Salafi-Jihadi Movement Weekly Update, May 31, 2023

Authors: Brian Carter, Kathryn Tyson, Liam Karr, and Peter Mills

Data Cutoff: May 31, 2023, at 10 a.m.

Key Takeaways:

Iraq and Syria. ISIS likely is increasing large-scale operations, setting conditions to challenge regime control in some population centers. ISIS deployed more than 100 fighters in two separate operations in spring 2023, which indicates the group’s ability to coordinate between disparate elements to conduct sophisticated tactical efforts. ISIS is using its operations in the central Syrian desert to neutralize anti-ISIS forces in key areas. The group will gradually expand its attack zones into urban areas to coerce the population into supporting ISIS.

Burkina Faso. Al Qaeda–linked militants increased the rate and lethality of their attacks in northwestern Burkina Faso in May 2023 to strengthen and expand their support zone along the border of central Mali and northwestern Burkina Faso. The al Qaeda–linked group is using these support zones in northwestern Burkina Faso to expand toward the Burkinabe capital. The group will also use these zones to expand south along the Burkina Faso–Mali border to threaten southern Mali and Burkina Faso’s second largest city and economic capital in southwestern Burkina Faso.

Somalia. Self-admitted poor troop performance likely enabled al Qaeda’s Somali affiliate al Shabaab to overrun a Ugandan African Union base in southern Somalia in late May. The Ugandan contingent’s intelligence gaps and lack of close air support likely also contributed to al Shabaab’s success. Al Shabaab also overran a Somali National Army (SNA) base in central Somalia in late May, underscoring the continued vulnerability of holding forces in recently liberated areas of Somalia. 

Pakistan. Pakistan may have postponed an anti-Tehrik-e-Taliban Pakistan (TTP) operation to focus on suppressing protests in early May. The removal of counterterrorism pressure on the TTP may permit the group to conduct attacks against sensitive targets in Islamabad, where the government is holding meetings to discuss the protest crisis. Local sources claimed the TTP is planning attacks on high-level political leaders in Islamabad.

Afghanistan. Iran and the Taliban rhetorically deescalated following border clashes amid an ongoing water dispute. Both sides took measures to reinforce the border and are likely prepared for future clashes but will seek to avoid instigating another round of skirmishes. The Taliban will likely seek to preserve its economic relationship with Iran by deescalating tensions along the border.

Assessments:

Iraq and Syria. ISIS is increasing its rate of large-scale attacks against regime security forces, likely setting conditions to challenge regime control in some population centers. ISIS conducted one major operation—the capture of Al Kawm in December 2022—between December 2022 and March 2023. ISIS has conducted at least two large-scale attacks in April and May 2023.[1] Current ISIS operations in the central Syrian desert aim to disrupt the Syrian regime’s and Russian forces’ ability to move freely in the area and counter ISIS movements.

Two separate ISIS operations in April and May 2023 involved 100–150 ISIS fighters targeting regime positions along a key road. ISIS successfully constrained the regime forces’ freedom of movement during a series of battles near al Kawm in early April.[2] Russian milblogger Rybar reported that a 150-fighter ISIS force attacked a Russian base north of Sukhnah town on May 25–26.[3] A third attack featuring an unspecified “large number” of ISIS fighters attacked regime checkpoints between Rusafa and Tabqa on May 31.[4] This is a break from previous hit-and-run ISIS attacks, which were small in scale and did not involve massing fighters.[5]

Figure 1. ISIS Operations in Central Syria Along the Kawm-Sukhnah Axis

Source: Brian Carter.

These operations indicate a high degree of tactical and organizational sophistication that enable complex and large-scale operations. ISIS forces fixed and outflanked Wagner-backed Syrian forces in battles during April while orchestrating complex ambushes using improvise explosive devices and small-arms fire.[6] The large size of the ISIS forces involved also demonstrates a high level of coordination. ISIS cells are siloed from one another to improve operational security, meaning a force of 100–150 fighters must be controlled by a mid-level ISIS commander.[7]

