What did the latest UN Report on jihadism say? Part 2
Transnational networks in Africa, IS in the Syrian desert, jihadist parapolitics in Yemen, stirrings in Khorasan
Black Flags in the Maghrib
Vigilant against evolving threats, Moroccan security services confronted lone actors targeting public figures and security facilities, as well as extremists engaging in online bomb-making. In 2024, five terrorist cells were dismantled and 23 individuals arrested, successfully preventing attacks.1
IS has devoted considerable resources to targeting Morocco, with no successes as of yet. Most recently, on 19 February, Moroccan authorities foiled a massive IS plot in a number of raids in nine cities across the country, leading to the arrests of twelve operatives.2 The foiled attacks were planned by a Libyan ISGS leader, named “Abderrahmane Sahraoui” (Abdul-Rahman al-Sahrawi). Moroccan authorities also discovered signs of a smuggling network operating in the mountains.3 ISGS is also alleged to have been responsible for the recent kidnappings in the Algerian desert. The role of ISGS in external operations in Africa is quite interesting given the pressure put on this branch. The Malian Army has claimed to have killed and arrested several key ISGS operatives, while it has suffered defections to JNIM, yet it remains the planner of strikes abroad. ISKP is in a similar position. Despite significant repression from the Taliban, ISKP is still able to plan major attacks abroad. It seems that IS deputizes external operations on branches under pressure to compensate for local losses.
In October, Libyan services apprehended two Syrian nationals who had transferred funds to ISIL (Da’esh) in the Syrian Arab Republic to facilitate the movement of fighters from there to Mali through Libya.
As stated in Part 1, Iraqis and Syrians are the glue of the global IS network. As the organization comes under severe repression in its Middle Eastern heartland, it has increasingly re-deployed its key human assets to other branches. For example, in Afghanistan, there are reportedly Iraqi trainers in ISKP training camps in Kunar. Likewise, in July, authorities in Madagascar and Cote d’Ivoire arrested eight Iraqi and Syrian nationals reported to have facilitated travel of operatives outside the Middle East into Africa and perhaps beyond.4 Similarly, the leader of the IS presence in Sudan is an Iraqi national–supposedly the cousin of Abu Bakr al-Baghdadi–and he is responsible for logistical and smuggling networks.
Both ISIL (Da’esh) and Al-Qaida continued to exploit Libya as a transit corridor for fighters, arms, funds and illicit trade in resources, posing a persistent threat. Al-Qaida in Libya was active in the south-west, leveraging tribal connections to maintain logistical and financial platforms, in particular to support Sahel-based affiliates. In July, a cell led by a Libyan operative linked to JNIM, responsible for supplying satellite communication systems and wireless devices, was dismantled. Unlike ISIL (Da’esh), Al-Qaida has integrated more effectively into local tribes, enabling greater outreach and influence.
This information closely matches my reports from several months ago. It is worth quoting the relevant passages. First, from January (based on conversations in November and December):
JNIM is well-embedded in the smuggling and criminal networks of Northern Nigeria and Southern Libya. It uses these networks to transport fighters, weapons, and materiel. It is currently developing its drone capabilities.
From October (based on conversations in that month and September):
As for the tribes, I will not mention the names of the tribes in particular, but I will speak in general. They say that if you reach southern Libya, then you have already reached JNIM. This is what they often say. The group actually has a base in southern Libyan and among the southern tribes as well. There are many of our brothers from those regions of Libya present in JNIM today. The brothers from Libya are mainly present in the Timbuktu region and some areas of Macina, such as Mopti and Ségou, also possibly in Gao and Aribanda. As for the leader Talha Abu Hind, he is originally from Libya and his family is also present in Timbuktu and is nomadic. There are many Libyan tribes that have people and families in the Timbuktu desert.
I believe I was the first to report these details in English, or perhaps any Western language.
Another Look at the Middle East
Syria
Hurras al-Din (HAD, not listed), the other Al-Qaida affiliate in the Syrian Arab Republic, did not participate in the HTS-led offensive but maintained cooperation with Ansar al-Islam (see S/2024/92, para. 57). A few Member States noted occasional opportunistic collaboration between HTS and HAD but no systemic partnership, and HTS had in the past arrested some HAD members. HAD consists of 1,500 to 2,000 fighters, including locals and foreign terrorist fighters known for their combat experience and extreme ideology. The group faced leadership losses, including the death of Abu-Abd al-Rahman al-Makki in August, the third most important figure after the leaders Samir Hijazi and Sami al-Aridi (both not listed). HAD adhered more to a global than a local Syrian agenda and maintained external operations aspirations.
