Harakat al-Shabaab al-Mujahidin — Strategic Threat Outlook | November 2025
Operational Trends, Regional Risk, and Forecast
Executive Intelligence Summary
Harakat al-Shabaab al-Mujahidin remains one of the most resilient and operationally capable jihadist organisations in East Africa, posing a persistent and multidimensional threat to Somalia and neighbouring countries, particularly Kenya.
In November 2025, al-Shabaab activity reflects:
sustained pressure against Somali security forces and government targets;
continued use of complex and asymmetric attack methods;
A stable operational posture despite ongoing counterterrorism and military pressure.
No major strategic shift is observed during the reporting period; however, the group’s ability to sustain operational tempo and project violence regionally confirms a high and enduring threat level over the next 3–6 months.
Threat level: High
Trend: → (stable)
Primary risk areas: Somalia; cross-border risk to Kenya
Time horizon: 3–6 months
Confidence level: Medium–High
Scope and Methodology
This Strategic Threat Outlook is based on:
systematic monitoring of jihadist propaganda (videos, photos, statements, claims);
reporting from sources in the field;
Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT.
Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.
Limitations
Incomplete or delayed reporting from contested or remote areas;
exaggeration or omission in group claims;
Propaganda bias and potential disinformation.
Where verification is not possible, this is explicitly noted in the assessment.
Overview and Security Threat Assessment
Despite sustained counterterrorism operations by the Somali federal government, allied clan militias, and international partners, al-Shabaab remains the most consequential and resilient threat to the Somali state. While overall attack volume showed a marginal decline in 2024, this reduction did not translate into strategic degradation. Instead, al-Shabaab adapted its operational profile, preserving high lethality, territorial influence, and coercive capacity.
Since mid-February 2025, al-Shabaab has launched a large-scale, coordinated offensive in central Somalia, marking a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly along strategic towns, supply corridors, and population hubs.
The operation began on 15 February 2025 with synchronised assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry manoeuvres. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signalling momentum, inevitability, and state weakness.
Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance and coercion model, even in areas nominally held by the government. This includes:
Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalise al-Shabaab authority and delegitimise federal institutions.
Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.
Systematic taxation and extortion, including the collection of zakat in government-controlled zones, underscore the group’s parallel administrative reach.
Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.
During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the overall operational tempo of the insurgency.
After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran—areas where al-Shabaab retains deep logistical and social networks—the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.
Assessment: al-Shabaab is not merely enduring pressure; it is actively shaping the battlespace. Its ability to synchronise military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. Absent sustained territorial control, effective local governance, and disruption of al-Shabaab’s parallel administration, the threat trajectory for 2025 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.
Al-Shabaab activities – November 2025
In November 2025, the operational landscape related to al-Shabaab showed continuity with previous months, confirming the group’s resilience despite military pressure from Somali government forces and their international partners. In several areas of the country, especially in the central and southern regions, the presence of the jihadist militia remains entrenched; al-Shabaab continues to exploit rural areas and poorly controlled logistical corridors to reorganise, move fighters, and maintain informal control over local communities through taxation, coercion, and a parallel governance system that guarantees it a constant income and social influence.
During November, there were no attacks of major media significance or particularly complex operations as in other periods of the year, but this did not mean a decrease in the threat. On the contrary, the group chose to maintain widespread pressure through ambushes, small assaults on government posts, and the use of IEDs along secondary roads, a strategy that allows al-Shabaab to slowly wear down state forces while avoiding head-on clashes. This fragmented and adaptive operational style suggests a tactical awareness on the part of the group, which prefers to preserve its men and resources while continuing to contest control of the territory.
At the same time, there has been an increase in targeted operations by Somali government forces during the month, often conducted in coordination with external partners. Numerous interventions, especially in the Middle Shabelle and southern regions near Kismayo, led to the elimination of active cells and the destruction of weapons depots. These operations, based on more effective use of intelligence, indicate an attempt to target al-Shabaab’s logistical hubs and key operational figures rather than limiting themselves to reactive or large-scale interventions. Despite these tactical successes, the group’s ability to disperse quickly and reform elsewhere makes it difficult to achieve a lasting impact.
