may be inflated for propaganda purposes, a fact that should be considered when assessing operational impact.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 556, eight pages long, covers the week of 24 Muharram to 1 Safar 1448, from 9 to 15 July 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

Several themes emerge from this month’s reporting.

African provinces continue to dominate the organisation’s operational narrative, particularly through increasingly sophisticated attacks against military installations in Nigeria, Niger, the Democratic Republic of the Congo and Mozambique. Rather than demonstrating isolated local successes, these operations illustrate a common operational philosophy centred on mobility, surprise, concentration of force and systematic degradation of state security structures.

At the same time, leadership messaging shows an organisation seeking to preserve cohesion rather than expand rapidly. Propaganda continues to reinforce ideological discipline, organisational loyalty and strategic patience, while avoiding narratives that could divert resources or attention from its principal theatres of activity.

Beyond areas where the Islamic State maintains formal provinces, another dimension deserves increasing attention. Arrests, disrupted attack plots, online facilitation networks and multilingual propaganda continue to demonstrate that the organisation retains an international support ecosystem capable of sustaining radicalisation and encouraging violence well beyond its conventional battlefields. Although these activities rarely generate the visibility of large insurgent operations in Africa, they remain central to the organisation’s long-term strategy.

Taken together, these developments point toward a broader structural shift. The Islamic State is no longer best understood as a single insurgency centred on Iraq and Syria. It increasingly operates as a transnational network in which military pressure, ideological control, media production and global supporter mobilisation reinforce one another across multiple regions. Understanding that ecosystem, rather than focusing on any single province, is essential for assessing the organisation’s future trajectory.

📌 Analysis Index

1. The Big Picture: Beyond Survival. The Islamic State's New Centre of Gravity

2. The Battlefield Is Changing: From Attrition to Operational Initiative

3. Inside the Network

4. Beyond the Battlefield

5. Why Africa Matters Now

6. Alternative Assessment - Red Team

7. Signals to Watch

8. What this Means: Strategic Implications

9. Executive Conclusion

1. The Big Picture

Beyond Survival: The Islamic State’s New Centre of Gravity

The evidence emerging from the organisation’s own media indicates that the Islamic State has largely abandoned the assumption that strategic success depends on restoring a centralised territorial project in the Levant. Instead, it is consolidating a decentralised model in which geographically dispersed provinces generate military momentum, while the central leadership provides ideological direction, strategic legitimacy and narrative cohesion.

This transformation has not occurred suddenly. It has been visible for several years, but June provides one of the clearest illustrations yet of how the system now functions.

Read more

The second week of July illustrated how the global threat environment is becoming increasingly interconnected across domains that were once analysed separately, highlighting the urgent need for comprehensive understanding among security professionals and policymakers.

The United Kingdom’s decision to strengthen its legal response against the IRGC and Harakat Ashab al-Yamin al-Islamiyya reflects growing concern over covert state-backed proxy activities operating below the threshold of conventional conflict, emphasising the need for vigilance among security professionals and policymakers.

Meanwhile, Türkiye continued its sustained campaign against Islamic State networks. At the same time, the United States introduced another significant element into the evolution of modern warfare through the operational employment of unmanned maritime systems during military operations against Iranian targets.

The developments of this week underline a broader reality. To respond effectively, different government agencies must understand not only individual actors but also the broader ecosystem linking technology, ideology, covert action, and asymmetric warfare, thereby highlighting operational coordination challenges.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Infographic: Converging Threat Landscape

3. Threat Signals

4. The Information Battlefield

5. Why It Matters

6. Watchlist, Next 30 Days

7. Strategic Consequence

8. Final Analytical Line.

The Shift of the Week

Jihadist radicalisation, state-linked proxies, far-right threats and the operational arrival of maritime drones.

The defining development of this week was not the emergence of a new terrorist organisation or a single spectacular attack. Instead, it was the growing convergence of different forms of security threats that are increasingly reinforcing one another across multiple domains.

The arrests carried out in Spain illustrate this transformation particularly well. Authorities dismantled a network whose members were geographically dispersed but digitally connected through Islamic State propaganda, online indoctrination and self-directed radicalisation. Unlike many terrorist investigations of the past, this was not a conventional hierarchical cell operating under direct command from abroad. Rather, it reflected the decentralised model that increasingly characterises extremist movements, in which individuals separated by hundreds of kilometres can develop a common operational intent through shared digital environments.

This trend has important implications. The internet has evolved beyond a propaganda platform. It now functions as an operational ecosystem in which recruitment, ideological reinforcement, technical guidance, and social validation occur simultaneously. Physical distance has become far less relevant than digital proximity.

A second development points toward an equally important evolution. The United Kingdom’s decision to formally strengthen measures against organisations linked to the Iranian security apparatus reflects a broader recognition that contemporary security threats extend beyond traditional terrorist groups. State-backed proxy organisations increasingly operate using methods historically associated with clandestine extremist networks, including surveillance, intimidation, covert logistics and deniable operations. The distinction between terrorism, hybrid warfare and covert state activity is becoming progressively more difficult to define.

Read more

Ittehad-ul-Mujahidin Pakistan (IMP) represents a low-visibility but potentially destabilising jihadist actor within Pakistan’s militant landscape, operating at the intersection of ideological fragmentation, rivalry with established groups, and external influence.

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest the potential for tactical escalation or diversification beyond its present operational profile, warranting ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. However, limitations such as potential propaganda bias, disinformation, and incomplete reporting from remote areas must be considered when evaluating the reliability of intelligence. Clarifying how these limitations impact operational decisions will help stakeholders interpret the data appropriately and avoid misjudgments.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — June 2026

3. Number, Targets, and Areas of Attacks in June 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Scope and Methodology

This Strategic Threat Outlook is based on:

• monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material disseminated through IMP-affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Limited availability of independently verifiable data;

• potential exaggeration or omission in group claims;

• propaganda bias and disinformation risks;

• uncertainty regarding organisational cohesion and external support.

These limitations are central to the assessment and are explicitly reflected in confidence levels and scenarios.

Overview and Security Threat Assessment

In early April 2025, the formation of a new jihadist militant alliance in Pakistan—Ittehad-ul-Mujahidin Pakistan (IMP)- was publicly announced, marking a significant development within the country’s fragmented militant landscape. The alliance represents the formal unification of three established Pakistani jihadist factions: Hafiz Gul Bahadur Group (HGB), Lashkar-e-Islam (LeI), and Harkat Inqilab-e-Islami Pakistan (HIIP).

