ISIS in September 2026: Cell Activity in Syria and Iraq and Escalating Operations in Africa

Monthly Monitoring Report on ISIS Activity – Syria | Iraq | Africa
Reporting Period: 1–30 September 2026
Syria Monitor – Strategic Research Center

September 2026 saw continued activity by ISIS and ISIS-linked cells across Syria, Iraq, and Africa, although the scale and operational patterns differed considerably between the three theaters.

Syria Monitor’s monitoring indicates that activity in Syria primarily took the form of assassinations, improvised explosive devices (IEDs), ambushes, and limited attacks against security and military personnel. In Iraq, ISIS cells continued to demonstrate an ability to move and strike, particularly across Kirkuk, Salah al-Din, and Anbar. Africa, meanwhile, recorded the most extensive operations and the highest reported casualty levels, particularly in Niger, Nigeria, and the wider Sahel.

This report is based on Syria Monitor’s incident-monitoring database for September, supplemented by open-source information used for verification and comparison. Not every incident included in the report is treated as an officially claimed or independently confirmed ISIS operation. The monitoring methodology distinguishes between attacks formally claimed by ISIS, attacks attributed to the group by security, local, or other reliable sources, and incidents displaying characteristics consistent with ISIS activity but for which attribution remains unconfirmed.

Syria: Assassinations, IEDs, and Rapid Attacks

ISIS-linked activity in Syria during September showed a relatively broad geographical distribution, with Daraa emerging as one of the most prominent areas of monitored activity, alongside Raqqa, Hama, and Homs.

On 11 September, gunmen assassinated a member of the Syrian Ministry of Defense near Dahiyat al-Walid, overlooking the Homs–Damascus highway.

On 13 September, an explosion occurred outside a church in Hama Governorate. The incident was included in Syria Monitor’s database, but direct attribution to ISIS requires additional evidence before it can be classified as a confirmed ISIS operation.

On 17 September, the city of al-Sanamayn in Daraa witnessed an armed confrontation during an attempt by General Security forces to arrest a man accused of terrorism-related offenses. According to field information received by Syria Monitor, three General Security personnel — Nael al-Safadi, Salloum Masalmeh, and Mustafa Saad al-Din — were killed, while others were wounded.

On 19 September, an IED targeted a motorcycle in the al-Duwaira area of Daraa, killing its rider.

One of the deadliest incidents recorded in southern Syria during the month occurred on 20 September, when a military force was ambushed near Kafr Shams in Daraa. According to preliminary information monitored by Syria Monitor, seven personnel were killed: Khaled al-Halqi, Mohammad Jawad al-Maidani, Abdul Razzaq al-Samadi, Mohammad Hilal, Raafat al-Hajji, Qutaiba Adnan al-Jabawi, and Alaa Saeed al-Hariri. Attribution to ISIS requires independent confirmation in the absence of a verified claim or additional evidence.

On 21 September, an IED targeted the vehicle of a General Security commander known as Abu Ammar Qataf in the city of al-Hirak in rural Daraa, causing significant material damage.

Activity subsequently extended into northeastern Syria. On 23 September, three military personnel were wounded when an IED exploded in the village of al-Hurriya in the Tal Abyad area of northern Raqqa.

On 24 September, gunmen attacked a military overnight-transport bus in the Maadan area of eastern rural Raqqa. Available information indicated that the personnel fled the bus, while no confirmed casualty figure was immediately available.

On 27 September, media figure Fawzi al-Sharif was assassinated inside his home in al-Sanamayn, Daraa. Al-Sharif was known for media activity hostile to ISIS. The profile of the target is relevant when assessing the possible motive, but it is not, by itself, sufficient evidence to establish ISIS responsibility.

On 28 September, gunmen attacked the vehicle of a military member in the town of Nabaa al-Tayyib in rural Hama, wounding him and damaging the vehicle.

Operational Assessment: Syria

September’s incidents reveal three recurring patterns: IED attacks, assassinations, and short-duration surprise attacks against limited targets.

