Rising ISIS Attacks in Syria, Iraq, and Africa During October 2026

Syria Monitor Warns of an Increasing Threat in Deir ez-Zor, Kirkuk, and Nineveh

Syria Monitor – Strategic Research Center

Monthly Security Report | October 2026

Syria Monitor – Strategic Research Center has confirmed that its field monitoring and security assessments during October 2026 documented continued armed activity by the Islamic State (ISIS) across Syria, Iraq, and several African countries. The recorded incidents included attacks targeting government forces, military formations, and security personnel, alongside assassinations, kidnappings, and improvised explosive device (IED) attacks.

According to the center’s documentation and field sources, the month witnessed a series of operations attributed to ISIS, concentrated in areas that have historically served as major operational environments for the organization. These developments have produced security indicators that warrant warnings of a potential increase in attacks during the coming period.

Available information suggests that ISIS continues to rely on small cells and relatively limited armed groups capable of conducting rapid attacks against military and security targets. These groups exploit the geographical characteristics of rural and desert environments, where maintaining continuous surveillance over all movement routes remains a significant challenge.

Deir ez-Zor Governorate in eastern Syria and Kirkuk Governorate in northern Iraq stand out as two areas requiring intensified security monitoring. Syria Monitor also warns of the potential expansion of ISIS activity into additional areas of Nineveh Governorate, particularly desert corridors connecting it with Salah al-Din and Anbar.

In Africa, incidents monitored by the center demonstrated the continued ability of ISIS and its regional affiliates to conduct deadly attacks, particularly in Nigeria and the Democratic Republic of the Congo (DRC).

Syria Monitor assesses that the significance of these developments does not necessarily lie in ISIS’s ability to regain territorial control, but rather in its continued capacity to conduct repeated attacks, inflict casualties, and maintain sustained pressure on government security forces.

1. Syria:

Continued Attacks and Warnings of Escalating ISIS Activity in Deir ez-Zor

Throughout October 2026, Syria experienced a series of operations documented by Syria Monitor as part of ISIS activity. These incidents affected Deir ez-Zor, Raqqa, Homs, Rural Damascus, and Daraa, alongside security incidents in other areas.

Deir ez-Zor: Growing Threat Indicators

Deir ez-Zor emerged as one of the most significant areas of monitored activity during the month, with repeated attacks targeting security and military patrols and vehicles in the eastern countryside and other parts of the governorate.

On October 1, an explosive device attached to a General Security Forces vehicle detonated near a security checkpoint in the Jazrat al-Buhamid area of rural Deir ez-Zor, causing injuries according to preliminary reports.

On October 2, an IED explosion in the Islah al-Husseiniyah area wounded two military engineering personnel during a field operation.

On October 9, gunmen attacked a vehicle carrying three people in the town of Sa’alu in eastern rural Deir ez-Zor, killing one person and wounding the other two.

On October 19, an IED targeted a General Security Forces patrol in the town of al-Shuhail, continuing a pattern of attacks against security movements in the eastern countryside.

On October 22, Syria Monitor also recorded an IED explosion targeting a General Security Forces patrol in Deir ez-Zor Governorate. No final casualty figures were available. The relationship between this report and previously recorded incidents remains insufficiently established, requiring further review before counting it as a separate operation.

These incidents indicate the persistence of the security threat in rural Deir ez-Zor, particularly in areas east of the Euphrates River, where geographical conditions, the distribution of settlements, agricultural areas, and secondary roads create continuing security challenges.

Syria Monitor warns that repeated attacks against security patrols and vehicles over a relatively short period may indicate attempts by ISIS cells to intensify their activity and test the ability of security forces to monitor movements and secure transportation routes.

This does not indicate that ISIS exercises territorial control. However, it demonstrates the persistence of an operational threat requiring close monitoring, particularly if the coming weeks witness an increase in attack frequency or simultaneous operations across multiple locations.

Raqqa: Attacks Against Security Movements

On October 7, Syria Monitor documented an IED attack targeting a General Security Forces patrol inside the city of Maadan, east of Raqqa.

The incident is significant because of its location along a geographical corridor connected to Deir ez-Zor Governorate, highlighting the importance of monitoring security developments along the eastern Euphrates axis.

Homs and the Syrian Desert

Homs Governorate witnessed attacks against government and security forces during the opening days of October.

On October 1, a bus carrying military personnel came under armed attack near Masyaf Bridge, reportedly killing seven people according to preliminary information.

