Tag Archives: ISIS

Islamic State releases first video of leader al-Baghdadi since June 2014; aimed at boosting morale of fighters, supporters worldwide – Global Analysis

Executive Summary

On April 29, Abu Bakr al-Baghdadi, leader of the Islamic State (IS), openly appeared in a video for the first time in almost five years.

The main objective of the video is to showcase to IS followers that al-Baghdadi is alive and still in command of the organization, and to rally his followers to increase their rate of activities.

Additional goals of the video include portraying al-Baghdadi as a combat leader and successor of Osama bin Laden and Abu Musab al-Zarqawi, as well as to bolster the image of the organization’s global operations.

Lastly, the video includes some insights into IS’s current organizational structure and into its affiliated groups around the world.


There is likely to be an increase in the rate, scope, and scale of attacks by IS and by sympathizers of the group over the coming weeks and months, particularly during the upcoming holy month of Ramadan.

During this time frame, IS will put a greater emphasis on conducting high-profile attacks against soft targets, including in regions that so far did not witness an attack by the group.

Over the longer term, IS will invest in building up its local affiliates, particularly in Africa and Central Asia, to compensate for its recent losses in the Middle East and its current inability to fully rehabilitate itself there.

Current Situation

  • On April 29, al-Furqan Media Foundation, the main Islamic State (IS) propaganda branch responsible for the release of messages by the group’s senior leadership, released an 18-minute video of IS’s leader, Abu Bakr al-Baghdadi, who is openly seen for the first time since an IS video on June 2014 showed him giving a sermon at al-Nouri Mosque in Mosul, Iraq.
  • In the video, al-Baghdadi is addressing his followers through a long speech delivered to three companions whose faces have been blurred, and who are likely senior leaders in the organization.

 Al-Baghdadi and the three companions  seen in the video

Assessments & Forecast

Video aims to showcase al-Baghdadi is alive, well, and still heads the group, boost the morale of fighters and supporters

Throughout the first part of the video, al-Baghdadi names “martyrs” who have been killed during the Baghouz campaign in Syria, which concluded in March 2019 as IS lost its last pocket of control over an urban terrain and a population. Thus, the timing of the video is highly symbolic and meant to highlight to IS followers that the “Caliph” and “Amir al-Mu’minin” (“leader of the faithful”) is alive and well and still heads the group, despite its continues strategic losses in recent years. This is especially so as it comes after years of various rumors about al-Baghdadi being killed by different actors, and at times that he has been overthrown from the leadership of the group. It is important to note however, that despite seemingly being healthy, al-Baghdadi appears to be very weary, and the video cuts several times, likely to allow him to rest and to refer back to his notes. There are clear efforts made by IS to prove that the video is contemporary, including by al-Baghdadi referencing current events such as the ongoing political unrest in Algeria, the ongoing revolution in Sudan, and Benjamin Netanyahu’s victory in the Israeli elections.

However, the only time when the video does not show al-Baghdadi is when he speaks about the Sri Lanka Easter attack from April 21, as the video shows footage released by international media showing the aftermath of the attack, as well as by the IS-linked Amaq news agency showing the militants prior to the attack, with an audio recording by al-Baghdadi of different quality than that of the video. Thus, it is possible that the original video was made and edited prior to the Sri Lanka attacks, with IS later adding a reference to it, due to the event’s importance.

Overall, mentioning the loss of Baghouz and the Sri Lanka attack is meant to mobilize IS fighters, as well as the group’s supporters around the globe, to conduct attacks as part of the “Revenge for al-Sham (Syria)” Campaign, an ongoing effort that commenced after IS lost Baghouz, during which the group increased the rate, scope, and quality of their operations worldwide. While it remains unclear if this was intentional or not, the video was also released shortly before the holy month of Ramadan, which begins around May 6, a period of time that traditionally experiences an uptick in jihadist attacks, with the release of the video likely to serve as a further conducive factor for such attacks. Moreover, the references to Algeria and Sudan were emphasized by stating that “unfortunately Muslims did not wise up to the fact that they keep replacing one tyrant by another, and that the only way to deal with these tyrants is through Jihad for Allah”, thus trying to appeal to persistent widespread perceptions of marginalization among Muslims in order to increase the support base for IS.


Al-Baghdadi affirms strategic shift of IS from state-like structure to primarily asymmetric warfare

In the video, al-Baghdadi glorified the resistance of the Baghouz defenders and highlighted that “no IS territory was ever lost without a fight”, also mentioning by name the lost of Sirte, IS’s de facto capital in Libya, in December 2016. Later, he praised the recent actions of the fighters in Libya, especially their raid on the town of al-Fuqaha and their conduct of a “war of attrition” in their attacks on enemy infrastructure and supply lines, as well as the attackers of the az-Zulfi police station in Saudi Arabia, hoping for more such attacks.

This provides further support for the longstanding assessment, supported by evidence from conflict zones, that with the demise of the “physical Caliphate” of IS in Syria and Iraq, the group has shifted its strategy toward asymmetric warfare. This means that, at least at the current stage, the group will not be attempting to regain territory and revive its government or country-like structure. Instead, it will be focusing primarily on conducting attacks varying from small-scale hit-and-run to large-scale raids, to maximize enemy casualties on the one hand, and minimize the militants’ exposure and thus potential casualties in their ranks on the other.


Al-Baghdadi seeking to portray himself as a combat leader, successor of Osama bin Laden and Abu Musab al-Zarqawi

Al-Baghdadi himself makes an effort to bolster the image of the organization now being active as a guerilla group. Namely, al-Baghdadi is seen with an assault rifle and combat gear as if to imply that he is now a combat leader and not just a political and spiritual leader. Notably, the type of rifle, an AKS-74U, is the exact same model traditionally seen with Osama bin Laden, founder of al-Qaeda, and Abu Musab al-Zarqawi, leader of the group that preceded IS, indicating that al-Baghdadi is also trying to draw a parallel between himself and the two revered jihadist leaders. Another important factor is that the room in which al-Baghdadi is sitting is covered entirely by white sheets. This is based on tradecraft adopted by Osama bin Laden and meant to protect operational security (OPSEC) and prevent giving out any clues that could be used to geolocate the area in which he is staying, thus fortifying that the group is now operating covertly and underground, as opposed to the recent past when it was operating more overtly and as a state-like and military-like entity.

Al-Baghdadi (left) Osama bin Laden (center) and al-Zarqawi (right) with the same firearm and a sheet covering their surroundings

Al-Baghdadi highlights role in countries other than Iraq and Syria to project image of global success and encourage bolstering activity there

Most of the regions referred to by name by al-Baghdadi in the video, aside for Baghouz, are areas outside of the “core territory” of IS in Syria and Iraq. This includes the aforementioned references to Sri Lanka, Libya, and Saudi Arabia, but also congratulating the “brothers from Burkina Faso and Mali for joining the Caliphate”, as well as welcoming the groups in Khorasan (Afghanistan-Pakistan-Iran) who joined the “Mujahideen”. This is meant to project a sense that, despite the loss of its core territory, IS is continuing to grow and is successful in other regions around the world.

This point is also highlighted by the fact that the only seemingly living person al-Baghdadi names throughout the video is Adnan Abu al-Walid al-Sahraoui, leader of the Islamic State in the Greater Sahara (ISGS), which has merged with the Islamic State’s West Africa Province (ISWAP) in recent months. In addition to the gesture showing great respect to al-Sahraoui and bolstering the image of Africa and its importance to IS, there are two other important factors. First, that al-Baghdadi is trying to dispel the persistent rumors that al-Sahraoui has been killed by stating “we ask Allah that he may protect…our brother Aba al-Walid al-Sahraoui”, implying that he is still aliveSecond, that it comes amid other persistent rumors that the leader of ISWAP, Abu Musab al-Barnawi, has been relieved from leadership of the group. Taken together with ISGS merging with and possibly coming under ISWAP, this may serve as an indication that al-Sahraoui is now the leader of ISWAP, though this still remains unclear.

