هذا التقرير متاح أيضًا بـ العربية
Over the past two years, Syria has undergone sweeping changes, from the fall of Bashar Assad’s regime to the emergence of a new governing order. The Islamic State group, or ISIS, has come to treat the current authorities, led by interim President Ahmed al-Sharaa, much as it treated the previous regime. The label “apostate regime” has returned to its literature and media rhetoric.
The group quickly stepped up its offensive, particularly in the media, with the new regime featuring in most issues of Al-Naba, its weekly mouthpiece. It has also labelled the Syrian authorities “Agent 90”, a reference to Syria joining the US-led international coalition against ISIS.
The group has continued to incite attacks on Syrian security and army personnel. Meanwhile, hundreds of accounts and groups on platforms such as Facebook and Telegram promote what they describe as an agenda of “fighting the apostate Syrian regime,” and call on young men and foreign fighters formerly in the ranks of Hayat Tahrir al-Sham to join the organisation.
Unclaimed attacks do not mean ISIS has disappeared
For more than two months, ISIS has not claimed any new attack in Syria. Its last announced operations date back to June. The subsequent relative lull in its publicly declared activity could give someone newly following the group the impression that it has disappeared.
This apparent inactivity fits a recurring pattern ISIS has followed since losing its areas of influence in late 2017 and turning to covert operations and guerrilla warfare. The group aims to reorganise and reposition itself in the new Syria, particularly in urban areas, towards which it moved from the Syrian Badia and the Jazira region after the fall of Assad’s regime.
On this assessment, ISIS cells are likely responsible for a large share of the attacks on the Syrian authorities for which no official claim of responsibility has been made. ISIS sees secrecy as an urgent security necessity at this stage, especially in and around Damascus, where it may opt for a prolonged period of calm before launching major attacks on sensitive targets.
The group’s supporters have previously invoked “security necessities” in media outlets supporting it to explain the absence of claims of responsibility. This rhetoric was especially prominent in 2023, when a marked lull in ISIS activity was followed by a major wave of attacks at twice the pace.
The strategy also provides media cover to soften the impact of the group’s declining operational capabilities until it can establish itself in new areas under changed conditions. Conditions in Syria appear favourable for ISIS to regain momentum, given the difficulties in improving security despite substantial efforts by the Syrian Interior Ministry.
Widespread weapons proliferation, multiple security challenges and the fragility of the security apparatus further complicate the situation. Syrians’ deteriorating living conditions add to these pressures, which the group may exploit and count on if they worsen.
Fewer operations and changing recruitment methods
ISIS has carried out and claimed approximately 28 attacks in Syria this year, most of them in February, following an intensive appeal by its leadership for cells in the country to “mobilize.” These operations ranged from assassinations and bombings to inghimasi attacks. About 27 attacks on Syrian forces and government interests were also recorded without any official claim of responsibility. The group is likely behind most of them. As noted above, withholding claims for some operations is an established ISIS policy.
Field analyses of the operations claimed between February and June this year show that the group has undergone a sharp contraction on the ground. Figures recorded through August also show a historic decline in its operational activity: about 60 attacks were counted, including both claimed operations and others strongly suspected of involving the group, compared with 128 in 2025.
Alongside this numerical decline, the data indicate that ISIS has adopted a tactic of “withdrawal and deliberate dormancy” to ease pressure from the Syrian authorities while retaining an “operational core” capable of planning and carrying out attacks deep inside government-controlled areas, particularly major cities.
Its cells now operate through complex, highly secretive structures. Small security groups coordinate through temporary Telegram chat rooms to monitor targets and pass details to cells according to their geographical distribution.
Our monitoring indicates that two types of operatives carry out these attacks. The first consists of ideologically committed members with strong ties to the group’s doctrine. Most lived through its period of control in Syria, while some are adolescents.
The second consists of paid operatives whose economic circumstances the group exploits. Adolescents account for a large proportion of them. In one case announced by the Syrian authorities in Al-Mayadeen, two people were arrested after throwing a hand grenade at the Internal Security Directorate building. According to the official account, preliminary investigations indicated that they belonged to a cell affiliated with ISIS.
