This weekly strategic intelligence report documents and summarises jihadist propaganda and military activities from 1 to 8 September, highlights recent developments in the threat, and provides a structured overview of the situation across various organisations and operational theatres.

This report emphasises operational claims and objectives, especially their focus on military targets, to reinforce the strategic importance for threat recognition and motivate policymakers to prioritise threats.

This product helps analysts and policymakers track threat trends in depth, supporting their work in shaping strategic responses and maintaining awareness of the active threat environment.

This publication includes brief threat assessments and analyses of operational intentions or forecasts, correlating propaganda content like attack claims and ideological messages with recent activities to help analysts understand groups’ adaptive tactics and the dynamic threat environment.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

The emphasis on documentation, classification, and structured presentation of firsthand material aims to instil confidence in analysts and policymakers in the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies exclusively on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clearly define the source scope and enhance data reliability for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

The team collects and categorises material by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, should be interpreted within the broader context of operational tempo, recent events, and known threat indicators to support analysts’ confidence in threat assessments and minimise misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), released a video lasting 8 minutes and 58 seconds showing an attack on the barracks of the Malian Army in the Segou region, Mali.

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 30 statements and 23 photos, claiming 34 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Niger Army,

The areas of the attacks were :

1) Burkina Faso = 15

- Gourma province, Poni province, Yatenga province, Sissili province, Soum province, Bam province.

2) Mali = 16

- Timbuctu region, Segou region, Mopti region, Kidal region, Bamako area;

3) Niger = 3

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 10 statements claiming responsibility for 22 attacks.

The targets of the attacks were:

The targets included the Somali Army, Somali pro-government militias, the Burundian Army, the Ugandan Army, the Ethiopian Army, and the Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 16

- Afgooye area, Mubarak area, Bulo Merer area, Qoryooley area, Janale area, Shalanbud area, Lower Shabelle region;

- Wajid area, Hudur area, Bakool region;

- Beledweyne area, Hiiran region;

- Luuq area, Gedo region;

- Afmadow area, Lower Juba region;

2) Kenya = 6

- Lafi area, El Galo area, Mandera County;

- Fafi area, Garissa County;

- Quroof Harar area, Wajir County.

The sixth issue of the weekly Al-Bayan, published by the pro-Al-Qaeda (AQ) media outlet al-Yaqin, this time 15 pages, in addition to the usual infographic summarising last week's attacks, religious messages, and photographic accounts of al-Shabaab and JNIM activities, features a highly interesting two-page editorial.
This is not just the annual commemorative eulogy for 9/11, but an attempt at strategic lesson learning.

It then includes a highly relevant section on al-Qaeda's current condition. The author explicitly acknowledges a contemporary weakness. He speaks of a state of passivity, retreat, or inertia that has affected the umma and, indirectly, the jihadist movement. He asks how al-Qaeda can regain its role and become an influential player in the conflict.

The answer is interesting because it does not simply advocate a repeat of 9/11. The argument is more strategic: we must regain the ability to unleash the "Islamic will," mobilize the umma's resources, and once again transform this will into action. The author argues that the Muslim community has enormous demographic, economic, and intellectual resources, but that these are insufficiently mobilised.

The second page develops this concept by contrasting material capabilities with will. The problem, according to the author, is not primarily a lack of resources, but rather the weakening of "Islamic will." Among the causes, he cites the fear of death and attachment to earthly life.

This gives rise to an overtly mobilising component. The author argues that ideological intervention through indoctrination, education, and training is necessary to eliminate fear and passivity. The text therefore assigns propaganda an operational function: rebuilding individuals’ willingness to engage in jihadist action.

9/11 is described as an event that represented a turning point in the conflict between "the Islamic nation" and its enemies, particularly the United States and Israel. The attacks are not treated as terrorism against civilians, but reinterpreted as a strategic action against a system held responsible for attacks against Muslims.

The author emphasises the Palestinian dimension. The argument is that US political, military, and diplomatic support for Israel and what is described as the international inability to resolve the Palestinian question "fairly" contributed to the creation of the conditions that led to the attack. This is a classic causal construction of al-Qaeda propaganda: Palestine, American support for Israel, wars against Muslim countries, repression of the umma, jihadist response.

The section on al-Qaeda’s strategic objectives is particularly interesting. The article argues that one of the most important effects of 9/11 was to "mobilize the Islamic nation" and draw its enemies into direct conflict. In other words, it reiterates the bin Laden-esque strategic logic of provocation: to induce the United States to intervene militarily in the Muslim world, thus increasing polarisation, resentment, and jihadist mobilisation.

The article also argues that the operation would have forced the United States to demonstrate its hostility toward the Islamic world openly. Afghanistan and Iraq are implicitly used as ex post confirmation of the strategy's validity. The American war since 2001 is thus propagandistically transformed from a consequence of the attack into proof of al-Qaeda's original thesis.

The final message is equally clear: according to the article, September 11th achieved one of al-Qaeda's main strategic objectives because it profoundly altered the political and military geography of the Arab and Islamic world. Afghanistan, Iraq, and the subsequent wars are interpreted as consequences of that strategic decision.

2. Islamic State (IS)

The Islamic State’s official media published 1 issue of the weekly al-Naba this week (563). Issue 563, eight pages long, covers the week of 14 to 20 Rabi al-Awaal 1448, from 27 August to 2 September 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Iraq, Pakistan and the Democratic Republic of Congo.

IS claims to have conducted 21 operations in all the mentioned areas and to have caused 116 deaths and injuries.

1) Sahel Province: The weekly al-Naba reports 5 attacks carried out by IS Sahel militants: four against convoys and patrols of the Nigerien army and police in the Tillaberi and Dosso regions of Niger; and one attack against a Nigerian army patrol in Kebbi State, Nigeria.

2) West Africa Province: The weekly al-Naba reports 9 attacks carried out by ISWAP militants against checkpoints, convoys, patrols, and camps belonging to the Nigerian army and pro-government militias in the states of Borno and Yobe, Nigeria.

3) Khorasan Province: The weekly al-Naba reports on 1 attack carried out by ISKP militants against a member of Pakistani intelligence in the Bajaur area of Pakistan.

4) Central African Province: The weekly al-Naba reports that ISCAP militants carried out 5 attacks against patrols of the Congolese pro-government militias and against Christian villages in the province of Ituri in the Democratic Republic of the Congo.

5) Iraqi Province: The weekly al-Naba reports one attack by Iraqi militants against a patrol of the Tribal Mobilisation Forces in Anbar Governorate, Iraq.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 11 statements, claiming 11 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area: North Waziristan district, South Waziristan district, Kurram district, Bannu district; in the Khyber Pakhtunkhwa Province; Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising Hafiz Gul Bahadur’s (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), has released a 0:41-minute video showing an IED ambush on a Pakistani army convoy in the South Waziristan district of Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting about 10:32 minutes to show a major attack carried out by its militants against the Pakistani Army and Frontier Corps barracks and camps in the Peshawar district, Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), published its usual infographic summarising attacks carried out in the previous month. In August, the TTP claimed 406 attacks.

The attacks affected 25 different Pakistani districts. Pakistan

🔹Weekly Strategic Assessments

The reporting period from 1 to 8 September reflects a propaganda environment in which operational activity remained substantial. Still, the most consequential development occurred at the strategic narrative level rather than in attack volume. JNIM returned to a high operational reporting tempo across the central Sahel; Islamic State recorded a significant increase in both claimed operations and casualties. At the same time, Al-Shabaab moved back toward a more moderate level after several exceptionally active weeks. The most important development, however, was the latest issue of Al-Bayan, whose 9/11 editorial offers an unusually explicit assessment of Al-Qaeda’s contemporary strategic condition, its perceived weaknesses and the role propaganda is expected to play in rebuilding mobilisation.

Within the Al-Qaeda ecosystem, Jama’at Nusrat al-Islam wal-Muslimin registered a substantial increase in operational reporting compared with the previous week. Az-Zallaqa Media issued thirty statements and twenty-three photographic reports covering thirty-four claimed attacks across Mali, Burkina Faso and Niger. Mali accounted for sixteen operations, Burkina Faso fifteen and Niger three, producing one of the more geographically balanced JNIM reporting cycles observed in recent weeks.

The distribution of attacks is strategically relevant. In Mali, activity extended across Timbuktu, Ségou, Mopti and Kidal, while the inclusion of the Bamako area again demonstrates JNIM’s interest in maintaining pressure beyond peripheral insurgent zones. In Burkina Faso, the organisation continued to operate across a broad belt stretching through Gourma, Poni, Yatenga, Sissili, Soum and Bam. Tillabéri remained the focus in Niger. Taken together, the reporting reinforces the picture of a network able to sustain simultaneous pressure across multiple national theatres without becoming dependent on a single operational axis.

Az-Zallaqa’s nearly nine-minute video documenting an attack against Malian Army barracks in Ségou represents the principal visual product of the week. Its significance lies less in tactical novelty than in the depth of documentation. Longer operational videos help JNIM tell a more complete story about an engagement, moving beyond short battlefield clips to show initiative, access, and military effectiveness. This reinforces the broader JNIM communication model in which claim volume, photography and selectively amplified video products operate together to create the perception of sustained offensive pressure.

Al-Shabaab, by contrast, recorded a clear reduction in weekly claims after the very high levels observed during much of August. Shahada News Agency issued ten statements covering twenty-two claimed attacks, sixteen in Somalia and six in Kenya. The decline is significant in comparative terms, but it should not yet be interpreted as a structural contraction. The organisation continues to maintain a broad geographic footprint across Lower Shabelle, Bakool, Hiiran, Gedo and Lower Juba, while its Kenyan activity remains distributed across Mandera, Garissa and Wajir counties.

The important analytical point is therefore the baseline rather than the weekly peak. After several weeks in which Al-Shabaab reported forty or more attacks, the current reduction may indicate simple operational fluctuation rather than a deterioration in capability or media capacity. The persistence of cross-border operations in Kenya remains especially important, because it allows the organisation to frame its campaign as a regional insurgency rather than a conflict confined to Somalia. Subsequent reporting periods will be necessary to determine whether the August surge represented an exceptional mobilisation cycle or whether the group has established a structurally higher claims tempo.

The sixth issue of Al-Bayan constitutes the most strategically important propaganda development of the reporting period. Its two-page editorial on the anniversary of 9/11 goes beyond commemorative messaging and instead functions as internal strategic reflection. The text explicitly acknowledges passivity, retreat and inertia within the broader Muslim community and, indirectly, within the contemporary jihadist movement. This is significant because pro-Al-Qaeda propaganda rarely frames current weakness so openly.

The editorial’s response to this perceived weakness is equally important. Rather than calling simply for the replication of spectacular attacks, the text argues that the central problem is the erosion of what it describes as the Islamic will. Material resources, demographic weight, economic capacity, and intellectual potential are presented as insufficient unless converted into action through ideological mobilisation. In this formulation, the strategic deficit is psychological and political rather than material.

This gives propaganda an explicitly operational role. Indoctrination, education and ideological training are presented as mechanisms for overcoming fear, attachment to ordinary life and political passivity. Propaganda is therefore not portrayed merely as a tool for explaining or legitimising jihadist violence after the fact. It is presented as a mechanism for producing the human willingness required for future mobilisation. That distinction is important because it places the information domain directly within the movement’s theory of force generation.

The treatment of 9/11 also reinforces classic Al-Qaeda strategic logic. The attacks are presented as successful not simply because of their immediate destructive impact, but because they allegedly compelled the United States to enter prolonged conflicts in the Muslim world. Afghanistan, Iraq and the subsequent expansion of US military involvement are retrospectively interpreted as confirmation of Al-Qaeda’s original analysis. The adversary’s response is therefore incorporated into the organisation’s own victory narrative.

This is essentially a reassertion of the provocation strategy associated with bin Laden-era Al-Qaeda: force the stronger adversary into direct military intervention, intensify political and social polarisation, expose what the movement portrays as Western hostility toward Islam, and create conditions favourable to further mobilisation. The editorial’s emphasis on Palestine and US support for Israel places contemporary events inside that same causal structure, linking Palestine, Western intervention, repression and jihadist mobilisation into a continuous historical narrative.

The key conclusion is that Al-Bayan attempts to connect Al-Qaeda’s historical strategic doctrine with the movement’s present condition. The text does not argue that the current environment requires another 9/11. Instead, it asks how the underlying strategic effect attributed to 9/11, mobilisation of the umma and transformation of passive grievance into active confrontation, can be reproduced under contemporary conditions. This makes the editorial considerably more relevant than routine anniversary propaganda.

The publication therefore deserves increasing attention as a possible forum for strategic debate within the broader pro-Al-Qaeda information environment. Across its recent issues, Al-Bayan has evolved from an aggregator of affiliate activities into a platform combining operational statistics, ideological argument and geopolitical interpretation. The latest editorial strengthens the assessment that the outlet is developing a distinct strategic function within the pro-Al-Qaeda media ecosystem.

Islamic State propaganda activity increased during the week. Al-Naba issue 563 reported twenty-one operations and 116 deaths and injuries, compared with fifteen operations and fifty-two deaths and injuries in the previous issue. Although these figures remain self-reported and cannot be treated as independently verified operational data, the increase is significant within the organisation’s own propaganda cycle.

The geographic distribution further confirms Islamic State’s current decentralised posture. ISWAP accounted for nine attacks in Borno and Yobe, while Islamic State Sahel reported five operations across Niger and northwestern Nigeria. ISCAP claimed five attacks in Ituri, ISKP one operation in Bajaur and the Iraqi Province one attack in Anbar. The result is a weekly media picture in which no single central theatre dominates the entire organisation, but African provinces collectively provide the overwhelming majority of operational content.

The distinction between ISWAP and Islamic State Sahel is particularly relevant. Their simultaneous visibility allows Islamic State propaganda to present West Africa and the central Sahel as interconnected but operationally distinct theatres. ISWAP continues to emphasise attritional pressure against military positions, patrols and convoys in the Lake Chad environment, while Islamic State Sahel maintains pressure across Niger and adjoining areas. Together, they provide Islamic State with a broad geographic narrative stretching from the Lake Chad basin toward the western Sahel.

ISCAP’s attacks in Ituri continue to reinforce Central Africa as another persistent element of the organisation’s global narrative. The targeting of both pro-government militias and Christian communities allows the province to combine insurgent warfare with sectarian messaging, a pattern repeatedly amplified in previous al-Naba issues. The single attack reported in Iraq is symbolically relevant in a different way. Its limited scale highlights how far the operational centre of gravity of Islamic State propaganda has shifted away from its former Iraqi and Syrian heartlands.

Independent jihadist propaganda in Pakistan remained active but differentiated. IMP released eleven statements covering eleven attacks across North and South Waziristan, Kurram and Bannu. The reduction from previous weeks indicates a lower operational reporting tempo. At the same time, the short video of an IED ambush in South Waziristan preserves the organisation’s established preference for concise visual documentation of battlefield activity.

TTP presented a more expansive picture. Umar Media’s 10-minute video documenting an attack against Pakistani Army and Frontier Corps facilities in Peshawar provides a higher-value visual product than routine tactical clips. More importantly, the organisation’s August infographic claims 406 attacks across twenty-five Pakistani districts. This represents a sharp increase from the 315 attacks claimed for July and is intended to communicate not only intensity, but territorial dispersion and organisational depth.

TTP’s monthly statistics should be treated as organisational claims rather than independently verified attack counts. Their propaganda value, however, is clear. By systematically presenting monthly totals, district-level distribution and multi-method operational footage, Umar Media constructs an image of a campaign that is persistent, geographically extensive and capable of sustaining pressure against multiple components of the Pakistani security apparatus. The statistical product and the longer Peshawar video therefore perform complementary functions: one demonstrates scale, the other demonstrates capability.

Overall, Week 1 to 8 September reflects a jihadist propaganda environment in which the most significant developments occurred at two different levels. At the operational level, JNIM returned to high-volume reporting, Islamic State increased its claimed activity and impact, while TTP presented another month of exceptionally high self-reported operational activity. At the strategic level, however, Al-Bayan produced the most consequential material of the week.

The editorial indicates that parts of the pro-Al-Qaeda media ecosystem are no longer focused exclusively on preserving historical memory or celebrating affiliate battlefield activity. They are increasingly asking how the movement can regenerate political relevance, psychological mobilisation and strategic initiative under contemporary conditions. The explicit acknowledgement of inertia, the emphasis on rebuilding will, and the reinterpretation of propaganda as a mechanism for force generation are particularly important signals.

The broader assessment is therefore one of operational decentralisation combined with continued ideological convergence. Al-Qaeda’s strongest affiliates remain overwhelmingly focused on regional insurgencies, Islamic State continues to depend on dispersed provincial warfare, and Pakistani organisations operate within increasingly localised campaigns. Yet the accompanying propaganda repeatedly attempts to connect these geographically distinct struggles to broader strategic narratives. In the case of Al-Bayan, that effort has now moved beyond simple ideological continuity toward an explicit debate over how jihadist mobilisation itself can be renewed.

Distribution patterns remained stable on established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled, Falcon), with no changes observed in distribution channels or media architecture.

🔒Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Daniele Garofalo is an independent researcher and analyst specialising in Intelligence, Jihadist Terrorism, Islamist insurgencies, Non-State Armed Groups (NSAG), Cognitive Warfare, and Hybrid Warfare.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

The 2–8 September reporting period reinforced a security trend that is becoming increasingly difficult to treat as marginal: operational capability is spreading across smaller, less structured, and often geographically disconnected actors.

In Europe, three suspected jihadists detained in France illustrate how a small digital network can combine domestic attack intent, aspirations to join Islamic State abroad and contacts extending across the Atlantic. In Italy, the investigation of a 16-year-old exposed a different trajectory, in which Islamic State propaganda reportedly coexisted with neo-Nazi, white-supremacist and accelerationist material. Neither case resembles the structured European jihadist networks of the previous decade, yet both demonstrate pathways through which online environments can translate extremist consumption into operational interest.

A parallel development is visible in Russian activity against Europe. Denmark’s PET warned of concrete planning and preparation for sabotage against defence-related targets, including attempts to recruit ordinary individuals online. In Romania, the SRI announced the disruption of a suspected Russian intelligence operation involving reconnaissance of military facilities, critical infrastructure and Ukrainian cargo aircraft. These developments follow Germany’s attribution of the Leipzig/Halle explosive-drone operation and reinforce the assessment that Moscow is increasingly able to project disruptive capability through compartmentalised, expendable intermediaries rather than conventional intelligence infrastructure.

