Islamic State — 90-Day Threat Forecast (Jan.–Mar. 2026)

Near-Term Outlook Following Late-December Operational Surge

Executive Intelligence Summary

The increase in Islamic State (IS) operational claims reported in al-Naba Issue No. 528 (read here), late December 2025, reflects a short-term surge in activity rather than a confirmed strategic shift. The organisation demonstrated the ability to temporarily elevate operational tempo while maintaining geographic dispersion, particularly across African theatres.

Near-term threat level (90 days): Medium–High
Trend: → / ↑ (stable with surge potential)
Time horizon: 0–90 days
Confidence level: Medium

---

Key Intelligence Question (KIQ)

Does the late-December increase in Islamic State operational activity indicate the onset of sustained escalation, or does it represent a temporary surge within an otherwise stable consolidation strategy?

---

---

Situation Overview

During the final week of December 2025, IS claimed 20 operations across Nigeria, Syria, Mozambique, Mali, the Democratic Republic of Congo, and Türkiye. The inclusion of an attack claimed outside formal wilayat boundaries (Türkiye) represents a qualitative deviation but lacks corroborating indicators of a broader external operations campaign.

Overall patterns remain consistent with established Islamic State operational logic: low-to-moderate complexity attacks, prioritisation of security forces and Christian civilians, and continued emphasis on African theatres as permissive operating environments.

---

Most Likely Scenario (60–70%) — Sustained Baseline with Episodic Spikes

IS maintains a stable multi-theatre operational baseline through March 2026, driven primarily by ISWAP, ISCAP, and IS Mozambique. Short-lived spikes in activity occur in response to local opportunity structures, security force vulnerabilities, or seasonal factors, but do not translate into sustained escalation.

Characteristics:

• Continued attacks against checkpoints, patrols, and convoys
• Persistent targeting of Christian civilians in select African theatres
• Limited economic warfare without systematic infrastructure campaigns
• Sporadic extra-wilayat incidents without follow-on coordination

---

Upside Risk Scenario (20–30%) — Localised Escalation in a Single Theatre

IS transitions from episodic spikes to a sustained campaign within one permissive theatre (most plausibly Nigeria, eastern DRC, or northern Mozambique). Activity becomes geographically concentrated, tactically repetitive, and supported by consistent propaganda framing.

Indicators:

• Multi-week attack clustering within the same wilaya
• Repeated use of similar tactics against the same target set
• Named or branded campaign narratives in al-Naba
• Increased attacks against forward operating bases or logistics routes

Impact:

• Degradation of local security forces’ freedom of movement
• Increased civilian displacement and humanitarian stress
• Elevated risk to external partner forces

---

High-Impact / Low-Probability Scenario (5–10%) — External Operations Signalling

IS leverages latent networks outside formal provinces to conduct or claim additional attacks beyond core theatres, accompanied by a shift in propaganda tone legitimising extra-regional operations.

Indicators:

• Repeated non-wilayat attack claims in the same country or region;
• Editorial framing emphasising retaliation, global reach, or obligation;
• Evidence of logistical facilitation or network reactivation outside Africa.

Assessment: Absent these indicators, non-wilayat incidents should be treated as tactical anomalies rather than evidence of a strategic pivot.

---

---

Tripwires (Assessment-Changing Signals)

If two or more of the following occur within a 30-day window, reassess toward sustained escalation:

• Coordinated attacks across multiple provinces within 24–72 hours;

• Shift toward complex or high-risk attack modalities;

• Sustained targeting of hardened military installations;

• Reappearance of systematic Shi’a-targeting;

• Consistent economic warfare against transport or energy chokepoints.

---

Early Warning Indicators (Monitorable)

• Increased convoy interdictions and checkpoint overruns in Nigeria, DRC, or Mozambique;

• Growing frequency of attacks involving foreign partner forces (e.g., Rwandan or Russian-linked units);

• Escalation in propaganda output volume accompanying operational claims;

• Arrests or disruptions indicating network reactivation outside core theatres.

---

Decision Cues for Policymakers and Security Planners

• Do not equate weekly surges with strategic escalation absent corroborating indicators.

• Prioritise disruption of logistics, recruitment, and coercive governance, not attack count suppression alone.

• Focus intelligence resources on African theatres, where escalation is most likely to become sustained.

• Treat extra-wilayat incidents as warning indicators, not confirmation of an external operations campaign.

---

Analytical Confidence Statement

This forecast is offered with medium confidence, reflecting consistent weekly pattern analysis and multi-source corroboration, balanced against uncertainty regarding internal tasking decisions and unobserved network dynamics.

---

This 90-day forecast should be read in conjunction with the Executive Annual Threat Assessment (2025–2026) to contextualise short-term fluctuations within longer-term strategic trends.

---

🔒 Executive Intelligence Cycle

This assessment is part of a broader analytical cycle.

Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90 day forecast into a single monthly strategic synthesis.

---

© Daniele Garofalo Monitoring - All rights reserved.

Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.

His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.

Daniele Garofalo Monitoring is registered with the Italian National ISSN Centre and the International Centre for the Registration of Serial Publications (CIEPS) in Paris.

ISSN (International Standard Serial Number): 3103-3520

ORCID Code: 0009-0006-5289-2874

Support my research, analysis and monitoring with a donation here, PayPal.Me/DanieleGarofalo88