The announcement, disseminated simultaneously on 11 April 2025 through the official media channels of all three constituent groups, framed the creation of the IMP as a unified jihadist front aimed at “raising the word of Allah, supporting the oppressed, and conducting armed struggle under a shared ideological and organisational structure.” The founding communiqué designated Mahmood ul-Hasan as the official spokesperson of the alliance and introduced Sada-e-Ghazwat-ul-Hind as its centralised media wing. From this point onward, attack claims, communiqués, and propaganda outputs from the constituent factions were issued exclusively under the IMP brand, indicating a deliberate effort to subsume pre-existing identities into a single operational and narrative framework.

From an operational perspective, the IMP rapidly demonstrated a degree of tactical ambition and technological adaptability that exceeded the recent baseline of its predecessor groups. The execution of multiple high-profile attacks—some employing emerging technologies such as commercially adapted unmanned aerial systems (UAS) combined with multilingual propaganda releases in Urdu, Pashto, and English- suggests a calculated attempt to project operational sophistication, ideological coherence, and transregional relevance. This communication strategy mirrors broader jihadist trends aimed at signalling maturity, deterrence capacity, and alignment with global jihadist narratives rather than purely local insurgency dynamics.

Ideological Contestation and Rivalry with Tehreek-e-Taliban Pakistan (TTP)

The emergence of the IMP triggered a rapid and discernible ideological response from Tehreek-e-Taliban Pakistan (TTP), which has long positioned itself as the primary, and arguably exclusive, representative of jihadist militancy within Pakistan. While avoiding explicit reference to the IMP, the TTP disseminated a series of doctrinal messages through its official daily publication, Bunyanum Marsoos. Central among these was a written version of a speech by TTP emir Mufti Noor Wali Mehsud, emphasising the necessity of unity under a single leadership, a single banner, and a centralised command structure.

The speech invoked the Afghan Taliban’s success as a model rooted in discipline, hierarchical authority, and organisational cohesion, while warning that fragmentation and parallel jihadist projects had historically produced strategic failure. Although couched in doctrinal rather than overtly confrontational terms, the subtext was unambiguous: the TTP perceives the IMP as a rival pole threatening its narrative primacy, recruitment base, and territorial influence. The resulting ideological contest between the two actors revolves not only around legitimacy and doctrinal authority but also around control over militant ecosystems in Pakistan’s northwestern regions.

Al-Qaeda Linkages and Internal Militant Fracturing

In the weeks following the IMP’s formation, pro-TTP writers and activists intensified their criticism of the alliance, explicitly attributing its creation to Al-Qaeda in the Indian Subcontinent (AQIS). These narratives accused AQIS of orchestrating the emergence of HIIP and facilitating its subsequent alignment with HGB and LeI, with the alleged objective of engineering a parallel jihadist structure to dilute TTP dominance. Several commentaries went further, asserting that any future armed confrontation between the TTP and IMP should be considered the responsibility of al-Qaeda.

While these claims are polemical, they align with a growing body of indicators suggesting that the IMP benefits from at least indirect AQIS support, particularly in ideological framing, propaganda production, and potentially logistics and financing. The convergence of messaging themes, media aesthetics, and strategic priorities strengthens the assessment that AQIS views the IMP as a viable alternative vehicle for influence in Pakistan, especially at a time when overt militant activity risks complicating relations with the Afghan Taliban.

Notably, Jamaat-ul-Ahrar, which formally merged with the TTP in previous years, publicly congratulated the formation of the “Ittihad-ul-Mujahideen” through its official channels. This gesture, anomalous within the TTP’s broader critical posture, suggests internal fissures in the TTP ecosystem and raises the prospect of future defections or realignments toward the IMP.

IMP Activities – June 2026

During June 2026, Ittehad ul Mujahidin Pakistan remained an active component of the insurgent environment affecting northwestern Pakistan. Its activity remained embedded within the broader militant ecosystem of Khyber Pakhtunkhwa, where overlapping organisational networks, shared operational spaces, historical factional relationships, and contested attribution frequently obscure the boundaries among IMP, Tehreek e Taliban Pakistan, and locally rooted militant structures.

The available evidence indicates operational continuity rather than retrenchment. IMP maintained pressure against the Pakistani security apparatus while preserving the selective communications posture that has characterised its development since late 2025. Public claims and propaganda releases remain useful indicators of intent and capability, but they do not provide a complete representation of the group’s operational tempo. Some attacks occurring within IMP’s established areas of influence may remain unattributed, be provisionally assigned to the wider Pakistani Taliban environment, or receive no public acknowledgement from any organisation.

The group’s operational model remained predominantly insurgent and security-focused. Pakistani military personnel, police units, Frontier Corps positions, intelligence-linked structures, counterterrorism personnel, patrols, convoys, and locally recruited security intermediaries continued to constitute the most relevant target categories. This selection reflects an effort to weaken the state’s coercive capacity at the district level, degrade intelligence collection, restrict the movement of security forces, and discourage local cooperation with government institutions.

Read more

Tehrik-i-Taliban Pakistan (TTP) remains a persistent and adaptable security threat to Pakistan, especially in Khyber Pakhtunkhwa and along the Afghan–Pakistani border areas. Clarifying whether threat levels are high, moderate, or low will help stakeholders understand the current risk context and foster confidence in the threat evaluation.

The current threat trajectory remains high and persistent, emphasising the importance of strategic responses and resource allocation over the next 3–6 months to maintain operational effectiveness.

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest the potential for tactical escalation or diversification beyond its present operational profile, warranting ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. Clarifying how these limitations impact operational decisions will help stakeholders trust the assessment and interpret the data appropriately.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

📌 Inside this Assessment

1. Brief overview aof the TTP

2. Activity and Operations Analysis — June 2026

3. Number, Targets, and Areas of Attacks in June 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Brief overview of the TTP

The Tehrik-i-Taliban Pakistan (TTP), formed in 2007 as a coalition of Pashtun militant groups, remains the main jihadist threat to the Pakistani state today. The organisation, led since 2018 by Noor Wali Mehsud, has consolidated its internal structure by reabsorbing several splinter factions and strengthening its strategic communication. Its ideology is rooted in Deobandi jihadism with strong historical ties to the Afghan Taliban and Al-Qaeda. The TTP operates mainly in Khyber Pakhtunkhwa and Balochistan, but maintains selective capabilities in urban areas. The Afghan rear areas are strategically important, providing depth, training, and cross-border mobility. The group’s military campaign is now characterised by a combination of IEDs, ambushes, and complex attacks targeting police, paramilitary forces, and local administrative apparatus, with a more calibrated use of suicide operations than in the past. In 2024–2025, the TTP was consistently ranked among the most lethal groups globally, with increased operational sophistication and organisational resilience.