The common feature is not ideology or command structure. It is distributed capability, which shows why we need to understand evolving threats and should give the audience confidence to adapt strategies.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week #17

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line.

The Shift of the Week #17

From hybrid radicalisation and transnational jihadist micro-networks to disposable proxies and operational expertise

For intelligence services, organisational strength has traditionally provided one of the principal indicators of operational capability. Large networks offered recruitment pools, financing, training, logistical infrastructure and command structures. Disrupting those structures therefore reduced an adversary’s ability to act. That relationship is becoming less reliable.

This week’s cases show that capability can increasingly be assembled without a large organisation, so we need to stay vigilant about digital connectivity and online environments.

The French jihadist investigation is particularly illustrative. Three men aged between 20 and 26 were placed under investigation over an alleged violent project targeting the Jewish community. French authorities also suspect that they intended to travel to Africa to join the Islamic State. According to Le Monde, investigators identified them through a WhatsApp group called “Les soldats d’Allah.” One of the suspects was reportedly in contact with Jessica Bowie, the American woman arrested by the FBI on 19 August over an alleged Islamic State-inspired plot against the New York State Capitol.

No public evidence currently shows a formal transatlantic operational cell or centralised Islamic State direction, but this underscores the need for nuanced analysis of social networks linking prospective attackers across countries.

This is an important distinction. Online networks may be loose, unstable, and largely self-directed, which impacts operational security and challenges traditional counterterrorism measures by enabling contacts, ideological reinforcement, and operational encouragement in a decentralised manner.

Threat Signals

• France: From Digital Networking to Attack Intent

The French case shows several indicators at once. The alleged domestic targeting of the Jewish community coexisted with an apparent desire to reach an Islamic State theatre in Africa. This challenges a rigid distinction between foreign-fighter mobilisation and domestic attack planning. Individuals may consider both options, shift between them or regard overseas affiliation as part of a longer trajectory toward violence.

It also underscores Africa’s importance in contemporary jihadist mobilisation. The aspiration allegedly expressed by the suspects was not centred exclusively on Syria or Iraq. Islamic State’s strongest operational environments are now concentrated heavily in Africa, and European counterterrorism agencies increasingly need to consider African theatres when assessing attempted extremist travel.

The reported contact with Bowie adds a further layer. Her arrest in the United States initially appeared consistent with a highly individualised Islamic State-inspired trajectory. The subsequent discovery of a connection to an individual under investigation in France does not establish organisational coordination. Still, it demonstrates why the category of “lone actor” should be applied cautiously. Digital radicalisation can produce individuals who act alone physically while remaining socially connected to a transnational extremist milieu.

• Italy: Hybrid Radicalisation and the Problem of Ideological Classification

On 2 September, Italian authorities placed a 16-year-old from Lombardy in a juvenile community as part of an investigation involving alleged self-training for terrorist purposes. According to Italian reporting, investigators identified Islamic State propaganda alongside neo-Nazi, white-supremacist and accelerationist material, as well as an increasing interest in weapons, explosives and incendiary substances.

The case’s significance lies less in ideological coherence than in its absence. Islamic State jihadism and neo-Nazism remain fundamentally incompatible ideological systems. Yet that contradiction may matter considerably less to some young individuals whose radicalisation is driven by violence, transgression, identity construction and fascination with extremist aesthetics rather than by adherence to a coherent political doctrine.

The resulting threat profile can be difficult to classify using conventional categories. A teenager can simultaneously consume jihadist propaganda, glorify far-right attackers and investigate methods of violence without progressing through the traditional stages associated with membership in an extremist movement.

In such cases, behavioural indicators become particularly important. Growing interest in weapons, target selection, operational security, attack methodologies or technical preparation may reveal more about movement toward violence than attempts to identify a single dominant ideology. The Italian case should not be generalised from a single investigation. But it fits a broader European concern over increasingly young individuals moving through fluid online extremist environments.

• United States: When One Individual Adds Capability to a Network

A different model appeared in the United States. On 8 September, former Marine and former New Iberia police officer Micah James Legnon pleaded guilty to conspiracy to provide material support to terrorists. According to the U.S. Department of Justice, Legnon became involved with the Order of the Black Lotus, a faction associated with the Turtle Island Liberation Front, and discussed providing military knowledge to the network. The case involved discussions concerning explosives, urban combat, precision shooting and an alleged plan targeting a logistics facility in California.

The strategic significance lies in capability transfer. A small extremist network does not necessarily need to develop military expertise organically. One individual with previous professional training can significantly increase its competence.

This is a longstanding counterterrorism concern, but it becomes more consequential in decentralised environments. Network size may be a poor proxy for threat when one member has specialist knowledge of explosives, surveillance, weapons, communications, or military tactics.

• Türkiye: Persistent Islamic State Attack Mobilisation

Türkiye provided another indicator of continued Islamic State-related operational activity. On 4 September, Turkish police and intelligence personnel attempted to arrest a 21-year-old suspected of Islamic State links and of preparing an attack. The suspect opened fire during the operation at Istanbul’s Sultanbeyli bus terminal and was killed when police returned fire. A civilian subsequently died from injuries sustained during the incident. Searches reportedly recovered material assessed as potentially usable for explosive production, while another person connected to the suspect was detained.

The incident should be understood within sustained Turkish pressure against Islamic State networks rather than as evidence of a broader resurgence by itself. Its importance is operational: authorities were dealing with an individual assessed to have moved beyond propaganda consumption toward potential attack preparation. It also illustrates the continuing coexistence of two realities. Islamic State has suffered sustained leadership and organisational pressure, yet individuals and small networks remain capable of progressing toward violence.

Immediately before this reporting period, Yemeni and coalition forces also announced the killing in Seiyun of Abu Hudhayfah al-Ansari, identified as Islamic State’s official spokesman. If the organisation ultimately confirms the identification, the loss would represent a significant disruption at the central media-leadership level. Yet developments in France, Italy, and Türkiye show why leadership attrition cannot be treated as an immediate measure of ideological reach or mobilisation potential. Organisational degradation and distributed mobilisation can occur simultaneously.

The Information Battlefield

The week’s cases reinforce a structural change in the relationship between online activity and physical violence. Digital platforms are no longer simply channels through which extremist organisations distribute propaganda to passive audiences. They increasingly become environments where individuals meet, compete, exchange material, construct identities, and occasionally establish operational relationships.

The French investigation illustrates the network dimension. The Italian case illustrates ideological fluidity. Together they demonstrate two different problems for intelligence collection. In the first, investigators must determine whether apparently autonomous individuals are connected to others and whether those relationships provide operational value. In the second, the problem is almost reversed. Analysts may encounter so many contradictory ideological signals that classification itself becomes misleading.

This matters particularly among younger subjects. Some contemporary extremist ecosystems reward violence more consistently than they reward ideological consistency. Islamic State imagery, neo-Nazi symbolism, previous mass killers, accelerationist literature and violent online subcultures can coexist inside the same digital consumption pattern.

Read more

The architecture that produced 9/11 has been largely dismantled. Osama bin Laden and Ayman al-Zawahiri have been eliminated, much of the historic leadership has been neutralised, and al-Qaeda no longer enjoys the Afghan environment that, before 2001, allowed it to train militants and plan international operations with a level of freedom that would be difficult to replicate today.

The Islamic State has undergone an equally radical transformation. The loss of Mosul, Raqqa, and finally Baghouz destroyed the territorial project that, between 2014 and 2019, had consolidated territory, population, resources, foreign fighters, military apparatus, and propaganda under a single structure.

Yet global jihadism has not disappeared; it has adapted, underscoring the need to remain vigilant and responsive to evolving threats.

In 2001, the threat was characterised primarily by a concentration of capability. In 2014, the Islamic State added an unprecedented territorial concentration. In 2026, the dominant model is different: distributed capability.

Today, jihadist capability is distributed across regional organisations, insurgencies, Islamic State provinces, clandestine cells, logistical and financial networks, propaganda apparatuses, and digital communities. Recognising these regional nodes can help the audience appreciate their strategic importance and the need for targeted responses.

The 2026 paradox: a weaker centre, a more resilient periphery.

Measuring the strength of jihadism solely by the state of central leadership yields an incomplete picture today. Al-Qaeda’s leadership is presumably weaker than it was in 2001. The 38th report by the United Nations Analytical Support and Sanctions Monitoring Team, published on August 10, 2026, and based on information available up to June 9, describes al-Qaeda’s senior leadership as marginalised and views both its capacity for and priority regarding the conduct of external operations as uncertain. However, the same report assesses that the overall threat level has remained substantially unchanged, even as it has intensified in the Sahel and South Asia1.

The American assessment presents the same paradox from a different perspective. The 2026 Annual Threat Assessment estimates the number of al-Qaeda members worldwide at between 15,000 and 28,000, and those linked to the Islamic State at between 12,000 and 18,000. According to the U.S. Intelligence Community, the growth recorded over the past five years has occurred primarily within African conflicts, where some of the largest and most violent affiliates are located2.

Decentralisation has made jihadism harder to gauge and, consequently, complicates threat assessment and strategic planning, affecting how policymakers allocate resources in certain theatres.

The centre has weakened, so counterterrorism efforts must now focus more on peripheral branches that operate independently, requiring adjustments to operational security measures and intelligence priorities.

The centre has weakened. Some peripheral branches have strengthened.

No single epicentre remains.

The second transformation is geographical. In 2001, the primary jihadist stronghold was Afghanistan. Over the next decade, Iraq, Yemen, Somalia, and North Africa became central theatres of operation. Between 2014 and 2019, Syria and Iraq constituted the symbolic, territorial, and propaganda hub of the Islamic State. By 2026, no single geographical equivalent exists.

The UN Monitoring Team employs a significant phrase: the threat is “multipolar and increasingly complex.” This highlights the need for the audience to appreciate the multifaceted nature of the threat landscape and adapt strategies accordingly.

Statistically, however, the growth in Africa is unmistakable. Attacks attributed to the Islamic State and al-Qaeda have nearly doubled. This shift does not mean that the Middle East has become irrelevant. It means that the geography of jihadism can no longer be interpreted through the Iraq-Syria paradigm. The Sahel, the Lake Chad basin, Somalia, East Africa, the Democratic Republic of the Congo, Mozambique, and the Afghanistan-Pakistan ecosystem are now strategically central areas.

Case Study: JNIM, when counting attacks is no longer enough.

The Sahel arguably represents the most significant laboratory for this transformation. JNIM should no longer be analysed merely as a regional al-Qaeda affiliate capable of carrying out attacks, but rather as an insurgent system.

Operational monitoring conducted for the “Strategic Outlook” series on this site recorded 85 attacks in January 2026, 71 in February, 89 in March, 78 in April, 92 in May, 52 in June, 158 in July, and 93 in August, totalling 718 actions over eight months3.

However, the number of attacks is not the most critical indicator. An August 2026 UN report estimates JNIM’s membership at approximately 7,000–8,000, with about half concentrated in Mali, and identifies the group as the primary terrorist threat in the Sahel. The Monitoring Team highlights the organisation’s command, control, and coordination capabilities across its combat units as a key strength, noting its increasing use of commercial satellite communication systems to maintain resilient connectivity and real-time coordination in remote areas4.

Financial capacity is even more significant. The same report indicates that a large portion of a roughly $50 million ransom received in 2025 was redistributed among JNIM’s *katibas*, playing a major role in funding the 2026 offensive in Mali. Some funds were reportedly allocated to AQIM, while the report assesses it as likely that a share of the revenue flowed into the broader al-Qaeda network5.

Here, an often-underestimated strategic variable emerges. When an organisation simultaneously possesses thousands of fighters, inter-regional coordination capabilities, substantial independent revenue streams, geographic depth, resilient communication systems, and the ability to influence transportation and economic activity, a simple tally of attacks captures only part of the threat. JNIM is progressively developing the capacity to determine not only where to strike the state, but also where the state can manoeuvre, resupply, and maintain a presence. This represents a fundamental difference.

From Terrorism to Insurgency

The transformation in the Sahel highlights a broader issue. Many of the organisations we continue to classify as “terrorist” employ terrorism merely as one component of a much wider operational repertoire. JNIM and al-Shabaab are prime examples. Al-Shabaab has not survived for nearly two decades simply because it remains capable of constructing explosive devices or assassinating officials. Its resilience stems from a combination of military activity, intelligence gathering, taxation, coercion, parallel justice systems, propaganda, and the ability to embed itself within local economies.

Monitoring conducted for my Strategic Outlook reports on the group recorded 73 attacks in January 2026, 53 in February, 72 in March, 54 in April, 64 in May, 48 in June, 97 in July, and 152 in August, totalling 613 actions6.

Furthermore, al-Shabaab has undergone a qualitative shift in its operational conduct, moving toward more “targeted and strategic” operations. International military pressure remains high. AFRICOM recorded 78 strikes in Africa during 2026 up to early August, with a significant portion concentrated on Somalia. In July alone, strikes against al-Shabaab were reported in Jamaame, Welmaro, Sablaale, Qumbi, Baqdaad, Juba, Jamame, Farsooley, and Jilib7.

The campaign’s persistence does not prove the strikes are ineffective; that would be a methodologically flawed conclusion.

Rather, it demonstrates that tactical degradation and strategic resolution are not the same thing.

Counterterrorism and counterinsurgency are not synonymous.

Leadership can be eliminated. A financial network can be disrupted. A camp can be destroyed. But when an organisation has embedded itself in local economies, community disputes, criminal networks, and areas where the State’s presence is intermittent, neutralising it cannot be reduced to a targeting problem.

Islamic State: The Caliphate has been destroyed, but the network has not.

The same distinction applies to the Islamic State. The destruction of the territorial caliphate represented a massive strategic defeat. It eliminated the ability to govern millions of people openly, utilise state infrastructure, concentrate vast economic resources, and attract tens of thousands of foreign fighters; however, the central territory and the global network were not the same.

The 38th UN report from August 2026 describes the organisation’s core as struggling, subjected to persistent counter-terrorism pressure, plagued by leadership issues, and unable to provide coherent direction to the network as a whole. Nevertheless, its propaganda and capacity for incitement remain potent8.

This combination is significant, as a strategically weakened core can coexist with highly active regional affiliates. ISWAP, IS Sahel, ISCAP, Islamic State Mozambique, and Islamic State Somalia do not share the same capabilities, priorities, or trajectories.

The pertinent question is not simply how strong the Islamic State is, but rather what function each node within the system performs. Some provinces primarily constitute local insurgencies, whereas others generate resources, facilitate the transfer of personnel and know-how, and hold greater importance for the trans-regional network.

A case in point is the Islamic State Khorasan Province (ISKP), which remains one of the most critical nodes for assessing the external threat.

The UN Monitoring Team believes that ISKP has suffered serious setbacks due to counter-terrorism operations conducted by the Taliban and Pakistan. Yet, it simultaneously highlights the group’s persistent intent to carry out external operations. The group appears to be in a rebuilding phase, retaining the capacity to carry out infrequent yet high-profile attacks and, according to UN-consulted member states, possessing drones, night-vision devices, thermal imagers, and specialised training9.

Like ISKP, AQAP is among the groups most likely to engage in future external plotting activities. This assessment highlights a fundamental distinction: intent does not equate to capability.

While numerous jihadist organisations threaten the West in their propaganda, far fewer possess the combination of reliable personnel, facilitators, funds, documentation, secure communications, know-how, and access to the target area required to turn intent into a complex operation. A proper threat assessment must therefore measure the gap between will and capability. ISKP is particularly significant because it has demonstrated a greater inclination than many other affiliates to attempt to bridge that gap.

Al-Qaeda: Leadership in Decline, AQAP Seeks Centrality

Al-Qaeda today requires a more granular analysis; while its leadership remains marginalised, the network has not disappeared. A particularly important element of the 2026 landscape is AQAP, which appears increasingly intent on assuming greater ideological and operational leadership within the global al-Qaeda network. In August, the aforementioned Monitoring Team went further, defining the group as “the vanguard of the global Al-Qaida movement” and highlighting its commitment to external operations.

In February 2026, member states also reported an improvement in AQAP’s financial situation, fueled by the smuggling of goods and weapons between Somalia and Yemen, as well as by kidnapping for ransom and extortion. The Monitoring Team also noted economic ties with al-Shabaab10.

AQAP took advantage of the security vacuum in southern Yemen during the first months of the year to strengthen its capabilities; however, none of these indicators demonstrates that AQAP has returned to the external operational capacity of its most dangerous years. Given a history of external plotting, a deteriorating environment, improved finances, and the ambition to assume a more central role in the network, this warrants priority monitoring.

Afghanistan-Pakistan: The Problem Is the Ecosystem

South Asia constitutes the other theatre where the threat intensified in 2026. The most evident operational data concerns the TTP. Monitoring conducted for this site’s Strategic Outlooks recorded 245 attacks in January 2026, 352 in February, 385 in March, 409 in April, 309 in May, 336 in June, 315 in July, and 406 in August, totalling 2,757 actions over eight months11. While the TTP remains primarily focused on the Pakistani state, there is insufficient evidence to automatically translate this immense insurgent capability into a comparable direct threat to Europe or the United States. However, a different strategic factor is at play, as highlighted by the UN, namely that al-Qaeda continues to provide the TTP with ideological guidance, training, and support. Meanwhile, AQIS remains a regional entity that has become more cohesive, even as it continues to operate through decentralised cells and, as of 2025, supports the IMP in Pakistan.

The key variable to monitor, therefore, is not merely the existence of formal alliances, but the cross-pollination of capabilities. An ecosystem where the TTP, IMP, ISKP, AQIS, elements of al-Qaeda’s central leadership, and other militant organisations coexist facilitates the exchange of operational experience, facilitators, technologies, tactics, and personal networks. A group can remain locally focused while simultaneously contributing to an environment from which other organisations derive transnational capabilities.

Europe: The Threat is Contained but Persistent

The threat facing Europe and North America can be described as primarily linked to homegrown “lone actors” inspired online by jihadist propaganda; these individuals are generally involved in small-scale plots and lack direct ties to the organisation or its affiliates.

In the early months of 2026, security services thwarted several plots in France, Germany, Italy, and Spain, mostly involving young sympathisers of the Islamic State and al-Qaeda.