On the same day, an IED targeted a security patrol near the Tiyas (T4) military airbase in the Syrian desert, killing three personnel.

On October 13, a security force came under attack along the Athriya–Salamiyah road. According to the latest casualty figures received by Syria Monitor, four personnel were killed and four others wounded.

These incidents indicate the persistence of security threats in the Syrian desert and along routes connecting central Syria with the country’s eastern governorates.

Rural Damascus and Daraa

On October 2, a bus came under armed attack in the Ras al-Maara area of the Qalamoun region in Rural Damascus, killing three people and wounding seven others.

On October 7, an armed attack targeted a General Security Forces patrol at Namer Bridge in rural Daraa, wounding two personnel according to preliminary figures.

The Rankous area of Rural Damascus also witnessed clashes between government forces and armed militants, resulting, according to information received by the center, in the deaths of three government personnel and injuries to ten others.

On October 1, Syria Monitor also recorded the killing of commander Anwar al-Jundi in the city of al-Sanamayn in rural Daraa.

Security Assessment: Syria

Syria Monitor assesses that continued attacks in Deir ez-Zor and the Syrian desert demonstrate that the ISIS threat remains active despite the country’s evolving military and security environment.

Deir ez-Zor stands out as the area requiring the closest monitoring during the coming period, given the recurrence of incidents throughout the month and the organization’s historical activity in the governorate’s countryside.

The center warns that continued attacks against security patrols and vehicles could increase pressure on deployed forces, particularly if accompanied by a rise in IED incidents and direct armed assaults.

2. Iraq:

Kirkuk as the Main Operational Hotspot and Warnings of Potential Expansion Toward Nineveh

Iraq experienced a series of operations documented by Syria Monitor as ISIS activity during October, with attacks concentrated primarily in Kirkuk Governorate, particularly Hawija District and its surrounding areas.

Available information indicates that ISIS retains the capacity to conduct repeated attacks against security and military forces amid changes in Iraq’s security environment following the restructuring of the International Coalition’s military presence.

Kirkuk and Hawija: Repeated Attacks Despite Heightened Security Measures

On October 5, barracks belonging to the Federal Police’s 9th Brigade at the Danadish intersection in the Barghaliyah area near Hawija came under armed attack. According to preliminary reports, the incident resulted in a combined total of five personnel killed and wounded.

On October 6, another armed attack targeted a position belonging to the Popular Mobilization Forces’ (PMF) 61st Brigade in Hawija District, despite heightened security measures and a state of alert in the area.

On October 7, Syria Monitor recorded clashes in the Daquq area of Kirkuk Governorate, alongside an armed attack that wounded two people.

On October 10, a Federal Police position in Hawija came under another attack, accompanied by clashes and field reports indicating that security personnel requested air support to confront the attackers.

On the same day, a hand grenade targeted a residential property in the Sayyadah area of Kirkuk, causing material damage.

The recurrence of attacks in Hawija over several consecutive days indicates the persistence of a security threat despite deployment operations, searches, and intensified security measures by Iraqi forces.

Wadi Zghaitun: Senior Iraqi Army Officer Killed

In mid-October, an IED explosion in the Wadi Zghaitun area of Rashad Subdistrict in Kirkuk Governorate struck a military Humvee during an inspection operation at a location previously targeted by an airstrike.

The explosion killed Brigadier General Ahat Yasser Khudair Hussein, commander of the 11th Infantry Division’s Communications Command, and another Iraqi Army serviceman. Other personnel were wounded, and the military vehicle was destroyed.

According to field information obtained by Syria Monitor, the explosion occurred near al-Awashirah village within the Wadi Zghaitun area.

The incident is particularly significant because of the casualties it caused and its occurrence during a military operation associated with efforts to pursue ISIS activity.

It also highlights the danger posed by explosive devices in areas previously used by ISIS, including locations subjected to military operations or airstrikes.

Attacks Continue Through the End of October

On October 22, a military position in Hawija came under armed attack targeting Iraqi Army and PMF personnel, following the arrival of new military units to replace Federal Police forces in the district.

On the same day, security forces closed several roads inside Kirkuk city after discovering an explosive device along a roadside.

On October 29, gunmen raided a farm on the outskirts of Hawija, approximately six kilometers from al-Sayhah village, and abducted a man suspected of cooperating with government forces. The abductee was reportedly the son of a local mukhtar.