TTP Activities – June 2026

In June 2026, Tehrik i Taliban Pakistan maintained a high and sustained operational tempo, conducting 336 attacks across its principal areas of activity. The monthly figure confirms that the organisation remained fully capable of generating persistent pressure against Pakistani security forces, despite the intensified counterterrorism campaign and the deteriorating security relationship between Islamabad and Kabul. Although lower than the 409 attacks claimed in April, the June total remained above the January level and broadly consistent with the high activity recorded during the first half of 2026.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 1 and 8 July, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehreek-e-Taliban Pakistan

• People’s Fighters Front

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), released a 1-minute 38-second video showing a violent IED attack on a Burkinabe army convoy in the Gnagna province, in the East Region of Burkina Faso.

Az-Zallaqa Media, Jama’at Nusrat al-Islam wal-Muslimin (JNIM), released a 53-second video showing an ambush on a Malian army patrol in the Ségou region of Mali.

Az-Zallaqa Media, Jama'at Nasr al-Islam wal Muslimin (JNIM), issued a military statement claiming responsibility for 10 attacks against convoys, checkpoints, barracks, and headquarters belonging to the Malian army, the Russian PMC Africa Corps, and the Dozo militias in the regions of Mopti, Timbuktu, and the Bamako area. Mali

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 21 statements and 15 photos, claiming 32 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia.

The areas of the attacks were :

1) Burkina Faso = 10

- Yatenga province, Sissili province, Loroum province, Séno province, Gourma province, Poni province, Mouhoun province, Sanmatenga province.

2) Mali = 21

- Kayes region, Koulikoro region, Mopti region, Timbuktu region, Segou region, Kidal region; Bamako area.

3) Niger = 1

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 11 statements claiming responsibility for 21 attacks.

The targets of the attacks were:
Somali Army, Somali Intelligence, Somali Special Forces, Somali pro-government militia, Ethiopian Army, Ugandan Army.

The areas affected by the attacks were:

1) Somalia = 21

- Afgooye area, Janale area, Bulo Marer area, Farsooley area, Mubarak area, Lower Shabelle region; Baidoa area, Qansahdhere area, Bay region; Harardhere area, Mudug region; Mogadiscio area.

Al-Qaeda in the Indian Subcontinent (AQIS) has published the June–July 2026 issue of its magazine “Nawa’i Ghazwat al-Hind”.

The magazine runs to 107 pages and includes a collection of doctrinal, political and organisational articles relating to Al-Qaeda’s narrative, focusing on Palestine and Gaza, Israel, tensions between India and Pakistan and the role of the United States, boycotting America, etc.

Al-Yaqin, a pro-al-Qaeda media outlet, launched the first issue of a new newsletter, al-Bayan, which will be published every Friday and will consist of 9 pages. This issue features photos and information on attacks carried out by al-Qaeda affiliates, infographics, and an editorial.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (554). Issue 554, eight pages long, covers the week of 10 to 16 Muharram 1448, from 25 June to 1 July 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Pakistan and the Democratic Republic of Congo.

IS claims to have conducted 16 operations in all the mentioned areas and to have caused 64 deaths and injuries.

The Amaq news agency, the official media of the Islamic State, released a 1-minute 12-second video showing an attack carried out by ISCAP militants against a Congolese army patrol in the province of Haute Uele, in the DR Congo.

The Amaq news agency, the official media of the Islamic State, released a 1-minute 12-second video showing an attack carried out by ISCAP militants against a Congolese army barracks in the province of Haute Uele, in the DR Congo.

The Amaq news agency, the official media of the Islamic State, published a lengthy statement claiming responsibility for a massive attack on a Mozambican army barracks by ISM, in the district of Macomia, in the province of Cabo Delgado, in Mozambique.

The official media outlets of the Islamic State published a photo report showing a massive attack on a Mozambican army barracks by ISM, in the district of Macomia, in the province of Cabo Delgado, Mozambique.

The Amaq News Agency, the official media of the Islamic State, published a lengthy statement claiming responsibility for an attack on a Congolese Army patrol by ISCAP, in the province of Haute Uele, in the DR Congo.

The Amaq News Agency, the official news outlet of the Islamic State, has published a lengthy statement claiming responsibility for two large-scale attacks carried out by ISWAP militants against two Nigerian army camps in Borno State, Nigeria.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 14 statements, claiming 21 attacks.

Target: Pakistan Army, Pakistan Police, Counter-Terrorism Department (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, Khyber district, Bannu district, Orakzai district;

Khyber Pakhtunkhwa Province;

- Diamer district, Gilgit-Baltistan

Pakistan

Umar Media, a Tehrik-i-Taliban Pakistan (TTP) publication, published its usual infographic summarising the attacks conducted in the previous month.

In June, the TTP claimed 336 attacks.

The attacks affected 23 different Pakistani districts. Pakistan

The jihadist organisation in Sistan and Baluchistan, Iran, the “People’s Fighters Front”, released a video lasting over 4 minutes showing the training of its militants. Iran

🔹Weekly Monitoring Notes

Weekly Monitoring Notes

The reporting period from 1 to 8 July reflects a clear increase in propaganda activity across the global jihadist ecosystem, driven primarily by Al-Qaeda affiliates operating in the Sahel and Somalia. Compared with the previous reporting cycle, the volume of official communications rose significantly, while Islamic State maintained a stable but comparatively lower operational profile. The week was characterised by JNIM’s intensified operational reporting in Mali, Al-Shabaab’s sustained battlefield communications, the launch of a new pro-Al-Qaeda weekly publication, and the continued operational tempo of Pakistani jihadist organisations.

Within the Al-Qaeda network, Jama’at Nusrat al-Islam wal-Muslimin (JNIM) recorded one of its most active reporting cycles in recent weeks. Az-Zallaqa Media released 21 statements and 15 photo reports documenting 32 attacks across Mali, Burkina Faso and Niger. Mali accounted for nearly two-thirds of all claimed operations, with activity extending across Kayes, Koulikoro, Mopti, Timbuktu, Ségou, Kidal and the Bamako area. Particularly significant was the military communiqué detailing ten coordinated attacks against Malian military positions, Russian PMC Africa Corps personnel and Dozo militias around Bamako and central Mali. This concentration of attacks illustrates JNIM’s continuing ability to operate simultaneously across multiple operational sectors while maintaining sustained pressure on both national and foreign security actors. The accompanying videos documenting IED attacks and ambushes further reinforce the organisation’s emphasis on portraying tactical effectiveness and operational continuity.

