Monthly Monitoring Report Islamic State (ISIS) Activity Syria – Iraq – Africa

Monthly Monitoring Report on Islamic State (ISIS) Activity

Syria – Iraq – Africa

July 2026

Syria Monitor
Strategic Research Center

Throughout July 2026, the Islamic State (ISIS) remained active across several key theaters, with significant variations in the nature and intensity of its operations in Syria, Iraq, and Africa. In Syria, the group’s activity was primarily characterized by assassinations, improvised explosive device (IED) attacks, and limited assaults targeting security personnel, military forces, and local officials. In Iraq, the overall pace of direct attacks remained relatively low, although indicators continued to point to the presence of active ISIS cells in rural and desert areas, alongside several security incidents suspected of being linked to the group.

In contrast, Africa remained ISIS’s most active operational theater during the reporting period. The organization’s regional branches in West Africa, Central Africa, and Mozambique carried out a series of attacks targeting military forces, local militias, and civilians. These operations resulted in dozens of fatalities and injuries, in addition to the destruction of villages and homes and the seizure of weapons and military equipment.

The monitoring further indicates that ISIS continued to rely on low-cost, high-impact tactics, including improvised explosive devices, motorcycle-based assassinations, and rapid attacks against checkpoints and security patrols, while continuing to exploit rural and desert environments that facilitate the movement and concealment of its cells.

This report is based on daily monitoring conducted by Syria Monitor between 1 and 31 July 2026, drawing upon open-source intelligence (OSINT), official statements, local sources, and official ISIS media releases whenever available. The report distinguishes between attacks officially claimed by ISIS, incidents attributed to the group by security or field sources, and attacks that remain under verification.

The report aims to provide a comprehensive overview of ISIS activity throughout July 2026, analyze its principal operational and geographical trends, and support researchers, policymakers, and analysts monitoring the evolution of militant organizations across the region.

Monitoring Methodology and Classification

The Syria Monitor Strategic Research Center prepared this report using a structured monitoring and analytical methodology based on collecting and cross-referencing information from multiple sources in order to produce the most accurate possible assessment of ISIS activity between 1 and 31 July 2026.

Daily monitoring covered security and military developments in Syria, Iraq, and Africa, focusing on incidents believed to be linked to ISIS, whether through official claims of responsibility, attribution by security authorities or reliable local sources, or operational patterns consistent with the organization’s known methods.

Information Sources

This report is based on information obtained from multiple sources, including:

• Official statements issued by government and military authorities.

• Local sources and field correspondents.

• Open-Source Intelligence (OSINT).

• Official ISIS media releases and publications.

• Regional and local monitoring networks.

• Cross-referencing multiple independent sources to verify reported incidents.

Rather than relying on a single source, every effort has been made to corroborate available information through multiple independent channels whenever possible.

Classification of Attacks

For analytical purposes, Syria Monitor classifies reported incidents into three categories:

1. Officially Claimed ISIS Attacks

   Operations for which ISIS has publicly claimed responsibility through official statements or media releases.

2. ISIS-Attributed Attacks

   Incidents attributed to ISIS by security agencies, local sources, or credible media outlets, without an official claim by the organization.

3. Suspected ISIS-Linked Attacks

   Incidents whose tactics, targets, or operational environment are consistent with ISIS activity but which have not yet been conclusively confirmed by official or security sources.

Overview of ISIS Activity During July 2026

Throughout July 2026, ISIS continued to conduct security and military operations across three primary theaters: Syria, Iraq, and Africa, with noticeable differences in both operational intensity and tactics.

Monitoring indicates that the organization maintained its strategy of attritional warfare rather than territorial control, carrying out limited but recurring attacks against security forces, military personnel, local officials, and individuals perceived as cooperating with government authorities, while preserving the mobility of its cells across rural, desert, and remote areas.

At the same time, ISIS sustained a consistent propaganda campaign through its official media outlets. The group claimed responsibility for several attacks in Africa, whereas the majority of incidents attributed to ISIS in Syria and Iraq remained unclaimed despite displaying operational characteristics consistent with the organization’s established methods.

1. Syria

Throughout July 2026, Syria continued to witness a series of scattered security incidents attributed to the Islamic State (ISIS), with activity concentrated primarily in the governorates of Deir ez-Zor, Raqqa, Daraa, Rural Damascus, and Latakia, alongside isolated incidents reported in other areas.

