Within less than a week, the Syrian capital, Damascus, witnessed two significant security incidents. The first involved an improvised explosive device (IED) detonating inside a café near the Palace of Justice, resulting in multiple fatalities and injuries. The second occurred today during the official visit of French President Emmanuel Macron, when two IEDs exploded near the Four Seasons Hotel and the Ministry of Tourism, injuring 18 people, including police personnel, while the French delegation remained unharmed.

Although the two attacks targeted different locations, their close timing and the similarity in the attack method raise important questions regarding their strategic implications and the actors that may have benefited from them.

Evolution of the Security Pattern

The two incidents suggest a renewed reliance on low-cost improvised explosive devices (IEDs) inside the capital, representing a departure from suicide attacks or large-scale coordinated assaults.

This operational approach offers several advantages to perpetrators, including:

• Ease of concealing and emplacing explosive devices.
• Reduced operational risk for attackers.
• Significant psychological and media impact.
• The ability to disrupt security forces without requiring extensive operational networks.

Target Selection

Palace of Justice Bombing

Targeting a crowded civilian area adjacent to a judicial institution carries several potential messages, including:

• Demonstrating the capability to conduct attacks inside the capital.
• Undermining the public perception of security in central Damascus.
• Generating substantial media attention.

Today’s Bombings

Today’s explosions occurred near the Four Seasons Hotel, where French President Emmanuel Macron was staying, in an area hosting several government institutions during his visit to Damascus—the first visit by a European Union head of state to Syria in years.

According to Syrian authorities, both explosive devices detonated outside the security perimeter established for the presidential visit, and President Macron was not present at the scene when the explosions occurred.

Operational Pattern

Preliminary indicators reveal notable similarities in the modus operandi of both incidents, as each relied on pre-positioned improvised explosive devices rather than suicide bombers or direct armed assaults.

This method reflects a preference for covert operations, minimizing the likelihood of exposing operational cells while maximizing psychological, security, and media impact with relatively limited human resources.

Potential Implications

These attacks are likely to prompt tighter security measures across Damascus, particularly around government institutions, diplomatic missions, and foreign delegations.

They may also lead Syrian authorities to expand intelligence-led raids against suspected operational cells while reassessing security protocols for major political events and high-level international visits.

Who Benefits?

At the time of writing, no group has claimed responsibility for today’s bombings. However, according to media reports, the previous attack targeting the café near the Palace of Justice was claimed by an extremist group.

Accordingly, attributing responsibility for today’s attacks to any specific actor remains premature.

Nevertheless, the nature of the attacks aligns with the objectives typically pursued by extremist organizations seeking to:

• Disrupt Syria’s growing international diplomatic engagement.
• Undermine perceptions of stability.
• Demonstrate their continued capability to operate inside major urban centers.

At the same time, alternative scenarios cannot be ruled out and should remain subject to ongoing official investigations.

Security Assessment (Syria Monitor Assessment)

Syria Monitor assesses that the repeated use of improvised explosive devices inside Damascus within a short timeframe indicates that the capital continues to provide an operational environment in which clandestine networks remain capable of conducting covert attacks, despite the political and military transformations Syria has experienced in recent months.

Available indicators further suggest that networks linked to Iranian-backed militias, in addition to cells associated with the former Syrian regime, have not been fully dismantled. These networks continue to maintain varying levels of presence across Damascus and its surrounding countryside and may retain the capability to conduct limited security operations when operational conditions permit.

Meanwhile, the Islamic State (ISIS) continues to maintain active cells inside Syria and possesses extensive expertise in manufacturing and deploying improvised explosive devices, making it one of the actors operationally capable of executing attacks of this nature.

At the time of publication, no organization has claimed responsibility for the latest bombings, and no official investigation has identified the perpetrators. Consequently, attributing responsibility to any specific actor would be premature.

Based on current operational capabilities and the prevailing security environment, the principal hypotheses warranting further investigation include:

• ISIS cells seeking to demonstrate their continued operational capability inside Damascus and undermine perceptions of stability.
• Cells affiliated with the former Syrian regime attempting to destabilize the security environment and challenge the authority of the current government.
• Individuals or networks linked to Iranian-backed militias aiming to deliver political and security-related messages associated with evolving regional dynamics and Syria’s renewed international engagement.

Syria Monitor cannot exclude the possibility of limited logistical interaction or indirect cooperation between some of these networks, particularly regarding logistical facilitation or access to explosive materials. However, there is currently no sufficient evidence to establish direct operational coordination among them in relation to these incidents.

Syria Monitor further assesses that the recurrence of this type of attack demonstrates that Damascus continues to face threats from dormant cells and clandestine networks. Achieving sustainable security will therefore require continued efforts to dismantle remaining militant infrastructures while maintaining pressure on ISIS cells, networks associated with the former Syrian regime, and Iranian-backed militia structures, in accordance with the findings of ongoing investigations and future security operations.

Indicators to Monitor

• Any claim of responsibility issued by an armed group.
• Official investigation findings regarding the type of explosive devices and detonation methods.
• The occurrence of similar attacks in Damascus or its countryside in the coming weeks.
• Large-scale security operations targeting ISIS cells, networks associated with the former Syrian regime, or Iranian-backed militia structures.