Executive Summary

• The first half of 2026 brought significant changes to the security environment in which ISIS operates in Syria. The expansion of Syrian state control east of the Euphrates and the redeployment of government forces in areas newly brought under state control disrupted the organization’s established operating environment, forcing its cells to adapt to increased security pressure.
• ISIS increasingly relied on low-cost guerrilla tactics, particularly shootings, individual assassinations, and hit-and-run attacks, rather than complex military operations. Shooting attacks accounted for approximately 83% of recorded attack methods, with 59 incidents. Attacks involving explosive devices, grenades, projectiles, and suicide attackers remained limited. This pattern indicates growing reliance on small, mobile cells rather than sustained engagements.
• ISIS also reoriented its target bank—the people, institutions, and assets it seeks to attack—toward the Syrian state. Military and security personnel, headquarters, checkpoints, and associated state institutions accounted for roughly 75% of recorded targets. Government forces replaced the Syrian Democratic Forces (SDF) as the organization’s principal target following the transfer of former SDF-held areas to government control. Attacks on customs personnel and oil infrastructure sought to undermine state revenues, while attacks on judges and tribal leaders targeted other sources of authority.
• ISIS attacks killed 49 people, with military and security personnel accounting for the largest share of fatalities. Individual assassinations were more lethal than attacks on fortified positions, indicating a preference for exposed targets that allow the organization to inflict substantial damage at low operational cost. Attacks on checkpoints and headquarters were more often intended to harass security forces, test their defenses, and wear them down.
• Attacks peaked in February and March, then declined sharply in subsequent months. The decline in frequency did not eliminate the threat: ISIS shifted toward fewer attacks on targets of greater symbolic significance, including headquarters, government personnel, oil-related targets, and judicial officials. This pattern suggests adaptation to growing security pressure and a reduced capacity to sustain frequent attacks, while retaining the ability to carry out attacks with significant impact.
• Deir ez-Zor remained the main center of ISIS activity, accounting for approximately 55% of recorded attacks, followed by Raqqa and Aleppo. This concentration underscores the organization’s continued exploitation of desert terrain, proximity to the Iraqi border, tribal networks, and gaps in government security deployments. Activity elsewhere remained limited and sporadic.
• Syrian military and security institutions increasingly shifted from reactive containment toward intelligence-led preemption, using intelligence to identify and disrupt threats before attacks could be carried out. Operations targeted ISIS leaders, assassination cells, and networks producing explosive devices. Rapid responses, searches for cells and weapons, the interception of suicide attackers, and stronger links between intelligence collection and operational action supported this shift.
• The security response also involved consolidating dispersed forces in fortified positions, replacing isolated and vulnerable checkpoints in Palmyra and al-Sukhnah. Sustaining the decline in ISIS activity will require closing remaining security gaps, protecting vulnerable personnel and critical supply routes, disrupting illicit weapons and explosives networks, strengthening rapid-response capabilities, and deepening cooperation with local communities in Deir ez-Zor and Raqqa.
  
  For More: https://bit.ly/4yDiaM5