Europol provides the quantitative picture for 2025: 45 terrorist attacks were recorded in the European Union, 22 completed, 20 thwarted, and three failed, with 24 of them being jihadist in nature. A total of 486 people were arrested for terrorism-related offences, 347 of whom (71%) were linked to jihadism. Jihadist attacks resulted in five deaths and 81 injuries12.

However, the most significant aspect is the online ecosystem that enables dispersed networks, lone actors, and self-initiated cells to radicalise, mobilise, and act autonomously. Many individuals display only a superficial ideological understanding, while personal grievances, a fascination with violence, a search for identity, and extremist narratives may overlap. Another factor to consider is the shift in age demographics. In 2025, 130 people arrested in the EU for terrorism offences were 18 years old or younger; the youngest was 1213. While this figure covers the entire terrorist spectrum, not just jihadism, it highlights the growing exposure of minors to digital extremist ecosystems.

We are not witnessing a reconstruction of the 9/11 model. We are witnessing a lowering of the organisational threshold required to generate violence. In 2001, a strategic operation required selecting attackers, training, international travel, funding, communications, and a lengthy preparation phase. By 2026, an organisation can produce terrorist effects without personally knowing the perpetrator. This reduces the organisational cost of the attack, without necessarily increasing its lethality, but it does reduce its signature.

The digital realm has not replaced the sanctuary.

Digital transformation represents one of the most significant changes to occur since 9/11. In response to the degradation of capabilities required for complex attacks, Al-Qaeda and the Islamic State have invested more heavily in information operations, propaganda, and the inspiration or facilitation of individuals with access to the West. The increasing use of short, emotionally evocative content centred on grievances allows them to reach young audiences with limited knowledge of traditional jihadist doctrine.

The digital realm, however, does not replace territorial sanctuary; it complements it.

A digital ecosystem can radicalise, connect, and instruct, but territory can generate different capabilities: trainers, bomb-makers, protected leadership, documentation, funding, logistics, military experience, and freedom to plan. For this reason, the territorial expansion of an organisation seemingly focused on a local conflict must also interest those assessing threats to the West and global security. The question is not necessarily what JNIM or Al-Shabaab intend to do today in Rome, Paris, or London. The intelligence question concerns the capabilities they could develop if they acquired sufficient sanctuary, revenue, expertise, and freedom of action.

What has counter-terrorism actually achieved?

Finally, interpreting the post-9/11 era requires more rigorous examination. The fact that jihadist organisations continue to exist does not prove that twenty-five years of counter-terrorism efforts have been futile. The infrastructure that enabled 9/11 has been severely degraded, Al-Qaeda’s historic leadership has been progressively eliminated, and the Islamic State’s territorial caliphate has been destroyed. Financial intelligence, biometrics, watchlists, Passenger Name Records, screening, battlefield evidence, and multilateral cooperation have vastly improved the ability to identify suspicious movements and networks.

Interpol offers a concrete measure of this evolution. Operation Neptune VII, conducted in 2025 across more than 70 border points in Europe, the Middle East, and North Africa, resulted in approximately 30 million checks against Interpol databases. Authorities identified 328 individuals subject to Interpol Notices or Diffusions, 57 of whom had suspected links to terrorism, while the checks yielded further information on the movements of nearly 60 alleged foreign terrorist fighters14.

The correct conclusion, therefore, is neither “success” nor “failure.” Counterterrorism efforts have vastly increased the cost of centralisation. This is arguably one of the most overlooked strategic consequences of the past twenty-five years. The most adaptive organisations have learned to reduce their operational footprint, distribute functions, grant autonomy to their peripheries, embed themselves in local conflicts, and survive the loss of their leaders. The jihadism of 2026 is thus, at least in part, the product of the selective pressure exerted upon it by twenty-five years of military, financial, investigative, and intelligence operations.

This is not an argument against counterterrorism; it is a reason to adapt it once again.

What should be monitored?

JNIM represents a prime contemporary example of jihadist expansion driven by insurgency, economic coercion, military capability, and the gradual penetration of state peripheries. However, its expansion toward coastal West Africa should not be viewed as inevitable. The group’s leadership maintains a relatively cautious approach to geographic expansion, prioritising internal cohesion and consolidation. This balance between growth and discipline makes it strategically significant. Al-Shabaab remains one of the most mature jihadist insurgencies in terms of longevity, institutional capacity, and resilience. ISKP remains a critical focal point for monitoring potential external power projection. The TTP represents one of the most intense insurgent campaigns within the Afghanistan-Pakistan theatre. Yet, it must be assessed primarily through the lens of its domestic and regional priorities, rather than automatically equating its tactical capabilities with a threat to the West. The Islamic State’s African provinces require nuanced analysis; some may remain primarily local organisations, while others could gain greater financial, logistical, or territorial importance for the network. Finally, AQAP poses a significant risk of resurgence.

The point is not to argue that it has already regained its past capabilities, but rather to observe the convergence of a permissive environment, financial resources, a history of external plotting, and its growing centrality within the al-Qaeda network.

Conclusions: The next strategic surprise

Merely tallying the attacks carried out by al-Qaeda and the Islamic State in Western nations or globally is insufficient to understand what might lie ahead.

A strategic threat is not necessarily the actor generating the most violence today; it may well be the one amassing capabilities that have not yet been deployed. Twenty-five years later, al-Qaeda no longer possesses the organisational structure it had in 2001. The Islamic State no longer controls the territory it held in 2014. Military, financial, investigative, and intelligence pressures have made it much harder to recreate the conditions necessary for complex transnational operations. Yet, the jihadist system has not disappeared; it has simply changed its architecture.

No single centre of global jihadism exists; instead, regional systems evolve at different speeds. Some control territory, while others build insurgencies, generate resources, and maintain transnational networks. Still others harbour ambitions for external operations and can survive the loss of their commanders.

Today, this system is likely less capable of rapidly concentrating resources on the scale that enabled the 9/11 attacks, but it is more dispersed and thus harder to neutralise as a whole.

The next strategic surprise might not take the form of another 9/11; it could unfold gradually, through a state progressively losing control of its peripheral regions, a local organisation expanding across borders, an insurgent network amassing tens of millions of dollars, a province acquiring specialists and logistical capabilities unnecessary for its local conflict, a propaganda apparatus successfully mobilising a new generation in Europe, or a peripheral haven transforming into a hub for external operations.

The challenge for intelligence agencies lies in identifying this transition before it culminates in an attack. Hence the question, twenty-five years after 9/11, of whether another al-Qaeda exists today capable of replicating the events of 2001. Based on current evidence, the answer is likely no.

However, a more useful question is: which organisations are currently acquiring the conditions that could enable them to pose a strategic threat in the future?

The jihadist movement of 2026 is weaker at its core but more expansive at its periphery. The strategic error would be to interpret the absence of another 9/11 as proof that the system capable of generating transnational jihadist violence has disappeared. It has not disappeared; it has adapted.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Document Type: Executive Intelligence Briefing
Scope: Global Jihadist, Insurgent & Hybrid Warfare Threat Assessment
Time Horizon: Rolling Forecast (30–90 Days)
Reference Period: September- November 2026.

This document is an independent analytical product intended for professional use by analysts, policy planners, security practitioners, and decision-makers.

Intended Audience & Use

This Executive Intelligence Briefing is intended for use by intelligence analysts, policy planners, military and security decision-makers, international organisations, and applied academic researchers concerned with the threat dynamics of jihadist, insurgent, and hybrid warfare.

The document supports strategic awareness, forward-looking risk assessment, and prioritising monitoring over a rolling 30–90-day horizon. It is not intended to provide tactical-level tasking, real-time operational guidance, or event-specific prediction. Use the briefing as a decision-support and situational-awareness tool to inform planning, posture adjustment, and analytical focus, not immediate response.

📌 Inside this Executive Intelligence Briefing

This briefing includes:

• Executive Overview – Strategic Context

• Key Judgments

• Global Threat Posture

• Global Structural Assessment

  Africa, Middle East & Asia, Transnational Networks & Secondary Threat Environment.

• Operational Actor Assessment

  • Africa: ISWAP, IS-Sahel, IS-Somalia, ISM, ISCAP, JNIM, al-Shabaab, Boko Haram, Lakurawa.

  • Middle East & South Asia: IS Syria/Iraq, AQAP, AQIS, ISKP, ISPP, ISEAP, TTP, Ittehad-ul-Mujahidin Pakistan.

• Cognitive & Hybrid Battlespace
  Narrative Competition and Strategic Legitimacy, Al-Qaeda’s Wider Narrative Adaptation, Palestine as a Cross-Ecosystem Mobilisation Narrative, Capability Dissemination and Operational Enablement, Digital Ecosystem Evolution, Iranian-Aligned Cognitive and Digital Architecture, Ansar Allah and the Weaponisation of Strategic Geography, Hamas and Post-Conflict Cognitive Survival.

• Forward Assessment (30–90 Days)
  Forecast Framework, Europe and the Western Threat Environment, Hybrid Actors and European Strategic Exposure, Strategic Risk Assessment, Escalatory Scenario, Strategic Shock Scenario, Early Warning Indicators.

• Strategic Risk Assessment

  Strategic Risk Hierarchy, Escalation Triggers, Cross-Theatre Risk Interaction, Executive “So What?”

• Intelligence Monitoring
  Priority Indicators, Key Intelligence Questions.

Confidence, Assessment & Intelligence Gaps

This assessment is produced with moderate to high confidence regarding structural trends, theatre-level operational logic, tempo modulation patterns, and the most likely 30 to 90-day trajectories, based on systematic analysis of incident data, propaganda monitoring, and pattern continuity across regions to ensure methodological transparency.

Confidence is highest in assessing Africa as the primary kinetic centre of gravity, Pakistan as a high-endurance attrition theatre, and the broader ecosystem’s reliance on below-threshold operational logic, while acknowledging that intelligence gaps in remote or contested areas introduce moderate confidence levels.

Key limitations remain:

• In some theatres, especially remote or contested areas, incident visibility is structurally uneven.

• Quiet months or reduced media output may reflect risk management and force preservation rather than degradation. Conversely, concentrated claim density may serve reputational objectives without a proportional increase in kinetic expansion.

• Assessments of intent are based on pattern analysis, target-selection logic, propaganda framing, and behavioural shifts rather than confirmed insider access.

• The dissemination of training material, UAV manuals, and cumulative infographics signals capability socialisation, but the conversion rate from dissemination to operational activation is difficult to measure in advance.

• Attribution ambiguity in decentralised ecosystems complicates the accurate linking of online enablement, local facilitation networks, and offline incidents, particularly in transnational secondary environments.

These gaps do not alter the central assessment of continuity, resilience, and distributed attritional logic. They reinforce the need to prioritise qualitative shifts over quantitative fluctuations, including changes in target class, geographic clustering, claim behaviour, technical enablement signals, and evidence of HUMINT degradation.

Ongoing monitoring should therefore focus less on monthly totals and more on behavioural anomalies, corridor reactivation, escalation in target salience, and the intersection between cognitive signalling and operational execution.

Methodological Note

This briefing is based on:

• systematic monitoring of primary jihadist propaganda (statements, videos, magazines, claims);

• analysis of reports from field sources, local media, and military publications/statements

• analysis of OSINT, IMINT, Digital HUMINT, and SOCMINT

• comparative temporal analysis to distinguish short-term variation from structural trends;

• explicit separation between observation, assessment, and judgment.

Forecasting judgments are probabilistic, not predictive, and are designed to inform preparedness and decision-making rather than to anticipate specific events.

Scope Exclusions

This briefing operates within clearly defined analytical boundaries.

• It does not include classified, law-enforcement–sensitive, or restricted government information, and is based exclusively on open-source intelligence and structured analytical assessment.

• It does not assess domestic extremism in Western states except where relevant to transnational jihadist cognitive and influence dynamics.

• It does not attempt to predict specific attacks, timelines, or targets; instead, it focuses on probabilistic trends, threat configurations, and early warning indicators.

• It does not provide policy prescriptions or normative recommendations, limiting its scope to assessment, implications, and monitoring priorities.

Executive Overview – Strategic Context

The global jihadist, insurgent and hybrid threat environment entering September–November 2026 is characterised by operational resilience, selective acceleration and increasing threat density rather than a single systemic escalation.

Africa remains the principal centre of gravity. JNIM has demonstrated exceptional surge capacity across the central Sahel and is increasingly positioned to convert military persistence into economic and political pressure. Al-Shabaab has recorded the strongest recent operational acceleration, expanding from 48 attacks in June to 152 in August while simultaneously increasing activity in Kenya. Islamic State’s African provinces have declined in aggregate activity but retain substantial geographic resilience across Nigeria, eastern DRC, Mozambique, Somalia, Niger and Cameroon.

Pakistan represents the most intense counter-state insurgency environment. TTP’s 406 attacks in August confirm that exceptionally high operational tempo has become structural, while IMP adds a secondary layer of pressure against many of the same security institutions. The principal escalation mechanism remains the Afghanistan–Pakistan border, where a major militant attack and subsequent cross-border retaliation could rapidly expand a domestic insurgency into a wider political and security crisis.

Syria remains strategically important despite limited Islamic State attack volume. The principal concern is clandestine regeneration during political and security transition rather than renewed territorial control. Urban facilitation, detention instability and selective attacks against politically consequential targets would provide more meaningful indicators of Islamic State recovery than aggregate attack statistics.

Europe has become the priority external threat environment. Recent counterterrorism cases indicate continued movement by a limited number of subjects from ideological exposure toward technical research, external training intent, reconnaissance and attack preparation. There is insufficient evidence of a restored centrally directed jihadist campaign against Europe. The more immediate threat comes from self-initiated actors, micro-networks and partially facilitated individuals whose operational development may occur largely within digital environments.

Europe simultaneously faces persistent hybrid pressure. Russia-linked sabotage and hostile intelligence activity increasingly rely on deniable methods, low-cost technologies and disposable intermediaries. Iranian-aligned networks retain a separate latent external capability whose activation will depend heavily on escalation in the Middle East. These threat systems remain organisationally distinct, but their simultaneous presence creates growing pressure on European intelligence and protective-security resources.

The information environment increasingly operates as a capability layer across these theatres. JNIM integrates communications with insurgent legitimacy and governance. Al-Qaeda-aligned networks exploit Gaza, Iran, Yemen and other conflicts to maintain ideological coherence. Islamic State supporters continue distributing attack-enabling material. Hezbollah, Ansar Allah and Iranian-linked structures combine information activity with deterrence, proxy warfare and strategic coercion.

Read more

Ittehad-ul-Mujahidin Pakistan (IMP) represents a low-visibility but potentially destabilising jihadist actor within Pakistan’s militant landscape, operating at the intersection of ideological fragmentation, rivalry with established groups, and external influence.

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties suggest the potential for tactical escalation or diversification beyond its present operational profile, warranting ongoing monitoring.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. However, limitations such as potential propaganda bias, disinformation, and incomplete reporting from remote areas must be considered when evaluating the reliability of intelligence. Clarifying how these limitations impact operational decisions will help stakeholders interpret the data appropriately and avoid misjudgments.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — August 2026

3. Number, Targets, and Areas of Attacks in august 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion

Scope and Methodology

This Strategic Threat Outlook is based on:

• monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material disseminated through IMP-affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Limited availability of independently verifiable data;

• potential exaggeration or omission in group claims;

• propaganda bias and disinformation risks;

• uncertainty regarding organisational cohesion and external support.

These limitations are central to the assessment and are explicitly reflected in confidence levels and scenarios.

Overview and Security Threat Assessment

Ittehad ul Mujahidin Pakistan, IMP, emerged in April 2025 as a new jihadist coalition bringing together the Hafiz Gul Bahadur Group, Lashkar e Islam, and Harkat Inqilab e Islami Pakistan. The alliance was formally announced on 11 April through the official media structures of its constituent organisations and was presented as a unified framework for armed jihad under a common ideological, organisational, and communications architecture.

The founding declaration appointed Mahmood ul Hasan as official spokesperson and established Sada e Ghazwat ul Hind as the alliance’s central media structure. The subsequent transfer of attack claims and propaganda production under the IMP identity was strategically important. It indicated an attempt to move beyond tactical coordination and create a recognisable insurgent brand capable of aggregating previously autonomous militant networks.

Since its formation, IMP has developed from an emerging coalition into an increasingly structured actor within Pakistan’s jihadist landscape. Its significance derives less from numerical strength alone than from the combination of experienced commanders, established militant infrastructure, historical knowledge of the tribal belt, access to cross border sanctuary, and an increasingly diversified tactical repertoire. The group has demonstrated the ability to employ suicide attacks, SVBIEDs, improvised explosive devices, indirect fire, sniper teams, RPGs, and commercially adapted unmanned aerial systems.

This tactical diversification has been accompanied by deliberate capability signalling. Training footage, battlefield imagery, multilingual propaganda, and selective presentation of operational successes indicate an organisation seeking to demonstrate discipline, technological adaptation, and military professionalism. At the same time, IMP has repeatedly limited or suppressed public attribution of attacks when visibility could generate excessive political or operational costs. Consequently, public claims provide only a partial representation of its actual activity.

The group’s centre of gravity remains Khyber Pakhtunkhwa, particularly the southern districts and former tribal areas where the Hafiz Gul Bahadur network and Lashkar e Islam possess longstanding organisational roots. These environments offer difficult terrain, experienced facilitation networks, local intelligence, weapons access, and connectivity with Afghanistan. The widening militant footprint observed across Pakistan since early 2026 increases the possibility that IMP can exploit existing militant corridors to extend activity beyond its traditional core.

The security threat posed by IMP is therefore best understood as an insurgent threat with escalation potential rather than as a conventional terrorist organisation primarily oriented toward indiscriminate civilian mass casualty attacks. Its principal target set has remained the Pakistani security architecture, including the Army, Police, Frontier Corps, Counter Terrorism Department, intelligence personnel, and local security intermediaries. This targeting logic seeks to erode state presence, degrade intelligence collection, intimidate local collaborators, restrict security force mobility, and create greater freedom of action within contested districts.

• Ideological Competition with Tehreek-e-Taliban Pakistan

The establishment of IMP challenged the organisational primacy that Tehreek e Taliban Pakistan has attempted to maintain over the Pakistani jihadist movement. TTP’s early response emphasised unity under a single emir, a single command structure, and a single organisational banner, invoking the Afghan Taliban as evidence that disciplined centralisation produces strategic success.

