Return to main page
Signal Reports ISIS
ISIS

ISIS Reorganization: Probing Activity Across Syria, Iraq and Saudi Arabia

Report 3 min read
SyriaSaudi ArabiaIraqISIS

Background

Signals monitoring over recent months points to a rise in ISIS reorganization across the Levant and the Arabian Peninsula. Cells have been probing the security posture of Syria, Iraq and Saudi Arabia, testing response times and gaps in coverage. In Saudi Arabia the activity has been limited, with only three minor incidents recorded. In Syria, the attribution of "unknown gunmen" used by some outlets fits the pattern of low-signature attacks that avoid claiming responsibility.

The assessment for the next six months is a more concerning increase in both reorganization and attacks.

Development

Reduced Intelligence Pressure

The reported US drawdown from Iraq and Syria, combined with Syria's removal from the US state sponsors of terrorism list, lowers the priority of the region for the intelligence agencies best equipped to dismantle ISIS networks. Fewer assets and less collection mean fewer disruptions to cells that are rebuilding.

Iraq: Al-Anbar and Nineveh

Al-Anbar is assessed to be slowly "mined" with vehicle-borne and conventional improvised explosive devices, while cells study the terrain. Cells in Nineveh have their attention on the Al-Hawl detention camp, which holds a large population of ISIS-linked detainees and remains a high-value target for any group seeking to rebuild manpower.

Infiltration of State Forces

Signals indicate that ISIS fighters are already present within the current government's military. Some of them are assessed to have used the pro-Palestine movement as cover to coordinate and identify one another faster. The same individuals have purchased drones and used their positions inside the military to learn how to operate them effectively and strategically.

Analysis: The Insider Model

The pattern is consistent with what JNIM has been planning against the Malian Armed Forces (FAMa), documented in a separate report.
ℹ INFO — "JNIM and the "Trojan Horse" Threat to the Malian Armed Forces"

In both cases the group does not need to defeat the state's forces from outside. It places members inside them, where they gain training, access, knowledge of procedures and freedom of movement.

This approach carries several advantages for a degraded organization:
  • Training and equipment are obtained from the state itself.
  • Insiders learn internal routines, communication habits and response patterns.
  • Membership is hard to detect because the cover is legitimate.
  • Drone skills acquired in service transfer directly to cell operations.

Implications

The main risk over the next six months is not a single large offensive but a gradual accumulation of capability: mapped terrain, trained operators, drones and prepositioned explosives, built under reduced external monitoring. Attacks attributed to "unknown gunmen" are likely to remain the dominant signature, as they obscure responsibility and complicate the response of local authorities.

Indicators worth tracking include new IED activity in Al-Anbar, movement or probing around Al-Hawl, unexplained drone purchases or use by personnel, and further incidents inside Saudi Arabia that extend beyond the three recorded so far.



End of report ← Return to main page