Since al-Baghdadi realizes that it will be difficult to rebuild his forces in Syria and Iraq in the coming months and possibly years, he wants to bolster IS’s strength in other parts of the world, something that has been evident for months as the group has been calling on its supporters to make “Hijra” (religious immigration) to countries other than Iraq and Syria. To serve this purpose, al-Baghdadi has to emphasize the importance of these other countries in order to attract more supporters to go there, as they are often perceived as less desirable destinations for jihad.

 Video hints at current organizational structure to underscore global outreach

The video concludes by al-Baghdadi reviewing 12 notebooks with the names of IS affiliates. These are, by order, Wilayat Iraq, Wilayat al-Sham (Syria), Wilayat Khorasan (Afghanistan-Pakistan-Iran), Wilayat West Africa, Wilayat Sinai, Wilayat Libya, Wilayat Somalia, Wilayat Yemen, Wilayat Central Africa, Wilayat Caucasus, Tunisia, and Wilayat Turkey.

In IS’s terminology, “Wilaya” is a reference to a region in which a direct local affiliate purportedly has any of the following or a combination of them: territorial control, control over a population and at least a basic governmental structure. In this context, the fact that Tunisia did not have the Wilayat prefix (as has been the norm in IS claims thus far) is further indication that IS does not presume to have any of the above in the country, and that in their view Tunisia is currently strictly an area of attacks. Additionally, this is the first time an official reference was ever made to a “Wilayat Turkey”, whereas in IS attacks in the country, the last officially claimed one being the attack against a nightclub in Istanbul on New Years 2017, it was referred to only as “Turkey”. Despite the lack of overt IS offensive activity in Turkey, there is widespread logistical activity by the group in the country, with this gesture by al-Baghdadi denoting the strategic significance the country maintains in the group’s structure.

al-Baghdadi reviewing a notebook titled “Wilayat Turkey”

There are two other notebooks left at the feet of the companions, however their titles are not visible. At least three known IS affiliates: East Asia, Algeria, and (mainland) Egypt were missing from al-Baghdadi’s review. It is possible that any of the two, with East Asia being the highest likelihood given its overall success, are the two notebooks left by the companions, and that at least one of the two others are officially considered disbanded by the central leadership, most likely Algeria given its inactivity in recent years. That being said, it cannot be ruled out that the two other notebooks are of different regions that IS is trying to maintain a secret and therefore are not exposed.

Overall, the point of this staged scene is twofold. First, to underscore IS’s global operations and presence, and second, to project an image that the group still maintains a centralized command structure in which sub-organizations conduct operations in their regions but all report back and fall under the direct command of al-Baghdadi.

IS attack against Tazirbu police station on November 23 indicative of increase in militant group’s ranks, capabilities in Libya – Libya Analysis

Executive Summary

The modus operandi of the November 23 attack against the Tazirbu police station is very similar to the October 28-29 Islamic State (IS)-claimed attack against a police station in al-Fuqaha, Jufra District. The scale of these attacks, combined with the short time span within which they occurred make them highly noteworthy.

This shift in IS strategy from localized small-scale attacks across Libyan territory towards more focused large-scale attacks against towns in southern Libya, which witness lower security presence, indicates that the militant group has to some degree managed to reinforce its ranks as well as rebuild its capabilities over the past year.

Similar to the al-Fuqaha attack, IS militants kidnapped ten people, including government officials and security personnel from Tazirbu. IS’ increased focus on kidnappings can be attributed to its interest in using the abductees as bargaining chips for ransom. This would allow the group to replenish its revenues, purchase supplies and weaponry, and ramp up its operations in Libya.

We advised against all travel to the southern outlying areas of Libya at this time due to the general lack of governance and security protocols in this region, which makes it conducive for militant activity and attractive targets for attacks.

Current Situation

According to reports, suspected IS militants aboard ten armed vehicles launched an attack targeting a police station in Tazirbu, located in the Kufra District, during the night hours of November 23.
At least nine civilians and policemen were killed, and 15 were wounded as a result of the attack.
Reports further indicate that the militants kidnapped at least ten people, including the Mayor of Tazirbu and a member of the municipal council, and fled the scene.
The Libyan National Army (LNA) has diverted forces from other parts of Kufra District towards the town of Tazirbu to secure it.

Assessments & Forecast

The modus operandi, target, and location of the attack suggest that it was carried out by IS militants. The Sunni jihadist militant group recently conducted a very similar attack against the al-Fuqaha police station, located in the Jufra District, during the overnight hours of October 28-29. The scale of these two attacks, along with the short time span within which they occured make them highly noteworthy. In the time period between IS’ complete loss of territories in Libya in December 2016 and October 2018, the majority of the militant group’s attacks had been relatively small-scale as well as spread out over a long period of time and territory. The majority of these attacks utilized suicide vehicle-borne IEDs (SVBIEDs) against security checkpoints or small-scale raids against police stations. For instance, the July 24 raid against the al-Uqaylah police station killed two LNA soldiers and wounded three others, while the June 2 raid against the al-Qunan police station killed one civilian and wounded five others.

Over the past year, IS was likely operating in groups of 10-12 fighters in the country. This allowed its militants to avoid attracting security forces’ attention and move relatively undetected across a larger swathe of territory. The lack of sufficient personnel and weaponry may have compelled IS to operate in this manner, which, in turn, had an impact upon their ability to launch larger-scale attacks. The recent attacks in al-Fuqaha and Tazirbu may indicate that IS has managed to bolster its ranks, partly through militants fleeing the group’s territorial losses in Syria and Iraq and partly through new recruits who now consider Libya as a more attractive arena. This has allowed IS to concentrate its forces towards launching larger-scale attacks against entire towns, rather than just security checkpoints or isolated government infrastructure, for example, in Tripoli in May and September as well as in Misrata in October 2017.

While, on the one hand, this indicates that IS has managed to rebuild its capabilities in Libya to some degree since its loss of territories to Misrata forces in December 2016, the location of the recent attacks suggest that these capabilities are still limited. Although al-Fuqaha and Tazirbu are both located within LNA-held territories, the towns witness relatively lower security presence as compared to areas located further north in the Sirte Basin and the Oil Crescent. The security forces of southern towns are largely comprised of local militias, who maintain small armed fighting units that are neither well-equipped nor well-trained. Therefore, it is possible that IS decided to focus its efforts in southern Libya, as this would increase the militant group’s chances of success.

As witnessed in the attack on the al-Fuqaha police station, the focus on conducting kidnapping of government officials and security forces stands out in the recent incident. Unconfirmed reports from November 10 indicated that IS is seeking to negotiate the release of four out of the ten hostages abducted in the attack on al-Fuqaha. If confirmed, this would suggest that through such kidnappings-for-ransom, the Sunni jihadist militant group is aiming to replenish its revenues, which, in turn, would allow it to purchase supplies and weaponry to ramp up its operations in Libya. This would also explain the recent kidnapping of the Mayor of Tazirbu, who by the prerogative of his position within society would demand a higher ransom. Aside from the ransom, such an abduction allows IS to project the Libyan authorities as incapable of securing its own civilians, thereby allowing the group to showcase its relatively higher capabilities.
FORECAST: IS will claim responsibility for the attack over the coming hours, as its scale will allow the militant group to significantly raise its profile in Libya. Meanwhile, the LNA will divert forces towards Tazirbu in order to secure the town over the coming hours and days. It will increase security protocols in Kufra District, which may include increased security checkpoints along main roads. The LNA may also tighten security along Libya’s southern borders with Sudan and Chad, as the porosity of these borders allows militant organizations to engage in the cross-border movement of fighters, supplies, and weaponry. While this may facilitate LNA forces in gathering vital intelligence and intercepting IS convoys, it will also provide the militant group with additional targets for attacks. On a more strategic level, the UN-backed Government of National Accord (GNA) may utilize this attack to highlight the LNA’s inability to secure its held territories and attempt to leverage this in its political negotiations with the latter.