Although much of this messaging avoided direct confrontation with IMP, the underlying competition was clear. The emergence of a separate coalition incorporating experienced militant factions created an alternative pole for fighters, commanders, donors, and local networks unwilling to operate under Noor Wali Mehsud’s leadership.

This competition should not be interpreted as necessarily leading to open armed conflict between the organisations. The more plausible dynamic is simultaneous rivalry and selective coexistence, with both movements exploiting overlapping operational environments while competing for legitimacy, recruits, influence, and territorial access.

Developments during 2026 have made this organisational competition more important. Fragmentation inside the broader TTP ecosystem, particularly developments surrounding Jamaat ul Ahrar, creates potential opportunities for IMP to attract dissatisfied cadres or develop tactical relationships with factions seeking greater autonomy. Any such realignment would improve IMP’s manpower, operational experience, and potentially its access to urban attack networks.

• Al Qaeda Linkages and Emerging Militant Nexus

The relationship between IMP and Al Qaeda in the Indian Subcontinent has become an increasingly important component of the threat assessment. Initial accusations that AQIS had encouraged the creation of a parallel militant structure originated largely from pro TTP circles and therefore required caution. Subsequent indicators, however, have strengthened the assessment that AQIS exercises meaningful ideological and organisational influence within the IMP environment.

Recent analytical reporting describes AQIS as having played an important supporting role in the development of the alliance and notes that AQIS propaganda has incorporated IMP operations into its broader presentation of Al Qaeda aligned militant activity. This does not establish that AQIS exercises direct operational command over IMP. It does, however, increase confidence that the relationship extends beyond rhetorical sympathy and includes ideological, media, facilitation, or organisational connectivity.

The potential convergence of AQIS, IMP, and Jamaat ul Ahrar linked networks represents the most consequential medium term development to monitor. JuA retains a history of high impact and urban terrorism, while IMP provides an increasingly coherent insurgent platform and AQIS can contribute ideological guidance, strategic networking, and transnational legitimacy. A durable nexus among these actors could broaden the threat beyond IMP’s current predominantly northwestern security focus.

Afghanistan remains central to this assessment. Pakistani militant networks continue to benefit from geographic depth across the border, while Islamabad increasingly treats Afghan sanctuary as a core driver of domestic insecurity. IMP’s leadership and constituent networks have strong historical connections to this cross border environment. This provides resilience and operational depth but also creates a political vulnerability, since highly visible IMP activity increases pressure on the Afghan Taliban and raises the risk of Pakistani military retaliation.

As of August 2026, IMP should therefore be assessed as an established and adaptive insurgent coalition rather than an experimental militant alliance. Its immediate threat remains concentrated primarily in northwestern Pakistan, but its organisational trajectory, tactical sophistication, AQIS connectivity, and ability to exploit fragmentation within the Pakistani jihadist ecosystem give it credible expansion potential.

The principal intelligence concern is not simply whether IMP increases its monthly attack volume. It is whether the alliance succeeds in transforming current operational resilience into a broader militant network capable of absorbing additional factions, expanding beyond its established geography, and integrating insurgent warfare with the urban attack capabilities historically associated with other Pakistani jihadist actors.

IMP Activities – August 2026

During August 2026, Ittehad ul Mujahidin Pakistan remained operationally active within a Pakistani militant environment characterised by renewed violence and sustained counterterrorism pressure. The group continued to benefit from the same interconnected militant geography that links the former tribal districts, southern Khyber Pakhtunkhwa, and cross border areas adjoining Afghanistan.

Read more

The group continues to prioritise attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signalling operations.

No structural fragmentation or operational collapse is observable, underscoring the group’s resilience and the need for sustained efforts to address the threat.

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT, including analysis of propaganda, disinformation, and group claims, is essential to understanding al-Shabaab’s influence operations and countering their narrative effectively.

Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.

Limitations

• Incomplete or delayed reporting from contested or remote areas;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted in the assessment.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — August 2026

3. Number, Targets, and Areas of Attacks - August 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

Despite ongoing counterterrorism efforts, al-Shabaab’s resilience is shaped by regional support and international engagement, which should reinforce the audience’s confidence in the importance of proactive, coordinated regional strategies to maintain security.

Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centres. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly in strategic towns, along supply corridors, and around population hubs.

The operation began on 15 February 2025 with synchronised assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry manoeuvres. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signalling momentum, inevitability, and state weakness.

Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance-and-coercion model, even in areas nominally held by the government. This includes political and religious penetration, targeted assassinations, systematic taxation, and narrative dominance, which collectively sustain the group’s influence and complicate counter-insurgency efforts.

• Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalise al-Shabaab authority and delegitimise federal institutions.

• Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.

• Systematic taxation and extortion, including collecting zakat in government-controlled zones, underscore the group’s parallel administrative reach.

• Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.

During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.

After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran—areas where al-Shabaab retains deep logistical and social networks—the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.

Assessment: al-Shabaab actively shapes the battlespace through synchronised military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, as al-Shabaab continues to shape the battlespace and impact regional stability. Its ability to synchronise military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. In the absence of sustained territorial control, effective local governance, and disruption to al-Shabaab’s parallel administration, the threat trajectory for 2026 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.

Al-Shabaab Activities – August 2026

August 2026 was marked by a substantial intensification of Harakat al-Shabaab al-Mujahidin activity across southern and central Somalia, accompanied by sustained cross-border pressure in northeastern Kenya.

Read more

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• OSINT, IMINT, SOCMINT, and Digital HUMINT integration.

Sources include primary JNIM media channels, open-source reporting, official statements, and local sources, which collectively strengthen the credibility and comprehensiveness of this analysis.

Limitations

• Incomplete or delayed reporting from conflict areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — August 2026

3. Number, Targets, and Areas of Attacks in August 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

The operating environment in Mali and across the central Sahel remains characterised by persistent governance deficits, chronic socioeconomic vulnerability, and uneven state presence. These structural conditions, long evident in northern Mali and historically exploited by autonomy-oriented and separatist movements, continue to constitute the primary enabling factors for armed mobilisation. In this context, jihadist recruitment is less a function of large-scale ideological adherence than of the ability to convert local grievance systems into mechanisms of compliance, protection, and mobilisation. Where the state is absent, predatory, or inconsistent, armed actors that can impose order, resolve disputes, and regulate daily life retain a decisive advantage. This dynamic, widely documented in international analytical and academic literature on Sahelian insurgencies, remains central to understanding the durability and expansion of Jama’at Nusrat al-Islam wal-Muslimin (JNIM).

JNIM remains the most capable Salafi-jihadist actor in the central Sahel, though logistical and intelligence limitations constrain its operational capacity. Established in March 2017 through the merger of Ansar Dine, Katibat Macina, al-Mourabitoun, and AQIM’s Sahara branch, the group has evolved into a federated coalition rather than a rigidly hierarchical organisation. It operates primarily in Mali, Burkina Faso, and Niger, while periodically extending operational pressure toward coastal states and peripheral borderlands. Analytically, JNIM is best understood as a hybrid insurgent structure that combines guerrilla warfare, selective governance, and political signalling. Its resilience derives from a decentralised operational architecture, strong social embedding through local intermediaries, and a pragmatic strategic culture that prioritises survivability and influence over symbolic or purely spectacular violence. However, it remains vulnerable to targeted countermeasures.

Over time, JNIM has demonstrated a consistent capacity to instrumentalise local discontent, particularly among marginalised rural populations exposed to insecurity, intercommunal violence, and abuses by state or auxiliary forces. Its traction among segments of Fulani (Peul) communities in central Mali and Burkina Faso, and among Tuareg networks in the north, is better explained by political-economy and security dynamics than by doctrinal mobilisation alone. Protection arrangements, dispute resolution, retaliation logics, and access to livelihoods remain the primary vectors of recruitment and passive support. Where counterinsurgency responses rely on indiscriminate coercion, proxy militias, or collective punishment, they tend to generate strategic blowback, accelerating recruitment and deepening JNIM’s social cover.

Multiple international assessments have repeatedly underlined that the persistence of jihadist violence in the Sahel is rooted in unresolved political and governance failures rather than ideological diffusion. Operationally, JNIM has pursued a sustained and adaptive campaign targeting civilians, national security forces, foreign militaries, and, previously, UN peacekeepers. The group’s operational logic has remained broadly consistent: incrementally degrade state presence, contest transport corridors, impose costs on governance, and convert insecurity into leverage. From an intelligence perspective, two developments matter more than the absolute number of attacks. First, JNIM has demonstrated improved coordination of operations across wide geographic areas within compressed timeframes, indicating maturation in communications, command and control, and tactical mobility. Second, the group has continued to diversify its tactical repertoire, increasingly integrating drones for aerial surveillance and attack facilitation, alongside persistent use of IEDs, ambushes, targeted assassinations, and complex assaults against fixed military installations. Conflict-monitoring organisations have noted that JNIM is now among the most active non-state actors using drone-enabled tactics in the Sahelian theatre, reflecting rapid learning and diffusion within the network.

Leadership dynamics further shape JNIM’s operational behaviour across sub-theatres. While the coalition maintains strategic coherence, different operational styles remain evident. In northern Mali, leadership associated with Iyad Ag Ghali has historically prioritised calibrated violence, elite brokerage, and selective accommodation with local power brokers, including militia, political, and religious figures. In contrast, Amadou Koufa’s operational influence in central Mali and Burkina Faso has relied more heavily on community-level mobilisation and identity-linked grievance narratives, particularly among Fulani populations. These variations do not represent fragmentation but rather flexible adaptation to distinct sociopolitical environments within a common strategic framework.

The escalation cycle observed since mid-2023 reflects a convergence of internal confidence, expanded mobilisation narratives, and favourable opportunity structures. While propaganda messaging alone does not drive operational tempo, it provides insight into intent and organisational self-perception. The broader trendline, higher operational intensity, expanding geographic reach, and increasing tactical sophistication have continued into 2024 and 2025, as documented by international analytical reporting on Sahelian jihadist dynamics.

In 2025, a qualitative shift has become particularly salient: JNIM’s increasing reliance on economic warfare as a deliberate instrument of political coercion. The group has moved beyond opportunistic predation toward systematic disruption and regulation of supply chains, particularly in western Mali. Attacks against industrial facilities, infrastructure projects, and artisanal mining sites have been followed by explicit threats and subsequent action targeting fuel supplies from neighbouring coastal states. The resulting interdiction of logistics corridors, especially around Kayes and Nioro, has transformed economic disruption into a mechanism of political engineering. In a country heavily dependent on imported fuel and goods, such a disruption poses a direct challenge to the state’s functioning. The authorities’ inability to secure long, vulnerable road networks amplifies the impact of relatively small-scale attacks, producing cascading effects on transport, electricity generation, education, and urban services. In this context, JNIM positions itself not merely as a spoiler but as a regulating authority capable of permitting, denying, or conditioning access to essential flows.

As control over supply channels increases, JNIM’s governance practices become more visible and enforceable. Field reporting indicates the imposition of behavioural and social regulations in areas under its influence, including dress codes and public conduct rules, which are enforced through coercive means. These measures should be interpreted less as isolated ideological enforcement and more as signals of authority and rule-setting capacity. By normalising compliance and demonstrating the state’s inability to protect alternative norms, JNIM reinforces its claim to de facto governance.

JNIM’s continued operational effectiveness is closely tied to a tactical model optimised for the Sahelian environment. Small, highly mobile units using motorcycles and pickup trucks can rapidly mass, strike, and disperse in swarm-like manoeuvres that overwhelm static defences. These teams rely on radio and mobile communications, ground observers, and increasingly drone-based surveillance to maintain situational awareness. The attack spectrum remains broad, ranging from IEDs and ambushes against convoys to targeted killings, raids on villages associated with pro-government militias, and complex assaults on bases and checkpoints using suicide vehicle bombs, indirect fire, and direct assaults. This combination of mobility, decentralisation, and technological adaptation continues to complicate prediction and containment efforts.

Despite contradictory official narratives from affected governments, available open-source indicators suggest that JNIM’s territorial influence and operational reach continue to expand. The coalition has demonstrated a new level of confidence by conducting operations hundreds of kilometres apart and probing previously less affected areas in central and western Mali. Emerging activity along border corridors toward Niger, Benin, and Nigeria further suggests a strategy of gradual geographic expansion rather than sudden territorial conquest.

Strategically, JNIM is following a well-established insurgent trajectory: fight to gain leverage, govern to retain influence, and negotiate from a position of accumulated power. This does not imply imminent political talks, but it does indicate that the group’s centre of gravity is increasingly political rather than purely military. The most significant risk posed by JNIM today is therefore not limited to kinetic violence. Still, it lies in the progressive erosion of state authority and the normalisation of armed governance across significant portions of the Sahel.

Activity and Operations Analysis — August 2026

During August 2026, Jama’at Nusrat al Islam wal Muslimin maintained an extensive military campaign across the central Sahel, with Mali and Burkina Faso remaining the principal theatres of activity.

Read more

Africa remains the Islamic State’s primary global theatre of operations, surpassing the Middle East and Asia in attack volume and organisational strength, underscoring the critical need for vigilance among security and policy leaders to address this evolving threat.

Scope and Methodology

This Strategic Threat Outlook is based on:

systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

reporting from sources in the field;

While integrating OSINT, SOCMINT, IMINT, and Digital HUMINT enhances intelligence breadth, it is crucial to acknowledge their respective reliability, sources-including primary Islamic State media channels and local reports-and limitations to ensure accurate threat assessments.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

• Overview and Security Threat Assessment

• Activity and Operations Analysis — August 2026

• Number, Targets, and Areas of Attacks in August 2026

• Charts and Statistics

• Analytical and Intelligence Assessments

• Implications for Decision Makers

• Early Warning Indicators

• Threat Forecast, 30 to 90 Days

• Executive Intelligence Conclusion and Risk and Threat Overview

Provincial Snapshots

• Islamic State West Africa Province (ISWAP)

• Islamic State Sahel Province

• Islamic State Central Africa Province (ISCAP)

• Islamic State Somalia Province

• Islamic State Mozambique Province (ISM)

Overview – Islamic State in Africa

The Islamic State’s presence in Africa is resilient and adaptive, demonstrating high operational continuity despite counterterrorism efforts, reinforcing the importance of sustained strategic focus for security officials to counter this persistent threat.

In Africa, IS affiliates demonstrate high operational continuity, executing attacks with diverse tactics like assaults, ambushes, kidnappings, and terror campaigns, especially against Christian communities, in recent months.

The epicentre of this dynamic remains sub-Saharan and central-eastern Africa, with particularly worrying developments in the Democratic Republic of Congo and Mozambique, where IS affiliates have demonstrated not only a capacity for sustained violence, but also a growing level of coordination, intermittent territorial control, and integration with local criminal economies. In such contexts, violence is not episodic but part of a strategy of progressive erosion of state authority, exploiting structural fragility, socio-economic marginalisation, inter-community conflicts, and governance vacuums.

On March 20, 2025, the Islamic State officially announced the launch of a new military campaign, called “Burning Camps,” with a stated focus primarily on Africa. This campaign’s implications include heightened regional instability, increased displacement, and the need for enhanced security cooperation among affected nations to counteract these threats.

The strategy remains consistent with the Islamic State’s operating model: creating chronic instability, delegitimising the state, presenting itself as an alternative (or inevitable) actor, and exploiting chaos to facilitate recruitment, logistical support, and territorial entrenchment. In this sense, IS does not aim exclusively at permanent territorial conquest but at fluid, opportunistic control sufficient to maintain freedom of manoeuvre and offensive capability.

Currently, the Islamic State is actively and continuously operating in at least eight African countries, with monthly variations in geographical distribution and intensity of activities. During the period under review, the organisation focused its efforts on fewer theatres without reducing overall capacity, indicating a decentralised yet functional structure.

A central and often underestimated element is the propaganda dimension. Every significant attack has been followed by intense media activity. In the month analysed, the Islamic State disseminated a significant volume of content, photographs, videos, and press releases through its central channels, in particular the Amaq news agency and the weekly al-Naba. Propaganda is not limited to claims of responsibility but constructs a narrative of success, resilience, and inevitability, aimed at both local supporters and a global jihadist audience.

In summary, the African picture shows an Islamic State that is not in decline but in a phase of adaptive consolidation, capable of absorbing losses, reorienting priorities, and exploiting the structural weaknesses of local contexts. For intelligence, security, and political and military decision-makers, Africa is not a secondary front but the current centre of gravity of the threat posed by the Islamic State, emphasising the need for sustained vigilance.

Islamic State in Africa - Activities — August 2026

During August 2026, Islamic State activity across Africa remained concentrated in its established operational theatres, but the month also highlighted continued adaptation under sustained counterterrorism pressure. The principal centres of activity remained northeastern Nigeria, eastern Democratic Republic of the Congo, northern Mozambique, the central Sahel and Puntland, each displaying distinct local dynamics but a common pattern of organisational persistence, mobility and exploitation of uneven state control.

Read more

Tehrik-i-Taliban Pakistan (TTP) remains a high and adaptable security threat to Pakistan, especially in Khyber Pakhtunkhwa and along the Afghan–Pakistani border areas. Clarifying threat levels will help stakeholders feel assured about the current risk assessment and trust the evaluation.

The threat remains high and persistent, underscoring the need for stakeholders to stay vigilant and allocate resources effectively over the next 3–6 months to maintain operational effectiveness.

Scope and Methodology

Although current patterns indicate a stable-to-increasing threat trajectory, the TTP’s demonstrated adaptability and cross-border ties highlight the importance of ongoing monitoring to ensure readiness against tactical escalation or diversification.

This Strategic Threat Outlook is based on:

• systematic monitoring of jihadist propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.

Sources include primary material from TTP-affiliated channels, open-source reporting, official statements, and local sources. Clarifying how these limitations-such as potential propaganda bias and delayed reporting-impact operational decisions will help stakeholders trust the assessment and interpret the data appropriately.

Limitations

• Incomplete or delayed reporting from remote or contested areas;

• Exaggeration or omission in group claims;

• Potential propaganda bias and disinformation.

Where attacks or claims cannot be independently corroborated, this is explicitly indicated in the assessment.