The trends observed during the month confirm that the organisation’s strength lies primarily in its ability to function as a widespread insurgency. The group does not need to control large cities to remain operational: it is sufficient to maintain control over strategic rural areas, secure lines of communication, and continue recruitment through clan networks, economic pressure, and a persistent propaganda apparatus. This allows it to constantly regenerate its military potential and compensate for losses, a factor that weighs heavily on government strategies.
Overall, November ends with the threat level remaining high, even in the absence of traumatic events or high-impact attacks. Al-Shabaab retains freedom of movement in various areas of the country and continues to be an armed actor capable of destabilising not only Somalia but also neighbouring regions, particularly along the border with Kenya. Its ability to adapt, disperse, and strike when conditions allow suggests that, despite recent counterterrorism operations, the conflict will remain protracted and characterised by slow erosion rather than decisive advances.
Number of attacks in November 2025: 48
AREA:
Somalia: 47
Afgoye area, Scialambod area, Baledogle Airfield, Merca area, Coriolei area, Janaale area, Lower Shabelle Region;
Kismayo area, Lower Juba Region;
Baidoa area, Dinsor area, Bur Acaba area, Berdaale area, Bay Region;
Baardheere area, Luuq area, El Wak area, Gedo Region;
Beledweyne area, Jalalaqsi area, Hiraan Region;
Mogadishu area, Banaadir Region.
Kenya: 1
Dadaab area, Garissa County.
Target: Somali Special Forces, Danaab Special Forces, Somali intelligence, Somali Army, Ethiopian Army, Ugandan Army, Kenyan Army, AMISOM Multinational Forces, Ma’awisley militia, Somali pro-government militias.
The official media outlets, al-Kataib Media and al-Shahada News, disseminated the propaganda, including photos, videos, and claims. The group has released 30 statements claiming its military activities.
Intent–Capability–Opportunity (ICO) Assessment
The overall operational activity recorded in November 2025 indicates with high confidence that al-Shabaab is pursuing objectives that go beyond a simple war of attrition. The primary intent remains the systematic delegitimisation of the Somali state, accompanied by a progressive re-territoria of the conflict.
The geographic distribution of attacks, with a clear shift toward Lower Shabelle, Bay, and the Mogadishu area, suggests a deliberate intent to:
Strengthen control over critical logistical corridors;
Restrict government forces’ freedom of manoeuvre in urban and peri-urban areas;
Pave the way for insurgent-style stabilisation in already-intruded areas, rather than indiscriminate expansion.
The lack of significant activity in some regions (Galgaduud, Bakool) does not indicate a retreat, but rather a selective prioritisation of the operational theatre.
Capability
During the period analysed, al-Shabaab demonstrated a mature and multi-layered operational capability, characterised by:
Operational persistence: 48 attacks in a single month, with geographic and temporal continuity.
Tactical versatility: combined use of IEDs, landmines, targeted assassinations, and complex attacks against regular and special forces.
Urban penetration: the ability to strike Mogadishu and Banaadir confirms the existence of logistical networks, sleeper cells, and coercive support within the urban ecosystem.
Sophisticated targeting: targeted selection of elite forces (Danaab), intelligence, multinational contingents, and pro-government militias, a reliable and up-to-date tactical intelligence index.
From an informational perspective, the production of multimedia evidence and 30 official communiques indicates a functioning chain of command, communication discipline, and a clear alignment between military operations and the strategic narrative.
Opportunities
The operational opportunities exploited by the group remain structural, not contingent:
State territorial discontinuity: government control remains fragmented, temporary, and dependent on external support.
Limited sustainability of government offensives: “liberated” areas are not consolidated in the medium term.
Clan ambiguities and hybrid militias: gray areas that al-Shabaab exploits for infiltration, coercion, or forced neutrality.
Security force overload: resources are dispersed between urban defence, infrastructure protection, and rural operations.
In short, al-Shabaab operates in an environment that continues to favour insurgency more than the state.