The UN here is largely mistaken. Per my own information, now corroborated by other journalists,5 Hurras al-Din fighters did participate in the HTS offensive that led to the fall of the Assad regime. These fighters participated against the orders of their leaders, suggesting significant internal tensions, which were seemingly confirmed by the decision to formally disband HaD. The UN’s membership estimates are also far off most figures. HTS harshly repressed HaD back in 2020-21, reducing it to a small fringe organization. The US’s relentless (and still ongoing) air campaign against HaD has also considerably thinned out its ranks. By all measurements, the organization (or remnants thereof) is terminally ill and headed towards total elimination.
Member States remained concerned over the fate of the thousands of ISIL (Da’esh)-affiliated individuals held in camps and prisons that may now be less well secured. After HTS launched its offensive, an ISIL (Da’esh) operative infiltrated the Hawl camp on 30 November. He replaced ISIL (Da’esh) members there with teenage boys, allowing experienced fighters to escape to the Badia. He also reactivated the Ansar al-Afifat Brigade that included women, tasked with intelligence-gathering, training young people for operations, recruiting and managing funds.
The prison camps in the Syrian northeast are perhaps the greatest regional security threat. They contain not only several thousand hardened IS fighters, but thousands of children who have known only the camps, where they have been raised by their fanatical mothers. The trafficking routes connecting al-Hawl and Ruj prisons to IS networks on the inside were first reported last summer by Syrian journalist Zain al-Abidin (mentioned above).
Perhaps the easiest and best way for the organization is to bring fighters [to the desert] from the Jazira regions, where the authority of the SDF militia is fragile, through experienced smuggling networks that specialize in transporting those wishing to head to the desert. They are helped in this by the widespread corruption in the [former] regime’s military system.
The western and eastern countryside of Raqqa, along with the countryside of Deir Ezzor, are considered the most active place for smuggling operations, as the journey begins with arriving at what is called “ISIS guest houses,” which are a house in a village or a tent within a camp, where those wishing to cross into the desert to join the organization gather, and some of them are usually minors who have succeeded in escaping from the al-Hawl camp, which is run by the SDF.6 [Emphasis mine]
These routes are one element of the broader IS insurgency in the Badiya, which, as of 1 March, has paused for now. Since 2017, the Badiya has become the safehaven for IS in Syria, containing many weapons caches, camps, and operating bases for hundreds, if not thousands, of fighters. Zain reported that there are three to five thousand IS operatives in Syria, primarily concentrated in the Badiya region. Many of these fighters and their leaders–including one of the IS caliphs–are Iraqi, and they not infrequently travel to and from Iraq. More broadly, IS has had a special strategic affinity for the desert going back to the Sahwa years. Although writing about Iraq, Nibras Kazimi’s analysis holds true for Syria:
The jihadists fight as if they were pirates, with the desert being their sea. […] Nowadays, they field various types of forces, but their elite and most successful ones, not to mention their best-equipped ones, are small, disparate mobile desert units that converge on a target when needed. They treat the cities and towns they have captured as ports of call, for booty and resupply. When challenged by superior forces attempting to retake these ports, the jihadists dissolve away into the desert, leaving small and determined bands of fighters to deflect and bleed-out the invading force. Their best fighters are not garrisoned in those cities; they live in the skiffs that carry them around the desert, such as the ubiquitous Toyota pick-up trucks [or in Syria, motorcycles] they favor. There may be several mother ships in the desert that steam towards a target around which the skiffs gather.7
In the Badiya, alongside strikes on (former) regime forces, IS fighters routinely attacked shepherds and truffle hunters to steal their livestock and truffles for re-sale primarily in SDF-controlled territories.8 The function of these attacks is two-fold. On the one hand, sheep and truffles are a vital form of income, replacing IS’s once highly lucrative oil trade. The scale of this theft is massive. Just in the early months of 2021, IS had reportedly sold 23,000 stolen sheep in the Raqqa black market.9 On the other hand, these attacks terrorize the population into distancing themselves from authorities and avoiding the desert entirely. In both cases, there is less monitoring of IS, thus permitting more frequent and more severe activities, such as the growing strikes on fuel trucks and oil-and-gas infrastructure (particularly in SDF territories). Prior to the HTS offensive last winter, IS had turned the Badiya into a “black hole draining the regime,” as put it. It is possible that this “black hole” will re-open soon.
Yemen
Since assuming leadership of AQAP in March 2024, Saad ben Atef al-Awlaki (Yemeni, not listed) consolidated control of the group. Leveraging strong tribal bonds, he repaired ties with communities, notably in Abyan and Shabwah Governorates, and reintegrated his predecessor Khaled Batarfi’s supporters. The approximate strength of AQAP of 2,000 to 3,000 fighters included skilled explosives experts and unmanned aerial vehicle operators.
