The Islamic State’s Global Long Game and Resurgence in Syria Poses an Evolved Threat to the West
Liam Karr and Brian Carter are the authors. Key Takeaway: The Islamic State has evolved and expanded globally since the territorial defeat of IS in Iraq and Syria in 2019, enabling the organization to continue to orchestrate and inspire attacks on the West. Key nodes in IS’s external attack network, the IS Turkey Province and the IS Khorasan Province, both based in Afghanistan, have repeatedly demonstrated their ability to coordinate attacks outside of their primary operational areas. IS has taken advantage of weak states and poor governance in Africa to establish growing affiliates that control territory, support the IS global network, and bolster IS propaganda narratives. IS in Iraq and Syria (ISIS) is now resurging in Syria after a years-long campaign to reconstitute itself. Recent shifts in the international counterterrorism posture in Syria and Africa risk creating security vacuums that IS can exploit to strengthen further. More lone wolf attackers will be inspired by IS’s growing strength, which will result in more external attack plans against the West. Since the organization’s territorial defeat in Iraq and Syria in 2019 and its subsequent global expansion, the Islamic State is able to continue orchestrating and inspiring attacks on the West. ISIS lost control of 95 percent of the territory that it seized between 2014 and 2017 and lost control of its final territories in Iraq and Syria in 2017 and 2019, respectively.[ 1] IS has continued to expand across the globe since 2019, however. IS claimed its first attacks in the DRC and Mozambique in 2019 under the newly-founded IS Central Africa Province (ISCAP).[ 2] IS also recognized smaller and less active provinces in India, Pakistan, and Turkey in 2019.[ 3] In 2022, IS finally made IS-Mozambique a separate province from ISCAP, which is based in the Democratic Republic of the Congo. 4] IS also formally recognized IS Sahel Province as distinct from the Nigeria-based Islamic State West Africa Province in 2022.[ 5]
Since the demise of its Middle Eastern territorial statelet, IS has substantially reorganized its General Directorate of Provinces, which was formerly known as the Administration of Distant Provinces until 2020.[ 6] The directorate provides operational guidance and coordinates funding to all of IS’s global affiliates, plays a central role in external attack operations, and oversees internal administrative high-level affairs within provinces.[ 7] IS created regional offices (Maktab)to oversee this support across its various provincial affiliates and its traditional core territories in Iraq and Syria around 2019.[ 8] This decentralized system helps coordinate financing, directives, and other support between the group’s personnel in local theaters, the global IS network, and central IS leadership despite IS’s weakened position in the Middle East.[ 9]
Figure 1. Overview of the structure of ADP and GDP IS’s Khorasan Province and Turkey Province, both based in Afghanistan, are crucial nodes in the organization’s external attack network and have repeatedly demonstrated their ability to coordinate attacks outside of their primary operational areas. IS Khorasan Province (ISKP) and IS Turkey Province have made crucial contributions to several IS attack plots in 2023 and 2024.[ 10] Successful attacks include a July 2023 suicide bombing in Pakistan that killed at least 63 people, the January 2024 bombings in Kerman, Iran, that killed 94 people, and the March 2024 Crocus City Hall attack in Moscow, Russia, that killed 145 people.[ 11] In 2024, analysts and security officials predicted an increased risk of IS plots against the West, and European security forces have stopped several attack networks with connections to ISKP and Turkey. 12]
In spite of the Afghan Taliban’s pressure to combat terrorism, ISKP has relied on online recruitment and guidance to carry out external attacks.[ 13] ISKP attacks in its core areas of operation in Afghanistan have steadily decreased in the face of this pressure since the Taliban took control in 2021.[ 14] ISKP’s online methods differ from the historical modus operandi of Salafi-jihadi attackers traveling abroad to train before returning to their home country to carry out an attack.[ 15]
IS Turkey Province functions as a key facilitation node in external attack plotting. Prior to their attacks, several IS militants associated with plots in Germany and Russia traveled to Turkey. 16] In January 2024, IS Turkey Province claimed direct responsibility for a small-arms attack on a Catholic church in Turkey.[ 17] The fact that IS claimed the attack for the first time in Turkey since 2017 suggests that the group has some local attack capabilities. The fact that IS Turkey Province is also involved in financing and smuggling schemes that support IS’s external operations is evidenced by US sanctions against IS networks in Turkey. In comparison to the majority of other IS affiliates, ISSP, ISWAP, and, to a lesser extent, ISCAP, ISMP, and ISS control and govern more territory in their respective operational areas. For example, ISSP and ISWAP systematically levy taxes, enforce strict shari’a law, and otherwise control local economies and populations in parts of West Africa.[ 21] The other IS African affiliates attempt to proselytize local communities and carry out these activities less frequently. 22]
ISS and ISWAP play critical roles in IS’s global administrative network. Al Karrar, the IS office in East Africa, is hosted by ISS, and al Furqan, the IS office in West Africa, is hosted by ISWAP. The al Karrar office oversees ISCAP, ISM, ISS, and IS cells in South Africa. ISS invests the hundreds of thousands of dollars that it generates every month through extortion rackets in the port of Bossaso in northern Somalia back into the IS network through the al Karrar office.[ 23] The al Karrar office has sent trainers and some of its funds to ISCAP and ISM.[ 24] This support has likely contributed to the growing capabilities of both groups since their founding.