Operations conducted during the reporting period were characterized by the use of:

• Improvised Explosive Devices (IEDs).

• Motorcycle-based assassinations.

• Attacks targeting security patrols.

• Assaults on security checkpoints.

• Targeting individuals affiliated with security and military institutions.

The pattern of attacks indicates that ISIS continues to rely on small, semi-autonomous cells capable of carrying out rapid, localized operations before withdrawing, rather than attempting to seize or hold territory or engage in prolonged confrontations.

Monitoring also suggests that most incidents occurred in areas characterized by security vulnerabilities or the presence of multiple security actors, conditions that provide militant cells with greater operational freedom and flexibility in planning and executing attacks.

1. Iraq

During July 2026, ISIS operational activity in Iraq continued at a lower tempo compared to other theaters. Nevertheless, monitoring indicates that the group’s cells retained the capability to conduct limited attacks across several governorates, particularly Anbar, Nineveh, Salah al-Din, Kirkuk, and Diyala.

The recorded incidents included:

• Attacks targeting security forces.

• Improvised Explosive Device (IED) attacks.

• Direct armed assaults.

• Night-time attacks.

• Hit-and-run operations.

The reporting period also witnessed a number of large-scale fires in agricultural areas. However, Syria Monitor does not classify any such incident as ISIS-related unless sufficient evidence or credible indicators support a connection between the event and the organization.

The observed operational pattern suggests that ISIS continues to rely on small, mobile cells capable of exploiting remote rural and desert terrain to carry out limited attacks while avoiding sustained engagements with security forces.

III. Africa

Throughout July 2026, Africa remained the most active theater of ISIS operations, with attacks recorded across Nigeria, Niger, the Democratic Republic of the Congo (DRC), Mozambique, and Cameroon.

Compared to Syria and Iraq, ISIS operations in Africa were generally larger in scale and more coordinated, involving:

• Attacks on military bases and barracks.

• Raids on villages and populated areas.

• Ambushes targeting government security forces.

• Executions of captured personnel.

• Arson attacks against homes and civilian property.

• Seizure of weapons, ammunition, and military equipment.

ISIS also continued to release regular statements and propaganda through its official media outlets, claiming responsibility for a number of these attacks as part of its ongoing effort to demonstrate its operational presence and influence across the African continent.

General Trends – July 2026

Monitoring throughout July 2026 identified several key trends that characterized ISIS activity during the reporting period, most notably:

• The continued shift of the organization’s operational center of gravity toward Africa.

• Persistent reliance on decentralized cells in both Syria and Iraq.

• Increased use of motorcycles in assassinations and rapid hit-and-run attacks.

• Continued use of Improvised Explosive Devices (IEDs) as one of the group’s primary attack methods.

• A continued focus on attrition against security forces rather than attempts to seize and hold territory.

• Sustained propaganda activity alongside military operations, particularly across Africa.

Documentation Standards

The report follows a number of documentation standards, including:

• Recording the precise date and geographical location of each incident.

• Identifying the type of attack and method of execution.

• Documenting the intended target.

• Recording human and material losses based on the most recent information available.

• Updating incident records whenever new information or official corrections emerge.

Casualty figures may vary between sources; therefore, the report relies on the most up-to-date information available at the time of publication, while acknowledging that some casualty figures remain preliminary and subject to revision.

Scope of the Report

This report focuses exclusively on ISIS operational activity during July 2026. It does not include every security or criminal incident reported in the countries under review unless credible indicators suggest a possible link to the organization. Likewise, incidents for which responsibility has not been conclusively established are classified as suspected pending additional evidence.

Syria

During July 2026, Syria continued to experience scattered attacks attributed to ISIS, primarily concentrated in Deir ez-Zor, Raqqa, Daraa, Damascus and its countryside, and Latakia.

Most recorded attacks involved assassinations, Improvised Explosive Devices (IEDs), and rapid motorcycle-based assaults targeting security personnel, military forces, local officials, and, in some cases, civilians.

Although the overall number of attacks remained lower than in previous years, the continued occurrence of incidents across multiple governorates indicates that ISIS retains operational cells capable of movement and execution, exploiting security gaps and the vast rural terrain.