Since Awlaki has taken over, AQAP has significantly escalated its campaign, called the “Arrows of Truth,” against the Emirati-backed Southern Transitional Council (STC), most notably with a major suicide car bomb that killed and wounded over fifty STC troops. In the subsequent months, AQAP’s has relentlessly targeted STC forces, particularly the Security Belts, in the form of sniper attacks, IEDs, and drone strikes. The organization’s close ties to tribal communities has enabled it infiltrate the STC’s Giants Brigades, which it has used to great military effect.10 At the same time, that has exposed the organization to moles who have leaked crucial information, leading to the recent drone strikes killing a number of senior commanders.
Member States reported that al-Awlaki likely retained communication with Sayf al-Adl, notwithstanding the death in March 2024 of Khaled Zidane, the son of Sayf al-Adl and the AQAP link to Al-Qaida’s core leadership. Al-Awlaki also maintained close ties with the AQAP veterans Ibrahim al-Qosi (alias Khubayb al-Sudani, Sudanese) and Ibrahim al-Banna (Egyptian) (both not listed), linked to Sayf al-Adl, and key Shura figures. Member States noted that al-Awlaki maintained the pragmatic agreement with the Houthis that had lasted for the past three years, which was described as opportunistic and transactional. This agreement included mutual non-aggression, prisoner exchanges and the movement of weapons.
As mentioned in Part 1, researcher of Michael Horton has recently investigated the hidden relationship between Ansarallah and AQAP.11 His analysis largely matches the UN’s characterization. However, the Emirati news station Al Akhbar al Aan has alleged for several years that the relationship goes deeper than mere opportunism. Indeed, they argue that Ansarallah and AQAP are now in a strategic alliance as part of a broader alliance between AQ General Command and the IRGC. The news station’s close ties to the Emirati government means that its claims should be treated with significant suspicion. At the same time, its correspondents–particularly its Yemeni journalist, Mohammed bin Faisal–have revealed a number of fascinating scoops that meaningfully bolster Al Aan’s theory about AQAP and Ansarallah. There is no space here to critically analyze Al Aan’s reports, but one fact speaks for itself. Last year, AQAP announced a dead-or-alive bounty on Faisal, accusing him of spying on the organization for international intelligence agencies.12 In particular, they accuse him of revealing the organization’s movements and plans, admitting that his information is not only factual but pertains to guarded secrets of AQAP. Curiously, the group also cryptically accuses Faisal of demoralizing its members. This may be a reference to his constant allegations of AQAP’s ties to Ansarallah and the IRGC. If AQAP feels this threatened by Al Aan’s reporting, then there is likely something to it.
Events in Khorasan
ISIL-K benefited from the Taliban’s inability to protect itself against infiltration and corruption among its own ranks, despite raids conducted to arrest disloyal officials. Following the attack on 17 May against foreign tourists in Bamyan, one Member State subsequently reported the involvement of a notorious ethnic Tajik commander, Mawlawi Nik Mohammad Aizaifa, head of the Taliban General Directorate of Intelligence in Bamyan Province.
The UN seems to be mistaken on this point. The commander’s name is not “Aizaifa” but “Hozaifa.” Reports of his defection are unconfirmed. He was allegedly redeployed to Ghor province. This may have been due to his perceived unreliability, but the story remains unclear.
ISIL-K continued to build its capabilities to threaten Central Asian countries from northern Afghanistan. Previous terrorist attacks in the Islamic Republic of Iran and the Russian Federation indicated the focus of ISIL (Da’esh) in the region and beyond. The group consolidated its support base while seeking to capitalize on the growing dissatisfaction among ethnic Tajiks against Taliban rule in northern provinces. The number of ISIL-K sympathizers and supporters in Badakhshan and Kunduz Provinces increased significantly. Despite Taliban pressure against ISIL-K, in particular in Helmand and Kandahar Provinces, farmers affected by the poppy cultivation ban reportedly provided shelter for ISIL-K fighters in retaliation.
In other words, the Taliban’s policies, particularly its ultra-retrograde misogyny and its poppy cultivation ban, contribute to the conditions for Salafi Jihadist militancy in the country. However, there are slightly different regional dynamics at work. The northern provinces have a small but non-insignificant population of Salafis who belong to the same “Salafi continuum” in neighboring Tajikistan. Local sympathies with IS are not purely motivated out of resentment against the Taliban, but a real ideological affinity. Ethnic and sectarian tensions therefore blur together. The ethnic component makes it difficult for the Taliban to either preempt or retroactively investigate strikes from local IS cells. In contrast, in Pashtun regions like Nangarhar and Kunar, the Taliban can rely on tribal networks to identify or aid in counter-insurgent efforts.