📌 Inside this Assessment

1. Brief overview of the TTP

2. Activity and Operations Analysis — August 2026

3. Number, Targets, and Areas of Attacks in August 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion

Brief overview of the TTP

The Tehrik-i-Taliban Pakistan (TTP), formed in 2007 as a coalition of Pashtun militant groups, remains the main jihadist threat to the Pakistani state today. Led since 2018 by Noor Wali Mehsud, the organisation has consolidated its internal structure by reabsorbing several splinter factions and strengthening its strategic communication. Its ideology is rooted in Deobandi jihadism with strong historical ties to the Afghan Taliban and Al-Qaeda. The TTP operates mainly in Khyber Pakhtunkhwa and Balochistan, but maintains selective capabilities in urban areas. The Afghan rear areas are strategically important, providing depth, training, and cross-border mobility. The group’s military campaign is now characterised by a combination of IEDs, ambushes, and complex attacks targeting police, paramilitary forces, and local administrative apparatus, with a more calibrated use of suicide operations than in the past. In 2024–2025, the TTP was consistently ranked among the most lethal groups globally, with increased operational sophistication and organisational resilience.

TTP Activities – August 2026:

August 2026 confirmed that Tehrik i Taliban Pakistan remained firmly on an offensive trajectory, despite sustained counterterrorism pressure and repeated intelligence-based operations across Khyber Pakhtunkhwa. The broadening security burden, including high-impact attacks outside traditional areas like Swat, indicates a shifting regional threat landscape that requires strategic adaptation and resource reallocation.

The attack in Swat at the beginning of the month was particularly significant because it demonstrated the group’s continuing ability to generate high-impact violence outside the traditional southern frontier belt. The suicide bombing near Kabal police station struck during a pro police gathering and produced substantial civilian and police casualties. The incident carried clear strategic weight because Swat had previously been treated as a largely stabilised theatre. Renewed violence there reinforces concern that the TTP and associated networks are testing areas where state control had been considered more durable.

Police and CTD structures remained under persistent pressure throughout the month. A targeted attack in Peshawar killed a CTD officer, while a grenade attack against a police post in Mohmand wounded several officers. In Bajaur, militants used rocket launchers and small arms against a police position, and in Bannu, security forces reported repeated quadcopter attacks against police infrastructure. Taken together, these incidents show that the TTP campaign is increasingly combining conventional insurgent methods with low-cost technological adaptation, particularly unmanned platforms used for harassment, reconnaissance, or attacks against static positions.

The geographic picture remained centred on the northwestern corridor, but the pattern was more dispersed than in previous months. Bannu, North Waziristan, South Waziristan, Bajaur, Orakzai, Khyber, Peshawar and Swat all remained operationally relevant. The significance lies in the ability to maintain pressure simultaneously across former tribal areas and settled districts. This forces the Pakistani security apparatus to distribute personnel and intelligence resources across a widening battlespace while militant cells retain the initiative in choosing where to concentrate effort.

Pakistani security forces responded with a sustained and increasingly intelligence-driven campaign. Joint military and police operations in Bannu, North Waziristan, Orakzai and Khyber removed multiple TTP-linked militants. In contrast, repeated operations in South Waziristan and Dir have continued to pressure known insurgent corridors. The operational paradox remains unchanged: tactical successes are producing militant losses, but they have not yet translated into a durable reduction in violence. The return of activity to areas previously declared cleared highlights the limits of purely kinetic containment when local facilitation, mobility and governance weaknesses remain unresolved.

August also strengthened the cross-border dimension of the threat. The latest UN monitoring assessment reinforced the judgment that the Afghan Taliban continue to provide the TTP with a permissive environment, while also noting limited attempts by Kabul to restrain the group. The same assessment highlighted operational and facilitation linkages involving TTP, Al Qaeda and other militant networks. This confirms that the organisation’s resilience cannot be assessed solely through activity inside Pakistan. Its strategic depth remains tied to a broader regional militant ecosystem and the persistent absence of effective Pakistan-Afghanistan cooperation.

Read more

This weekly strategic intelligence report documents and summarises jihadist propaganda and military activities from August 25 to 31, highlighting recent developments in the threat and providing a structured overview of the situation across various organisations and operational theatres.

This report highlights operational claims and objectives, especially their focus on military targets, to underscore their significance for threat recognition and strategic guidance, helping analysts and policymakers understand their critical roles in ongoing threat assessment and strategic implications.

This product helps analysts and policymakers track threat trends in depth, supporting their work in shaping strategic responses and understanding ongoing threats.

This publication includes brief threat assessments and analyses of operational intentions or forecasts, helping analysts and policymakers understand groups’ adaptive tactics and the dynamic threat environment.

🔹 Scope of Monitoring

This issue covers all identifiable official and semi-official propaganda from a predefined list of jihadist groups, selected based on operational relevance and threat level during the reference period, to improve situational awareness.

The emphasis on documentation, classification, and structured presentation of firsthand material aims to instil confidence in analysts and policymakers in the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and strengthen the reliability of the data used for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format, such as increased messaging in local dialects, and signal activity trends should be interpreted within the broader context of operational tempo, recent events, and known threat indicators, supporting analysts’ confidence in threat assessments and reducing misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Strategic Assessments

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions include the Weekly Strategic Assessments.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), released a video lasting 3 minutes and 18 seconds showing an attack on the barracks of the Burkinabe Army in the Namantenga province, Burkina Faso.

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 12 statements and 25 photos, claiming 17 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia, Niger Army, Islamic State militia.

The areas of the attacks were :

1) Burkina Faso = 11

- Gourma province, Mouhoun province, Loroum province, Yatenga province, Sissili province, Soum province, Bam province.

2) Mali = 5

- Timbuctu region, Segou region.

3) Niger = 1

- Tillaberi region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 28 statements claiming responsibility for 41 attacks.

The targets of the attacks were:

Somali Army, Somali pro-government militia, Burundian Army, Ugandan Army, Ethiopian Army, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 33

- Afgooye area, Mubarak area, Warmahane area, Qoryooley area, Janale area, Lower Shabelle region;

- Qansahdere area, Bay region;

- Dhobley area, Afmadow area, Kismayo area, Lower Juba region;

- Mahaday area, Middle Shabelle region;

- Mogadishu area.

2) Kenya = 8

- Fino area, Sheikh Barrow, Mandera County;

- Fafi area, Garissa County;

- Majengo area, Ras Bori area, Lamu County.

Al-Kataib Media, Harakat al-Shabaab al-Mujahidin, released a 2-minute, 39-second video showing the attack on a convoy of pro-government militias in the Teedan area, in the Hiiran region of Somalia.

Al-Kataib Media, Harakat al-Shabaab al-Mujahidin, released a 2-minute, 39-second video showing the attack on a convoy of pro-government militias in the Wajiid area, in the Bakool region of Somalia.

The sixth issue of the weekly Al-Bayan, published by the pro-Al-Qaeda (AQ) media outlet al-Yaqin – this time comprising 21 pages. The issue features the usual infographic summarising the attacks of the past week, religious messages and reports on the activities of al-Shabaab and JNIM.

2. Islamic State (IS)

The Islamic State’s official media published 2 issues of the weekly al-Naba this week (562). Issue 562, eight pages long, covers the week of 7 to 13 Rabi al-Awaal 1448, from 20 to 26 August 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Pakistan, Somalia and the Democratic Republic of Congo.

IS claims to have conducted 15 operations in all the mentioned areas and to have caused 52 deaths and injuries.

1) West Africa Province: The weekly al-Naba reports 7 attacks carried out by ISWAP militants against checkpoints, convoys, patrols, and camps belonging to the Nigerian Army and pro-government militias in the states of Borno and Yobe, Nigeria.

2) Central African Province: The weekly al-Naba reports that ISCAP militants carried out 4 attacks against patrols and barracks of the Congolese army and pro-government militias in the province of Ituri in the Democratic Republic of the Congo.

3) Somali Province: The weekly newspaper al-Naba reports that ISM militants carried out 1 attack against a Puntland Security Forces convoy in the Bari region, Puntland Federal State, Somalia.

4) Khorasan Province: The weekly al-Naba reports 3 attacks by ISKP militants against the Taliban militia, a leader of the Peace Committee, and Pakistani intelligence in the districts of Khyber, Bajaur, and South Waziristan in the province of Khyber Pakhtunkhwa, Pakistan.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 11 statements, claiming 16 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area: North Waziristan district, South Waziristan district, Khyber district; in the Khyber Pakhtunkhwa Province; Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising Hafiz Gul Bahadur’s (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), has released a 1-minute 17-second video showing an IED ambush on a Pakistani army convoy in the South Waziristan district of Pakistan.

Umar Media, Tehrik-i-Taliban Pakistan (TTP), released a video lasting about 2:37 minutes to show the sniper attacks carried out by its militants against Pakistani Army barracks and checkpoints in the South Waziristan district, in the Khyber Pakhtunkhwa province of Pakistan.

🔹Weekly Strategic Assessments

The reporting period from 25 to 31 August reflects a high but increasingly differentiated propaganda environment across the principal jihadist organisations.

Read more

Source Document Box

Source: Az-Zallaqa Media
Organisation: Jama’at Nusrat al-Islam wal-Muslimin (JNIM)
Type of document: Video (31-minute)
Language: Arabic

The message behind the interview

In jihadist propaganda, format is part of the message. A claim of responsibility demonstrates operational capability. Battlefield footage demonstrates military effectiveness. A martyrdom video sanctifies sacrifice. A sermon provides ideological instruction. A lengthy interview with a territorial commander serves a different purpose: it allows an organisation to explain how it wants the conflict, itself and its adversaries to be understood.

The 31-minute interview released by Jama’at Nusrat al-Islam wal-Muslimin’s (JNIM) Az-Zallaqa Media with Sheikh Abu Mahmoud, presented as the emir of the group’s branch in Burkina Faso, is a strategic communication exercise aimed at shaping regional security perceptions and legitimacy amidst contested power dynamics across the central Sahel.

Abu Mahmoud does not primarily appear as a battlefield commander. He speaks as a religious authority, political representative and interpreter of the conflict. The discussion moves from military operations to foreign assistance, ethnicity and nationalism, repression by the Burkinabè authorities, media narratives, humanitarian organisations, civilian populations and the broader relationship between JNIM and Muslim communities. The cumulative effect is deliberate: JNIM attempts to present itself not simply as the armed organisation attacking the state, but as an alternative authority entitled to explain what is happening, identify who is responsible and define what constitutes legitimate political and social order.

The timing matters. JNIM enters the second half of 2026 from a substantially stronger regional position than several years ago. Its geographical reach now extends across much of the central Sahel and increasingly toward coastal West Africa. JNIM has become the most active armed actor in the Sahelian conflict system, combining sustained military pressure with taxation, economic coercion, population control, dispute resolution, and rudimentary forms of governance. In early 2026, the organisation launched a region-wide offensive across the central Sahel and into Benin, while its rivalry with Islamic State Sahel Province has increasingly become a transnational competition for territory, influence, and operational space.

The interview therefore accompanies, rather than substitutes for, kinetic expansion. This distinction is central to understanding its cognitive significance.

From battlefield success to political meaning

JNIM’s communication, which visualises military effectiveness through raids, ambushes, and captured equipment, aims to reinforce a narrative of resilience and ideological righteousness, fostering confidence in its broader political objectives.

When asked whether JNIM receives support from another state or external actor, Abu Mahmoud explicitly dismisses the proposition, emphasising the organisation’s strategic autonomy and resilience, which is critical for regional threat assessments and policy planning.

First, it protects the organisation’s image of strategic autonomy. Second, it reinforces an internal narrative in which battlefield performance confirms ideological righteousness. Third, it counters government narratives that portray jihadist expansion as the consequence of external manipulation or foreign support. The military event is therefore cognitively reconstructed: an attack is no longer merely an attack, but evidence that JNIM is autonomous, resilient and capable of overcoming materially superior opponents.

This is an important characteristic of insurgent information warfare. Tactical outcomes acquire strategic value when they alter perceptions concerning who is winning, who can provide security and whether the existing political authority can ultimately prevail.

That contest is particularly consequential in Burkina Faso. The state has invested considerable political capital in demonstrating that military mobilisation can reverse jihadist expansion. Yet independent conflict monitoring continues to indicate severe pressure on government forces and the Volunteers for the Defence of the Homeland. JNIM temporarily seized provincial capitals such as Djibo and Diapaga during 2025, and years of attrition have left government forces and auxiliary formations overstretched. The cognitive battlefield therefore intersects directly with the physical one. Every military position overrun by JNIM potentially communicates two messages: the organisation can reach the state, and the state cannot necessarily protect those who depend upon it. Abu Mahmoud’s interview attempts to determine how those facts should be interpreted.

The struggle for legitimacy

The most consequential aspect of the interview is the effort to reposition the relationship between JNIM, the population and the state. Insurgencies rarely survive through coercion alone. They require varying combinations of concealment, acquiescence, collaboration, intimidation, taxation, mediation and social penetration. Consequently, decisive political competition is often not over whether populations ideologically embrace an insurgent organisation, but whether they progressively accommodate its presence and recognise its authority as unavoidable, useful, or preferable to available alternatives.

JNIM appears acutely aware of this distinction. Abu Mahmoud repeatedly presents the conflict through a moral binary in which government institutions become sources of persecution while JNIM assumes the role of defender. He accuses the Burkinabè authorities of arrests, imprisonment, torture and campaigns against Muslims, and frames armed resistance as a response to state aggression rather than the origin of the conflict. This is not an incidental rhetorical device. It is the central inversion upon which the political narrative depends.

JNIM cannot credibly deny that it employs violence. Instead, it attempts to redefine the moral sequence of that violence. The state becomes the aggressor; JNIM becomes the respondent. Counterterrorism becomes persecution. Mobilisation becomes defence. Territorial expansion becomes liberation. Such framing is particularly potent where communities have experienced abuses by security forces, communal militias or jihadist actors themselves. Human Rights Watch documented serious abuses by multiple parties to the conflict in Burkina Faso in 2026, illustrating the environment in which competing narratives of victimhood and protection operate. JNIM can exploit genuine grievances while selectively excluding its own coercion and violence from the narrative.

That distinction is essential. Propaganda does not require every underlying grievance to be fabricated. The more effective strategy is often to appropriate existing grievances, remove inconvenient context, identify a responsible enemy and integrate the resulting interpretation into an ideological framework. JNIM is doing precisely that.

The ethnic question: escaping the Fulani trap

One of the interview’s most revealing passages concerns ethnicity. Abu Mahmoud rejects the proposition that the insurgency represents a Fulani cause or should be fought under a Fulani nationalist identity. He argues instead that Islam constitutes the relevant basis for collective identity and criticises ethnic and nationalist fragmentation. The message has strategic implications extending well beyond religious doctrine. A movement perceived as ethnically bounded encounters an inherent ceiling on expansion. It can mobilise grievances efficiently within one community while simultaneously strengthening resistance among others. A movement presenting itself as supra-ethnic can theoretically penetrate multiple social environments.

JNIM has progressively attempted to do exactly this. Its recruitment and influence have expanded beyond Fulani constituencies to communities including Dogon, Minyanka, Bissa, Djerma, Gourmantche and Mossi populations across different areas of Mali, Burkina Faso and Niger. The cognitive objective is therefore clear: decouple jihadist mobilisation from a single ethnic identity and replace it with an ideological identity capable of crossing communal boundaries. This matters geopolitically because JNIM’s geographical trajectory increasingly requires such adaptation. The organisation no longer operates primarily within familiar social environments in northern and central Mali. Its operational footprint now stretches toward Benin, Togo and the Nigerian borderlands. Geographical expansion consequently requires cognitive expansion. The narrative must travel before governance can consolidate.

JNIM’s cognitive battlespace

The interview reveals at least four mutually reinforcing lines of cognitive effort. The first is delegitimisation. The state is represented as incapable of protecting its population, dependent upon foreign assistance and responsible for repression. Military defeats reinforce this narrative because they transform ideological accusations into apparently observable evidence of government weakness.

The second is legitimisation. JNIM presents its fighters as disciplined Muslims acting within a religiously sanctioned framework. Military victories become validation. Relations with communities become evidence of social embeddedness. The organisation is progressively represented as an actor with rules, leadership, and political purpose rather than as a clandestine terrorist network.

The third is identity construction. The rejection of ethnic nationalism places religious affiliation above Fulani, Mossi or other communal identities. This allows JNIM to offer a political identity that can theoretically incorporate populations across national borders.

The fourth is narrative competition. Abu Mahmoud explicitly attacks official reporting about territorial control and battlefield outcomes. His argument is essentially empirical: governments can announce victories, but events on the ground eventually expose false claims.

This is perhaps the most modern component of the interview. JNIM is not simply transmitting propaganda. It is attempting to undermine the credibility of competing information systems. That distinction places the communication squarely within the cognitive domain. The desired effect is not merely belief in JNIM’s message. It is declining confidence in alternative sources of authority. Once official statements, military communiqués and government media are perceived as systematically unreliable, insurgent narratives do not need to become universally trusted. They only need to become competitive.

Different messages for different audiences

The interview should also be understood as a multi-audience communication product. For JNIM fighters and supporters, Abu Mahmoud offers ideological reassurance. Military success demonstrates divine favour, endurance becomes a religious obligation, and sacrifice acquires transcendent meaning. For Muslim populations living inside contested areas, the message is different. JNIM presents itself as protector, mediator and defender against government abuses. The objective is not necessarily immediate ideological conversion. Passive accommodation can be strategically sufficient. For communities outside the organisation’s traditional recruitment base, rejecting ethnic exclusivity is particularly important. JNIM offers an identity that claims to transcend ethnicity and borders. For Sahelian governments, the interview communicates confidence. Abu Mahmoud openly challenges their accounts of territorial recovery and military success.

Finally, the international community receives an unusually explicit message. Abu Mahmoud discusses humanitarian organisations and argues that NGOs should assist populations irrespective of which actor controls their territory. He criticises arrangements that, in his portrayal, restrict assistance to government-controlled areas. That passage deserves attention. JNIM is implicitly demanding recognition of a political reality: populations exist under its influence, those populations require services, and external organisations may eventually need to interact with the environment it controls. This does not constitute international legitimacy. It represents an attempt to normalise JNIM as an unavoidable actor within the humanitarian and political geography of the Sahel. That is a substantially more ambitious objective than recruitment propaganda.

