Harakat al-Shabaab al-Mujahidin remains one of the most resilient and adaptive jihadist organisations in East Africa, which should reinforce the audience’s confidence in the ongoing threat and the need for continued vigilance.
The group continues to prioritise attritional warfare, interdiction of government mobility, degradation of intelligence and special forces capabilities, and selective psychological signalling operations.
No structural fragmentation or operational collapse is observable, underscoring the group’s resilience and the need for sustained efforts to address the threat.
Scope and Methodology
This Strategic Threat Outlook is based on:
systematic monitoring of jihadist propaganda (videos, photos, statements, claims);
reporting from sources in the field;
Integration of OSINT, IMINT, SOCMINT, and Digital HUMINT, including analysis of propaganda, disinformation, and group claims, is essential to understanding al-Shabaab’s influence operations and countering their narrative effectively.
Sources include primary material disseminated through al-Shabaab–affiliated channels, open-source reporting, official statements, and local sources.
Limitations
Incomplete or delayed reporting from contested or remote areas;
Exaggeration or omission in group claims;
Propaganda bias and potential disinformation.
Where verification is not possible, this is explicitly noted in the assessment.
📌 Inside this Assessment
Overview and Security Threat Assessment
Activity and Operations Analysis — August 2026
Number, Targets, and Areas of Attacks - August 2026
Charts and Statistics
Analytical and Intelligence Assessments
Implications for Decision Makers
Early Warning Indicators
Threat Forecast, 30 to 90 Days
Executive Intelligence Conclusion and Risk and Threat Overview
Related Intelligence & Analysis:
Overview and Security Threat Assessment
Despite ongoing counterterrorism efforts, al-Shabaab’s resilience is shaped by regional support and international engagement, which should reinforce the audience’s confidence in the importance of proactive, coordinated regional strategies to maintain security.
Since mid-February 2025, al-Shabaab’s large-scale, coordinated offensives in central Somalia indicate a strategic shift from attritional violence to territorial contestation, requiring heightened vigilance among security stakeholders. The campaign targeted Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and clan militias, aiming to reverse 2022 territorial losses along strategic towns, supply routes, and population centres. A coordinated offensive in central Somalia marked a clear shift from attritional violence to territorial contestation. The campaign has primarily targeted the regions of Middle Shabelle and Hiiran, focusing on Somali National Army positions, African Union forces, and pro-government clan militias. The offensive represents a deliberate effort to reverse the territorial losses suffered during the 2022 Somali government–African Union campaign, particularly in strategic towns, along supply corridors, and around population hubs.
The operation began on 15 February 2025 with synchronised assaults against multiple Somali military installations, combining ground attacks, vehicle-borne improvised explosive devices (VBIEDs), and follow-on infantry manoeuvres. Several towns and villages were temporarily seized, while numerous forward operating bases and camps were overrun or destroyed. The group systematically documented these operations through high-quality photo and video releases, indicating a deliberate information-operations component aimed at signalling momentum, inevitability, and state weakness.
Beyond kinetic activity, al-Shabaab continues to consolidate control through a multi-layered governance-and-coercion model, even in areas nominally held by the government. This includes political and religious penetration, targeted assassinations, systematic taxation, and narrative dominance, which collectively sustain the group’s influence and complicate counter-insurgency efforts.
Political and religious penetration, leveraging clerics, mosques, Sharia courts, and sermons to normalise al-Shabaab authority and delegitimise federal institutions.
Targeted assassinations of elders, district officials, mayors, and clan intermediaries, designed to decapitate local governance and deter collaboration with the state.
Systematic taxation and extortion, including collecting zakat in government-controlled zones, underscore the group’s parallel administrative reach.
Narrative dominance, portraying the return of Sharia governance while framing the Somali government as corrupt, externally controlled, and incapable of providing security or justice.
During the fighting, both the United States Africa Command and Ethiopia conducted airstrikes against al-Shabaab targets, following repeated requests for support from Mogadishu. While these strikes imposed tactical costs, they did not disrupt the insurgency’s overall operational tempo.
After consolidating gains and exerting sustained pressure in Middle Shabelle and Hiiran—areas where al-Shabaab retains deep logistical and social networks—the group is now expanding its focus toward Lower Shabelle and Bay regions. This shift suggests a phased campaign design aimed at stretching government forces, exploiting overextension, and reasserting insurgent dominance across multiple operational theatres.
Assessment: al-Shabaab actively shapes the battlespace through synchronised military, governance, and information operations, maintaining strategic initiative in key regions. Without sustained territorial control and effective governance, the threat remains high in 2025, with a credible risk of further territorial setbacks for the Somali state, as al-Shabaab continues to shape the battlespace and impact regional stability. Its ability to synchronise military offensives, governance mechanisms, and information operations indicates that the group retains strategic initiative in key regions. In the absence of sustained territorial control, effective local governance, and disruption to al-Shabaab’s parallel administration, the threat trajectory for 2026 remains high and structurally persistent, with a credible risk of further territorial rollback by the Somali state.