The group’s reliance on adolescents and minors, particularly in Deir ez-Zor and Raqqa, reflects a severe crisis in mobilisation and recruitment. The situation differs in rural areas around Aleppo and Damascus, where adult and experienced operatives play a larger role, including veteran fighters and non-Syrian members. Some are likely to have left al-Hol camp during the chaos that accompanied the withdrawal of the Syrian Democratic Forces (SDF) and the Syrian authorities’ takeover of the camp.
Aleppo province ranks second after eastern Syria, or the Jazira region, for ISIS activity. Some of its rural areas are considered longstanding safe havens for its cells, particularly Manbij, Khanasser, al-Safira and al-Bab.
Where cells operate and whom they target
Deir ez-Zor: The main centre of operations
Data tracking ISIS operations show differences in the nature and level of its activity across Syria’s provinces. Deir ez-Zor recorded the highest number, with 11 attacks officially claimed by the group. Four took place in Al-Mayadeen and the surrounding countryside, targeting Internal Security and customs personnel.
Other operations targeted police personnel in Al-Sabha and Al-Basira along the Khabur River, with a further operation in Al-Bukamal. Al-Quriyah and Al-Shaafah in the Jazira also saw attacks on Syrian army personnel and guards at oil facilities.
The area stretching from Hajin to Baghouz, near the Iraqi border, saw about 13 ISIS attacks before Syrian security agencies dismantled the “Baghouz cell” in late July. On 1 August, the Interior Ministry announced that it had dismantled a dangerous security cell affiliated with the group in Deir ez-Zor, following a security campaign that began in Baghouz on 29 July.
During the operation, the official responsible for assassinations, known as “Atta Allah al-Anqoud,” was killed before he could detonate his suicide belt. The cell’s leader, Abdul Fattah al-Khalifa, nicknamed “al-Sisi”, was arrested. Security forces also seized suicide belts and weapons the cell had used in attacks on civilians and a member of the security forces.
A child was killed in the clash between Syrian security forces and the ISIS cell. This was the authorities’ third operation in Baghouz this year.
Aleppo: Cells return to old safe havens
Aleppo province ranked second, with eight claimed operations. Assessments link this activity to the return of dozens of al-Hol camp residents to their home areas in the eastern and southern Aleppo countryside.
Manbij and the surrounding countryside saw three ISIS operations, including the detonation of explosive devices and attacks on oil tankers, according to an Interior Ministry statement. Several assassinations targeting military personnel and civilians also took place around al-Rai and along the Aleppo–al-Bab road. They included the mistaken killing of a young man, Mahmoud al-Farwati. This reflects the group’s reliance on random ambushes and local intelligence of limited accuracy.
Al-Farwati was a civilian, but his military trousers aroused suspicion and led to his assassination. The group claimed he was a member of the security forces, a claim later proved false. Its Amaq agency often justifies such attacks by classifying the victims as “apostate soldiers.”
Al-Safira and Khanasser also saw separate assassinations of customs police and army personnel. ISIS has remained active in both areas since 2019, explaining the intensity of Syrian security operations against its cells there.
Raqqa: Limited operations with serious security implications
Raqqa recorded four ISIS operations with serious implications for security. In mid-June, two operatives, one a foreigner from the category of “muhajireen,” carried out a brazen suicide attack, storming a security headquarters and clashing with the fighters inside. Raqqa had seen similar attacks before, but the operation exposed the fragility of security there.
ISIS cells targeted army and security vehicles and personnel in Shnina and Al-Wasita in the Raqqa countryside. Two inghimasi fighters also attacked the Al-Sabahiya checkpoint inside the city in broad daylight.
Damascus and its countryside: Attempts to establish a lasting presence
ISIS claimed two operations in Damascus. The first was the assassination of a Shiite cleric in Sayyida Zainab, using an explosive device to target his car. The second targeted an employee at the Palace of Justice in the Daff al-Shawk neighbourhood, a dangerous sign that the group’s target list is expanding to include government employees.
The Syrian authorities also said ISIS cells were behind the 7 July bombings, which coincided with French President Emmanuel Macron’s visit to Syria. The group’s repeated use of explosive devices inside the capital is a notable feature of these operations, indicating an effort to establish its cells there.
Hasakah: Sleeper cells and limited activity
Only one attack claimed by the group was recorded in the province’s countryside, targeting a Syrian army transport bus. There were also indications of sleeper-cell activity in rural areas around Ras al-Ain.