Al-Shabaab also demonstrated a substantial increase in activity, claiming responsibility for twenty-one attacks through eleven official statements. Operations remained concentrated across southern and central Somalia, targeting the Somali Army, intelligence services, Special Forces, pro-government militias, and regional military contingents from Ethiopia and Uganda. Compared with previous weeks, the broader geographic distribution and increased number of claims suggest that Al-Shabaab continues to sustain a high operational tempo while preserving its ability to project simultaneous pressure across several fronts.

Beyond operational reporting, Al-Qaeda’s media ecosystem expanded through the publication of the June–July issue of AQIS’s magazine Nawa’i Ghazwat al-Hind and, more notably, the launch of Al-Bayan, a new weekly newsletter produced by the pro-Al-Qaeda media outlet Al-Yaqin. The establishment of a recurring weekly publication is analytically significant. By combining editorials, operational summaries, photographs, and infographics from multiple Al-Qaeda affiliates, Al-Bayan appears designed to strengthen information integration across the wider Al-Qaeda network and to provide supporters with a consolidated narrative, in format, comparable to long-established weekly publications within the global jihadist media environment.

Islamic State maintained a comparatively restrained but geographically diverse media cycle. Al-Naba issue 554 documented sixteen operations resulting in sixty-four reported deaths and injuries across Nigeria, Niger, Mozambique, Pakistan and the Democratic Republic of the Congo. Although the number of claimed operations declined compared with previous weeks, the organisation continued to allocate considerable media attention to Africa. Multiple Amaq statements, videos, and photo reports documented operations in Cabo Delgado, Haut-Uélé, and Borno State, confirming that Mozambique, Central Africa, and the Lake Chad Basin remain the organisation’s principal operational and propaganda priorities. Unlike previous reporting cycles, however, no major strategic editorial or leadership communication accompanied the operational reporting.

Independent jihadist organisations remained highly active in Pakistan. Ittehad-ul-Mujahideen Pakistan claimed twenty-one attacks targeting the Pakistani Army, Police, Counter Terrorism Department and local security structures across Khyber Pakhtunkhwa and Gilgit-Baltistan. Meanwhile, Tehreek-e-Taliban Pakistan published its monthly operational infographic, claiming 336 attacks across twenty-three districts during June. Although monthly statistical products have become routine within TTP communications, they remain valuable indicators of the organisation’s effort to demonstrate sustained operational momentum and territorial reach.

A noteworthy development outside the traditional Pakistani theatre was the publication of a training video by Iran’s People’s Fighters Front. Although the organisation’s operational activity remains limited compared with larger jihadist movements, the release of structured military training footage indicates continued efforts to project organisational development and consolidate its public identity within the militant landscape of Sistan and Baluchistan.

Overall, the reporting period demonstrates a renewed expansion in Al-Qaeda’s propaganda activity, particularly across the Sahel and Somalia, while Islamic State maintained operational continuity without significantly increasing its strategic messaging. The launch of Al-Bayan represents the most important media innovation of the week, suggesting a broader effort to reinforce coherence within the Al-Qaeda information ecosystem. Simultaneously, Pakistani jihadist organisations continue to demonstrate remarkable operational persistence, ensuring that South Asia remains one of the most active theatres in the contemporary global jihadist propaganda landscape.

Distribution patterns remained stable across established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled), with no observable shifts in dissemination channels or media architecture.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 555 last Thursday.

The weekly newsletter’s increased focus on West Africa aims to underscore its critical role, encouraging the audience to recognise the region’s strategic significance and feel motivated to prioritise region-specific countermeasures.

Time horizon: 30–90 days
Confidence level: Medium.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material from al-Naba Issue No. 555, including photographs, statements, and alleged military activities, which provides a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• The claims published in al-Naba are generally reliable regarding the occurrence of attacks; however, casualty and damage figures may be inflated for propaganda purposes, a fact that should be considered when assessing operational impact.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 555, eight pages long, covers the week of 17 to 23 Muharram 1448, from 2 Jul8 to 8 July 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Pakistan, Somalia, and the Democratic Republic of Congo.

IS claims to have conducted 32 operations in all the mentioned areas and to have caused 113 deaths and injuries.

On the fourth page, the weekly magazine goes into detail about the types of attacks, operations, and targets of Islamic State fighters, who follow two main strategies: “war of attrition” and “economic warfare”, as well as other methods aimed at targeting Christians and Shiites. Since 20 March 2025, the Islamic State has embarked on a new military campaign, particularly in Africa (in the areas of Nigeria, Niger, Cameroon, and Mozambique), called “Burning Camps”.

Below is a detailed account of the attacks by province/area:

1) Central Africa Province: The weekly al-Naba reports that ISCAP militants carried out 10 attacks against checkpoints, patrols, and barracks belonging to the Congolese military in the provinces of Ituri and Haute Uele, in the Democratic Republic of the Congo.

2) West Africa Province: The weekly al-Naba reports that ISWAP militants carried out 15 attacks against checkpoints, convoys, and camps belonging to the Nigerian army and pro-government militias (as well as against civilians accused of being spies) in the states of Borno, Yobe, and Adamawa in Nigeria.

3) Province of Pakistan: The weekly al-Naba reports on one attack carried out by ISPP militants against pro-government militia fighters in the province of Balochistan, Pakistan.

4) Somali Province: The weekly al-Naba reports on one act of economic warfare carried out by Somali militants against two telecommunications towers (used by the Puntland Security Forces for counterterrorism operations) in the Bari region of the Federal State of Puntland, Somalia.

5) Mozambique Province: The weekly newspaper al-Naba reports on five operations carried out by ISM militants against the Mozambican and Rwandan armies in the districts of Muidumbe, Macomia, and Mocimboa da Praia, in the province of Cabo Delgado, Mozambique.

CONCLUSION 1 — Strategic Impact and Operational Implications

Issue 555 marks a significant increase in Islamic State operational tempo following the lower activity observed in the previous reporting period. The organisation claimed 32 attacks across six operational theatres, resulting in 113 reported deaths and injuries. The sharp increase in the number of operations confirms that the reduction recorded in Issue 554 represented a temporary fluctuation rather than a sustained decline. Islamic State affiliates continue to demonstrate the ability to regenerate operational activity while maintaining pressure across multiple regions rapidly.

West Africa Province once again emerged as the most active affiliate, accounting for nearly half of all reported attacks. The fifteen operations conducted across Borno, Yobe, and Adamawa targeted military camps, checkpoints, convoys, pro-government militias, and civilians accused of collaborating with state authorities. This pattern reflects ISWAP’s continued emphasis on degrading military mobility while simultaneously consolidating local influence through coercion and counterintelligence measures. The repeated targeting of suspected informants remains a critical component of the group’s effort to deny government forces actionable intelligence.