It is advised to defer all travel to Tripoli and Benghazi at this time due to ongoing violence, threats against foreigners, and the risk of a broad deterioration of security conditions. We advise at this time that those remaining in Tripoli and Benghazi should initiate contingency and emergency evacuation plans due to deterioration in the security situation. Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support plans.

For those remaining in Tripoli, we advise to avoid nonessential travel to the outskirts of the city, particularly the Janzour and Tajoura neighborhoods, as well as to the Mitiga and Tripoli International Airports, given that these are focal points of ground clashes in the city.

Avoid the immediate vicinity of government buildings, police stations, media outlet offices, and political party and militia headquarters, given that these locales have been targeted by militia groups in the past and recently by militants, and thus remain at increased risk for violence and unrest.

We advised against all travel to the southern outlying areas of Libya at this time due to the general lack of governance and security protocols in this region, which makes it conducive for militant activity and attractive targets for attacks.

Westerners, particularly US citizens, operating in Libya are advised to maintain a low profile and exercise heightened vigilance in light of prevailing anti-Western sentiment and increasing attacks against foreigners.

Nationwide, take precautions to mitigate the risk of being targeted for kidnapping. Refrain from traveling in luxury vehicles and maintain a generally low profile. Routinely alter travel routes and refrain from divulging sensitive itinerary information to strangers.

Barcelona stabbing, one year after La Rambla attack, underscores continuing link between psychological instability and militant style attacks – Spain Analysis

Current Situation

On August 20, around 05:00 (local time), an individual armed with a knife reportedly attempted to enter a police station in Cornella de Llobregat, Barcelona and attack personnel, while shouting “Allahu Akbar”, before being shot dead. Reports indicate that the attacker was of Algerian origin and had lived in the area for several years.

The incident is reportedly being treated as a militant attack by authorities. However, police have claimed that they have no reason to believe that there are any direct links to major militant networks or that the assailant was connected to the cell that carried out the Barcelona attacks one year earlier. In addition, the testimony of his ex-wife indicated that the attacker had recently come out as homosexual, and was reportedly experiencing serious psychological instability and was suicidal due to confusion over how this could fit in with his Muslim faith. Some sources within the investigation have claimed that they do not believe the attack to be linked to jihad.

On August 16, a pro-Islamic State (IS) group published a poster on social media calling for attacks targeting police in Spain in both English and Spanish.

Click here to see Map Legend 


The August 20 attack is the latest in a series of violent or militant-related incidents involving North Africans or individuals of North African origins in south and south-west Europe over the past year.

In addition, on July 22, a 29-year old Canadian national of Pakistani origin, Faisal Hussain, killed two and injured three in a shooting in Greektown, Toronto. Hussain was allegedly also known to have had a history of psychological instability and had reportedly expressed concerns about his employment and financial situation to a friend prior to the incident. On July 25, the Islamic State (IS)-linked media outlet, al Amaq, reported that the attack was carried out by a soldier of the Caliphate in response to their call to target citizens of coalition nations.


Attack on police station underscores growing trend of violence copying Islamic State methods among psychologically unstable Muslim males

Despite claims that the attacker had a number of problems in his personal life, the possibility of links to wider militant trends cannot be ruled out. On the contrary, the fact that the attacker shouted “Allahu Akbar” and carried out the attack on the specific target that pro-IS groups had called for four days prior indicates that, even though he was likely not linked to any established militant cell, broader ideas of jihad informed part of his motivation. That is to say, while he may not have been looking to aid the goals of the Islamic State or avenge the deaths of Muslims, it is likely that, within his psychological instability, when thoughts of suicide arose, the concept of carrying out a jihadist attack was seen as a viable method. Possibly copying previous ‘suicide by cop’ attacks, in which the perpetrator intends to be killed by security forces. This assessment is further bolstered by the reports that his confusion over homosexuality was, in part, caused by an uncertainty about how it fit in with Islam.

With this in mind, the incident comes amid a continuing trend of psychologically unstable individuals, most of whom are migrants who adhere to the Muslim faith, carrying out attacks that mimic IS-inspired lone wolf incidents. Such attacks tend to be conducted by young males with mental health issues, who are, in part, influenced by the concept of jihadist militancy as a form of anti-establishment violence that has entered the West’s collective consciousness. Psychologically unstable individuals, and immigrants who perceive themselves to be disenfranchised and socially isolated from their community, whether it’s the Muslim or wider community, are copying IS-methods of attacks. In this sense, the media coverage of the various IS shootings and the general global trend of young men using mass violence as an outlet for frustration and disenfranchisement have merged.

Regardless of the psychological issues of the attacker, the fact that the incident came following the call from pro-IS groups means that online jihadist communities, and even Islamic State-linked media organizations, are likely to attribute the event to part of their ideology and larger plan. This is especially the case given the timing of the incident around the anniversary of the August 2017 attacks in Barcelona and Cambrils. In turn, this will perpetuate the aforementioned trend merging psychological instability and attacks that appear to be militant in nature.

Finally, the August 20 attack in Barcelona constitutes the latest in an ongoing trend of incidents related to violent attacks linked to Islamism from within the local North African community in north-eastern Spain and southern France. IS and IS-linked operatives have put a particular emphasis on recruiting in the region, due to the fertile ground for radicalization born from the feelings of disenfranchisement in both the established North African community and among North African migrants. These sentiments, which come partly due to perceptions of otherness within Spanish society and partly due to pressures put on from the local community, have the potential to lead young men towards violence, sometimes personally and sometimes linked to a militant organization.


Travel to Spain can continue while maintaining vigilance, due to the elevated threat of militancy.

IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers – Tajikistan Alert

Please be advised

The Islamic State (IS) claimed a car ramming and stabbing attack that resulted in the deaths of four Western tourists in Danghara District, approximately 90 km south of Dushanbe. Meanwhile, Islamic State (IS)-linked Amaq News Agency reported on July 30, that “soldiers of the caliphate” conducted the attack in response to calls to target citizens of coalition countries.

IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers - Tajikistan Alert | MAX Security

IS claims killing of Western nationals in July 29 armed attack in Khatlon Province; likely involvement of sympathizers - Tajikistan Alert | MAX Security
Click here to see Map Legend 


While over 1,000 Tajik citizens are believed to have traveled to Syria and Iraq to join IS, the July 31 claim appears to be the first such acknowledgment by the group of an attack within Tajik boundaries and is therefore notable. The extent to which the operation was guided by the IS leadership in Syria and Iraq remains unclear at this juncture.

At present, it appears more likely that the attack was conducted by radicalized individuals that were inspired by IS rather than trained operatives of the group itself. This is indicated by the reference to targeting Coalition citizens in the Amaq report issued on July 30, which derives from a landmark statement by IS spokesperson Abu Muhammad al-Adnani in 2014, that called for sympathizers to perpetrate low-intensity attacks against individuals in nations comprising the military coalition against the IS.