These operations do not in themselves indicate territorial control. Rather, they point to the continued presence of clandestine cells capable of identifying targets, carrying out short attacks, and withdrawing without maintaining a visible presence on the ground.

Daraa stands out particularly strongly in September’s monitoring, both in the number of incidents and the nature of the targets. At the same time, incidents in Raqqa and Hama indicate that the threat is not confined to southern Syria.

Iraq: Kirkuk at the Forefront and Continued Activity Along Desert Corridors

In Iraq, September monitoring showed continued ISIS activity across a geographical belt extending from Kirkuk and Hawija toward Salah al-Din and Anbar, with IEDs, attacks on military positions, and exploitation of open terrain and interprovincial movement corridors forming important components of the operational pattern.

On 3 September, an armed attack targeted a position belonging to the 16th Brigade of the Turkmen Popular Mobilization Forces in the Altun Kupri/Dibis area north of Kirkuk. According to monitored information, one member was killed and others were wounded.

On 12 September, gunmen attacked a military position in the area between Sargaran and Hawija, near Jabal Mama in Kirkuk. Preliminary information indicated that a thermal surveillance camera was destroyed. The incident followed Iraqi air activity against locations suspected of hosting ISIS cells.

On 13 September, an Anbar police member was killed by an IED explosion in western Anbar.

On 15 September, a position belonging to the 32nd Brigade of the Iraqi Army’s 8th Division was attacked in the Jabal al-Gharra area of Kirkuk. When reinforcements moved toward the area, an IED targeted the force, wounding several personnel, including an officer serving as a company commander, according to field information.

On 16 September, an armed attack targeted a position belonging to emergency police forces in the Nukhaib area of southwestern Anbar. No final casualty figure was available.

A notable development was recorded on 18 September along the Baiji–Haditha corridor west of al-Siniya, between northwestern Salah al-Din and northeastern Anbar. The available information does not indicate territorial control or permanent administration of the road by ISIS. Rather, it points to the ability of cells to access parts of the corridor and conduct attacks in or around it. In the same context, electricity transmission lines supplying positions belonging to the Jughaifa tribal mobilization forces in Haditha were targeted.

On 24 September, Iraqi government forces launched a security operation in Hibhib, Diyala, following the appearance of pro-ISIS graffiti on a mosque in the town.

On the same day, Abbas Jawad, a Badr Organization figure and director of the Abi Saida water department, was found dead inside his orchard in Diyala. Available information is insufficient to directly attribute his killing to ISIS, and the incident therefore remains under monitoring rather than being classified as a confirmed ISIS operation.

On 27 September, the Altun Kupri area north of Kirkuk witnessed a direct confrontation involving Iraqi Counter-Terrorism Service forces and an ISIS cell. The incident reinforced indications that small cells remain present and capable of operating in the broader Kirkuk environment.

Operational Assessment: Iraq

The significance of September lies not in evidence of major ISIS operations aimed at capturing cities or holding territory, but in the continued presence of small cells capable of operating within a complex security environment.

The Kirkuk–Hawija axis and its surroundings stands out in particular. Activity extending through Salah al-Din toward western Anbar also highlights the continuing importance of desert areas, rugged terrain, and interprovincial routes as environments that can facilitate concealment and movement.

The most important indicator is therefore not territorial expansion, but the persistence of a cellular infrastructure capable of survival, movement, reconnaissance, and limited attacks in areas historically associated with ISIS activity.

Africa: The Most Active Theater

Africa remained the most intense theater covered by Syria Monitor during September, with activity concentrated particularly in Niger, Nigeria, Mali, Somalia, and Mozambique.

On 8 September, at least 22 people were reported killed in an armed attack in Gombe State, Nigeria, while a church was also burned. The identity of the perpetrators requires independent confirmation before the incident can be classified as a confirmed ISIS operation.

On 11 September, an armed attack targeted a local militia in the Tahoua region of Niger, killing seven members according to preliminary information.