Key Observations

• Continued activity by ISIS cells in eastern Syria.

• Primary targeting of security and military personnel.

• Heavy reliance on IEDs and assassinations.

• No evidence of attempts to seize territory, while ISIS maintains a presence through dispersed cells operating within the Syrian desert.

Methodological Note:
The following table includes attacks officially claimed by ISIS, incidents attributed to the organization by security or local sources, and attacks consistent with ISIS operational patterns that remain under verification, in accordance with the monitoring methodology adopted by Syria Monitor.

Iraq

Throughout July 2026, ISIS continued to conduct limited operations across Anbar, Nineveh, Salah al-Din, Kirkuk, and Diyala.

Compared to Africa, operational activity remained relatively limited and consisted primarily of IED attacks, direct armed assaults, and small-scale attacks targeting security forces.

Available information indicates that ISIS continues to maintain active cells in remote desert and rural areas, relying on a strategy of attrition while avoiding prolonged engagements with security forces.

Key Observations

• Continued activity by ISIS cells in remote areas.

• Persistent reliance on IED attacks.

• Security forces remained the primary targets.

• No territorial control was observed; however, ISIS continues to maintain a presence in the Nineveh Desert along the Syrian border, as well as the Hamrin and Makhoul mountain ranges.

Africa

Africa remained ISIS’s most active operational theater during July 2026, with attacks recorded across Nigeria, Niger, the Democratic Republic of the Congo (DRC), Cameroon, and Mozambique.

Operations included attacks on military bases, raids on villages, ambushes against government forces, executions of captives, the burning of homes, and the seizure of weapons and equipment, resulting in dozens of fatalities and injuries.

ISIS also continued to issue official claims of responsibility for a number of these attacks, reinforcing its propaganda efforts aimed at demonstrating its operational presence across the continent.

Key Observations

• Africa remained the organization’s primary operational theater.

• The number of attacks exceeded those recorded in Syria and Iraq.

• Government forces and rural communities remained frequent targets.

• Military operations continued to be accompanied by an active propaganda campaign.

Conclusions

Monitoring conducted throughout July 2026 indicates that ISIS continues to retain the capability to carry out dispersed attacks across multiple theaters, despite notable differences in operational intensity between Syria, Iraq, and Africa.

In Syria, the organization continued to rely on small operational cells conducting assassinations, IED attacks, and assaults against security patrols, with no indications of attempts to seize territory.

In Iraq, active ISIS cells maintained the ability to conduct limited attacks, particularly in rural and desert areas, while IEDs remained one of the group’s principal operational tools.

In Africa, ISIS remained significantly more active, both in terms of operational tempo and the scale of casualties, with continued attacks against military bases, government forces, and civilian communities. The organization also officially claimed responsibility for a considerable number of these operations.

Overall, the findings indicate that ISIS continues to pursue a long-term strategy of attrition, maintaining highly mobile decentralized cells while relying on low-cost, high-impact attack methods.

Recommendations by Syria Monitor

Based on the findings of this report, Syria Monitor recommends the following:

• Strengthen intelligence collection and monitoring capabilities in areas experiencing recurring ISIS activity.

• Enhance coordination and intelligence-sharing among security agencies operating in border regions.

• Expand capabilities for detecting and neutralizing Improvised Explosive Devices (IEDs), which remain the organization’s most frequently employed attack method.

• Intensify efforts to identify and disrupt ISIS logistical and financial support networks.

• Increase international cooperation in monitoring ISIS movements, particularly across Africa.

• Support counter-radicalization initiatives aimed at reducing recruitment, especially in security-vulnerable communities.

Conclusion

The July 2026 Monthly Monitoring Report confirms that, despite losing the territorial control it once exercised, ISIS continues to pose a persistent security threat through a dispersed network of operational cells capable of conducting attacks across multiple regions.

Africa remains the organization’s most active theater of operations, while Syria and Iraq continue to experience recurring attacks that demonstrate ISIS’s ability to exploit security gaps and conduct limited but sustained operations.

Syria Monitor Strategic Research Center will continue publishing periodic monitoring reports to track the evolution of ISIS activity and provide evidence-based analysis derived from field monitoring and open-source intelligence, supporting researchers, policymakers, and media organizations in understanding evolving security threats.