The IS-linked media’s reference to “soldiers of the caliphate” further suggests that the perpetrators were likely self-radicalized, considering the use of such phrasing in previous attacks by individuals influenced by IS ideologies but possessing no evident links to IS functionaries. This is also consistent with the lack of sophistication of the attack, as well as the reported numbers of extremist sympathizers in the country leading from long-standing anti-Islamist government policies.


Travel to Tajikistan may continue at this time while adhering to standard security protocols given the latent threat of militancy, crime, and unrest.

Those operating or residing in Dushanbe are advised to maintain heightened vigilance due to the risk of crime and militancy while avoiding unsecured travel to the country’s rural districts such as Danghara.

We advise against nonessential travel to outlying areas in Tajikistan near the country’s borders with Afghanistan, given the threat of militant activity and criminality, including drug smuggling.reat of radicalization in Central Asia, read our in-depth report.

AQIM-OIB claims attack against National Guard patrol in Jendouba Governorate’s Ghardimaou on July 8 – Tunisia Alert

Please be advised

According to the Ministry of Interior (MoI), a group of militants killed six National Guardsmen in an ambush targeting two vehicles patrolling the Tunisian-Algerian border near Ain Soltane village, located in Jendouba Governorate’s Ghardimaou District, during the morning hours of July 8.

The militants reportedly detonated an IED against the patrol, which was then followed by gunfire against the National Guardsmen. The assailants reportedly fled the scene following the attack and are still at large.
The attack was later claimed by al-Qaeda in the Islamic Maghreb (AQIM)-affiliated Okba Ibn Nafaa Brigade (OIB). According to their statement, nine National Guardsmen, including an officer, were killed in the attack. The militants seized eight rifles, a handgun, and a machine gun before fleeing the scene of the attack.

According to reports, a man was arrested in Kairouan Governorate for expressing support for the AQIM-OIB claimed attack on July 9.

In addition, members of the security services of Beja staged a protest in front of the National Guard’s headquarters demanding that the Minister of Interior (MoI) support new legislation meant to protect servicemen on July 9.

Tunisia Alert (UPDATE): AQIM-OIB claims attack against National Guard patrol in Jendouba Governorate’s Ghardimaou on July 8; avoid all travel to area | MAX Security

Assessments & Forecast

The attack is highly notable since it is the largest militant attack on Tunisian soil since March 2016, when Islamic State (IS) militants infiltrated Medenine Governorate’s Ben Guerdane from Libya. This incident highlights the increased risk of militancy near Tunisia’s western borders with Algeria, with the latest attack in the area recorded on May 31, when security forces foiled an AQIM-OIB attack in Kasserine Governorate. Although, AQIM-OIB is known to maintain an operational base along the Tunisian-Algerian border, the majority of its attacks over the past year have been mainly focused in the southwest, namely Kasserine Governorate, rather than in Jendouba, which is located in the northwestern part of the country.

Furthermore, all of these attacks have been of a lower sophistication, mainly involving the use of landmines or shootings. However, the latest attack utilized a relatively more sophisticated modus operandi. The multi-pronged nature of attack highlights the militant group’s resilience to security forces’ ongoing operations in western Tunisia, as well as their fighters’ abilities to regroup in the aftermath of such operations. It is also indicative of their ability to plan and execute coordinated attacks in order to achieve maximum casualties.

The timing of the attack is further significant. It was likely conducted in response to several developments that undermine the group’s interests in the area. These developments include the recent heightened security protocols put in place by Tunisian security forces along the border area in coordination with their Algerian counterparts.

This has led to a decline in the militant group’s abilities to operate along the border area, as witnessed in February, when Tunisian security forces neutralized a leader of AQIM-OIB in Kasserine Governorate based on intelligence from the Algerian intelligence apparatus. The militant had reportedly been sent from Algeria to reorganize the Tunisian affiliate.

Security protocols along the western border have also hindered smuggling operations, which provide militant groups with supplies and revenue, and cement their codependence with local smugglers, as the latter also depends on these operations as a source of income. Mitigating these operations not only damages the militant group’s supply lines, but also erodes their influence over the local population, as its members inevitably seek other sources of income.

Therefore, the attack likely seeks to compel security forces to divert resources away from Kasserine Governorate, which is AQIM-OIB’s primary area of operations in the country, towards Jendouba Governorate. This will overstretch the resources at the disposal of the Tunisian security apparatus, thus allowing militants to operate more freely in the area.

The latest attack follows the June 3 IS-claimed attack against a gas pipeline near Kasserine Governorate’s Sbeitla. In light of the ongoing competition between IS and AQIM over weapons, supplies, and personnel in western Tunisia, it is highly likely that the latest attack was meant to be symbolic in nature. This would project AQIM-OIB as the more prominent Sunni jihadist group in the country, allowing it to attract supporters and recruits at the expense of IS.

FORECAST: In response, the Tunisian Armed Forces (TAF) will launch intensified counter-militancy operations in western Tunisia, including in Jendouba, Kef, and Kasserine governorates. These will likely include increased security patrols as well as artillery shelling against potential militant hideouts in the mountainous regions. Security protocols will also be elevated along the Algerian border in order to prevent militants from crossing into Algeria and evading arrests.

However, this increase in security presence may provide militants with additional targets, leading to further clashes between security personnel and militants. Moreover, the increase in AQIM-OIB activity may prompt IS to heighten operations in the country in the near term. Overall, given the continued entrenchment of militants in western Tunisia’s mountainous areas due to their demonstrated ability to adapt and evolve, further similar sporadic attacks are likely to take place in the coming weeks and months.


Travel to Tunis may continue while adhering to all security precautions regarding militancy and civil unrest. Those operating or residing in Tunisia are advised that we maintain operational capabilities in the country.

Contact us at [email protected] or +44 20-3540-0434 for itinerary and contingency support options.

Those operating or residing in Jendouba District on July 8 should avoid all travel to the Ghardimaou District in light of the anticipated counter-militancy operations following the attack, as well as the likelihood for further clashes in the area over the coming days.

Avoid all travel to the Kasserine, Kef, and Jendouba Governorates, in addition to all border areas, due to jihadist activity and military closures. Furthermore, avoid all travel to within 50 km from the border with Libya, due to the increased threat of attacks originating from Libya targeting Tunisian interests.


Recent spate of coordinated IS-linked attacks, new modus operandi in Surabaya exhibits increased operational capabilities of local cells – Indonesia Analysis

Executive Summary

IS-linked suicide attacks in Surabaya likely stem from active attempts by the JAD to offset leadership setbacks and mobilize sympathizers.

The coordinated nature of the attacks and use of an unprecedented modus operandi indicate increased operational capabilities of local jihadist cells.

Increased visibility of consecutive IS-linked incidents in Java within the same week may spur additional attacks by cells or lone-wolves in urban centers and elsewhere, including Jakarta and Bali.

Those operating or residing across Indonesia are advised to maintain heightened vigilance in the vicinity of government buildings, transportation hubs, iconic public areas, military bases, restaurants, high-value soft targets, shopping centers, and religious centers including mosques and churches, as they remain potential targets for militant attacks.

Indonesia Analysis: Recent spate of coordinated IS-linked attacks, new modus operandi in Surabaya exhibits increased operational capabilities of local cells | MAX Security

Friction Points | MAX Security

Current Situation

On May 14, a family of five individuals, arriving on two motorcycles, detonated their explosives outside the police headquarters in Surabaya, East Java. The attack was claimed by Islamic State (IS)-linked Amaq News Agency. On the same day, six militants part of Jamaah Ansharut Daulah (JAD), a local outfit affiliated to IS, were arrested in Surabaya and nearby Sidoarjo Regency. Two other suspects were killed in the raid, including the second-in-command of the Surabaya cell of the JAD.