Governance as cognitive warfare

The distinction between physical control and perceived authority is becoming increasingly important in the Sahel. JNIM does not need to administer territory through a bureaucratic structure resembling a conventional state. Its governance model can remain comparatively thin. What matters is whether it can regulate behaviour, adjudicate disputes, extract resources, control movement, impose sanctions, and establish predictable rules.

Available evidence indicates that this process is already occurring. JNIM is a competing governance actor that taxes populations, regulates social behaviour, provides limited justice and security functions, resolves disputes and manages access by nongovernmental organisations in some areas under its influence. Economic warfare complements this model. Blockades, attacks against infrastructure and pressure on transportation routes do more than generate economic costs. They expose the state’s inability to guarantee movement and services while demonstrating JNIM’s capacity to determine who and what can circulate; this economic coercion is an increasingly important component of JNIM’s strategy to undermine government authority. The relationship between coercion, governance and communication is therefore circular: military power creates access, coercion modifies behaviour, governance institutionalises influence, propaganda explains why that influence should be considered legitimate. The cognitive campaign connects all four.

What Abu Mahmoud does not say

The omissions are almost as informative as the statements. The interview does not revolve around spectacular terrorism. Abu Mahmoud does not build his message principally around suicide operations, global jihad, martyrdom or indiscriminate violence. Al-Qaeda’s global leadership is not the central protagonist. The discussion remains overwhelmingly anchored to local political realities, Muslim communities, state conduct and the conflict in the Sahel. This should not be interpreted as ideological moderation; it is strategic localisation.

JNIM remains an al-Qaeda-affiliated jihadist organisation. What changes is the communication required to sustain an insurgency seeking durable territorial and social penetration. An organisation attempting to govern populations cannot communicate exclusively with committed jihadists. It must also communicate with people who do not share its ideology but whose behaviour it seeks to influence.

That creates an important distinction between ideological constituency and strategic audience. The first can remain relatively narrow; the second must expand with the insurgency.

The geopolitical dimension

JNIM’s communication strategy cannot be separated from the broader transformation of the Sahel. Burkina Faso, Mali and Niger have experienced profound changes in their international alignments and security architectures. At the same time, the insurgency has continued expanding geographically.

JNIM consequently operates in a geopolitical environment characterised by weakening regional counterterrorism coordination, contested state legitimacy, military-led governments, and growing pressure along the Sahel’s southern frontier. The movement’s expansion into the littoral states changes the strategic problem. Benin, Togo, Côte d’Ivoire, Ghana, and increasingly Nigeria are no longer peripheral to the Sahelian conflict. They constitute the next layer of strategic depth. Mapping of militant networks shows that borderlands connecting Burkina Faso, Mali and coastal West Africa increasingly function as transit areas, staging grounds and contested spaces. This means JNIM’s competition with states is simultaneously territorial, military, economic and cognitive.

Analytical Assessment

The interview suggests that JNIM increasingly understands legitimacy as a centre of gravity in the Sahelian conflict. This does not mean that kinetic operations are becoming less important. The opposite is more likely. Military pressure creates the conditions under which the cognitive campaign becomes credible. An insurgent organisation cannot convincingly present itself as an alternative authority if it cannot survive confrontation with the state. JNIM’s evolution therefore appears additive rather than substitutive. It is retaining terrorism and insurgent warfare while expanding economic coercion, governance mechanisms and strategic communication.

The resulting model is more dangerous than a purely clandestine terrorist organisation because its objective is not simply to inflict casualties. It seeks to modify political relationships between populations and governments. The key cognitive effect is normalisation. JNIM does not need every inhabitant of Burkina Faso to support al-Qaeda. It benefits whenever a community begins to consider its presence permanent, resistance futile, government protection unreliable and accommodation rational. At that point, legitimacy does not necessarily mean ideological approval; it can mean acceptance of reality. That distinction should shape how counterterrorism institutions evaluate the organisation’s expansion.

Alternative Assessment: propaganda may be running ahead of reality

There is an important alternative interpretation. The interview could represent an attempt to project political maturity that exceeds JNIM’s actual governance capabilities. The organisation may be exploiting military successes to project territorial authority without the administrative capacity to transform coercive influence into durable governance.

There is evidence supporting caution. JNIM’s administrative structures remain considerably less developed than those of a conventional state, and its relationship with populations cannot be reduced to voluntary acceptance. Violence, intimidation, taxation, blockades and punishment remain fundamental instruments of control. The propaganda should therefore not be mistaken for an objective description of conditions on the ground, but neither should it be dismissed because it is propaganda. Its intelligence value lies precisely in revealing how JNIM wants those conditions to be perceived and, consequently, what political environment it is attempting to create.

Intelligence Outlook

Several indicators will determine whether the Abu Mahmoud interview represents an isolated communication initiative or the beginning of a more systematic evolution in JNIM’s information strategy.

The first will be replication. Additional long-form interviews with regional emirs would indicate an effort to build recognisable territorial leadership rather than keeping communication overwhelmingly centred on the central leadership.

The second will be the growing visibility of governance themes: justice, taxation, dispute resolution, humanitarian access, economic regulation and relations with local communities.

The third will be audience diversification. Increasing communication directed toward specific ethnic groups, religious authorities, traders, humanitarian actors or populations in coastal states would suggest that JNIM is adapting its information architecture to territorial expansion.

The fourth will be geographical localisation. If Az-Zallaqa increasingly allows regional leaders to discuss local grievances and political conditions, this would indicate a sophisticated communication model in which a common jihadist ideology is translated into locally resonant narratives.

The fifth will be the relationship between propaganda and territorial pressure. Communication should be monitored alongside blockades, temporary seizure of towns, destruction of state infrastructure, negotiations with communities and the establishment of informal justice mechanisms.

Together, these indicators would point toward something more consequential than an improvement in jihadist media production. They would indicate the progressive construction of an insurgent political communication system. The strategic contest with JNIM is therefore no longer adequately understood through attack numbers alone. The organisation is simultaneously competing over territory, mobility, economic access, community compliance and the interpretation of the war itself.

Az-Zallaqa’s interview with Abu Mahmoud captures that evolution unusually clearly. The commander sitting before the camera is not primarily explaining how JNIM fights. He is explaining why its audience should understand the conflict on JNIM’s terms.

For counterterrorism and policy communities, that distinction matters. Military pressure can degrade an armed organisation. It cannot, by itself, restore confidence in institutions, resolve local grievances, establish credible governance, or defeat a narrative that derives its plausibility from observable state weakness.

The cognitive contest will therefore be decided less by producing more counter-messaging than by reducing the gap between what governments claim and what populations experience. Where the state can provide security, justice, mobility and predictable governance, JNIM’s narrative becomes harder to sustain. Where it cannot, Az-Zallaqa has increasingly fertile ground on which to operate.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

The reporting period of 26 August–1 September marked a significant transition from threat indicators to operational manifestation. Several dynamics monitored across previous issues moved closer to, or reached, the point of execution: jihadist mobilisation remained connected to both foreign training and domestic attack planning; adolescent extremist networks produced increasingly specific attack preparations; suspected Iranian-linked violence in the United Kingdom generated criminal convictions; and European defence and logistics infrastructure faced increasingly credible sabotage activity.

Germany’s attribution of the Leipzig/Halle incident to Russia indicates a significant escalation, but the likelihood of similar future attacks remains uncertain. Clarifying this can help security officials assess the immediate threat level and prioritise resources accordingly.

The same week, Polish prosecutors opened a terrorism and foreign-intelligence investigation after an explosive-incendiary device was allegedly used to set fire to facilities belonging to WB Electronics, a major Polish defence company producing unmanned systems used by Ukraine. Meanwhile, developments in Norway and Germany demonstrated that violent extremist mobilisation continues to evolve at the individual and small-network level.

The defining shift, therefore, is not simply an increase in incidents. Threats we observed in the preparatory phase are now showing clearer signs of operational execution, so security stakeholders should stay vigilant.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week #16

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line.

The Shift of the Week #16

From jihadist mobilisation and youth extremism to proxy violence and state-linked sabotage

Over recent months, many of the most important warning indicators have appeared before violence: reconnaissance, acquisition of weapons, extremist networking, testing of logistics routes, drone incursions and clandestine infrastructure. This week shows that these preparatory layers are delivering tangible operational results, so we need to stay vigilant.

Germany’s attribution of the Leipzig/Halle incident is the clearest example. The explosive-equipped drone discovered near Ukrainian Antonov cargo aircraft in August was initially treated cautiously, as it should have been. Now, the German government’s conclusion that Russia was responsible highlights a significant escalation and underscores the need for strategic awareness among security officials.

This matters because it represents an escalation in method as much as in target selection. European states have already confronted cyber intrusions, disinformation, suspicious fires, parcel bombs, reconnaissance operations and other forms of activity attributed or suspected to involve Russian services. An explosive drone directed toward a strategic logistics facility introduces a more overtly kinetic capability while still retaining many characteristics of hybrid warfare: deniability, limited footprint, ambiguous escalation thresholds and the use of technology capable of producing disproportionate disruption at relatively low cost.

NATO’s assessment during the same period is equally important. Alliance officials stated that Russian hybrid activity in Europe is increasing, while also stressing that there is currently no indication of an imminent conventional Russian attack against NATO territory. That distinction defines the problem. The most immediate confrontation with Russia is not necessarily occurring through tanks crossing an Alliance border. It is occurring in the space below conventional war, where sabotage, intelligence operations, drones and covert networks can impose costs without triggering an automatic military response.

Threat Signals

The jihadist threat produced a different but complementary indicator in Germany. Two German nationals, Edis Z. and Jiyan K., went on trial in Frankfurt over allegations that they prepared a serious act of violence associated with the Islamic State. Prosecutors allege that they intended to travel abroad to receive weapons training and die as “martyrs”. One of the defendants is additionally accused of having contemplated a suicide attack in Germany using either an explosive belt or a vehicle. Both were arrested at departure gates while allegedly attempting to travel towards the Middle East.

The analytical value of the case lies in the relationship between external mobilisation and domestic violence. The traditional foreign-fighter model is often understood as movement from Europe toward an overseas jihadist theatre. But training abroad and violence at home can exist within the same trajectory. The concern is not merely that individuals may reach a militant organisation. It is that contact with an organisation, battlefield environment or training network can increase capability before violence is redirected toward the country of origin.

Read more

The 19–25 August reporting period highlighted a threat environment in which the traditional boundaries separating terrorism, violent extremism and state-linked covert action are becoming increasingly difficult to maintain at the operational level. In the United States, an alleged ISIS-inspired plot against the New York State Capitol progressed from ideological commitment to reconnaissance and attempted acquisition of an explosive capability. In the United Kingdom, the conviction of Mohamed Mohamoud demonstrated that outbound jihadist mobilisation has not disappeared, with Somalia emerging as a potential destination beyond the traditional Syria-Iraq foreign-fighter pathway.

Europe simultaneously faced less conventional indicators. German investigations into a clandestine weapons cache near Berlin and explosive-equipped drones around Leipzig/Halle Airport raised concerns over potentially state-linked covert operations against European territory and strategic infrastructure, although attribution remains under investigation. Meanwhile, the growing law-enforcement focus on “The Com” illustrates the emergence of transnational online environments where violence can develop without a coherent ideological framework. At the same time, the Lyon–Turin investigation demonstrates the potential transition from radical political militancy toward organised violent preparation.

The key shift is therefore not ideological convergence, but operational convergence. Recognising how threat actors exploit common environments can boost security professionals’ confidence in adapting strategies, which is essential for effective threat mitigation.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week #15

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line.

The Shift of the Week #15

From IS-inspired plots to violent online networks and state-linked covert action

The most important development this week is not a single attack or arrest. It is the increasingly blurred boundary between different forms of political violence.

Across the United States and Europe, investigations exposed several apparently unrelated threat environments: an advanced ISIS-inspired plot against a government institution in New York, a British resident who travelled to Somalia seeking to join Islamic State, transnational online communities associated with nihilistic violence, suspected preparations for violent action by radical left-wing militants, and two German investigations pointing toward increasingly sophisticated forms of possible state-linked covert activity.

The emerging security environment is therefore becoming less defined by a single dominant threat and more by simultaneous, overlapping pathways to violence.

1. United States: an ISIS-inspired plot reaches an advanced operational stage

The arrest of Jessica Bowie in Albany on August 19 provides the clearest jihadist threat signal of the week. According to the U.S. Department of Justice, Bowie, 35, allegedly intended to attack the New York State Capitol with an explosive device, kill public officials and destroy as much of the building as possible before attempting to reach ISIS-controlled territory in Syria. Investigators say she conducted repeated reconnaissance around the Capitol, photographed the building, expressed support for ISIS online and recorded a bay’ah, or pledge of allegiance, to the organisation. She was arrested while taking possession of what she believed to be an explosive device. The allegations remain to be tested in court.

The significance lies less in the ideological profile than in the progression from radicalisation to operational behaviour. This was not limited to propaganda consumption or expressions of support. The alleged trajectory incorporated target selection, reconnaissance, acquisition of an attack capability and a concept for post-attack movement. The intended target was also explicitly institutional: the alleged objective was not simply to produce casualties, but to strike political representatives and damage a symbol of government.

The case reinforces an uncomfortable reality about the current ISIS threat in the West. A large territorial organisation is not required to generate operational effects abroad. The ideological ecosystem can sustain individuals who develop increasingly concrete attack intentions while remaining physically distant from the organisation’s principal theatres of activity.

For security services, the critical threshold is therefore no longer simply radicalisation. It is the moment when ideological commitment begins to generate observable preparatory behaviour.

2. Germany: the discovery of a clandestine weapons infrastructure

A very different threat emerged near Berlin. German authorities confirmed that the domestic intelligence service had identified a concealed weapons cache in woodland outside the capital. Two handguns and ammunition were recovered. Germany’s Federal Prosecutor General is investigating a suspect detained in Romania, and German authorities are seeking his extradition. Interior Minister Alexander Dobrindt confirmed the investigation and said the involvement of a foreign power could not be ruled out.

German media reporting based on security sources goes further, suggesting that the cache may have been established for operatives acting on behalf of Russian intelligence and potentially intended to support violent operations or assassinations. That attribution remains under investigation and should therefore not be treated as fact yet. The distinction matters, but so does the infrastructure itself.

A clandestine weapons cache represents something qualitatively different from online influence operations, cyber activity or opportunistic vandalism. Such infrastructure can allow weapons to be positioned in advance, separated from the individual who ultimately retrieves them and concealed from the wider command structure. It reduces the logistical signature immediately preceding an operation and facilitates compartmentalisation between handlers, intermediaries and executors.

If the suspected foreign-intelligence connection is ultimately established, the case would fit a broader European concern over the use of low-level or disposable operatives for sabotage, reconnaissance and potentially kinetic operations.

Read more

This weekly intelligence brief documents and structures recent jihadist propaganda activities released between 18 and 24 August, highlighting recent threat developments and providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their significance for threat recognition and strategic focus, helping analysts and policymakers see their critical role in understanding ongoing threats and their strategic implications.

This product supports systematic monitoring, reassuring analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are vital to maintaining a clear understanding of threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

This analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and strengthen the reliability of the data used for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format signal activity trends that analysts should interpret within the broader context of operational tempo, recent events, and known threat indicators, supporting their confidence in threat assessments and reducing misinterpretation risks.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

• Pro-AQ media channels (Al-Bayan Newspaper - Weekly Issue)

• AQIS

Islamic State

• Al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

• Tehrik-i-Taliban Pakistan

The conclusions are included in the Weekly Monitoring Notes.

Read more

Latin America today represents one of the main global enabling environments for the intersection of transnational organised crime, hostile intelligence activities, logistical facilitation networks, illicit financial flows, and hybrid operations conducted by state and non-state actors. Although the region remains commonly associated with drug trafficking and organised crime, a multidimensional analysis shows it increasingly functions as a strategic ecosystem that can indirectly support operations affecting European and Euro-Atlantic security, including threats to critical infrastructure and financial stability.

The combination of extensive, poorly governed areas, high levels of informal economy, corruption, globalised logistics infrastructure, constantly evolving clandestine maritime capabilities, and highly adaptive criminal networks creates favourable conditions for the development of activities that go well beyond drug trafficking. These activities include money laundering, circumventing sanctions regimes, procuring dual-use technologies, producing and using fraudulent documentation, clandestine logistical support, moving high-risk individuals, and creating facilitation networks exploitable by hostile intelligence services.

The analysis identifies Central and South America as areas of particular strategic interest. Brazil emerges as a central hub due to its geographic location, territorial depth, simultaneous access to the Amazon and Atlantic corridors, and its growing role in transcontinental criminal routes. The Amazon region and the South American Atlantic basin are also becoming increasingly important as logistical platforms for long-range maritime trafficking, including semi-submersibles and other clandestine platforms capable of reaching Europe, Africa, and Oceania. The analysed material highlights a progressive evolution in the operational capabilities of Latin American criminal organisations, including the use of ocean-going semi-submersibles, autonomous vehicles, and low-observability maritime networks.

Numerous indicators suggest Latin America’s vulnerabilities-such as porous borders and maritime clandestine platforms- can be exploited. Foreign intelligence services, proxy networks, and hostile actors could exploit this corruption, underscoring the need for proactive awareness among security professionals.

For Italy, the main concern is not direct violence. Still, the convergence of criminal networks, mafias, and hostile actors-potentially targeting ports, logistics hubs, and critical infrastructure-could threaten operational continuity, requiring heightened vigilance.

Confidence Level: Medium-High.

📌 Inside This Assessment

1. Latin America as a Hybrid Permissive Ecosystem

2. Hostile Intelligence Activity in the Region

3. Proxies, Facilitators and Indirect Recruitment

4. Convergence between crime, facilitators, and intelligence

5. Brazil as a Strategic Hub

6. Latin American Organised Crime

7. Italian Mafias and South American Connections

8. Maritime Domain and Logistics Infrastructure

9. Terrorism, Proxies, and Support Networks

10. Hybrid Facilitation Risk Matrix

11. Italian Vulnerabilities

12. Counterintelligence implications

13. Implications for Europe

14. Future Scenarios 2026-2030

15. Analytical Conclusions.

Latin America as a Hybrid Permissive Ecosystem

Latin America continues to be frequently analysed through the lens of drug trafficking, organised crime, and political instability. While these elements remain central, a strategic, security-oriented approach calls for a broader perspective. Today, the region is a permissive environment in which transnational criminal networks, logistical facilitators, opaque economic operators, hostile state actors, financial intermediaries, and individuals involved in clandestine activities can coexist and interact. This does not necessarily involve structured cooperation among these actors, but rather their ability to exploit the same territorial, economic, and institutional vulnerabilities simultaneously. The region’s relevance for European security stems primarily from its function as a facilitating platform. Indeed, in many Latin American contexts, one can observe consolidated logistical corridors, large informal economies, limited control over vast territorial areas, and growing interconnectedness with global markets. These conditions make the continent a favourable environment for the movement of people, goods, capital, and information, creating opportunities that criminal organisations and state actors can exploit to operate outside the theatres most closely monitored by Western security structures.