Central Africa Province maintained its position as the second most active theatre with ten attacks against Congolese military positions in Ituri and Haute Uele. Unlike previous weeks, civilian targets received less emphasis in al-Naba’s reporting, with the operational narrative focusing primarily on sustained attrition against security forces. This suggests a continued effort by ISCAP to preserve pressure on state military structures while maintaining freedom of movement across eastern Democratic Republic of the Congo.

Mozambique Province also demonstrated renewed operational activity through five attacks directed against Mozambican and Rwandan security forces in Cabo Delgado. The continued ability to engage two separate military actors illustrates that Islamic State Mozambique remains capable of operating despite sustained multinational counterinsurgency pressure. The attacks indicate that the affiliate retains sufficient operational depth to exploit local terrain and preserve dispersed insurgent cells.

The attacks reported in Pakistan and Somalia, although limited in number, remain strategically relevant. The operation claimed by Islamic State Pakistan Province in Balochistan highlights the diversification of Islamic State’s South Asian network beyond the traditional Khorasan theatre. Likewise, the deliberate destruction of telecommunications infrastructure in Puntland reflects the growing importance of economic warfare and infrastructure disruption within the organisation’s broader operational doctrine. Rather than producing immediate casualties, these attacks seek to degrade state command, communications, and counterterrorism capabilities over time.

Taken together, Issue 555 reinforces the assessment that Islamic State continues to favour a model of geographically dispersed, locally adaptive insurgency. The organisation remains capable of simultaneously sustaining multiple regional campaigns while calibrating operational intensity according to local opportunities, security conditions, and affiliate capabilities. Africa continues to represent the principal centre of gravity of the movement, both in terms of operational volume and strategic significance.

CONCLUSION 2 — Implications for Policy and Counterterrorism

The operational developments presented in Issue 555 underline the necessity of maintaining sustained counterterrorism pressure despite periodic fluctuations in weekly attack numbers. The rapid increase from 16 attacks in Issue 554 to 32 attacks in Issue 555 demonstrates that Islamic State affiliates retain considerable operational resilience and can quickly restore offensive momentum after temporary periods of reduced activity.

For governments operating in the Lake Chad Basin, the continued predominance of ISWAP confirms that military containment alone remains insufficient to degrade the organisation’s long-term capabilities significantly. The persistent targeting of logistical assets, checkpoints, and local collaborators highlights the need to strengthen intelligence protection, improve convoy security, enhance surveillance along supply routes, and reinforce cooperation between military forces and local communities. Preventing the erosion of government intelligence networks should remain a strategic priority.

The sustained operational activity of ISCAP reinforces the need for a regional approach involving the Democratic Republic of the Congo, Uganda, and neighbouring states. Military operations should be accompanied by improved intelligence sharing, cross-border coordination, civilian protection measures, and initiatives aimed at reducing the permissive environment exploited by armed groups. Continued insurgent resilience in eastern Congo demonstrates that tactical successes have yet to translate into lasting strategic containment.

The growing diversification of Islamic State’s operational methods also deserves increased attention. The economic warfare attack against telecommunications infrastructure in Puntland illustrates an expanding emphasis on disrupting critical infrastructure supporting state security operations. Such attacks require comparatively limited resources but can generate significant operational effects by degrading communications, delaying military responses, and reducing situational awareness. Protection of communications infrastructure, energy networks, and logistical hubs should therefore become an increasingly integrated component of counterterrorism planning.

The appearance of Islamic State Pakistan Province alongside Islamic State Khorasan also warrants continued monitoring. Although current operational activity remains limited, the emergence of distinct provincial identities may reflect organisational adaptation rather than fragmentation. Intelligence services should closely monitor whether these provincial designations evolve into more autonomous operational structures with differentiated recruitment, command, or propaganda functions.

For NATO, European governments, and international security partners, Issue 555 further confirms that the principal strategic challenge posed by Islamic State lies in the durability of its regional affiliates rather than in any immediate prospect of rebuilding a territorial caliphate. The organisation continues to exploit fragile governance environments, porous borders, and protracted local conflicts to sustain long-term insurgencies. Counterterrorism policy should therefore prioritise persistent intelligence collection, regional partnerships, institutional resilience, protection of critical infrastructure, disruption of financial and logistical networks, and long-term capacity building for partner security forces. The current trajectory suggests that Islamic State remains strategically constrained at the global level but operationally resilient across several interconnected theatres, particularly in Africa, where its affiliates continue to generate the greatest level of sustained instability.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The first week of July highlighted two developments that, although unfolding in very different environments, point toward the same strategic trend. On one side, European authorities continue to face increasingly complex forms of youth radicalisation emerging within closed digital communities, where extremist references, violent subcultures and imitation of previous attacks can rapidly converge. On the other, North African security services are confronting a growing external projection of jihadist networks originating in the Sahel, reinforcing concerns that instability is no longer confined to traditional conflict zones.

The arrest of six students in Belgium over an alleged plot targeting their own school and Morocco’s dismantling of an Islamic State-linked cell with reported operational ties to the Sahel illustrate two distinct but interconnected dimensions of the contemporary threat landscape. One develops through social media, peer influence and fragmented online ecosystems. The other relies on transnational logistical networks, operational guidance and regional insurgent structures.

Meanwhile, coordinated attacks against military positions in Mali confirmed that the Sahel remains the principal engine of jihadist military activity, while simultaneously acting as an exporter of instability well beyond its immediate borders.

The events of this week reinforce a broader assessment. The threat is becoming increasingly difficult to classify through traditional categories. It is simultaneously younger, more networked, geographically interconnected and capable of evolving from online spaces into operational planning with remarkable speed.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line.

The Shift of the Week

From TikTok Cells to Sahel-Linked Plots

One of the most significant changes emerging from this reporting period is the growing convergence between local radicalisation and transnational jihadist ecosystems. Although the Belgian and Moroccan cases differ substantially in ideology, structure and operational maturity, both demonstrate how contemporary security threats increasingly develop inside networks that remain largely invisible until authorities intervene.

The arrests in Belgium are particularly revealing. According to investigators, six students from the same school allegedly discussed arson, a possible chemical attack and other forms of extreme violence through a private TikTok group. Authorities have deliberately refrained from attributing a specific ideological motivation, an important reminder that today’s threat environment cannot always be interpreted through traditional labels such as jihadism or far-right extremism. Instead, digital spaces increasingly facilitate hybrid forms of radicalisation where violent symbolism, extremist narratives, fascination with previous attacks and online subcultures overlap in unpredictable ways.

