Escalating ISIS Activity in Iraq Following the Withdrawal of the International Coalition: Kirkuk Enters a More Dangerous Phase

Syria Monitor – Strategic Research Center

Updated Security Assessment | October 15, 2026

Security developments monitored by Syria Monitor during the first half of October 2026 indicate a growing threat associated with ISIS cells in Iraq, with a series of armed attacks and explosions targeting security and military forces over a relatively short period, particularly in Kirkuk Governorate.

These developments are especially significant given the geographic expansion of reported incidents from the Hawija area toward Daquq and Wadi Zghaitun. The attacks are no longer limited to military barracks and security positions but have also involved military movements and search operations conducted as part of efforts to pursue ISIS cells.

One of the most significant developments occurred on October 14, when an improvised explosive device (IED) detonated in Wadi Zghaitun, killing a brigadier general and another Iraqi Army serviceman. The incident highlights the continuing threat facing security forces, including during operations conducted after airstrikes against suspected militant positions.

These incidents reinforce Syria Monitor’s assessment that the security threat associated with ISIS activity in Iraq is increasing, particularly in Kirkuk, although available information does not indicate that the organization has regained territorial control or developed the capacity to seize and hold territory.

The escalation coincides with changes in the International Coalition’s military presence in Iraq, raising questions about whether ISIS cells are attempting to exploit shifts in the security environment. However, the timing alone does not establish a direct causal relationship between the Coalition’s withdrawal and the recent attacks.

Kirkuk and Hawija: Repeated Attacks and an Expanding Threat

Monitoring data for October indicate that Kirkuk Governorate has emerged as the principal concentration of armed activity associated with ISIS in Iraq, with repeated attacks against different security formations over short intervals.

On October 5, an armed attack targeted barracks belonging to the Federal Police’s 9th Brigade at the Danadish intersection in the Barghaliyah area near Hawija. According to preliminary information monitored by Syria Monitor, the attack resulted in a combined total of five personnel killed and wounded.

On October 6, another armed attack targeted a position belonging to the Popular Mobilization Forces’ (PMF) 61st Brigade in Hawija, despite heightened security measures and the state of alert imposed in the area.

On October 7, Syria Monitor recorded reports of clashes in the Daquq area of Kirkuk Governorate, alongside information indicating that two people had been wounded in an armed attack. Sufficient information was not available to independently establish ISIS responsibility for this incident.

On October 10, another attack targeted security forces in Hawija, accompanied by clashes and field reports indicating that security personnel requested air support to confront the attackers.

Media reports published on the same day described an attack on a military position in the Barghaliyah area of Hawija District, followed by clashes with ISIS militants. Kirkuk Provincial Council’s Security Committee also warned of increasing ISIS movements after three attacks were recorded in less than a week.

Also on October 10, Syria Monitor documented a grenade attack against a residential property in the Sayyadah area of Kirkuk, causing material damage. This incident remains outside the category of confirmed ISIS attacks pending evidence identifying the perpetrators.

The latest attacks do not appear entirely disconnected from activity recorded in September, when Syria Monitor monitored attacks and IED incidents targeting military positions and movements around Altun Kupri, Dibis, Jabal Mama, and Hawija.

The recurrence of attacks within a relatively concentrated geographic area, combined with the targeting of Federal Police, PMF, and Iraqi Army personnel, increases Kirkuk’s significance as an early-warning area. These incidents should therefore not be assessed exclusively as isolated security developments.

Wadi Zghaitun: A Significant Development Raising the Threat Level

On October 14, Kirkuk Governorate witnessed a significant security incident when an IED exploded during an Iraqi Army operation to inspect a location previously targeted by an airstrike in the Wadi Zghaitun area, within the operational sector of the 11th Infantry Division.

According to field information received by Syria Monitor, the explosion occurred near al-Awashirah village in Rashad Subdistrict and struck a Humvee military vehicle, destroying it and killing an officer and a soldier while wounding other personnel.

The Iraqi Ministry of Defense confirmed the deaths of Brigadier General Ahat Yasser Khudair Hussein, commander of the 11th Infantry Division’s Communications Command, and Warrant Officer Mutaz Shaheed Abbas during an inspection of a location where an airstrike had targeted an ISIS hideout in Wadi Zghaitun. The ministry described the explosive device as a remnant of ISIS activity.

Casualty figures for the wounded varied. Syria Monitor’s preliminary information indicated two injuries, while a Xinhua report mentioned three wounded personnel. The final number of injuries therefore remains subject to confirmation.

The significance of this incident can be assessed at three interconnected levels.

First, the explosion demonstrates the continued danger posed by explosive devices in areas associated with previous ISIS activity, including after military operations or airstrikes have been conducted against suspected militant positions.

Second, the death of a brigadier general represents a significant personnel loss for the Iraqi military in terms of rank and command responsibility, although the incident alone does not establish that the officer was deliberately selected as an individual target.

Third, the geographic location adds Wadi Zghaitun and Rashad Subdistrict to the areas where security threats have been recorded during the current period, alongside Hawija and Daquq.

An important distinction must be made between an IED recently planted to target military movements and an explosive device left behind from earlier ISIS activity. The Iraqi Ministry of Defense’s statement supports the latter explanation, and the available information does not establish that the explosion resulted from a newly planned ambush following the airstrike.

Nevertheless, the security implications remain significant: explosive threats associated with ISIS activity continue to inflict casualties on Iraqi military forces during pursuit and inspection operations.

Anbar: Continued IED Activity Along Desert Corridors

Alongside developments in Kirkuk, Syria Monitor documented security incidents in Anbar Governorate.

On October 4, an IED explosion targeting a security force in western Anbar killed two personnel and wounded two others, according to preliminary information.