The lack of such ethnic and sectarian tensions in Pashtun Deobandi strongholds such as Helmand and Kandahar means that local assistance IS is likely motivated by simple resentment. Although well-intentioned, the poppy cultivation ban disproportionately affect poorer farmers who lack large landholdings that would make cereal farming profitable. Poppy is a highly profitable crop, especially for smallholders, hence its popularity. The ban has not come with institutional support for these affected smallholders, almost certainly leading to anger and resentment. However, the lack of any real IS cells in the south indicates that the UN’s report of farmers providing shelter to IS fighters is not the whole story. It seems that these fighters were in transit to somewhere else, perhaps Pakistani Balochistan, which the Taliban (with credible evidence) have alleged has become ISKP’s main base of operations.
There was increased collaboration between TTP, the Afghan Taliban and Al-Qaida in the Indian Subcontinent (AQIS, not listed), conducting attacks under the banner of Tehrik-e Jihad Pakistan (TJP, not listed). Greater facilitation among these groups and TTP in terms of the provision of suicide bombers and fighters and ideological guidance might transform the latter into an extraregional threat and an umbrella organization for other terrorist groups operating in the region.
It had long been rumored that TJP is a mere front for radical elements of the TTP to stage spectacular attacks. AQIS may be advising these elements, but I am skeptical that they are meaningfully involved given that they have abandoned militancy for years. It is also unclear whether the Afghan Taliban are as involved as the UN alleges. In conversations with locals, I have often heard that TTP fighters are frustrated with the Afghan Taliban’s reluctance to fully support jihadist efforts in Pakistan. While the two organizations are closely intertwined, they are operationally distinct with different manpower pools. Unlike the TTP, the Afghan Taliban must balance jihadist aims with statecraft and international diplomacy. The Emirate is still fragile and cannot risk especially bold moves like fully endorse jihadist efforts, i.e. declaring war, in Pakistan.
END
Unless otherwise indicated, all block quotes are from the linked UN report: https://docs.un.org/en/S/2025/71
“Morocco says it dismantled a terror cell that was planning attacks,” PBS, 25 February, 2025. Link: https://www.pbs.org/newshour/world/morocco-says-it-dismantled-a-terror-cell-that-was-planning-attacks
“BCIJ discovers ISIS weapons hidden in Morocco, investigates smuggling network,” Hespress English, 20 February, 2025. Link: https://en.hespress.com/104126-bcij-discovers-isis-weapons-hidden-in-morocco-investigates-smuggling-network.html
Benjamin Roger, “Un réseau de l’organisation Etat islamique qui voulait rallier l’Europe démantelé en Côte d’Ivoire et à Madagascar,” Le Monde, 24 November, 2024. Link: https://www.lemonde.fr/international/article/2024/11/24/un-reseau-de-l-organisation-etat-islamique-qui-voulait-rallier-l-europe-demantele-en-cote-d-ivoire-et-a-madagascar_6412220_3210.html
Unless otherwise indicated, all accounts of the IS insurgency in the Badiya are taken from: Zain al-Abidin al-Akidi, “The Syrian Badiya: A Safe Haven and a Black Hole Draining the Regime” (in Arabic), Noonpost, 26 June, 2024. Link: https://www.noonpost.com/220245/
Kazimi, “Notes On Methodology In The Study Of Jihad,” Hoover Institute, 3 December, 2015. Link: https://www.hoover.org/research/notes-methodology-study-jihad
Gregory Waters, “Unsolved Murders in Syria’s Badia: Truffle Hunters in the Crosshairs and ISIS at Large,” Counter Extremism Project, April 2023. Link: https://www.counterextremism.com/content/unsolved-murders-syrias-badia-truffle-hunters-crosshairs-and-isis-large
Gregory Waters, “Smuggling Away the Future in Syria’s Northeast,” Counter Extremism Project, 26 October, 2021. Link: https://www.counterextremism.com/blog/smuggling-away-future-syrias-northeast
Cf. Ahmad al-Kazmi, “Al Qaida’s incursion into Abyan under the cover of the Southern Giants Brigades: Serious breaches threaten security forces” (in Arabic), Gnoub Arab, 19 August, 2024. Link: https://www.gnoubalarab.com/news/30204
Michael Horton, “Looking West: The Houthis’ Expanding Footprint in the Horn of Africa,” CTC Sentinel 17, no.11 (December 2024). Link: https://ctc.westpoint.edu/looking-west-the-houthis-expanding-footprint-in-the-horn-of-africa/
BBC Monitoring’s report on the bounty can be found here: https://x.com/M_Faisal311/status/1778419948743688371