This evolution presents a growing challenge for security services. The objective is no longer simply to identify members of established organisations but to recognise behavioural indicators within highly fragmented online communities. In many cases, ideology is secondary to identity, notoriety or participation in increasingly violent digital ecosystems.

If Belgium illustrates the emergence of domestic digital radicalisation, Morocco demonstrates the continued international projection of organised jihadist networks. Moroccan authorities announced the dismantling of a structured Islamic State cell operating across several cities and reportedly connected to the Islamic State’s branch in the Sahel. Investigators described a network with defined leadership, logistical preparation, reconnaissance activities and plans targeting security institutions and critical infrastructure.

This case is particularly significant because it reinforces a trend that has become increasingly visible over the past two years. The Sahel is no longer simply an operational theatre where jihadist groups fight local governments. It is gradually becoming a platform from which operational expertise, logistical support and ideological influence can extend into North Africa.

Read more

The group continues to prioritise attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signalling operations.

No structural fragmentation or operational collapse is observable. While counterterrorism efforts have imposed costs, the group’s resilience underscores the importance of sustained, coordinated efforts to maintain regional stability and reinforce collective commitment.

📌 Inside this Assessment:

1. Overview and Security Threat Assessment

2. Operational Evolution, January to May 2026

3. Chinese Interests and Security Risks in the Horn of Africa

4. Strategic Assessment and Conclusions

5. Risk and Threat Overview

Overview and Security Threat Assessment

Despite ongoing counterterrorism efforts, external influences, including regional support and international engagement, continue to shape al-Shabaab’s resilience, underscoring the need for comprehensive regional strategies.

Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centres. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly along strategic towns, supply corridors, and population hubs.

The operation began on 15 February 2025 with synchronised assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry manoeuvres. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signalling momentum, inevitability, and state weakness.

Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance-and-coercion model, even in areas nominally held by the government. This includes political and religious penetration, targeted assassinations, systematic taxation, and narrative dominance, which collectively sustain the group’s influence and complicate counter-insurgency efforts.

• Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalise al-Shabaab authority and delegitimise federal institutions.

• Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.

• Systematic taxation and extortion, including the collection of zakat in government-controlled zones, underscore the group’s parallel administrative reach.

• Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.

• During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.

After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran, areas where al-Shabaab retains deep logistical and social networks, the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.

Al-Shabaab actively shapes the battlespace through synchronised military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, actively shaping the battlespace and impacting regional stability. Its ability to synchronise military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions.

Read more

The group continues to prioritize attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signaling operations.

No structural fragmentation or operational collapse is observable. While counterterrorism efforts have imposed costs, the group’s resilience underscores the importance of sustained, coordinated efforts to maintain regional stability and reinforce collective commitment.

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT, including analysis of propaganda, disinformation, and group claims, is essential to understanding al-Shabaab’s influence operations and countering their narrative effectively.

Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Incomplete or delayed reporting from contested or remote areas;

• exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted in the assessment.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — June 2026

3. Number, Targets, and Areas of Attacks in June 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

Despite ongoing counterterrorism efforts, external influences, such as regional support and international engagement, continue to affect al-Shabaab’s resilience, underscoring the need for comprehensive regional strategies.

Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centers. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly along strategic towns, supply corridors, and population hubs.

The operation began on 15 February 2025 with synchronized assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry maneuvers. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signaling momentum, inevitability, and state weakness.

Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance-and-coercion model, even in areas nominally held by the government. This includes political and religious penetration, targeted assassinations, systematic taxation, and narrative dominance, which collectively sustain the group’s influence and complicate counter-insurgency efforts.

• Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalize al-Shabaab authority and delegitimize federal institutions.

• Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.

• Systematic taxation and extortion, including the collection of zakat in government-controlled zones, underscore the group’s parallel administrative reach.

• Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.

During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.

After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran—areas where al-Shabaab retains deep logistical and social networks—the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.

Assessment: al-Shabaab actively shapes the battlespace through synchronized military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, actively shaping the battlespace and impacting regional stability. Its ability to synchronize military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. In the absence of sustained territorial control, effective local governance, and disruption to al-Shabaab’s parallel administration, the threat trajectory for 2025 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.

Al-Shabaab Activities – June 2026

In June 2026, Harakat al-Shabaab al-Mujahidin continued to operate in a context conducive to attrition warfare, simultaneously exploiting military vulnerabilities, the political crisis in Mogadishu, the fragility of the AUSSOM force, and humanitarian pressure in rural areas. This month’s dynamics do not indicate a strategic shift, but rather a confirmation of the group’s resilience, which remains capable of maintaining pressure on multiple axes while Somali forces and international partners are forced to distribute resources between internal stabilization, protection of the capital, counterinsurgency operations, and management of the political and institutional crisis.

Read more

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• OSINT, IMINT, SOCMINT, and Digital HUMINT integration.

Sources include primary JNIM media channels, open-source reporting, official statements, and local sources, which collectively strengthen the credibility and comprehensiveness of this analysis.

Limitations

• Incomplete or delayed reporting from conflict areas;

• exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — June 2026

3. Number, Targets, and Areas of Attacks in June 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

The operating environment in Mali and across the central Sahel remains characterised by persistent governance deficits, chronic socioeconomic vulnerability, and uneven state presence. These structural conditions, long evident in northern Mali and historically exploited by autonomy-oriented and separatist movements, continue to constitute the primary enabling factors for armed mobilisation. In this context, jihadist recruitment is less a function of large-scale ideological adherence than of the ability to convert local grievance systems into mechanisms of compliance, protection, and mobilisation. Where the state is absent, predatory, or inconsistent, armed actors capable of imposing order, resolving disputes, and regulating daily life retain a decisive advantage. This dynamic, widely documented in international analytical and academic literature on Sahelian insurgencies, remains central to understanding the durability and expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM).

JNIM remains the most capable Salafi-jihadist actor in the central Sahel, though logistical and intelligence limitations constrain its operational capacity. Established in March 2017 through the merger of Ansar Dine, Katibat Macina, al-Mourabitoun, and AQIM’s Sahara branch, the group has evolved into a federated coalition rather than a rigidly hierarchical organisation. It operates primarily in Mali, Burkina Faso, and Niger, while periodically extending operational pressure toward coastal states and peripheral borderlands. Analytically, JNIM is best understood as a hybrid insurgent structure that combines guerrilla warfare, selective governance, and political signalling. Its resilience derives from a decentralised operational architecture, strong social embedding through local intermediaries, and a pragmatic strategic culture that prioritises survivability and influence over symbolic or purely spectacular violence. However, it remains vulnerable to targeted countermeasures.