On October 6, another IED attack was recorded in the al-Obeidi area of western Anbar, wounding at least one security member.

These incidents follow activity previously monitored by Syria Monitor during September in western Anbar and along desert corridors, including the broader Baiji–Haditha axis and surrounding open terrain.

The nature of the threat in Anbar differs from the repeated attacks against security positions in Kirkuk. In Anbar, IEDs targeting military movements remain particularly prominent in extensive areas where continuous security coverage of every route is difficult.

These indicators do not demonstrate that ISIS maintains continuous territorial presence or control over desert corridors. Rather, they point to the continuing threat posed by small cells and explosive remnants associated with the organization’s previous armed activity.

Salah al-Din: The Threat Persists Beyond Kirkuk

Syria Monitor also recorded an IED attack targeting a PMF patrol in the Dujail area of southern Salah al-Din Governorate.

Although this incident alone is insufficient to establish an independent escalation of ISIS activity in the governorate, its significance becomes clearer when considered within the broader security picture involving Kirkuk and Anbar.

This underscores the importance of monitoring possible connections between incidents across different governorates, without assuming the existence of unified operational command or direct coordination in the absence of supporting evidence.

Operational Patterns: Short Attacks, IEDs, and Targeting Military Movements

The incidents monitored during the first half of October reveal the persistence of an operational pattern that relies on relatively limited resources but remains capable of inflicting casualties and disrupting security movements.

The use of automatic weapons in direct attacks against barracks and security positions remains prominent, alongside IEDs targeting vehicles, patrols, and military movements.

Some incidents also indicate the continued use of nighttime or early-morning attacks, a pattern previously observed in ISIS activity over recent months.

The Wadi Zghaitun incident adds an important dimension to this assessment: the danger of explosive devices during post-airstrike inspection operations, rather than exclusively during routine patrols.

Consequently, the current threat does not necessarily depend on ISIS possessing large numbers of fighters or the capacity to sustain prolonged engagements. Instead, it reflects the continuing presence of small cells and explosive hazards in geographic environments where casualties can be inflicted without the need to control fixed positions.

What Do the Latest Indicators Mean?

Developments recorded between October 5 and October 14 warrant a more serious assessment of the threat level than the indicators observed during the opening days of the month.

Initially, the principal indicators involved repeated attacks against barracks and security positions in Hawija. Subsequent developments revealed incidents extending into Daquq, renewed clashes in Hawija, and the Wadi Zghaitun explosion, which killed a senior Iraqi Army officer and another serviceman.

This sequence points to three principal analytical findings.

First, an increased frequency of incidents in Kirkuk. Repeated attacks and clashes over a short period indicate the persistence of the threat and warrant heightened attention to the possibility of additional security incidents.

Second, greater diversity in targets and threat characteristics. The incidents have involved barracks, security positions, military movements, and inspection operations, demonstrating that the security threat is not confined to a single attack pattern.

Third, a broader geographic distribution of monitored incidents. The occurrence of incidents in Hawija, Daquq, and Wadi Zghaitun reinforces the importance of assessing Kirkuk as an interconnected security environment, without implying that a single network was responsible for every attack.

At the same time, there is insufficient evidence to conclude that ISIS has entered a phase of territorial expansion or acquired substantial military capabilities. Nor can responsibility for every reported incident be conclusively attributed to ISIS.

The more precise assessment is therefore that indicators of increasing security risk are clearer than the available evidence of an actual expansion in ISIS’s organizational capabilities.

The increase in casualties and recurrence of incidents can be observed, while the size of individual cells, their level of coordination, and their capacity to sustain operations require further evidence.

Syria Monitor Assessment

Syria Monitor assesses that security developments during the first half of October 2026 reflect an increasing threat associated with ISIS activity in Iraq, with the clearest indicators concentrated in Kirkuk Governorate.

Within a short period, the governorate has moved from repeated attacks against security positions in Hawija to a broader series of incidents involving Daquq and Wadi Zghaitun, culminating in the deaths of Brigadier General Ahat Yasser Khudair Hussein and another Iraqi Army serviceman during a military operation.

This sequence reinforces Syria Monitor’s assessment that Kirkuk currently represents the primary early-warning area, while western Anbar and the desert corridors connecting Salah al-Din and Nineveh remain important areas for continued security monitoring.

The center does not assess that current evidence indicates a return to ISIS’s former model of territorial control. Nevertheless, the recurrence of attacks against multiple security formations over short periods suggests that the organization, or threats remaining from its previous activity, retains the capacity to affect the security environment and inflict casualties.

Based on the observed patterns, the threat of IED incidents and short-duration armed attacks is expected to persist in the near term. Considerable uncertainty remains regarding the size of active cells and their ability to conduct simultaneous or more complex operations.

The decisive factor over the coming weeks will be whether the frequency of incidents continues to increase and whether evidence emerges of organizational or operational links between attacks recorded in different areas.

Accordingly, Syria Monitor’s assessment as of October 15, 2026, is that the threat posed by ISIS attacks and associated security risks in Iraq is increasing, and that recent developments in Kirkuk represent a clearer early-warning signal than those observed at the beginning of the month.

The principal danger at this stage does not lie in an imminent return to territorial control, but in the possibility that limited and scattered attacks could develop into a more frequent and sustained operational pattern, increasing casualties and placing additional pressure on Iraqi security forces.

Editorial Note: This updated assessment draws on Syria Monitor’s monitoring data through October 15, 2026, together with published reporting concerning the Hawija attacks and the Wadi Zghaitun incident. The term “escalation” refers to the assessed direction of the threat during the monitored period and does not constitute statistical proof of a long-term increase compared with all preceding months.