Indicators & Early Warning
Based on the observed patterns, the following indicators merit priority monitoring over the next 1–3 months:
Increase in coordinated attacks against bases and checkpoints in Lower Shabelle and Bay → possible prelude to attempts at stable territorial control.
Increase in targeted assassinations of local officials, clan elders, and administrative intermediaries → indicator of preparation for parallel governance.
Return of systematic taxation (zakat) in areas formally under government control → signal of insurgent consolidation.
Temporary reduction in activity in secondary regions → possible reallocation of resources to priority theatres.
Increasing sophistication of propaganda (timeliness, visual quality, synchronisation with operations) → indicator of operational confidence and high morale.
The combination of at least two of these indicators should be considered a credible early warning of a new offensive phase.
Intelligence Assessment
Overall, the November 2025 data indicate that al-Shabaab is neither on the defensive nor simply containment. On the contrary, the group is showing consistent signs of strategic adaptation, geographic focus, and qualitatively strengthening its operations.
The quantitative stability of attacks masks a more dangerous evolution: less dispersion, more control; less noise, more substance. The organisation continues to dictate the timing and location of engagements in large portions of the country, maintaining operational initiative and forcing the state into a reactive posture.
In the absence of:
continued territorial control,
neutralisation of urban networks,
and integration between military action, local governance, and intelligence,
al-Shabaab will remain not only the primary threat to Somali security, but also a player capable of shaping the evolution of the conflict in the medium term, with direct impacts on regional stability in the Horn of Africa.
Conclusion
During the month under review, al-Shabaab confirmed its solid capacity to conduct complex, multi-level operations, both in the capital and in neighbouring areas. The group continues to use a wide range of operational tools—improvised explosive devices, landmines, and targeted killings of government officials and members of the security forces—demonstrating a high degree of tactical adaptability and a persistent ability to penetrate security measures, even in urban contexts such as Mogadishu.
Al-Shabaab’s influence is not confined to the rural areas traditionally under its control, but extends in a structured manner to the suburbs of the capital and surrounding areas, in some cases infiltrating state mechanisms. This highlights the limitations of the Somali government’s authority, which remains fragmented and territorially discontinuous. These gaps offer the group ample room for manoeuvre, not only to plan and conduct operations, but also to secure safe havens and resilient logistics lines.
From a quantitative point of view, the overall level of attacks remains largely stable compared to the previous month, with a slight increase recorded in Somalia and a decrease in Kenya. However, the most significant factor is not so much the numerical variation as the geographical distribution and quality of the operations. During the month, there was a reduction in attacks in the Middle Shabelle and Hiiraan regions, areas that remain strongly influenced – if not de facto controlled – by al-Shabaab, as well as an absence of significant incidents in Galgaduud and Bakool. At the same time, there was a marked increase in offensive activities in the Lower Shabelle and Bay regions, as well as an intensification of attacks in the Mogadishu area and the Banaadir region. In Kenya, the threat appears to have temporarily subsided, with only a single incident in Garissa County.
This spatial reconfiguration suggests a strategy aimed not only at striking symbolic or opportunistic targets but also at consolidating and expanding territorial control in districts considered strategic. Al-Shabaab seems to be focused on strengthening its grip on areas it has already conquered or is fighting over, increasing the complexity and coordination of its attacks to erode the state’s presence and, in the long run, taking direct control of entire districts.
In the broader context of 2025, the al-Shabaab insurgency remains resilient, adaptive, and, in many respects, growing stronger. The group remains the main threat to security in Somalia, exploiting the structural weakness of state institutions, territorial fragmentation, and the limited ability of government forces to sustain military gains over time. In the absence of a lasting strengthening of state control and an integrated strategy that goes beyond the purely military dimension, al-Shabaab will continue to be a central factor of instability in the country and the region.
© Daniele Garofalo Monitoring - All rights reserved.
Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.
His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.
Daniele Garofalo Monitoring is registered with the Italian National ISSN Centre and the International Centre for the Registration of Serial Publications (CIEPS) in Paris.ISSN (International Standard Serial Number): 3103-3520ORCID Code: 0009-0006-5289-2874Support my research, analysis and monitoring with a donation here on PayPal.Me/DanieleGarofalo88