Since ISSP’s expansion in 2022 and 2023, the al Furqan office has sent funds, fighters, and direction from ISWAP territories to ISSP. According to a June 2024 UN report, at the direction of IS core leadership, ISWAP established facilitation cells and networks in northwest Nigeria to move fighters, fuel, and equipment to support ISSP operations. 25] Field researcher Vincent Foucher reported that ISWAP defectors previously claimed that ISWAP and ISSP sent cadres back and forth to each other, and IS supporters claimed that ISWAP fighters traveled to Mali to support an ISSP offensive against al Qaeda’s Sahelian affiliate in 2022.[
In addition, Africa has emerged as a transit point between Africa and the Middle East and a haven for senior IS leadership. US officials said in 2024 that IS had elevated ISS Emir Abdulqadir Mumin to become IS’s “global leader.”[ 27] According to CTP and a number of analysts, Mumin is probably in charge of GDP, not the official IS caliph. 28] A claim made by Middle East Institute scholar Guled Wiliq that the alleged IS caliph Abu Hafs al Hashemi al Qurayshi arrived in Somalia in June 2024 was unsubstantiated was reported by Voice of America. 29] Nigeria-based open-source reporting network Zagazola claimed in January 2024 that the IS Shura Council was considering setting up a base for core leadership in Niger.[ 30] The CTP is unable to verify either claim, and such relocations run the risk of undermining IS’s legitimacy by effectively admitting defeat, if only for a short time, in the Middle East, its historical and religious heartland. Through the Global Directorate of Provinces, IS’s African affiliates contribute to external plots and increase the likelihood of lone wolf attacks by bolstering IS propaganda narratives. The United Nations and the United States have confirmed that the al Karrar office transferred funds to ISKP through South African agents. 31] Swedish police have disrupted multiple attack and recruitment cells linked to ISS, and the former ISS emir’s alleged role as the GDP head would further connect ISS to external attack planning.[ 32] The ISS also houses a lot of foreign fighters, which makes it more likely that plans for an external attack will be made. 33] Many foreign fighters are hardened ideologues who adhere to transnational Salafi-jihadism and demonstrate an interest in returning to their countries of origin to organize attack plots after being further radicalized in an active conflict theater.[ 34] IS Sahel Province has set up facilitation networks between Europe and the Sahel to move foreign fighters, and Spain disrupted an IS cell based in of Morocco and Spain in 2021 that had links to IS Sahel Province, ISKP, ISIS, and IS cells in Europe.[ 35]
IS’s African affiliates support IS propaganda that inspires and radicalizes lone-wolf attackers.[ Since 2023, IS affiliates in Africa have claimed more attacks annually than all other IS provinces combined. 37] IS’s African affiliates accounted for nearly 70 percent of all IS-claimed attacks in 2024 and 64 percent of all IS-claimed casualties according to the Washington Institute scholar Aaron Zelin’s Islamic State Worldwide Activity Map.[ 38] IS media features on its African affiliates also highlight governance and religious efforts[39] This propaganda activity is critical to the Islamic State’s legitimacy as a governing power. IS media covers this activity to demonstrate its persisting strength around the globe despite the fact that it no longer controls a territorial caliphate in the Middle East.
ISIS is now resurging in Syria after a years-long campaign to reconstitute itself. ISIS has gradually rebuilt its capabilities since 2022 in the central Syrian desert—where regime forces infrequently and ineffectively patrolled—and gradually infiltrated then-regime-held towns along the Euphrates River.[ 41] Neither the Assad regime nor Russian forc
The Islamic State’s Global Long Game and Resurgence in Syria Poses an Evolved Threat to the West