According to field information, the attackers released his brother and took the targeted individual to an unknown location.

The incident is additionally significant because it occurred while the commander of Kirkuk Operations was reportedly present in Hawija District inspecting deployed military units.

Syria Monitor assesses that repeated attacks and kidnappings in Hawija demonstrate the continuing ability of armed cells to reach selected targets and conduct rapid operations despite security precautions.

Nineveh: An Early-Warning Area

Syria Monitor warns of the potential expansion of ISIS activity into additional areas of Nineveh Governorate, particularly the Hatra Desert and open areas connected to Salah al-Din and Anbar governorates.

The importance of these areas stems from their geography, extensive desert and rural terrain, and their connections to corridors previously used by ISIS cells.

Although the most prominent attacks documented during October were concentrated in Kirkuk, Syria Monitor considers it necessary to maintain heightened security monitoring in Nineveh.

The center emphasizes that this warning represents a forward-looking risk assessment rather than confirmation that Nineveh experienced a comparable increase in attacks during the month.

Anbar and Salah al-Din

On October 4, an IED targeted a security force in western Anbar, killing two personnel and wounding two others.

On October 6, Syria Monitor recorded another IED attack in the al-Obeidi area of western Anbar, wounding at least one security member.

The center also documented an IED attack targeting a PMF patrol in the Dujail area of Salah al-Din Governorate.

These incidents indicate the continuing danger posed by explosive devices against patrols and military movements, particularly in open terrain and desert corridors.

Security Assessment: Iraq

Syria Monitor assesses that Kirkuk Governorate currently represents the principal concentration of monitored ISIS activity in Iraq.

This assessment is based on the recurrence of attacks in Hawija and its surroundings, the targeting of multiple security and military formations, and the continuation of operations despite intensified security measures.

The center warns that the persistence of this pattern could lead to an increased frequency of attacks in the coming period, particularly if indicators emerge of activity spreading into additional areas of Nineveh, Salah al-Din, and Anbar.

At the same time, current information does not indicate that ISIS has regained control over cities or territory. Instead, the organization continues to rely on small cells and short-duration operations.

3. Africa:

Continued Deadly Attacks in Nigeria and the Democratic Republic of the Congo

Africa witnessed a series of attacks during October that Syria Monitor documented as part of ISIS and its affiliates’ activities, with substantial casualties reported particularly in Nigeria and the Democratic Republic of the Congo.

Nigeria: Attacks Against Military Forces and Positions

On October 3, the Marte area of Borno State in northeastern Nigeria came under armed attack, reportedly killing 18 people according to preliminary information.

On October 9, Syria Monitor recorded an armed attack targeting a Nigerian Army position, killing two soldiers according to the initial casualty report.

On October 15, a Nigerian Army camp in Borno State came under a major attack, reportedly killing 20 soldiers and resulting in the attackers taking control of the camp and its equipment, according to preliminary information.

On October 18, eight Nigerian Army personnel were killed when an IED detonated during a military mission near the Cameroonian border in northeastern Nigeria.

On October 19, an IED struck a Nigerian Army patrol in Yobe State, killing one officer and six other soldiers.

Syria Monitor also documented an attack targeting government positions in the Salawa area of Sokoto State, although no final casualty figures were available.

These incidents demonstrate the continued severity of attacks targeting military forces in northern and northeastern Nigeria, with IEDs and direct assaults against military camps among the most consequential operational patterns.

Democratic Republic of the Congo

On October 16, an armed attack struck locations in the Makimbilio, Biasiko, and Makamanda areas of Mambasa Territory in Ituri Province, northeastern Democratic Republic of the Congo, reportedly killing ten people according to preliminary figures.

On October 28, an army barracks in the northeastern part of the country came under armed attack, killing three Congolese soldiers and wounding seven others.

These operations highlight the continuing security threat posed by ISIS-affiliated armed groups in unstable areas of northeastern DRC.

Security Assessment: Africa

Syria Monitor assesses that attacks recorded in Nigeria and the Democratic Republic of the Congo demonstrate the continued ability of ISIS and its regional affiliates to inflict substantial casualties.

Some African operations have resulted in higher death tolls than the more limited attacks recorded in Syria and Iraq, particularly when military camps and isolated positions have been targeted.

Nevertheless, the security, geographic, and organizational environments differ significantly across these operational theaters. The various affiliates should therefore not be assumed to possess identical capabilities or operate under a unified tactical model.