Over time, JNIM has demonstrated a consistent capacity to instrumentalise local discontent, particularly among marginalised rural populations exposed to insecurity, intercommunal violence, and abuses by state or auxiliary forces. Its traction among segments of Fulani (Peul) communities in central Mali and Burkina Faso, and among Tuareg networks in the north, is better explained by political-economy and security dynamics than by doctrinal mobilisation alone. Protection arrangements, dispute resolution, retaliation logics, and access to livelihoods remain the primary vectors of recruitment and passive support. Where counterinsurgency responses rely on indiscriminate coercion, proxy militias, or collective punishment, they tend to generate strategic blowback, accelerating recruitment and deepening JNIM’s social cover.

Multiple international assessments have repeatedly underlined that the persistence of jihadist violence in the Sahel is rooted in unresolved political and governance failures rather than ideological diffusion. Operationally, JNIM has pursued a sustained and adaptive campaign targeting civilians, national security forces, foreign militaries, and, previously, UN peacekeepers. The group’s operational logic has remained broadly consistent: incrementally degrade state presence, contest transport corridors, impose costs on governance, and convert insecurity into leverage. From an intelligence perspective, two developments matter more than the absolute number of attacks. First, JNIM has demonstrated improved coordination of operations across wide geographic areas within compressed timeframes, indicating maturation in communications, command and control, and tactical mobility. Second, the group has continued to diversify its tactical repertoire, increasingly integrating drones for aerial surveillance and attack facilitation, alongside persistent use of IEDs, ambushes, targeted assassinations, and complex assaults against fixed military installations. Conflict-monitoring organisations have noted that JNIM is now among the most active non-state actors using drone-enabled tactics in the Sahelian theatre, reflecting rapid learning and diffusion within the network.

Leadership dynamics further shape JNIM’s operational behaviour across sub-theatres. While the coalition maintains strategic coherence, different operational styles remain evident. In northern Mali, leadership associated with Iyad Ag Ghali has historically prioritised calibrated violence, elite brokerage, and selective accommodation with local power brokers, including militia, political, and religious figures. In contrast, Amadou Koufa’s operational influence in central Mali and Burkina Faso has relied more heavily on community-level mobilisation and identity-linked grievance narratives, particularly among Fulani populations. These variations do not represent fragmentation but rather flexible adaptation to distinct sociopolitical environments within a common strategic framework.

The escalation cycle observed since mid-2023 reflects a convergence of internal confidence, expanded mobilisation narratives, and favourable opportunity structures. While propaganda messaging alone does not drive operational tempo, it provides insight into intent and organisational self-perception. The broader trendline, higher operational intensity, expanding geographic reach, and increasing tactical sophistication have continued into 2024 and 2025, as documented by international analytical reporting on Sahelian jihadist dynamics.

In 2025, a qualitative shift has become particularly salient: JNIM’s increasing reliance on economic warfare as a deliberate instrument of political coercion. The group has moved beyond opportunistic predation toward systematic disruption and regulation of supply chains, particularly in western Mali. Attacks against industrial facilities, infrastructure projects, and artisanal mining sites have been followed by explicit threats and subsequent action targeting fuel supplies from neighbouring coastal states. The resulting interdiction of logistics corridors, especially around Kayes and Nioro, has transformed economic disruption into a mechanism of political engineering. In a country heavily dependent on imported fuel and goods, such a disruption poses a direct challenge to the state’s functioning. The authorities’ inability to secure long, vulnerable road networks amplifies the impact of relatively small-scale attacks, producing cascading effects on transport, electricity generation, education, and urban services. In this context, JNIM positions itself not merely as a spoiler but as a regulating authority capable of permitting, denying, or conditioning access to essential flows.

As control over supply channels increases, JNIM’s governance practices become more visible and enforceable. Field reporting indicates the imposition of behavioural and social regulations in areas under its influence, including dress codes and public conduct rules, which are enforced through coercive means. These measures should be interpreted less as isolated ideological enforcement and more as signals of authority and rule-setting capacity. By normalising compliance and demonstrating the state’s inability to protect alternative norms, JNIM reinforces its claim to de facto governance.

JNIM’s continued operational effectiveness is closely tied to a tactical model optimised for the Sahelian environment. Small, highly mobile units using motorcycles and pickup trucks can rapidly mass, strike, and disperse in swarm-like manoeuvres that overwhelm static defences. These teams rely on radio and mobile communications, ground observers, and increasingly drone-based surveillance to maintain situational awareness. The attack spectrum remains broad, ranging from IEDs and ambushes against convoys to targeted killings, raids on villages associated with pro-government militias, and complex assaults on bases and checkpoints using suicide vehicle bombs, indirect fire, and direct assaults. This combination of mobility, decentralisation, and technological adaptation continues to complicate prediction and containment efforts.

Despite contradictory official narratives from affected governments, available open-source indicators suggest that JNIM’s territorial influence and operational reach continue to expand. The coalition has demonstrated a new level of confidence by conducting operations hundreds of kilometres apart and probing previously less affected areas in central and western Mali. Emerging activity along border corridors toward Niger, Benin, and Nigeria further suggests a strategy of gradual geographic expansion rather than sudden territorial conquest.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 554 last Thursday.

The weekly newsletter’s increased focus on West Africa aims to underscore its critical role, encouraging the audience to recognise the region’s strategic significance and feel motivated to prioritise region-specific countermeasures.
Time horizon: 30–90 days
Confidence level: Medium.

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material from al-Naba Issue No. 554, including photographs, statements, and alleged military activities, which provides a comprehensive view of current operations.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• The claims published in al-Naba are generally reliable regarding the occurrence of attacks; however, casualty and damage figures may be inflated for propaganda purposes, a fact that should be considered when assessing operational impact.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism: Counterterrorism efforts should prioritise intelligence, rural security, and stabilisation, empowering the audience to take targeted action.

Issue 554, eight pages long, covers the week of 10 to 16 Muharram 1448, from 25 June to 1 July 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, although often with new elements or additional details, both written and photographic. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 24 and 30 June, providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, aiding analysts and policymakers in understanding ongoing threats and their strategic implications.

The purpose of this product is to support systematic monitoring, providing reassurance to analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are crucial to understanding threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format serve as signals of activity trends that analysts should interpret in a broader context to support accurate threat assessment and avoid overestimating their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be analysed within broader intelligence products.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehreek-e-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 17 statements and 3 photos, claiming 18 attacks.

The targets of the attacks were: Malian Army, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Niger Army.

The areas of the attacks were :

1) Burkina Faso = 11
- Yatenga province, Séno province, Gourma province, Mouhoun province.