A family of six, including three minors, carried out a series of coordinated suicide attacks involving the use of vehicles, at three churches in Surabaya on May 13. Both IS Central and Amaq News Agency claimed the attack. The adult male in the family was later identified as the leader of the JAD Surabaya cell. An explosion was also recorded in Sidoarjo Regency south of the city on the same day. A man, suspected to be a militant, his wife, and their son were found dead at the scene, while two other minors were rescued from the apartment alive.

A riot situation in a military detention center in Depok, which lies 16 km south of the capital city of Jakarta in western Java, was resolved on May 10 after high-risk militant detainees seized firearms from prison guards and killed five security personnel on May 8. IS Central claimed the prison attacks on May 8, while an IS-affiliated media agency released pictures from inside the facility on May 9. The founder of the JAD, Aman Abdurrahman, is incarcerated in the same prison. Two suspected militants of the JAD’s Bandung cell were killed on May 10 while traveling from Bandung to a detention facility in Depok, with the intent to aid rioting prisoners.

Between April 9 and 30, pro-IS social media groups released a host of propagandist material appearing to target Western institutions and practices.

On March 14, IS-linked media sources confirmed the death of Bahrumsyah, a top-ranked militant and recruiter hailing from Indonesia, in a mismanaged suicide attack in Syria on March 13. Meanwhile, on February 13, Abdurrahman was indicted for his role in the 2016 attacks in Jakarta. Zainal Anshori, head of the JAD, was sentenced to seven years in prison on February 12, over his plans to smuggle weapons from the southern Philippines.

Assessments & Forecast

Attacks likely planned ahead of time, tied to leadership setbacks incurred by JAD

We assess that the plots in Surabaya on May 13-14 were informed by a combination of factors. The time period between February and May has seen the indictment of JAD’s founder, the sentencing of its senior-most leader, as well as the death of an influential recruiter in Syria who was known to leverage his contacts within the IS leadership to recruit sympathizers and remotely organize plots through the JAD in Indonesia. Collectively, the developments represent a host of challenges to the senior leadership of the outfit, potentially impacting the morale of its cadre and ability to newly recruit radical elements. Thus, the attacks were likely driven by a desire to signal to authorities the negligible effect of leadership setbacks on the operational capabilities of local cells, to publicly undermine recent counter militancy efforts, and to boost the morale of existing sympathizers.

The attacks also appear to have been organized well ahead of time, a fact that is illustrated by the surge of pro-IS messaging in the month of April. The timing of the attacks, only days prior to Ramadan, further hints at this possibility. There is an observable, general uptick in jihadist plots across the world during this time period over perceptions that the heightened religiosity of Ramadan would offer greater spiritual rewards for those engaging in jihad against non-believers. The difficulty in assembling high-grade triacetone triperoxide (TATP) explosives, which were believed to have been used in the Surabaya church bombings, as well as the time needed to activate JAD sleeper cells without attracting scrutiny suggests the low likelihood of the attacks being organized in an ad-hoc manner.

In terms of planning, it is likely that the attacks were devised with assistance from Indonesian functionaries in Syria. The current incarceration of top JAD leaders within the country and precedent of previous high-profile plots being organized by Indonesian militants fighting in Syria suggests that this may have been the case. The May 13 claim by IS Central, only the second attribution of the kind in three years of IS-linked attacks in Indonesia, is a potential sign of increased overseas involvement in the attacks, as is the comparative high-degree of coordination per local context.

Change in modus operandi, coordinated nature of plots indicates increase in operational capabilities

The most notable feature of all three attacks in and around Surabaya is the unprecedented modus operandi of using cells consisting of whole families, including women and children. While relatives of militants have been known to detonate explosives to avoid being captured during security operations in Syria, and in Bangladesh, this marks the first use of family units to conduct offensive attacks.

This tactical shift, the relative success of which may signal an emerging trend, is likely connected to active efforts to increase the scale and tempo of militant attacks in the country. More specifically, using multiple suicide bombers serves to increase the effect of the planned explosion, while employing members of a family unit helps to avoid the cells from being identified as potential threats and makes security forces more reticent to engage in hostilities. The fact that the JAD sleeper cells remained undetected until after the attacks despite the strict vigilance of counter-militancy units points to the discretion offered by using a family-based suicide squad.

Attacks by local cells, low-intensity plots by sympathizers possible over increased activity, visibility

FORECAST: The developments in Depok, when taken alongside the Surabaya attacks, signal a period of significant activity for local jihadists, compounded by increased visibility aided in view of the IS Central claim for both the church bombings and the prison riot. The ongoing month of Ramadan allows individuals or groups to sustain this exposure by conducting attacks, highlighting the continued risk of militancy across the nation, and especially on Java, where there is a noted presence of JAD cells.

The recent attacks have generated a significant amount of momentum and media coverage for the JAD and other jihadist sympathizers in the country. The perceived successes of recent efforts will embolden militant handlers to maintain a pace of operations in Java for as long as their manpower can sustain. While there have been no reported instances of encounters in the capital as of this report, it is highly likely that militants observed traveling to Depok had been using Jakarta as a transport hub. The ability for such elements to reach the capital in the face of significant police deployments underscores the heightened potential for attacks in Jakarta over the coming days. Whereas the JAD traditionally targeted government installations in the past, the church bombings may indicate that civilian targets have also become desirable. In addition to Jakarta, the tourist hotspot of Bali would also be a high-priority target for the group in this scenario.

Islamic State linked news agency claims May 13,2018 attack | MAX Security


Travel to Jakarta may continue at this time while maintaining heightened vigilance throughout the city given the risk of militancy.

Those operating or residing across Indonesia are advised to maintain heightened vigilance in the vicinity of government buildings, transportation hubs, iconic public areas, military bases, restaurants, high-value soft targets, shopping centers, and religious centers including mosques and churches, as they remain potential targets for militant attacks.

Remain cognizant of your surroundings, including any suspicious behavior of individuals, which may include a person wearing winter clothing during warm weather and/or seemingly wandering around, as well as items that look out of place, such as bags or containers.

Immediately alert authorities of any suspicious behavior or items.

Ensure that places of stay are properly secured, alter travel routes, and avoid disclosing sensitive itinerary information to unknown individuals.

AQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ – Africa & MENA Alert

Executive Summary

During the overnight hours of May 8-9, al-Qaeda in the Islamic Maghreb (AQIM) issued a threat against Western, and particularly French, companies that operate in the area “from Libya to Mauritania”.

While the threat is not new but rather a reiteration of an existing and proven one, its release in the lead-up to the holy month of Ramadan is indication of a heightened risk of al-Qaeda attacks against Western companies and interests in North Africa and the Sahel region over the coming weeks.

Please be advised

During the overnight hours of May 8-9, the al-Andalus Foundation, the media wing of al-Qaeda in the Islamic Maghreb (AQIM), published a “Statement for French and Western Companies”.

In the statement, AQIM threatens to attack Western, and particularly French, companies that operate in the area “from Libya to Mauritania”.

The publication further states that “85 percent of the wealth in this region is controlled by the French, while the rest is in the hands of traitors” and that the “French occupation prevents the prosperity of the region and has corrupted society”.

The statement concluded by warning Muslims to stay away from Western companies’ sites for fear of being hurt by collateral damage in an attack.

AQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ - Africa & MENA Alert | MAX SecurityAQIM publishes statement late night on May 8 threatening ‘French, Western companies in area from Libya to Mauritania’ - Africa & MENA Alert | MAX Security

Assessments & Forecast

AQIM’s statement does not denote a new threat to Western operations and presence in Africa, but is rather a reiteration of its main strategy: driving Western influence away from what AQIM perceive as their areas of influence, with the intention of consolidating its control and later expanding it while facing diminished resistance. AQIM and organizations that are directly affiliated with it, such as Jamaat Nusratal-Islam Wal Muslimeen (JNIM), have conducted several high profile attacks as part of this strategy. These most notably include the March 2 attack against the French Embassy in Ouagadougou, Burkina Faso; the October 25, 2017 attack against a French firm in Soumpi, Mali; and the March 18, 2016 attack against the Krechba gas facility in Algeria that was jointly operated by an Algerian government-owned company, and Norwegian- and British-based companies.

This strategy is also the main reason for AQIM’s threat particularly addressing French companies, as the French-led “Operation Barkhane” in the Sahel in support of the G5 countries (Burkina Faso, Chad, Mali, Mauritania, and Niger) is currently the main threat to AQIM and its direct affiliates’ operations. This threat was recently exemplified by French operations on February 14 in Mali that resulted in the deaths of six JNIM leaders, including that of Hasan al-Ansari, co-founder of JNIM, later confirmed by the group itself. However, as noted in AQIM’s latest statement, the threat extends to all Western companies, all perceived as “crusaders” in AQIM’s narrative, which it would attack given the opportunity, as underscored by the March 2016 Krechba attack that targeted Algerian, Norwegian, and British firms. That most of the attacks thus far have been directed against French interests is largely due to the outsized French presence among potential targets in the region and France’s lead role in regional counter-militancy operations.

The references made to the negative impact of the French presence on the region’s economy and society underscores an inherent part of al-Qaeda’s strategy as a whole, and that of AQIM in particular. AQIM, unlike certain other jihadist groups such as the Islamic State (IS), is willing to be more flexible in the implementation of its religious ideology in order to not only gain the support of, but also embed themselves in the local population. Thus, by appealing to material interests such as the state of the economy and society, AQIM is seeking to create an image of “us against them”, rallying as much of the local population as possible in opposition to foreign influence. While this may boost recruitment for the group, this is not the main goal in this case, as al-Qaeda favors quality over quantity with its fighters. The goal is rather to enhance the group’s freedom of operation within the population, which it will utilize to launch attacks and, later, to go into hiding as well as to facilitate logistical support.

FORECAST: Currently, AQIM and its direct affiliates maintain a presence, either of offensive operations or for logistical support, in parts of Algeria, Tunisia, Libya, Mauritania, Mali, Burkina Faso, and Niger, putting these countries at a high risk, which also corresponds with the message threatening Western companies “from Libya to Mauritania”. Given the current strategy and deployment of the group, as well as precedent, we assess that of these countries Algeria, Mali, and Burkina Faso are at the highest risk. Nonetheless, this foothold could, depending on developments and the dynamics of the situation in the region, be exploited to launch attacks into neighboring countries if needed.

FORECAST: It is important to note that while AQIM’s threat is not new, but rather a reiteration of an existing and proven threat, it does come ahead of the holy month of Ramadan, currently slated to start on May 15. This period of the year historically is when jihadist groups attempt to increase their rate of operations and conduct more high profile and notable attacks, so as to capitalize on the symbolism of the holiday. Accordingly, it is possible that the timing of AQIM’s latest message was similarly motivated, thus highlighting the elevated potential for al-Qaeda attacks against Western interests in North Africa and the Sahel region over the coming weeks.


Western companies operating in the North Africa and Sahel regions are advised to evaluate security procedures pertaining to attacks against installations, and emphasize guideline to their staff.

Examine behavioral patterns of local employees on site to mitigate potential risks arising from influence by Jihadist propaganda.

Monitor MAX Intelligence’s reports, as well as local publications to remain abreast of the dynamics of the threat posed by Jihadist groups in your areas of operations. Potential indications of a change in the level of threat include the rate, scope and rhetoric of Jihadist publications and their attacks, changes in modus operandi, scale and sophistication of attacks, and changes to areas of operations and influence of different groups.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city – Russia Analysis

Please be advised

On May 6, the Islamic State (IS)-linked media group, al-Amaq, claimed that a shooting attack which took place in Nizhny Novgorod, western Russia, was committed by a ‘soldier’ of the Sunni-jihadist group. According to a statement from Russia’s Federal Security Service (FSB) on May 4, an assailant opened fire on police officers during an identity check and barricaded himself inside an apartment in the city. The statement indicated that the perpetrator was later neutralized by security forces.

From 14 June to 15 July 2018, Russia will host the FIFA World Cup in a number of cities, including in Nizhny Novgorod. In the run-up to the tournament, Russian security forces have carried out a large number of raids and arrests, looking to neutralize militant cells made up of both Central Asian migrants, mostly based in major cities, and North Caucasian militants, mostly from the Republics of Chechnya, Dagestan, and Ingushetia.

Since the beginning of 2018, at least 38 militant counter militancy raids have been recorded in Russia, the majority focusing on reportedly IS-linked militants. At least five of the raids occurred in or near World Cup cities, including Moscow, Nizhny Novgorod, and Rostov-on-Don.

On April 17, three suspected IS-linked militants were arrested near Rostov-on-Don by FSB agents. A number of reports suggested the possibility that the militants were embedded in the city to wait until the start of the World Cup and carry out an attack during the tournament.

Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city - Russia Analysis | MAX Security
Islamic State-linked media reports shooting attack in Nizhny Novgorod on May 6; first 2018 Islamist militant attack in World Cup host city | MAX Security

Click here to see Map Legend


The claim from IS and the reports from the FSB indicate the first case of a successful attack occurring in a World Cup host city in 2018. The most recent Islamist militant attack in one of the host cities was in St. Petersburg in mid-2017. The incident underscores previous assessments that militants, from both Caucasian and Central Asian origins, are looking to focus their operations on the World Cup, so as to maximize exposure during the tournament. In addition, the developments come following the publication IS’ official newsletter, Al-Naba, on May 4 which called on its supporters to conduct attacks across Russia, underscoring the group’s continued interest in projecting its militant capabilities in the country. This assessment gains further credence considering IS’ repeated threats to the World Cup.

While there is no indication as to the origin of the militant at the time of writing, there are three main possibilities, all of which have been previously recorded in Russia. In the event that the attacker was a lone-wolf Central Asian migrant, who was locally radicalized within Russia through online and on ground Islamist networks, the incident highlights that lone-wolves in major cities are heeding to IS’ demands to carry out attacks on World Cup cities, demonstrating the threat in any city with a significant Central Asian diaspora community. In the event that the militant had links to Caucasian militant cells, it highlights attempts by the Caucasian Emirate pro-IS group to embed radicals within major cities, prior to the tournament, who will then carry out attacks. This is likely designed to occur before security in the North Caucasus becomes overwhelming around the time of the World Cup. The third option is that the militant may have had connections with both Central Asian militant networks and Caucasian cells, which would constitute a significant threat as such an assailant would be able to utilize the covert nature of the loosely linked Central Asian networks and the expertise of the well established Caucasian groups.

Going forward, a significant increase in counter-militancy operations in major cities and the North Caucasus will occur in the run-up to the World Cup. Furthermore, the potential for both minor and major attacks in all host cities remains before and during the tournament, likely looking to specifically target stadiums and locales with international attention, so as to maximize exposure.


Travel to Russia may continue while maintaining vigilant given the elevated risk of militancy and crime, particularly in major cities and World Cup host cities. (Click for our special report on threats to the 2018 World Cup).

Remain cognizant of any suspicious individuals or items that look out of place. Immediately alert authorities if identified.