4. Security Analysis: What Do the October Operations Reveal?

Monitoring data for October indicate that ISIS continues to employ several operational methods, varying according to geographic conditions and target characteristics.

Improvised Explosive Devices: IEDs remained a recurring method of attack against patrols, vehicles, and military movements, particularly in Deir ez-Zor, Kirkuk, Anbar, and northeastern Nigeria.

Direct Armed Assaults: These attacks targeted barracks, security positions, and military camps, especially in Hawija and parts of Nigeria.

Assassinations and Kidnappings: Such incidents were documented in several areas, highlighting the continued risk of targeted violence against individuals associated with government forces or security institutions.

Exploitation of Rural and Desert Terrain: The geographic characteristics of the affected areas underscore the importance of open terrain and secondary routes in sustaining security threats.

These operational patterns indicate that ISIS does not necessarily need to control extensive territory to conduct consequential attacks. Small cells can inflict casualties through rapid assaults or the deployment of explosive devices.

The recurrence of operations over short intervals may also indicate attempts to test government forces’ response capabilities. However, this alone is insufficient to establish centralized coordination across all recorded attacks.

5. Syria Monitor’s Warnings for the Coming Period

Syria Monitor – Strategic Research Center warns that the security threat associated with ISIS is likely to remain significant in the coming weeks, requiring focused monitoring of three principal areas in Syria and Iraq.

1. Deir ez-Zor – Eastern Syria

The center assesses that repeated attacks against security patrols and vehicles in rural Deir ez-Zor represent an indicator requiring heightened monitoring.

The principal concern is the potential continuation of attacks against security movements and the emergence of additional operations along rural routes and secondary roads, particularly if attack frequency increases compared with previous periods.

2. Kirkuk – Northern Iraq

Kirkuk represents the primary early-warning area in Iraq due to repeated attacks in Hawija and surrounding locations and the targeting of security and military forces despite heightened precautions.

The center warns of the potential continuation of armed assaults and IED incidents, emphasizing the importance of monitoring changes in operational frequency and geographic distribution.

3. Nineveh – Iraq

Nineveh remains an early-warning area, particularly the Hatra Desert and regions connected to Salah al-Din and Anbar.

Syria Monitor assesses that continued activity in Kirkuk warrants close monitoring for any indicators of the threat extending toward Nineveh, without assuming that such expansion has occurred before supporting field evidence becomes available.

In Africa, continued deadly attacks in Nigeria’s Borno and Yobe states, as well as northeastern DRC, require further monitoring of operational patterns and casualty trends.

6. Syria Monitor’s Final Assessment

Syria Monitor – Strategic Research Center concludes that October 2026 witnessed the continued threat posed by ISIS across Syria, Iraq, and parts of Africa, based on operations documented through the center’s field sources and monitoring network.

The developments demonstrate that ISIS retains the capacity to conduct armed assaults and IED attacks against military and security targets, although casualty levels and operational capabilities vary considerably across different regions.

In Syria, Deir ez-Zor stands out as one of the principal early-warning areas due to repeated attacks against security patrols and vehicles and continued armed activity in the eastern countryside.

In Iraq, Kirkuk represents the main operational hotspot, with Hawija and surrounding areas experiencing repeated attacks throughout the month. Nineveh, meanwhile, remains an area of concern regarding potential geographic expansion.

In Africa, attacks in Nigeria and the Democratic Republic of the Congo demonstrate the continued ability of regional ISIS affiliates to conduct deadly operations against government forces and military positions.

Syria Monitor warns that the persistence of these indicators in the coming weeks could lead to an increased frequency of ISIS attacks in eastern Syria and northern Iraq, particularly in Deir ez-Zor and Kirkuk, while any signs of activity expanding toward Nineveh require close monitoring.

The center emphasizes that the current threat does not necessarily involve a return to territorial control. Instead, it reflects ISIS’s continued ability to conduct repeated, short-duration operations that could develop into a more sustained operational pattern under favorable conditions.

The most important indicator during the coming period will be whether attacks remain isolated and sporadic or whether a sustained increase emerges in their frequency and geographic distribution, requiring a reassessment of the threat level in the most vulnerable areas.

Syria Monitor – Strategic Research Center

---

Methodological Note: This report is based on Syria Monitor’s field monitoring records through October 29, 2026. The classification of incidents as ISIS operations reflects attribution by the center and its sources and does not necessarily constitute independently published verification of the organization’s responsibility for every incident. S