1. Geographic Factors

Geography represents one of the main risk multipliers. The continent features vast, poorly controlled areas, extensive land borders, difficult-to-access Amazon regions, river networks that cross multiple states, and thousands of kilometres of coastline facing both the Pacific and Atlantic Oceans. Brazil, in particular, occupies a central position within this system. Connections between the Amazon Basin, Atlantic ports, and major regional trade hubs-such as [specific ports or corridors]-offer strategic depth that criminal and hostile actors can exploit for clandestine activities, complicating monitoring efforts.

2. Political Factors

The regional political situation is characterised by varying levels of institutional stability, but shares some common elements. Corruption, limited territorial control, administrative fragility, and strong political polarisation persist in several countries. These conditions do not necessarily imply the existence of failed states. Still, they can create institutional ambiguity that criminal actors or individuals seeking to develop clandestine activities under commercial, diplomatic, or financial cover can exploit. In some cases, limited regional cooperation and the varying operational capacity of security agencies further contribute to this room for manoeuvre.

3. Economic Factors

Latin America is deeply integrated into global trade networks through ports, airports, free zones, logistics corridors, and energy infrastructure. At the same time, the informal economy remains a significant component in many countries in the region. The coexistence of large legitimate trade flows and vast, poorly regulated economic zones offers significant opportunities for money laundering, the creation of front companies, the covert transfer of funds, and the concealment of illicit activities within normal commercial transactions. For criminal or state actors seeking to circumvent controls, sanctions, or financial traceability systems, this environment offers a significant operational advantage.

4. Criminal Factors

The region is home to some of the world’s most structured and resilient criminal organisations. However, the strategic importance of these groups stems not only from their drug trafficking capabilities, but also from their progressive transformation into logistical, financial, and transnational players. In recent years, Latin American criminal networks have demonstrated a growing capacity for innovation, technological adaptation, and international reach. The evolution of clandestine maritime routes, the use of ocean-going semi-submersibles, and the development of new concealment and transportation methods confirm a trend toward increasingly sophisticated forms of illegal mobility. These capabilities should not be interpreted solely as a criminal threat, but as infrastructures potentially exploitable by multiple actors interested in discreetly moving people, materials, or resources.

5. Structural Vulnerabilities

The most significant element is not a single threat, but rather the overlapping of different vulnerabilities. Within the same geographical space. In many areas of the region, the informal economy, organised crime, insufficient territorial control, high cross-border mobility, advanced logistical capabilities, and direct connections to international markets coexist. This combination creates an ecosystem conducive to the emergence of facilitation networks that can serve a variety of purposes, from illicit trafficking to sanctions evasion, from the clandestine movement of individuals to the creation of economic and financial cover. From the perspective of Italian and Euro-Atlantic security, the primary risk therefore lies not in the threat posed by a single actor, but in the possibility that criminals, facilitators, intermediaries, and hostile actors simultaneously exploit the same regional vulnerabilities to pursue different but convergent objectives. This makes Latin America not only an area of ​​investigative interest, but a truly strategic environment to be monitored from a multi-domain security perspective.

Hostile Intelligence Activity in the Region

Latin America has occupied a unique position in international strategic competition for decades. While not a priority theatre compared to Eastern Europe, the Middle East, or the Indo-Pacific, the region continues to offer operational opportunities that attract the interest of various foreign intelligence services. The combination of large geographic spaces, uneven counterintelligence capabilities, high international trade flows, opaque financial networks, and the presence of diaspora communities makes the continent particularly suited to developing intelligence gathering, logistical support, building cover, and facilitating international mobility. The primary objective of these activities is not necessarily the conduct of offensive operations within the region itself.

Read more

This weekly intelligence brief documents and structures official jihadist propaganda output released between 9 and 17 August, highlighting recent threat trends and providing structured situational awareness across multiple organisations and theatres.

This brief highlights operational claims and targets, emphasising their importance for threat recognition and strategic focus, and helping analysts and policymakers understand ongoing threats and their strategic implications.

This product supports systematic monitoring, reassuring analysts and policymakers that threat trends are being tracked thoroughly and that their efforts are vital to maintaining a clear understanding of threats.

This publication does not include threat assessments, intent evaluation, or operational forecasting. Those components are addressed separately in dedicated analytical outputs.

🔹 Scope of Monitoring

This issue covers all identifiable official propaganda from a predefined list of jihadist groups, selected for operational relevance and threat level, during the reporting period, enhancing situational awareness.

The focus on documentation, classification, and structured presentation of primary-source material aims to instil confidence in analysts and policymakers about the reliability of the data used for threat assessment.

🔹 Sources & Collection Methodology

The analysis relies solely on primary-source propaganda, such as official magazines, videos, photos, statements, claims, and audio recordings, to clarify the scope of sources and bolster the reliability of the data for threat assessment.

• Official magazines,

• Videos,

• Photo sets,

• Statements and claims of responsibility,

• Audio statements.

Material is collected and categorised by organisation, media outlet, and content type.

The study relies on OSINT, IMINT, SOCMINT, and Digital HUMINT collection streams.

No secondary reporting, media commentary, or interpretative overlay is applied.

🔹 Analytical Boundaries & Limitations

Fluctuations in volume, language, or format signal activity trends that analysts should interpret within the broader context of operational tempo, recent events, and known threat indicators to support accurate threat assessment and prevent misinterpretation of their significance.

They shouldn’t be considered in isolation as indicators of strategic shifts, operational escalation, or changes in intent and capability; instead, they should be integrated within broader intelligence products such as Strategic Threat Outlooks and Cognitive Assessments to support comprehensive threat evaluations.

• Strategic shifts,

• Operational escalation,

• Intent or capability changes.

All higher-order analytical interpretation is conducted separately within:

• Intelligence Briefs,

• Strategic Threat Outlooks,

• Cognitive and Information Domain Assessments.

🔹 Monitored Propaganda Output and Weekly Monitoring Notes

This issue includes all primary propaganda material released during the week by:

Al-Qaeda and affiliates

• JNIM

• Al-Shabaab

Islamic State

• al-Naba Newspaper (weekly Issue)

• Official IS media channels.

Independent Jihadist Groups

• Ittehad Mujahidin Pakistan

The conclusions are included in the Weekly Monitoring Notes.

1. Al-Qaeda (AQ)

Az-Zallaqa Media, Jamat Nusrat al-Islam wal-Muslimin (JNIM), released a video lasting 4 minutes and 18 seconds showing an attack on the headquarters of pro-government militias in Bam province, Burkina Faso.

Az-Zallaqa Media, Jama’at Nasr al-Islam wal Muslimin (JNIM), issued 10 statements and 6 photos, claiming 12 attacks.

The targets of the attacks were: Malian Army, Dozo militia, Russian PMC Africa Corps, Burkinabé Army, VDP militia.

The areas of the attacks were :

1) Burkina Faso = 4

- Gourma province, Sissili province, Poni province, Sèno province, Bam province.

2) Mali = 8

- Kayes region, Mopti region, Sikasso region, Segou region.

The Shahada News Agency, Harakat al-Shabaab al-Mujahidin (AS), released 21 statements claiming responsibility for 46 attacks.

The targets of the attacks were:

Somali Army, Somali Intelligence, Somali pro-government militia, Burundian Army, Ugandan Army, Ethiopian Army, Kenyan Army.

The areas affected by the attacks were:

1) Somalia = 39

- Afgooye area, Zubayd area, Barire area, Janale area, Bulomerer area, Mubarak area, Qoryooley area, Awdheegle area, Lower Shabelle region;

- Afmadow area, Lower Juba;

- Wajid area, Hudur area, Bakool region;

- Bardhare area, El Wak area, Gedo region;

- Jowhar area, Balad area, Middle Shabelle region;

- Mogadishu area.

2) Kenya = 7

- Lafey area, El Galo area, Mandera County;

- Kenton area, Wajir County.

2. Islamic State (IS)

The Islamic State’s official media published 2 issues of the weekly al-Naba this week (560). Issue 560, eight pages long, covers the week of 23 to 29 Safar 1448, from 6 to 12 August 2026. The main infographic summarises the areas affected by military operations this week, including:

Nigeria, Niger, Mozambique, Pakistan, and the Democratic Republic of Congo.

IS claims to have conducted 11 operations in all the mentioned areas and to have caused 50 deaths and injuries.

Amaq News Agency, the Islamic State’s official media outlet, has released a 22-second video showing an ISWAP attack using an IED against a Nigerian army convoy in the Dikwa area, in Borno State, Nigeria.

The Amaq News Agency, the official media of the Islamic State, released a lengthy statement setting out their claims of a major night-time attack by militants from the West African Province (ISWAP) on a Nigerian army camp in the Gajiram area, in Borno State, Nigeria.

The Amaq news agency, the official media of the Islamic State, released a 3-minute 20-second video showing a major night-time attack by militants from the West African Province (ISWAP) on a Nigerian army camp in the Gajiram area, in Borno State, Nigeria.

3. Independent Jihadist Groups

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising the Hafiz Gul Bahadur Group (HBG), Lashkar-e-Islam and the Harkat Inqilab-e-Islami Pakistan (HIIP), released 16 statements, claiming 19 attacks.

Target: Pakistan Army, Pakistan Police, Counter Terrorism Department Police (CTD), Secret/Peace Committee.

Area:

- North Waziristan district, Orakzai district, Bannu district, Khyber district; in the Khyber Pakhtunkhwa Province; Pakistan

Ittehad-ul-Mujahideen Pakistan (IMP), a Pakistani jihadist organisation comprising Hafiz Gul Bahadur’s (HBG) group, Lashkar-e-Islam and Harkat Inqilab-e-Islami Pakistan (HIIP), has released a 1-minute 22-second video showing an ambush on a Pakistani army convoy in the Bannu district of Pakistan.

🔹Weekly Monitoring Notes

The reporting period from 9 to 17 August reflects a differentiated propaganda cycle across the principal jihadist ecosystems. Overall output remained substantial, but the distribution of activity shifted markedly compared with the previous week. JNIM reduced its operational reporting, Al-Shabaab registered one of its highest weekly claim volumes in recent months, Islamic State maintained a comparatively restrained media posture centred largely on West Africa, and Pakistan-based jihadist organisations continued to sustain a stable operational communications rhythm.

Within the Al-Qaeda ecosystem, Jama’at Nusrat al-Islam wal-Muslimin remained active but at a significantly lower level than during the previous reporting period. Az-Zallaqa Media issued ten statements and six photo reports covering twelve claimed attacks across Mali and Burkina Faso. Mali accounted for the majority of operations, with activity distributed across Kayes, Mopti, Sikasso and Ségou, while Burkina Faso remained represented through attacks across several provinces. The targeting profile was consistent with established patterns, focusing on national armed forces, local militias and Russian Africa Corps personnel.

The principal JNIM visual product was a four-minute video documenting an assault against a pro-government militia headquarters in Bam Province. Unlike the previous week’s extended leadership interview, the current reporting cycle returned to a predominantly operational format. The reduction in strategic messaging is notable, but it does not represent a change in the organisation’s media architecture. Rather, it reflects the familiar alternation between leadership-level communication and routine battlefield documentation.

Al-Shabaab represented the most pronounced expansion in propaganda activity during the week. Shahada News Agency issued twenty-one statements claiming responsibility for forty-six attacks, thirty-nine in Somalia and seven in Kenya. This represents a further increase from the already elevated activity observed during the previous reporting cycle and confirms the group’s capacity to sustain intensive operational communication across multiple fronts simultaneously.

The geographical distribution was broad, encompassing Lower Shabelle, Lower Juba, Bakool, Gedo, Middle Shabelle and Mogadishu, alongside operations in Mandera and Wajir counties in Kenya. The target set remained equally diversified, including Somali military and intelligence structures, local militias and Burundian, Ugandan, Ethiopian and Kenyan forces. The volume and geographic dispersion of claims indicate that Al-Shabaab’s media apparatus is currently functioning at a particularly high tempo, with propaganda closely synchronised to battlefield activity rather than concentrated around a single strategic narrative.

Islamic State official media maintained a considerably lower operational tempo. Al-Naba issue 560 reported eleven operations and fifty deaths and injuries across Nigeria, Niger, Mozambique, Pakistan and the Democratic Republic of the Congo. The limited number of operations represents a clear contraction compared with several recent reporting cycles. However, the geographic structure of the output remains consistent with the organisation’s broader Africa-centred media pattern.

ISWAP dominated the additional official releases. Amaq documented an IED attack against a Nigerian military convoy in Dikwa and subsequently devoted both a detailed statement and a longer operational video to the attack on the Nigerian Army camp in Gajiram. The concentration of multiple media products around the same operation demonstrates Islamic State’s continued practice of selectively amplifying attacks that offer strong visual or tactical value, even during weeks characterised by lower overall claim volumes. The emphasis on Borno State also confirms ISWAP’s continued importance within the Islamic State media ecosystem.

Independent jihadist output remained concentrated on Pakistan. Ittehad-ul-Mujahideen Pakistan released sixteen statements claiming nineteen attacks across North Waziristan, Orakzai, Bannu and Khyber districts. The targeting profile remained unchanged, with the Pakistani Army, Police, Counter Terrorism Department and local security structures continuing to constitute the principal targets. The accompanying video documenting an ambush against a Pakistani military convoy in Bannu reinforced IMP’s established emphasis on tactical battlefield documentation.

Compared with recent weeks, IMP media activity remained stable rather than expansive. The absence of major training packages, drone compilations or long-form capability demonstrations suggests a reporting cycle centred primarily on operational continuity. The organisation nevertheless maintained sufficient claim frequency to preserve a persistent presence within the Pakistani jihadist information environment.

Overall, Week 9 to 17 August is characterised by an asymmetric distribution of propaganda momentum. Al-Shabaab clearly dominated the operational information space, combining exceptional claim volume with broad geographic coverage across Somalia and northeastern Kenya. JNIM remained active but shifted back toward a lower-volume battlefield reporting cycle after the strategically significant leadership messaging of the previous week. Islamic State maintained a more restrained media posture while continuing to prioritise ISWAP within its supporting releases, and IMP preserved a steady operational communications rhythm in Pakistan.

The principal monitoring signal is therefore not a system-wide increase in propaganda, but a redistribution of activity between organisations and theatres. Al-Shabaab’s sustained high-frequency reporting deserves particular attention in subsequent issues to determine whether the current tempo represents a temporary operational surge or the consolidation of a new baseline in its propaganda output.

Distribution patterns remained stable across established encrypted and semi-encrypted platforms (Element, Telegram, Rocket Chat, Chirpwire, Signal, UpScrolled), with no observable shifts in dissemination channels or media architecture.

🔒Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

Africa remains the Islamic State’s primary global theatre of operations, surpassing the Middle East and Asia in attack volume and organisational strength, underscoring the critical need for vigilance among security and policy leaders to address this evolving threat.

Scope and Methodology

This Strategic Threat Outlook is based on:

systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

reporting from sources in the field;

While integrating OSINT, SOCMINT, IMINT, and Digital HUMINT enhances intelligence breadth, it is crucial to acknowledge their respective reliability and limitations to ensure accurate threat assessments.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted.

📌 Inside this Assessment

• Overview and Security Threat Assessment

• Activity and Operations Analysis — July 2026

• Number, Targets, and Areas of Attacks in July 2026

• Charts and Statistics

• Analytical and Intelligence Assessments

• Implications for Decision Makers

• Early Warning Indicators

• Threat Forecast, 30 to 90 Days

• Executive Intelligence Conclusion and Risk and Threat Overview

Provincial Snapshots

• Islamic State West Africa Province (ISWAP)

• Islamic State Sahel Province

• Islamic State Central Africa Province (ISCAP)

• Islamic State Somalia Province

• Islamic State Mozambique Province (ISM)

Overview – Islamic State in Africa

The Islamic State’s presence in Africa is resilient and adaptive, demonstrating high operational continuity despite counterterrorism efforts, reinforcing the importance of sustained strategic focus for security officials to counter this persistent threat.

In Africa, IS affiliates demonstrate high operational continuity, executing attacks with diverse tactics like assaults, ambushes, kidnappings, and terror campaigns, especially against Christian communities, in recent months.

The epicentre of this dynamic remains sub-Saharan and central-eastern Africa, with particularly worrying developments in the Democratic Republic of Congo and Mozambique, where IS affiliates have demonstrated not only a capacity for sustained violence, but also a growing level of coordination, intermittent territorial control, and integration with local criminal economies. In such contexts, violence is not episodic but part of a strategy of progressive erosion of state authority, exploiting structural fragility, socio-economic marginalisation, inter-community conflicts, and governance vacuums.

On March 20, 2025, the Islamic State officially announced the launch of a new military campaign, called “Burning Camps,” with a stated focus primarily on Africa. This campaign’s implications include heightened regional instability, increased displacement, and the need for enhanced security cooperation among affected nations to counteract these threats.

The strategy remains consistent with the Islamic State’s operating model: creating chronic instability, delegitimising the state, presenting itself as an alternative (or inevitable) actor, and exploiting chaos to facilitate recruitment, logistical support, and territorial entrenchment. In this sense, IS does not aim exclusively at permanent territorial conquest but at fluid, opportunistic control sufficient to maintain freedom of manoeuvre and offensive capability.

Currently, the Islamic State is actively and continuously operating in at least eight African countries, with monthly variations in geographical distribution and intensity of activities. During the period under review, the organisation focused its efforts on fewer theatres without reducing overall capacity, indicating a decentralised yet functional structure.