Wearing down the state and widening the target list
An examination of ISIS attacks this year suggests that they form part of a broad strategy of long-term attrition against the security forces, the Syrian army and anyone dealing with the current government. Targets include police officers, guards at service facilities and judicial-sector employees. By widening its target list, the group aims to undermine outward signs of state stability.
The expanding list may indicate that the group’s current capabilities leave it with fewer options. It also signals a dangerous prospect: a broad section of state employees could become targets for its cells.
According to local sources, a number of young men who recently joined the security forces have requested transfers from Deir ez-Zor to other provinces. The requests appear linked to deteriorating security in eastern Syria and fears of attacks by ISIS cells. Even on a limited scale, this trend illustrates one aspect of conditions there.
The group also seeks to damage Syria’s economy and supply routes by targeting oil tankers and economic infrastructure, as it did in attacks on tankers in Abu Khashab and Manbij.
This pattern dates back to previous years, when ISIS attacked oil tankers in SDF-controlled areas and areas formerly controlled by the Assad regime.
Social media platforms, particularly Facebook and Telegram, have become channels for directing the group’s cells and sympathisers. In June, ISIS-linked accounts called on supporters to target Iraqi oil tankers. Within hours, an Iraqi tanker was attacked near Manbij on 14 June, and ISIS quickly claimed responsibility.
This reveals a dangerous method the group uses to direct its audience and incite attacks. It used the same method after its February 2026 “mobilization” message, which was followed by a wave of simultaneous attacks on Syrian security forces across several provinces.
ISIS also seeks to inflame sectarian conflict in Syria. The effects of sustained sectarian incitement remain visible in places such as Homs province, where attacks on citizens from religious minorities recur. In May, the group carried out a sectarian assassination in Sayyida Zainab in the Damascus countryside, targeting a Shiite cleric.
Another danger is the group’s earlier appeal to foreign fighters formerly in the ranks of Hayat Tahrir al-Sham. ISIS continues to address them in its media messaging and urge them to join. It is trying to rebrand itself as the “last refuge of the transnational global jihadist project,” exploiting unease among foreign fighters who reject the political path taken in the new Syria.
The participation of a foreign fighter in the June Raqqa attack showed the impact of this rhetoric. Large-scale recruitment remains limited because ISIS lacks territorial control. Meanwhile, the presence of about 5,000 heavily armed foreign fighters poses a latent challenge to the transitional government headed by Ahmed al-Sharaa.
About a third belong to the Turkistan Islamic Party; the remainder include Uzbeks, Chechens, Arabs and Europeans. They serve in brigades of the 84th and 82nd divisions following the integration of their former factions into the new army. Despite its current weakness, ISIS continues to count on attracting these fighters, as its media appeals to them show.
A UN report tracks the changing threat
The United Nations Analytical Support and Sanctions Monitoring Team recently issued a new report on al-Qaeda and ISIS, numbered S/2026/651. It highlighted changes in Syria and identified the evacuation of al-Hol camp earlier this year as a pivotal turning point in the conditions in which ISIS operates.
The camp had been one of the largest gathering places for the families of ISIS members and people associated with the group in north-eastern Syria. Its evacuation changed the nature of the security challenges, creating the complex tasks of tracking former residents, reintegrating them into society and reducing the risk that some could be recruited again.
The report also noted two consequences of transferring thousands of detained ISIS members from Syria to Iraq. The measure helps ease pressure on Syria’s overcrowded detention centres, but creates security gaps and logistical challenges during transfers. These could allow the group to attempt escapes similar to those seen in al-Shaddadi.
The report stated that ISIS and al-Qaeda may exploit polarisation and regional escalation to re-establish their presence. These indicators suggest that both groups are keen to capitalise on the effects of conflicts and regional tensions, taking advantage of the diversion of security resources and deteriorating security in some areas to rebuild their bases and move more easily.
The report concluded that Syria will remain central to ISIS’s strategy. The group does not need to declare its purported “caliphate” again to benefit from instability. Fragmented security arrangements, political changes and gaps in control give it vital room to rebuild its networks and sustain its activity.
The report estimated that ISIS has about 3,000 fighters in Syria and praised the Syrian authorities’ efforts to combat it. It also noted the presence of Iraqi ISIS leaders in Syria and raised concerns about foreign fighters, particularly members of Hurras al-Din. It expressed concern about the integration of most foreign fighters into the Syrian army’s 84th Division.