On 14 September, information emerged concerning the abduction of a South African national during an attack in Mozambique’s Niassa Reserve, an area affected by militant activity.

On 15 September, five Nigerian soldiers were reported killed in an ambush in northern Nigeria.

On 16 September, the Cal Miskaad mountains in Puntland, Somalia, witnessed attacks against Puntland forces, with reports indicating that the attackers advanced into some positions.

A major escalation was recorded on 23 September in Niger, when security forces were targeted in attacks in Tillabéri and Tahoua. Preliminary information indicated substantial casualties among Nigerien security personnel, with additional personnel reportedly captured or missing. Because casualty figures changed as further information emerged, the final toll requires continued verification.

On 26 September, an IED targeted a Nigerien security patrol in the city of Diffa, destroying a vehicle and reportedly killing and wounding personnel on board.

On 27 September, northern Nigeria witnessed a series of attacks against forces supporting the Nigerian military. The preliminary casualty toll initially stood at 12 killed, before rising to 15 and subsequently 19, as additional attacks were reported and confirmed during the day.

On the same day in Somalia, Puntland forces in the Cal Miskaad area were targeted in an aerial attack, according to field information received by Syria Monitor, resulting in preliminary reports of casualties. The precise platform used and attribution of the attack require further verification before being entered as confirmed findings.

On 28 September, attacks targeted positions belonging to the organization led by Iyad Ag Ghaly in the areas of In-Tillit and Tessit in Mali, with preliminary reports indicating that the attackers gained the upper hand and seized positions during the fighting. Given the complex militant landscape in the Sahel, final classification of these incidents as ISIS operations requires comparison with claims of responsibility and reliable local reporting.

South Africa: Incidents Kept Outside the ISIS Count

Syria Monitor also monitored reports on 27 September concerning mass shootings in South Africa, including the Carletonville incident and other reports involving areas west of Johannesburg and Cape Town.

However, these incidents should not be included in the ISIS operational tally unless credible evidence establishes a connection to the organization. The use of firearms or the scale of an attack alone is insufficient for attribution.

Key Trends in September

A comparison of the three theaters reveals substantial differences in the nature of the threat.

In Syria, monitored activity was primarily characterized by small cells, assassinations, IEDs, and rapid attacks, with Daraa emerging prominently during the month and additional activity recorded in Raqqa, Hama, and Homs.

In Iraq, the operational tempo remained more limited than in parts of Africa, but the incidents demonstrate continued activity within established geographical belts, particularly Kirkuk–Hawija, Salah al-Din, and western Anbar. The available data do not indicate a return to ISIS-style territorial control, but they do point to the continued presence of cells capable of concealment, surveillance, movement, and attack.

In Africa, the picture is markedly different. Some operations demonstrated a greater ability to inflict significant casualties on government forces, local security formations, and armed rivals. Niger and the wider Sahel remained particularly important areas of concern during September.

Overall Assessment

September’s data do not indicate a single uniform trajectory for ISIS across all theaters.

In Syria and Iraq, ISIS and ISIS-linked cells primarily operate according to a low-visibility insurgency model: small cells, IEDs, assassinations, ambushes, and short-duration attacks without the need to openly control populated territory.

In parts of Africa, particularly the Sahel, armed formations associated with ISIS demonstrate the capacity to conduct larger-scale operations against military and security positions and rival armed groups.

September also demonstrates why ISIS capability should not be assessed solely through the number of attacks. More meaningful indicators include target selection, accessibility of targets, the scale of forces involved, repeated activity within the same geographical areas, the ability of cells to survive security operations, and the level of casualties they are capable of inflicting.

The picture emerging from September 2026 is therefore not a return to the territorial “caliphate” model once employed by ISIS. Instead, the organization and its regional branches continue to adapt to their respective operating environments: clandestine cells and security attrition in Syria and Iraq, alongside broader and more intensive militant operations in parts of Africa.