Al-Shabaab Activities – August 2026
August 2026 was marked by a substantial intensification of Harakat al-Shabaab al-Mujahidin activity across southern and central Somalia, accompanied by sustained cross-border pressure in northeastern Kenya.
The most important development was not simply a higher operational tempo, but the group’s ability to convert that tempo into simultaneous pressure on several strategically relevant axes, particularly Lower Shabelle, Hiraan and the approaches to Mogadishu. In Lower Shabelle, al-Shabaab increased attacks along key ground lines of communication connecting the capital with southern support zones. At the same time, repeated IED activity around Awdheegle and adjacent corridors demonstrated continued freedom to contest military mobility and exploit predictable convoy patterns.
The month also showed renewed offensive momentum in central Somalia. Al-Shabaab captured Teedan in Hiraan after prolonged fighting, reversing part of the territorial gains achieved during earlier government counteroffensives and improving its access toward Beledweyne and surrounding population centres. This is operationally significant because it indicates that the group is not limiting itself to harassment and interdiction, but remains capable of exploiting local vulnerabilities to re-establish positional advantages in contested areas. The subsequent movement toward Matabaan reinforced concerns that Hiraan could again become a more active manoeuvre space if government forces cannot consistently hold reclaimed territory.
Mogadishu also returned to the centre of the threat picture. During the first week of August, al-Shabaab activity in the capital increased markedly, while Somali authorities warned of possible attacks against hotels and government facilities, and NISA announced the arrest of militants allegedly preparing operations in the city. This pattern suggests an attempt to rebuild pressure on the capital through infiltration, reconnaissance and access via the surrounding road network rather than through a single isolated spectacular attack. The security significance lies in the interaction between the outer belt and the urban core, because al-Shabaab continues to use Lower Shabelle support zones to sustain operational access toward Banaadir.
At the same time, the counterterrorism environment remained intense. AFRICOM conducted an airstrike against al-Shabaab near Jilib on 7 August, while Somali and partner forces continued intelligence-led operations across key southern sectors. These actions impose costs and disrupt concentrations, but the broader August pattern again demonstrates that kinetic pressure has not yet translated into durable denial of al-Shabaab’s capacity to regenerate, manoeuvre and reopen pressure points elsewhere.
The regional dimension also strengthened. In Kenya, al-Shabaab maintained pressure in Mandera and Wajir, including repeated probing attacks against Kenyan security forces and installations. Kenyan authorities responded by reinforcing patrols and border vigilance, reflecting concern that these incidents may represent preparation for larger attacks rather than isolated harassment. The persistence of cross-border activity confirms that the Kenya theatre remains integrated into the broader campaign, functioning both as a cost-imposition front and as an extension of al-Shabaab’s operational depth.
The strategic context became more favourable to al-Shabaab because of uncertainty surrounding AUSSOM’s future posture. Accelerated handovers of bases to Somali forces, combined with concerns over mission funding and support, create exploitable seams if local forces cannot immediately replace the intelligence, logistics, mobility and force-protection functions previously provided by AUSSOM. The handover of Buurhakaba is especially sensitive because the surrounding road network remains contested and links Baidoa to Mogadishu.
Overall, August 2026 reflects a more assertive insurgent posture. Al-Shabaab is combining territorial opportunism, pressure on strategic corridors, renewed activity around Mogadishu and sustained cross-border operations in Kenya. The group remains under significant military pressure, but its ability to expand activity across multiple theatres at the same time indicates that its operational resilience remains intact and that the security environment is entering a more demanding phase for Somali and regional forces.
Number of attacks in August 2026: 152
AREA:
Somalia: 128
Qoryooley area, Bulunungi area, Baledogle area, Shalaambood area Zubayd area, Barire area, Jaanale area, Mubarak area, Awdheegle area, Afgooye area, Shalanbud area, Bulo Merer area, Warmahane area, Lower Shabelle Region;
Jowhar area, Bal’ad area, Mahaday area, Middle Shabelle region;
Afmadow area, Dhobley area, Kismayo area, Lower Juba region;
Baidoa area, Dinsor area, Qansahdere area, Bay region;
El Wak area, Dolo area, Bardhare area,, Gedo region;
Wajid area, Hudur area, Bakool region;
Buloburde area, Beledweyne area, Tedan area, Hiiran region;
Mogadishu area, Banaadir Region.
Kenya: 24
Fafi area, Igara area, Garissa County;
Lafey area, El Galo area, Fino area, Sheikh Barrow, Mandera County.
Konton area, Wajir County.
Mangai area, Majengo area, Ras Bori area, Lamu County.
Target: Somali intelligence, Somali Army, Ethiopian Army, Ugandan Army, Kenyan Army, Ma’awisley militia, Somali pro-government militias.
Threat and Intelligence Assessment
August 2026 represents a major escalation in al-Shabaab’s operational tempo. The group conducted 152 attacks, compared with 97 in July, an increase of approximately 57% in one month. Somalia accounted for 128 attacks, while Kenya recorded 24, demonstrating simultaneous intensification in the primary insurgency theatre and the regional cross-border front.