2) Mali = 5
- Sikasso region, Segou region, Kayes region.

3) Niger = 2
- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 14 statements claiming responsibility for 18 attacks.

The targets of the attacks were:

Somali Army, Somali pro-government militia, Ugandan Army, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 14

- Janale area, Bulunagi area, Lower Shabelle region; Baidoa area, Bay region; Jowhar area, Middle Shabelle region; Beledweyne area, Hiiran region.

2) Kenya = 4

- Buuri area, Fafi area, Garissa County.

2. Islamic State (IS)

The official media of the Islamic State published an issue of the weekly al-Naba this week (553). Issue 553, eight pages long, covers the week of 3 to 9 Muharram 1448, from 18 to 24 June 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Syria, Somalia and the Democratic Republic of Congo.

IS claims to have conducted 17 operations in all the mentioned areas and to have caused 128 deaths and injuries.

The Amaq News Agency, the official media of the Islamic State, published a lengthy statement claiming responsibility for a massive, coordinated attack carried out by its militants against the Nigerien army base in Inates, in the Tillaberi region of Niger.

The Islamic State’s official media outlets have published a photo report showing the massive attack launched by fighters from the province of Sahel against the Nigerien army’s military base in the Inat area, in the Tillaberi region of Niger.

The Islamic State’s official media outlets have released a 1-minute 57-second video showing the massive, coordinated attack launched by fighters from the Sahel province against the Nigerien army’s military base in the Inates area, in the Tillaberi region of Niger.

The Islamic State’s official media outlets have published a photo report showing attacks carried out by fighters from the Sahel province against Nigerien army positions and bases in the Bani Bangou area, in the Tillaberi region of Niger.

The Islamic State’s official media outlets have published a photo report showing the attack carried out by fighters from the Mozambique province (ISM) against a Mozambican army camp in the Macomia district, in the province of Cabo Delgado in Mozambique.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 10 statements, claiming 13 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, South Waziristan district, Khyber district;

Khyber Pakhtunkhwa Province;

- Diamer district, Gilgit-Baltistan

Pakistan

Sad-e-Haq media, Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), released a 2:28-minute video showing several attacks against the Pakistan Army barracks, checkpoints and military bases in the North Waziristan district, province of Khyber Pakhtunkhwa, Pakistan.

Umar Media, Tehreek-e-Taliban Pakistan (TTP), released a 2:07 video showing its militants carrying out numerous attacks against Pakistan Army checkpoints in the Dera Ismail Khan area, in the province of Khyber Pakhtunkhwa, in Pakistan.

Umar Media, Tehreek-e-Taliban Pakistan (TTP), released a 5:40 video showing its militants carrying out numerous attacks against Pakistan Army checkpoints in the North Waziristan district, in the province of Khyber Pakhtunkhwa, in Pakistan.

🔹Weekly Monitoring Notes

The reporting period from 24 to 30 June reflects a noticeable increase in operational propaganda compared with the previous week, primarily driven by intensified activity from Al-Qaeda affiliates and the Islamic State’s extensive media coverage of its offensive in western Niger. The week is characterised by a return to a higher operational tempo across the Sahel, sustained insurgent messaging from Al-Shabaab, continued tactical communications from Pakistani jihadist organisations, and a renewed emphasis on large-scale conventional assaults rather than isolated attacks.

Within the Al-Qaeda network, Jama’at Nusrat al-Islam wal-Muslimin (JNIM) significantly increased its media activity, issuing 17 statements and three photo reports documenting 18 attacks across Burkina Faso, Mali and Niger. Burkina Faso once again represented the principal theatre, accounting for over half of all claimed operations, while activity in Mali remained concentrated in the Ségou, Sikasso and Kayes regions. Compared with previous weeks, JNIM returned to a higher operational reporting tempo, reinforcing its image as the dominant Al-Qaeda affiliate in the Sahel. Although the reporting cycle contained relatively limited multimedia material, the consistency of operational claims demonstrates the organisation’s sustained capability to conduct simultaneous attacks across multiple theatres while maintaining continuous strategic communications.

Al-Shabaab also increased its propaganda output. Through fourteen official statements, the group claimed responsibility for eighteen attacks across Somalia and northeastern Kenya. Operational activity remained concentrated in Lower Shabelle, Bay, Middle Shabelle, and Hiiran, while cross-border attacks in Garissa County reaffirmed the organisation’s intention to maintain pressure on Kenyan security forces. As in previous reporting periods, Al-Shabaab prioritised battlefield reporting over ideological messaging, focusing on demonstrating persistent military pressure against Somali government forces, regional military contingents and local militias.

Islamic State media activity was dominated by the coordinated assault on the Nigerien military base at Inates, representing the most significant propaganda event of the week. While al-Naba issue 553 reported 17 operations resulting in 128 deaths and injuries across six countries, the organisation devoted multiple official products to documenting the Inates operation, including a detailed claim of responsibility, extensive photographic documentation and a dedicated operational video. The coordinated use of multiple media formats illustrates Islamic State’s effort to maximise the strategic impact of a single high-profile attack. Beyond Inates, official media also highlighted continued activity in Bani Bangou and Cabo Delgado, reinforcing the centrality of the Sahel and Mozambique within the organisation’s current African narrative. The concentration of media resources around the Inates assault demonstrates Islamic State’s continued preference for exploiting major tactical successes to project operational momentum and organisational resilience.

Independent jihadist organisations in Pakistan maintained a consistent operational rhythm. Ittehad-ul-Mujahideen Pakistan claimed thirteen attacks across Khyber Pakhtunkhwa and Gilgit-Baltistan while releasing a battlefield video documenting assaults against Pakistani military positions in North Waziristan. Concurrently, Tehreek-e-Taliban Pakistan published two operational videos showing repeated attacks against Pakistani Army positions in Dera Ismail Khan and North Waziristan. These productions continue to emphasise repeated harassment operations, reinforcing the narrative of sustained pressure against Pakistani security forces rather than isolated spectacular attacks.

Overall, this reporting period marks a return to a more active propaganda cycle following the comparatively low operational tempo observed the previous week. JNIM expanded its operational reporting across the Sahel, Al-Shabaab maintained sustained pressure in Somalia and Kenya, Islamic State concentrated its strategic communications around the large-scale Inates offensive while preserving broad African coverage, and Pakistani jihadist organisations continued to reinforce narratives of persistent insurgency. The cumulative picture indicates resilient organisations capable of rapidly increasing propaganda output following operational successes, with Africa remaining the principal centre of gravity for both Al-Qaeda and Islamic State media ecosystems.

Distribution patterns remained stable across established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled), with no observable shifts in dissemination channels or media architecture.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874