Security gains and institutional weaknesses
The achievements of Syria’s nascent security apparatus reflect a substantial effort that can be seen as exceeding expectations. Weapons are widespread, and the authorities face multiple security challenges and external interventions aimed at destabilising the country.
A year and a half is a short time in which to build a professional security workforce capable of maintaining order in a country such as Syria. The current apparatus draws its personnel from several former factions, each with its own ideology and orientation. This has contributed to evident confusion and repeated abuses by some security personnel. The Interior Ministry has also placed mid-ranking commanders in charge of several security directorates, some of whom lack sufficient experience.
Compounding these problems is the intelligence services’ heavy reliance on local informants, colloquially known as “report filers,” to monitor security threats, including ISIS cells. Using this method without carefully verifying and cross-checking information can lead to serious mistakes and the detention of people with no connection to the group.
One such mistake came to light in Quneitra. On 13 August, the Interior Ministry apologised for detaining six citizens and released them after it was established that their only connection to one of the suspects was through family ties. Residents had appealed through the media for the authorities to reconsider the case, insisting that the accusations were malicious.
By contrast, the ministry announced that investigations had proved that three people detained in the 9 August security operation in Khan Arnabeh were linked to ISIS activities. They included one person it said had previously held leadership positions in the group. State media had published the detainees’ photographs and personal information. Local sources in Quneitra said some of those released had been outside the country during the period covered by the accusations. The sources also described the provincial security directorate’s poor reputation, citing repeated mistakes attributed to it.
In a separate incident, the Interior Ministry announced the arrest of an ISIS leader on 15 August, according to SANA.
On Tuesday, 18 August, the Interior Ministry identified the leader whose arrest it had previously announced. It said the Internal Security Forces and the General Intelligence Service, working with international partners, had arrested Hamza Abdullah Mohammed, known as “Abu Jihad al-Muhajir”, in a tightly coordinated operation in the Manbij countryside in Aleppo province.
According to the ministry’s statement, the detainee had held the position of “general military official for Wilayat al-Sham” and previously served as deputy to the group’s former general military official, known by the alias “al-Harithi.” He also oversaw the so-called “Wilayat Idlib.”
The arrest was part of an intensified series of Syrian operations against ISIS cells across the country. This year, most have been concentrated in Aleppo, Damascus and its countryside, and eastern Syria.
Conclusion
Combating ISIS in Syria requires an approach that goes beyond security operations. It must include developing a considered religious discourse that undermines the group’s propaganda and improving residents’ living conditions, especially in rural and poorer areas such as the Jazira region and the countryside of Aleppo, Damascus and Hauran.
ISIS exploits poverty and deprivation to attract and recruit young people, making better economic conditions an essential part of efforts to confront it. This should be accompanied by a review of restrictions that hinder young people from joining the security and military institutions, given that unemployment has become a major problem.
Syria also needs broad support from neighbouring countries to develop security and intelligence services founded on protecting the country and safeguarding citizens’ rights. These must move away from the abusive model of the ousted regime’s agencies. Making the security apparatus an adversary of society could create dangerous openings for several actors, including ISIS.
Current conditions also require better intelligence methods and closer monitoring of ISIS supporters online. They have become highly active on digital platforms, and some use accounts bearing real names to spread the group’s propaganda on Facebook from inside Syria.
Rules governing the movements of security and army personnel must also be tightened. Strict requirements for travel within and outside cities are needed to prevent personnel from becoming easy targets for ISIS cells. Security and intelligence directorates should be led by experienced, competent figures, with competence taking precedence over loyalty. Appointing inexperienced leaders could create major security gaps and threaten the country’s safety.
ISIS’s sources of financing also require closer monitoring, especially after the evacuation of al-Hol camp. For years, the camp was the focus of fundraising campaigns launched by the group’s supporters under the guise of helping its residents. This activity has now shifted to Akhtarin camp in the Aleppo countryside, which has received large numbers of families transferred from al-Hol.
Posts circulating on media accounts supporting the group indicate that dozens of pro-ISIS channels are collecting money in these families’ names. Some of the group’s own supporters warn that the cause is being exploited and that donations are not reaching their intended recipients.