Avoid all nonessential travel to the North Caucasus region, given the high risk of militancy and kidnapping.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security – Spain Analysis


During the afternoon hours of August 17, Spain experienced its first Islamic State claimed attack as a van plowed 500 meters into a crowd of people on the busy La Rambla street in central Barcelona, leaving 13 people killed and over 100 injured. The incident was subsequently claimed by the Islamic State who wrote that it was carried out by “soldiers of the Caliphate in Spain” and was intended to kill “Crusaders and Jews”.

Afterwards, during the evening hours of August 17, police located a second van in the town of Vic (80 km from Barcelona), which was hired at the same time as the van used in the initial attack, and was suspected to be a getaway vehicle.

At around 01:00 (local time) on August 18, a second car ramming incident took place in the city of Cambrils, around 100km southwest of Barcelona, in which one person was killed and six others injured. The attackers attempted to flee the vehicle on foot, allegedly wearing fake suicide belts before all five were killed by police.

More importantly, however, were the events that took place during the evening hours of August 16, less than 24 hours before the first car ramming incident. At this time, a large explosion was recorded in a small house in Alcanar, 160 km southwest of Barcelona and approximately 300 km from Ripoll. A police report, which was later released indicated that the occupants had been preparing a TATP-based explosive device, despite the blast initially being dismissed as a gas leak. The house was reportedly filled with over 100 canisters of propane and butane. Furthermore, sources indicate that the device being prepared in the house may have been intended to target Barcelona’s famous Sagrada Familia church.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Click here to see Map Legend 

Building the Terror Cell

Current reports suggest that the individuals involved in the attack all came from the area around the town of Ripoll, around 90 km north of Barcelona. Particularly, it appears that Abdelbaki Es Satty was the imam in Ripoll and is believed to have been instrumental in the radicalization and encouragement of the other seven younger individuals in carrying out the attack. Es Satty had been the imam since 2015 in Ripoll; however, he allegedly left “abruptly” in June 2017, and is suspected of using the time to start planning a militant attack.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

From 2010-2014 Es Satty served a four-year prison sentence in El Castellon, for a series of drug trafficking charges. It was during this time that he met and became friends with Rachid Aglif, who is serving an 18-year sentence for his role in the 2004 Madrid Train Bombings. Es Satty was also implicated in an operation in which he was involved in recruiting five individuals attempting to travel to fight in Iraq in 2006.

Other than Es Satty, the cell itself was built of young men of Moroccan heritage between the ages of 17 and 24-years-old. Reports indicate that all of them were born in Morocco and came to Spain at various times, all spending time or living in the town of Ripoll, where the cell appears to have been formed. Apart from Es Satty, there is no evidence to suggest that the other cell members had criminal records and no reported relations to other known radicals or militant networks. That said, a number of the members were reported posting increasing material on social media which pertained to topics typically associated with Islamism, including posts which spoke about the death of “infidels”, and contained excerpts of anti-Semitism common among radical Muslims.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Assessments & Forecast

Attack underscores emerging threat of homegrown cells in Europe

This attack is notable for numerous reasons, as despite the eventual act seeming to fit within the general pattern of attacks types (i.e. vehicular ramming) witnessed in Europe over the past year, it had the potential to be one of, if not the, deadliest, most damaging, and symbolic militant attacks by any group in Europe in years.

In this context, the incident on La Rambla on August 17 was clearly not the initial plan of attack. The connection between the attackers and Imam Es Satty, who was killed in the Alcanar explosion, as well as the almost immediate action following the explosion paints a clear picture that the explosives in Alcanar were meant to be used by the cell in a spectacular attack, and that the two eventual incidents were taken as a “plan b” method. Indeed, the use of fake explosive belts are indicative of a degree of organizing such a “plan b” approach. Furthermore, it is likely, given the speed with which they were carried out following the explosion on August 16, that the car ramming attacks were expedited in an attempt by the cell to carry out an attack before police investigations into the explosion foiled their plans and led to their arrests.

More telling, however, is the nature of the cell involved and what it says about the evolution and variety of threats from such militants in Europe. Indeed, we have seen that attacks range from Islamic State and copycat-inspired “lone wolf” attacks to much more organized and planned attacks, at times involving instructions from a central organization, such as the case in the Bataclan attack in Paris and the Brussels Airport attack. It is also important to note, that the lone-wolf attacks in and of themselves can range in death toll from one or a few dead from a stabbing, to scores killed in the Orlando night club shooting or Nice vehicular attack, two of the deadliest, yet simpler attacks by IS supporters.

The recent London Bridge and Boroughs Market attack was a new evolution along the range of lone-wolf Jihadist spectrum, as it involved a group of lone wolves cooperating with one another to form a cell. While the structure and formation of the London attack is not entirely clear, it appears that those involved were self-radicalized but connected to one another either by their own volition, namely via Jihadist messaging channels or were introduced to one another through such a channel or otherwise. That said, these individuals do not appear to have been organized by a central body or particularly experienced individual.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

The attack in Barcelona, for its part, appears to fall into the category of a “Homegrown Cell”, which has been rare in recent years. The origin of a homegrown cell can vary significantly and can be constructed by one radical and charismatic figure acting alone, such an individual working on behalf of a known group, or by a radical Islamist who has a connection to a known group to one degree or another but was not instructed by them.

In the case of the Barcelona cell, Abdelbaki Es Satty was the likely facilitator and builder of the cell. His recruiting background portrays him as someone with an understanding of the process of identifying targets for potential recruitment and likely having the personality to influence others in such a way. Additionally, he likely developed a greater familiarity with various terrorist techniques and principles during through this relationship with Rachid Aglif. We assess that Aglif and the attack he was involved in, in which 192 people were killed, served as an inspiration for Satty.

Beyond that, it is unclear if he did have guidance or instructions from Islamic State although the speed by which Islamic State released the official claim of the attack, may indicate their prior knowledge of his plans.

What can we learn about the threat of homegrown Islamic State cells and their growing risk to European security - Spain Analysis | MAX Security

Homegrown cells allow for greater reach, more sophisticated, destructive attacks

While the individual “lone wolf” attack has the benefit of being much more challenging to predict and thwart, given that it involves only one individual and minimal planning, they are less likely to have as high of an impact as more organized attacks. Other than rare cases, such as Nice and Orlando, the majority of “lone wolf” attacks only involve a small number of casualties before the attacker is neutralized, even in the case of more advanced lone-wolf attacks, such as in London. On the other hand, while a cell composed of more trained and experienced Jihadists is able to carry out highly effective and destructive attacks, due to their expertise and manpower, the accumulation of many affiliated militants, in one area, alongside their communications and activities, is far more likely to arouse the suspicion of security forces and risk being thwarted.

In that regard, the Ripoll cell is an interesting balance in that it can balance the low-key nature of a lone wolf group with the greater planning and organization of a more advanced Jihadist cell. Islamic State can select known and trusted individuals online, or returning foreign fighters, and instruct them on the formation of a homegrown cell, and in some cases lend them material support or connect them with other experienced or useful individuals.

The Spanish cell was able to plan and almost execute what could have been one of the most significant European attacks, without being thwarted by security, because although they were many in number, their relationships seemed organic enough not to arouse suspicion and the fact that the more suspicious activity they did was conducted in a remote location and not in their home environment.  This allowed them to prepare a highly sophisticated attack plan, with multiple layers and back-ups, without outwardly appearing to be a militant cell.

Further attacks from similar cells should be expected across Europe

While the possibility of typical “lone wolf” attacks remains throughout the world, particularly in Europe and the West, the homegrown cell phenomenon is likely to become more common than previously witnessed. Given that IS have penetrated almost every country in Europe and have propaganda and media communications in most major languages it is likely that there are already similarly structured cells across the continent, built of local radicals bound together by online facilitators or one local IS-affiliate or even one individual who has a greater degree of exposure to Islamist methodologies. Additionally, as seen in the past, the “copycat effect” is likely to take hold, with similar cells conducting attacks in the coming months.