The geographic pattern is particularly significant. Lower Shabelle remains the principal operational centre of gravity, with sustained activity across Qoryooley, Baledogle, Barire, Jaanale, Mubarak, Awdheegle, Afgooye, Bulo Merer and adjacent areas. This concentration indicates continued pressure on the southern approaches to Mogadishu, strategic road networks and security positions supporting government mobility. However, the wider distribution across Middle Shabelle, Lower Juba, Bay, Gedo, Bakool, Hiraan and Banaadir confirms that a single localised campaign did not generate the increase.
The Kenyan theatre also expanded sharply, from 14 attacks in July to 24 in August, an increase of about 71%. Activity across Garissa, Mandera, Wajir and Lamu indicates a broader cross-border footprint. It suggests that al-Shabaab is allocating sufficient resources to maintain a secondary operational theatre without reducing pressure inside Somalia. The target profile remains heavily security-oriented, reinforcing the assessment that the campaign is primarily directed at degrading intelligence, military mobility, local holding forces and regional counterinsurgency capacity.
Strategic Implications for Decision Makers
The August surge changes the operational picture. The key issue is no longer whether al-Shabaab remains resilient, but whether the organisation is entering a phase of sustained higher-tempo campaigning. Two consecutive months of strong escalation, combined with geographic expansion, indicate that Somali and partner forces face an increasingly demanding force-allocation problem.
Lower Shabelle should remain the primary military priority because control of this belt directly affects Mogadishu’s security, government lines of communication and access to southern Somalia. At the same time, concentrating resources exclusively there would create exploitable gaps in Hiraan, Gedo, Bay and the Kenya-facing border areas.
The increase in Kenya also requires a genuinely regional response. Garissa, Mandera, Wajir and Lamu should be treated as interconnected with the Somali battlespace, particularly for intelligence sharing, border surveillance, logistics interdiction and early warning. The risk is that fragmented national responses allow al-Shabaab to shift personnel and operational emphasis between theatres faster than security forces can adapt.
Early Warning Indicators
Sustained monthly attack volumes above the first-half 2026 baseline.
Further clustering around Afgooye, Awdheegle, Barire, Jaanale, Bulo Merer and Baledogle.
Increased attacks against Somali intelligence, Ma’awisley formations and forward military positions.
Additional operational expansion in Hiraan or Middle Shabelle, particularly along routes connecting contested rural areas with major population centres.
Continued growth of incidents across more than two Kenyan counties simultaneously.
Increased reconnaissance, IED activity or attacks around major transport corridors and military facilities.
A shift from distributed attrition toward coordinated assaults against multiple positions within the same operational window.
Forecast: 30 to 90 days
High probability of continued elevated operational tempo in Somalia, although monthly totals may fluctuate below the August peak.
High probability that Lower Shabelle will remain the principal concentration of attacks and counterinsurgency competition.
Moderate to high probability of sustained pressure in Hiraan, Bay, Gedo and Middle Shabelle.
High probability of continued cross-border violence in northeastern Kenya, particularly Mandera and Garissa, with Wajir and Lamu remaining secondary risk areas.
Moderate probability of a complex, high-visibility operation against a government, military or security target if al-Shabaab seeks to convert current operational momentum into strategic psychological effect.
Moderate probability that increased counterterrorism pressure will generate tactical displacement rather than immediate reduction of the wider insurgent threat.
Executive Intelligence Conclusion
August 2026 is the strongest operational month observed in the current reporting cycle and represents a material escalation in al-Shabaab’s campaign. The increase from 97 to 152 attacks, combined with simultaneous expansion in Somalia and Kenya, demonstrates substantial residual manpower, logistical capacity and operational coordination.
More importantly, the organisation is sustaining pressure across multiple geographically separated theatres. This reduces the value of interpreting al-Shabaab exclusively through territorial control. Its current strength lies in distributed operational reach, rural access, cross-border mobility and the ability to impose continuous security costs without requiring permanent control of major urban centres.
The principal intelligence question for the next 30 to 90 days is whether August represents a temporary surge or the emergence of a higher operational baseline. Current indicators favour continued elevated activity, although not necessarily at August’s exceptional level.
Risk and Threat Overview
Threat Level: Very High
Trend: Strongly Upward
Operational Change: July 97 attacks → August 152 attacks, +56.7%
Primary Risk Areas: Lower Shabelle, Hiraan, Middle Shabelle, Gedo, Bay, Banaadir, Garissa, Mandera, Wajir, Lamu
Main Threat Vectors: IED attacks, ambushes, raids against security positions, targeted attacks against intelligence and local militias, cross-border infiltration and attacks against military movements
Regional Risk: High and increasing
Time Horizon: 30 to 90 days.
Previous Strategic Threat Outlook:
Harakat al-Shabaab al-Mujahidin: Operational Trends, Regional Risk, and Forecast - August 2026. Strategic Outlook:
🔒Executive Intelligence Cycle
This assessment is part of a broader analytical cycle.
Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.
© Daniele Garofalo Monitoring - All rights reserved.
Daniele Garofalo is an independent researcher and analyst specialising in Intelligence, Jihadist Terrorism, Islamist insurgencies, Non-State Armed Groups (NSAG), Cognitive Warfare, and Hybrid Warfare.
His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.
ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874