Since the fall of Bashar al-Assad’s regime on December 8, 2024, the trajectory of ISIS operations in Syria appears to have entered a new phase marked less by decisive decline than by fluctuation. Just weeks before that turning point, the group had capped a year of escalating militant activity, carrying out at least 660 attacks in 2024 an average of nearly 60 per month. This figure represents roughly three times its operations in 2023, signaling a clear recovery in both operational capacity and battlefield confidence.
Yet the regime’s collapse delivered a political and organizational shock that temporarily slowed the pace of attacks. Previously, ISIS had relied on exploiting despair and sectarian and ethnic divisions in the region to justify its existence and fuel recruitment.
The formation of a transitional government, however, introduced a political and institutional pathway for Sunni Arab participation, threatening the ideological foundations upon which the group had built its legitimacy.
Between early 2024 and April 2025, operations declined to roughly 10 attacks per month, before gradually rising again from May 2025 onward.
The tempo of attacks accelerated further after Syria joined the international coalition in November 2025. Between November 16 and December 17, 2025, ISIS carried out 18 operations more than eight of them in areas controlled by the new Syrian government.
Al-Ansari Mobilizes Followers
On February 21, 2026, ISIS spokesperson Abu Hudhayfah al-Ansari released an audio message titled “Truth Has Become Distinct from Falsehood”, urging fighters to wage jihad against the Syrian government, which he described as an apostate and infidel regime. He also labeled President Ahmad al-Sharaa as a “new tyrant.”
Attacks against government forces escalated following the speech, which galvanized ISIS supporters. The group redirected its operations toward Syrian forces recently deployed in areas previously held by the Syrian Democratic Forces (SDF) in Deir ez-Zor and Raqqa.
Within just seven days of the address, ISIS carried out seven attacks across Deir ez-Zor, Raqqa, and Qamishli. The deadliest targeted an internal security checkpoint in the village of al-Sabahiyah in Raqqa, killing four personnel and wounding three others.
Al-Ansari’s message came one week after the United States announced the transfer of 5,700 ISIS fighters on February 13, 2026. He criticized the Syrian government for assisting in the detention and transfer of these prisoners to Iraq, declaring: “The Syrian tyrant rivals the Kurdish one in besieging you… Why has the world united against you?”
A New Phase of Deferred Confrontation
Mohammad Hassan, a fellow at the Middle East Institute, wrote in Al-Furats magazine that on January 9, 2025, he met a senior ISIS commander in the Syrian desert known as “Abu Miqdad al-Iraqi,” via a local intermediary from Palmyra.
During the meeting, Abu Miqdad revealed that indirect understandings had prevented direct confrontation between ISIS and Hay’at Tahrir al-Sham (which has since dissolved) during the “Deterrence of Aggression” battle and its aftermath. He also noted that the group had split following the regime’s fall: one faction favored reaching an understanding with the new government and halting activity, while another insisted on continuing operations in Syria.
He added that one reason for delaying confrontation with the government was to observe how authorities would handle ISIS detainees held in SDF prisons.
It is now clear that ISIS has effectively declared war and will intensify its attacks against the Syrian government. In addition to successful assassinations and targeted operations, Syria’s Ministry of Interior has foiled two major plots: one targeting a government convoy in Al-Bukamal and another involving a car bomb in Damascus in March 2026.
Abdul Rahman al-Haj, a researcher specializing in Islamist movements, argues that the fall of Assad’s regime created an opportunity for ISIS to expand its movements and accelerate the formation of urban cells, developing a new strategy aimed at preventing the new government from stabilizing.
Following Syria’s entry into the international coalition and the defeat of the SDF east of the Euphrates, one of ISIS’s key objectives has become undermining President al-Sharaa’s credibility—both domestically and internationally—while attempting to attract disaffected members of Hay’at Tahrir al-Sham and shake international, particularly American, confidence in his ability to ensure stability.
The Security Question in al-Jazira
The SDF lost control of Raqqa and Deir ez-Zor provinces, as well as large parts of Hasakah, after Syrian army operations to retake these areas. Deir ez-Zor has remained the primary hub of ISIS activity, accounting for 76% of its attacks in 2025 (185 out of 244).
Despite intelligence and operational cooperation between Syria, Turkey, and the international coalition, ISIS continues to carry out swift, limited attacks by infiltrating cells into provinces and urban centers. Its most recent operations targeted Syrian Ministry of Defense personnel in western Aleppo countryside and along the Aleppo–al-Bab road on March 6 and 7.
Motaz al-Sayyed, a researcher at the Syrian Center for Security and Defense Studies, notes that ISIS exploits temporary security vacuums despite lacking territorial control. He argues that curbing its activity requires strengthening intelligence capabilities, monitoring sleeper cells, and responding swiftly to early warning signs.
He also emphasizes the importance of leveraging international expertise and regional alliances especially after Syria formally joined the international coalition and investing in economic and social development to reduce environments conducive to extremism.
Nawar Shaaban Qabqibo, a specialist in Syrian military and security affairs, stresses that effectively confronting ISIS depends on accurately assessing the threat it poses. Traditional tools used in previous years, he argues, are no longer sufficient.
ISIS, he notes, is constantly evolving both in its operational tactics and its propaganda strategies aimed at recruitment and influence. Addressing this requires a comprehensive approach, including what he describes as a “linguistic operations room” to counter ISIS narratives, alongside proactive intelligence gathering and enhanced surveillance.
Will Attacks Reach Damascus?
ISIS demonstrated its ability to breach security in Damascus in one of its most significant post-regime attacks, targeting the Mar Elias Church in the Dweilaa district on June 22, 2025. The attack killed 25 civilians and injured 63 others. A militant entered the church, opened fire on worshippers, and then detonated an explosive vest.
The following day, internal security forces arrested the cell responsible, which had also planned to target the Sayyida Zaynab shrine. On February 7, 2026, Syria’s Ministry of Justice identified the perpetrators as Hassan Rostom (alias Abu Waqqas) and Abdulilah al-Jumaili (alias Abu Khattab/Abu Imad), a senior ISIS figure.
According to the Ministry of Interior, the attackers had entered Damascus from al-Hol camp via the Syrian desert, exploiting early security gaps.
Security forces have since conducted raids in the Damascus countryside, arresting key ISIS figures, including the group’s “governor” of Damascus and Horan in December 2025.
Motaz al-Sayyed argues that ISIS is closely monitoring Syria’s overall security landscape rather than focusing solely on Damascus. The capital and its outskirts, he notes, still exhibit vulnerabilities particularly in rural areas.
Attempts to expand operations into Damascus or other cities aim to create chaos, expose security gaps, and exert political and media pressure on the government.
Preventing this requires tighter control over access routes to the capital, strengthened checkpoints, effective surveillance systems, and precise field intelligence operations. Monitoring financial and logistical networks is equally crucial, as disrupting these channels limits the group’s ability to conduct complex attacks.
While fully eliminating ISIS may take time given limited resources and the relative newness of security institutions accumulated experience in combating such groups gives the current government a stronger chance of containing the threat.