Furthermore, IS regularly encourages attacks throughout the continent and adjusts their instructions to the successes of previous attacks. In this context, it is highly likely that Islamic State, whether involved in the Barcelona attack or not, will learn from its successes and failures.

Thus, and as IS continues to lose territory in the Middle East, and tends to want to balance these losses with an appearance of being a global phenomenon, we assess that Islamic State may actively seek to ‘activate’ such cells in Europe. In this way, the organization will likely want to have more control over how, when, and where an attack will take place, and may currently be reaching out to foreign fighters who returned to Europe, or other connections they may have, in order to encourage them to build their own homegrown cells.

Furthermore, Islamic State will likely learn from the failure of being over ambitious. Es Satty likely looked up to Rachid Aglif and his involvement in the deadly Madrid attacks from 2004, and in seeking to match its casualty level, chose to develop an extremely large explosive device by a large number of terrorists rather than launching an attack earlier and at a lower capacity. With this, we expect that IS will encourage smaller attacks by smaller homegrown cells, but ones that have a far greater potential for success.


On the corporate level

We advise raising the awareness of employees and security personnel to unusual activity and behavior of fellow employees. Encourage your employees to report such observations whether at work or in their personal surroundings. Monitor local unusual developments in order to predict emerging threats in the vicinity of your interests, and follow the global terror trends and modi operandi, in order to adapt your security measures and preparations. Conduct surveys to check and evaluate the relevancy of your current security protocols.

On the institutional level

Additionally, identify the social groups and communities in your area that are more susceptible to radicalization, identify the leading individuals, and monitor their activities. Raise the public’s awareness regarding key indicators of unusual activity.

For more information about the terror threat in Europe and what you can do to be prepared, check out our white paper here. 

Why the July 7 large-scale attack by the Islamic State in North Sinai is likely an effort to challenge regional & local setbacks – Egypt Analysis

Current Situation

A large scale and multi-pronged attack by the Islamic State (IS), involving at least two suicide vehicle-borne IEDs (SVBIED) followed by a ground assault targeted a military checkpoint near the North Sinai village of al-Barth, located approximately 30km south of Rafah, during the morning hours of July 7. According to the Egyptian Armed Forces (EAAF) Spokesperson, 26 casualties were inflicted on the Egyptian military, including the killing of one Colonel, while at least 40 militants from the IS-affiliated Wilayat Sinai were killed and six of their vehicles destroyed in the attack.

Why the July 7 large-scale attack by the Islamic State in North Sinai is likely an effort to challenge regional & local setbacks - Egypt Analysis | MAX SecurityClick here to see Map Legend 

Assessments & Forecast

While attacks by Wilayat Sinai in North Sinai, particularly the triangle area between al-Arish, Rafah and Sheikh Zuweid which is the group’s main area of operation, are common, this recent attack is highly notable due to its large scale, sophistication, and reports that it resulted in heavy casualties on both sides. This is compared to the more frequent, near-daily attacks in the area that largely include small arms fire and IEDs, have a more limited effect, and result in smaller numbers of casualties. In this context, while Wilayat Sinai continues to conduct offensive operations in North Sinai at a high frequency, the scope and volume of its activities had significantly decreased in recent months. Furthermore, while previously the group had conducted attacks outside of its primary area of operations in North Sinai on a regular basis including several times of a month, the last such attack took place in South Sinai’s Saint Catherine’s Monastery on April 18-19, and before that in Mount Halal on March 23, highlighting a continued decrease.

Why the July 7 large-scale attack by the Islamic State in North Sinai is likely an effort to challenge regional & local setbacks - Egypt Analysis | MAX Security

As such, the reasons for the decline in Wilayat Sinai’s scope and volume of activities is likely the result of regional and local developments relating to the Sunni jihadist group. Regionally, as the central organization is continuing to face defeats in Syria and Iraq, it is likely facing more difficulties in lending an active support for its affiliate in North Sinai. Locally, following the October 14, 2016, Wilayat Sinai’s attack on the Zakdan Checkpoint, Egyptian security forces had changed their strategy regarding counter-militancy operations in North Sinai. This entailed a change of focus away from combating the militant group at its “front lines” in the primary area of operations, which did result in killing militants but not in a substantial effect on the group’s overall capabilities. Instead, the focus was turned to the group’s logistic infrastructure such as tunnels, smuggling routes and hideouts and weapons caches in the Central Sinai mountains, which created a more long-term damage and one that is harder to recover from.

Additionally, the attack comes amidst rapprochement talks between the Egyptian government and the Gaza-based Hamas organization, which also include the creation of a buffer zone between Gaza and North Sinai, thus further challenging cross-border activity which benefits Wilayat Sinai and friendly Gaza based-Salafi organizations which are opposed to Hamas. Furthermore, following April 17 when IS prevented a cigarette smuggling operation by members of the Tarabin Tribe, one of the peninsula’s largest and most powerful tribes, parts of the Tarabin tribe, along with later members of the Sawarka Tribe, initiated operations against the militant group, both in their own independent militias, as well as in support of the EAAF. This has likely caused damage to Wilayat Sinai, as it heavily relies on the local population in the region to ensure its freedom of operation.

As such, while the recent attack serves as an indication that Wilayat Sinai still retains significant capabilities that allows it the mount such a large-scale operation, the attack was likely motivated by the aforementioned hardships the group is facing, regionally and locally, and may be the result of perceived despair. In this context, by conducting such a high-profile attack, the group likely seeks to highlight that it is still a viable threat. Moreover, it likely seeks to hinder and deter further counter-militancy operations in North Sinai, by leveraging the civilian population to pressure the government that the investment in North Sinai is not worth the high numbers of casualties caused by it.

If this strategy succeeds, it may allow Wilayat Sinai to at least partially rehabilitate its lost infrastructure and freedom of operation, however at the time of writing, it has low likelihoods of success. FORECAST: Taken as a whole, additional frequent limited-scale attacks by Wilayat Sinai are liable to occur in the al-Arish-Sheikh Zuweid-Rafah triangle area over the coming days and weeks, along with possible larger scale and higher profile attacks in this and other areas in the Sinai Peninsula, however at a significantly reduced rate. Furthermore, Egyptian authorities will likely increase their operations in North Sinai over the coming hours and days, to retaliate against the attack and portray an image to its citizenry that they were able to significantly damage the militant group, thus offsetting any arguments against operations in the peninsula.


Travel to Cairo and Alexandria may continue while adhering to all security precautions regarding militancy and civil unrest. Consult with us for itinerary-based travel recommendations. Avoid all travel to the North Sinai Governorate and border areas with Libya, Sudan, and Israel due to the persistent risk of militant attacks, kidnappings, and general lawlessness.

We further advise to avoid nonessential travel to the Southern Sinai Peninsula, while maintaining heightened vigilance in the Suez Canal Zone, the Upper Nile area, and the Nile Delta region due to an increased risk of unrest and the heightened risk of militant attacks. Before traveling to Sharm al-Sheikh, confirm that flight operations are continuing and have not been impacted by recent militant threats. As a general security precaution, remain vigilant in areas surrounding and avoid the immediate vicinity of government installations, police stations, and religious centers, particularly churches, as these locations remain under elevated threat of militant attacks. When traveling in central squares, or in areas with persistent police deployments, avoid the immediate vicinity of security forces, particularly fixed traffic booths, as such personnel and facilities have increasingly come under attack by militant elements.


Read more posts like this in Max security blog