A central and often underestimated element is the propaganda dimension. Every significant attack has been followed by intense media activity. In the month analysed, the Islamic State disseminated a significant volume of content, photographs, videos, and press releases through its central channels, in particular the Amaq news agency and the weekly al-Naba. Propaganda is not limited to claims of responsibility but constructs a narrative of success, resilience, and inevitability, aimed at both local supporters and a global jihadist audience.

In summary, the African picture shows an Islamic State that is not in decline but in a phase of adaptive consolidation, capable of absorbing losses, reorienting priorities, and exploiting the structural weaknesses of local contexts. For intelligence, security, and political and military decision-makers, Africa is not a secondary front but the current centre of gravity of the threat posed by the Islamic State, emphasising the need for sustained vigilance.

Islamic State in Africa - Activities — July 2026

During July 2026, Islamic State activity across Africa remained concentrated in a limited number of operationally mature theatres, while preserving a broader peripheral footprint across the continent. The Lake Chad Basin, eastern Democratic Republic of the Congo, northern Mozambique, the Sahel, and Puntland continued to define the organisation’s African operational architecture. However, intensity and tactical profiles varied significantly from one theatre to another.

Read more

The week of 12–18 August revealed a threat environment where early detection of activity before violence becomes visible is crucial for security professionals. Across terrorism, state-backed sabotage and cyber operations, the decisive phase is often no longer the attack itself, but the preparation that makes the attack possible: recruitment, reconnaissance, capability development, clandestine networking and intelligence collection.

The conviction in Switzerland of a nineteen-year-old who had prepared an Islamic State-inspired knife attack illustrated the persistent difficulty of managing individuals who have already crossed from ideological commitment into operational preparation. In Syria, the arrest of senior Islamic State commander Hamza Abdullah Mohammed, known as Abu Jihad al-Muhajir, demonstrated that the organisation continues to preserve experienced military leadership despite sustained pressure.

At the same time, developments in Germany, Estonia and the United States highlighted a parallel security challenge. European authorities are confronting reconnaissance and suspected sabotage associated with Russian interests. At the same time, US prosecutors exposed another large-scale cyber campaign allegedly conducted for the benefit of Iran’s Islamic Revolutionary Guard Corps.

The significance of these cases lies in the common pattern they expose. Modern hostile activity increasingly begins below the threshold of open violence and may remain there for extended periods. Recognizing early signs can empower security professionals to act proactively, which is crucial for effective defense.

📌 Inside this Weekly Threat Shift

1. The Shift of the Week #14

2. Threat Signals

3. The Information Battlefield

4. Why It Matters

5. Watchlist, Next 30 Days

6. Strategic Consequence

7. Final Analytical Line.

The Shift of the Week

ISIS-linked plots, leadership disruption and state-backed hybrid operations across Europe and Syria.

Security institutions are traditionally organised around events that can be clearly identified: an attack, an intrusion, an arrest, a sabotage operation. This week’s developments illustrate why that model is becoming increasingly insufficient. The most consequential activity often occurs considerably earlier.

The Swiss court case underscores the importance of monitoring ideological immersion that can evolve into operational intent. The defendant, a nineteen-year-old Swiss-Turkish citizen, moved beyond passive extremist material consumption, establishing encrypted contacts, acquiring operational instructions, ordering a tactical knife, and discussing attacks against civilians, illustrating the need for early threat indicators.

The relatively simple attack methodology should not obscure the significance of the preparatory process. The operational capability required for a knife attack is minimal. The difficult part for security services is identifying when ideological immersion becomes intent and when intent becomes preparation.

The sentence also raises a familiar but increasingly important counterterrorism issue. After serving the unconditional portion of his sentence through pre-trial detention, the defendant was released under supervision and required to continue deradicalisation and psychotherapy programmes.

No publicly available basis exists to conclude that the Swiss court underestimated his future risk. Yet, this case underscores the ongoing challenge for European systems to manage offenders effectively over time, emphasizing the need for continued vigilance and shared responsibility among policymakers and security officials.

This problem is becoming more important as European services encounter growing numbers of young individuals whose radicalisation began primarily online and whose ideological commitment may evolve rapidly.

The arrest of Abu Jihad al-Muhajir in northern Syria represents a different side of the same threat environment. Syrian authorities describe Hamza Abdullah Mohammed as a senior Islamic State military commander who previously held responsibility within the group’s Syrian structure, including leadership roles associated with Idlib and wider military operations. He was detained near Manbij during an operation conducted with international partners. If the Syrian description of his responsibilities is accurate, his capture represents more than the removal of another field operative.

Experienced commanders accumulate institutional knowledge that is difficult to replace quickly. They understand personal networks, communication practices, logistics, operational security, recruitment mechanisms and internal chains of authority. Capturing such a figure can therefore generate intelligence value well beyond the immediate arrest.

The continued evolution of Syria’s counterterrorism environment highlights the importance of sustained intelligence efforts. Understanding that territorial defeat does not equate to organizational elimination can reinforce confidence in the need for persistent, comprehensive security measures.

For the new Syrian security architecture, this creates a long-term challenge. The ability to dismantle Islamic State networks will depend not only on kinetic pressure but on sustained intelligence development, exploitation of detainees, international information sharing and the capacity to penetrate increasingly decentralised structures.

Threat Signals

Germany provided one of the week’s clearest indicators of how hostile-state activity increasingly operates through preparatory actions that may initially appear insignificant.

A Ukrainian national was sentenced after being convicted of conducting reconnaissance connected to a suspected Russian sabotage effort. According to the case presented in court, he helped test logistics routes by using parcels equipped with tracking devices, allowing those behind the activity to gather information about transport patterns and potential vulnerabilities. No explosion was required for the operation to have intelligence value.

This is precisely what makes contemporary sabotage campaigns difficult to identify early. Before infrastructure is damaged, an adversary may need to understand routes, schedules, security procedures, storage locations and response times. Reconnaissance can therefore be operationally significant even when the immediate activity remains below the threshold normally associated with sabotage.

Read alongside the explosive drone incident at Leipzig/Halle Airport during the previous reporting period, the case reinforces concerns that European logistics systems have become an increasingly important security domain.

The relevant vulnerability is not limited to airports or rail networks. European support for Ukraine depends on a complex infrastructure connecting ports, warehouses, defence manufacturers, transport corridors and military facilities. Mapping those systems provides potential adversaries with knowledge that may later support disruption.

• Hybrid Pressure on Europe’s Defence Base

A suspected arson attack against premises used by Estonian defence company Milrem Robotics adds another layer to the picture. Milrem produces unmanned ground systems and has become closely associated with European defence innovation and support to Ukraine. Estonian authorities have investigated the possibility of hostile foreign involvement in the fire, with Russia among the hypotheses publicly discussed. Attribution has not been established and should therefore remain clearly separated from the fact of the incident itself. The target, however, is strategically relevant regardless of the investigation’s outcome.

European defence companies increasingly sit at the intersection between military production, technological innovation and hybrid pressure. They possess intellectual property, supply-chain relationships, specialised equipment and production capacity directly relevant to contemporary conflict. This makes them attractive not only for traditional espionage but potentially for surveillance, disruption and sabotage.

The distinction between military and civilian infrastructure is consequently becoming less useful in parts of Europe’s security environment. A privately owned factory producing unmanned systems may have strategic value comparable to a military installation. A logistics company transporting defence components may become part of the same threat picture. Protecting defence production therefore increasingly requires counterintelligence and infrastructure-security measures normally associated with more traditional national-security targets.

• The Cyber Dimension

The United States provided the clearest example of the same preparatory logic in the digital domain. Federal prosecutors charged seventeen Iranian nationals in connection with a large cyber theft campaign allegedly conducted through the Mabna Institute and intended, in part, to benefit the Islamic Revolutionary Guard Corps and other Iranian institutions.

The alleged targets included universities, companies and research organisations possessing valuable intellectual property and technical information. This type of activity rarely produces the immediate visibility of a terrorist attack or physical act of sabotage. Its strategic consequences emerge over time.

Research data, technological expertise and proprietary information can reduce development costs, strengthen domestic capabilities and support wider intelligence requirements. Cyber espionage therefore allows states to accumulate advantages without crossing the threshold of conventional confrontation. The case is also important because it demonstrates why Iran-linked security activity cannot be understood exclusively through armed proxies.

The ecosystem associated with the Islamic Republic includes militias, intelligence actors, cyber operators, commercial entities and intermediaries performing very different functions. The threat profile consequently extends from missile and drone operations in the Middle East to cyber activity directed against research institutions thousands of kilometres away. For Western security agencies, the operational problem is therefore multi-domain by definition.

The Information Battlefield

The week’s developments also reveal the growing importance of information at the preparatory stage of hostile activity. For terrorist actors, encrypted communications can create communities in which ideological commitment gradually acquires operational form. Instructions, encouragement and contact with like-minded individuals can reduce the psychological and practical barriers separating radicalisation from action.

For hostile states, information collection serves a more instrumental purpose. Mapping logistics routes, identifying defence-industrial vulnerabilities or stealing technical research creates options that may be exploited months or years later. In both environments, information is not merely supporting an operation. Information is part of the operation.

This distinction matters because it shifts the analytical focus away from visible incidents and towards the accumulation of enabling capability. The security question therefore becomes less about whether a specific reconnaissance activity or cyber intrusion will immediately produce an attack and more about what strategic options that activity is creating for the actor behind it.

Why It Matters

The cases recorded this week highlight a convergence in the logic of contemporary threats even where the actors themselves remain fundamentally different. A young Islamic State supporter preparing a knife attack, an experienced jihadist commander maintaining clandestine networks, a suspected sabotage facilitator mapping logistics routes and an Iranian cyber operator stealing technological research do not belong to a single threat ecosystem. But they share one operational characteristic. Their most important activity occurs before the threat becomes obvious.

That creates a significant burden for intelligence services because prevention increasingly depends on interpreting behaviour whose meaning is uncertain when it is detected. Reconnaissance can be innocent or hostile. Technical research can be legitimate or preparatory. Online extremist rhetoric may remain rhetoric or progress toward attack planning. Travel, financial transfers, and encrypted communications can take on entirely different significance depending on context. Modern intelligence therefore depends increasingly on pattern recognition across fragmented indicators rather than on waiting for definitive evidence of an imminent operation.

Watchlist, Next 30 Days

1. The Syrian arrest deserves close monitoring for any indication that intelligence exploitation generates further operations against Islamic State personnel, facilitators or logistical structures. Additional arrests would help determine whether Abu Jihad al-Muhajir’s capture has exposed a wider network rather than simply removing an individual commander.

2. In Europe, suspected Russian-linked reconnaissance and sabotage activity should remain a priority indicator. Particular attention should be given to logistics infrastructure, defence production, transport routes associated with Ukraine and the use of low-profile intermediaries whose individual actions may initially appear disconnected.

3. The Estonian investigation will also be important. Evidence establishing external direction would significantly strengthen the assessment that European defence-industrial facilities are being systematically incorporated into hostile hybrid campaigns.

4. The Swiss case meanwhile reinforces the need to monitor the management of younger terrorism offenders after release. The relevant indicator is not whether every individual remains dangerous, but whether European systems can accurately identify the smaller subset whose ideological commitment survives judicial intervention and formal deradicalisation programmes.

5. Finally, further US or European investigations into Iranian cyber infrastructure could reveal additional links between ostensibly private operators and state security institutions.

Strategic Consequence

The central consequence of this week’s developments is that the decisive phase of security competition is moving progressively upstream. Terrorist attacks begin with radicalisation, networking and capability acquisition. Sabotage begins with reconnaissance and vulnerability mapping. Cyber campaigns begin with access development and intelligence collection. Organisational regeneration begins with commanders preserving relationships long after territorial structures have collapsed.

By the time violence or disruption becomes visible, much of the decisive work may already be complete. This places a premium on intelligence systems that can detect preparation across institutional boundaries. Counterterrorism, counterintelligence, cyber security and infrastructure protection increasingly need to exchange indicators that may appear insignificant when viewed in isolation. The strategic advantage will increasingly belong to the side capable of recognising hostile preparation before the adversary converts capability into action.

Final Analytical Line

The defining shift of 12–18 August was not an increase in one specific category of threat. It was the visibility of the preparatory layer beneath several different threats. From a young Islamic State supporter acquiring the means for an attack, to a senior jihadist commander sustaining clandestine structures, to reconnaissance of European logistics and the theft of technological research, the same analytical lesson emerges: the most important phase increasingly occurs before the public sees an attack at all. Modern security competition is therefore becoming a contest over anticipation. Actors that prepare quietly gain options. Institutions that recognise that preparation early deny them. That is where the decisive advantage is increasingly being created.

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874

As of June 2026, the Islamic State remains a resilient and decentralised insurgent actor operating across the Middle East and South Asia, capable of sustaining operational relevance despite a contained overall attack volume.

The organisation continues to operate within a post-territorial insurgent model defined by decentralised cells, localised autonomy, and the selective use of violence. There is no indication of an attempt to reconstitute territorial governance or to rebuild proto-state structures. Instead, IS prioritises survivability, targeted disruption, and the gradual erosion of state authority through low-visibility, high-impact actions.

Scope and Methodology

This Strategic Threat Outlook is based on:

• systematic monitoring of Islamic State propaganda (videos, photos, statements, claims);

• reporting from sources in the field;

• Integration of OSINT, SOCMINT, IMINT, and Digital HUMINT.

Sources include primary Islamic State media channels, open-source reporting, official statements, and local sources across affected regions.

Limitations

• Incomplete or delayed reporting from conflict zones;

• Exaggeration or omission in group claims;

• Propaganda bias and potential disinformation.

Where verification is not possible, this is explicitly noted. However, incomplete or delayed reporting from conflict zones, propaganda bias, and disinformation may affect the precision of threat assessments, requiring cautious interpretation of available data.

Provincial Snapshots

• Islamic State Sham;

• Islamic State of Iraq;

• Islamic State Khorasan;

• Islamic State Pakistan;

• Islamic State East Asia.

📌 Inside this Assessment

1. Overview and Security Threat Assessment

2. Activity and Operations Analysis — July 2026

3. Number, Targets, and Areas of Attacks in July 2026

4. Charts and Statistics

5. Analytical and Intelligence Assessments

6. Implications for Decision Makers

7. Early Warning Indicators

8. Threat Forecast, 30 to 90 Days

9. Executive Intelligence Conclusion and Risk and Threat Overview

Overview and Security Threat Assessment

Entering 2026, the Islamic State should no longer be analysed through the lens of territorial revival scenarios. The organisation has conclusively transitioned to a post-territorial insurgent configuration that prioritises survival, network preservation, and selective destabilisation over overt expansion.

The structural features identified in 2025 remain intact. IS continues to operate as a decentralised ecosystem of locally embedded nodes, loosely connected by ideological cohesion and brand identity rather than a rigid command hierarchy. Central leadership functions primarily as a symbolic and narrative anchor, while operational initiative remains provincial and context-driven.

What January 2026 clarifies is not a transformation but a consolidation. The organisation has demonstrated that it can sustain a calibrated level of violence across multiple theatres without requiring territorial control, reconstituting governance structures, or relying on large-scale operations. This model is inherently sustainable under conditions of fragmented governance, uneven security-sector capacity, and prolonged socioeconomic stress.

Strategically, Syria remains the core geographic anchor, while Afghanistan, through ISKP, and Pakistan, as a sensitive extension zone, are critical for regional stability. Focusing on these areas reinforces the need for targeted, region-specific efforts to manage the threat effectively.

From a strategic standpoint, the most significant conclusion entering 2026 is that IS has achieved operational equilibrium. It is not expanding, but it is not eroding, demonstrating the value of sustained, patient efforts to manage this persistent threat.

For political and military decision-makers, the implication is clear. At the start of 2026, the Islamic State is not a collapsing remnant, nor an imminent territorial challenger. It is a persistent insurgent actor embedded within fragile security ecosystems. Managing this threat will require sustained intelligence integration, partner capacity development, and governance stabilisation measures rather than episodic kinetic surges.

Islamic State Activities — July 2026

In July 2026, Islamic State activity across the Middle East and Asia remained consistent with a highly decentralised and geographically uneven threat environment. The regional picture was characterised less by broad operational expansion than by substantial differences between theatres, with observable activity increasingly dependent on the conditions available to individual provincial structures. The month therefore reinforces the need to distinguish between confirmed operational output, latent organisational presence, and incidents attributed to Islamic State by local authorities but not formally acknowledged through the organisation’s official media apparatus.

Read more

The Islamic State’s weekly magazine, al-Naba, remains a critical source for assessing the organisation’s operational tempo, geographic dispersion, and signalling posture across theatres.

The weekly newsletter reached number 560 last Thursday.

Time horizon: 30–90 days

The confidence level is assessed as Medium, reflecting the reliability of sources and verification methods used, which informs the assessment’s credibility and helps decision-makers understand its limitations.

📌 Inside this Assessment

1. Activity and Operations Analysis

2. Number, Targets, and Areas of Attacks

3. Charts and Statistics

4. Strategic Impact and Operational Implications

5. Implications for Policy and Counterterrorism

Source Basis & Methodology

This assessment is based on a direct analysis of primary propaganda material from al-Naba Issue No. 560, supplemented by OSINT, IMINT, and SOCMINT, which collectively provide a comprehensive, corroborated view of current operations and support informed decision-making.

The analysis integrates:

• OSINT

• IMINT

• SOCMINT

to contextualise reported attacks and assess credibility and operational relevance.

Limitations & Analytical Notes

• Reported casualty and damage figures may be exaggerated.

• Some attacks are presented without independent verification.

• The claims published in al-Naba are generally reliable regarding the occurrence of attacks; however, casualty and damage figures may be inflated for propaganda purposes, which should be considered when assessing operational impact.

Claims published in al-Naba are assessed as generally reliable regarding the occurrence of attacks, while casualty figures and material damage are likely to be inflated for propaganda purposes. Analytical judgments in this assessment prioritise event verification and pattern analysis over reported impact.

Historically, Islamic State attack claims in al-Naba have mainly proven accurate in terms of occurrence, with inflation primarily affecting reported impact rather than event existence.

Issue 560, eight pages long, covers the week of 23 to 29 Safar 1448, from 6 to 12 August 2026.

Al-Naba generally includes most of the statements and photos published daily over the past week on its official channels, often with new elements or additional written and photographic details. However, al-Naba won’t include unpublished statements or messages.

The main infographic summarises the areas affected by military operations this week, including:

Read more