Ongoing ISIS efforts to isolate, fix, and block regime and Russian forces have established ISIS support zones in desert areas that have enabled the group to strengthen and challenge major anti-ISIS forces. ISIS attacks have increased ISIS’s control over unpopulated territory in the central Syrian desert.[8] Some local anti-ISIS forces under regime control already intermittently refuse to patrol the central Syrian desert, which challenges Syrian efforts to clear ISIS areas by limiting already limited manpower.[9] This enables ISIS to use these unpopulated areas to rebuild itself and mass forces.[10] Chronic resource shortages further benefit ISIS. Regime forces were unable to retake the ISIS-controlled, unpopulated town of al Kawm for two weeks in December 2022 due to fuel shortages.[11]

ISIS’s transition to large-scale attacks could enable it to neutralize regime forces garrisoned in key areas, particularly if those forces lack airpower. Russia has previously limited or withheld air support for regime forces in central Syria.[12] ISIS successfully rolled back regime gains after two separate regime and Russian anti-ISIS operations, demonstrating ISIS’s ability to render counter-ISIS forces unable to interfere with ISIS operations.[13] ISIS has not fully neutralized pro-regime forces in key towns such as Sukhnah. Liwa al Quds launched an operation against ISIS forces northwest of Sukhnah in mid-May and began preparations for a separate mission north of Kabajib on May 30.[14]

Figure 2. ISIS Control Indicators and Activity in 2023

Source: Brian Carter.

These ISIS efforts to access the population would likely begin in areas the regime assigns lower priority to, which will enable the group to gradually build up resources to take on harder targets. ISIS is already pressuring key urban areas and will almost certainly use greater freedom of movement in central Syria to gradually expand its attack zones into urban areas in an effort to establish support zones.[15] ISIS efforts to increase freedom of movement by limiting the ability of regime and Russian forces to interfere will allow ISIS the ability to expand efforts to coerce cooperation in populated areas.  

ISIS will likely use increased support from urban populations to gain access to key resources required to increase its military capabilities throughout Syria. ISIS currently relies on small-scale and less-reliable ground lines of communication to bring goods into central Syria.[16] Access to the urban populations will allow ISIS to better supply its cells and launch more sophisticated attacks. Urban areas also afford ISIS greater opportunities to exploit the human and financial capital required to launch large-scale military operations, including against detention facilities and other high-value targets. The effects of ISIS’s access to these resources will be most immediately felt in central Syria, though ISIS would eventually attempt to resource higher-profile attacks in northeastern Syria.

Russia in Syria. ISIS likely killed a Russian colonel in a major attack north of Sukhnah, Homs province, on the night of May 25–26. Local Russian media also reported the officer died at a “command post” in Syria on the night of May 25–26, refuting Hayat Tahrir al Sham (HTS) claims that the officer died during daytime HTS shelling in Latakia province on May 26.[17] Russian milblogger Rybar said that ISIS “probably” killed the colonel at a Russian base north of Sukhnah during the May 25–26 ISIS attack.[18] Idlib-based opposition Twitter accounts also refuted the HTS claims.[19]

It is unlikely that HTS killed the Russian colonel in its daytime shelling of a joint Syrian-Russian command post in Latakia province on May 26. An HTS “military source” told northeastern Syrian outlet NPA Syria that HTS killed the colonel and up to 40 other Syrian and Russian personnel during daytime shelling near Jub al Ahmar on May 26.[20] Ukrainian reporting also claimed the colonel died in Latakia, citing a minor Russian milblogger who later deleted their post.[21]

Russian air strikes in the aftermath of the HTS shelling may be in retaliation for the large number of casualties caused by the May 26 shelling. Russian forces conducted air strikes against HTS-held territory in retaliation for the shelling, but the air strikes hit civilian areas.[22]

Figure 3. The Salafi-Jihadi Movement in the Middle East

Source: Kathryn Tyson.

Burkina Faso. Al Qaeda–linked Jama’at Nusrat al Islam wa al Muslimeen (JNIM) increased the rate and lethality of its attacks in northwestern Burkina Faso in May 2023 to strengthen and expand its support zone along the border of central Mali and northwestern Burkina Faso. JNIM attacked northwestern Burkina Faso’s Boucle du Mouhoun region 10 times in May, equaling its total attacks in January, which was its highest monthly total of 2023.[23] JNIM did not conduct any attacks in the region during April.[24] JNIM’s May attacks killed at least 90 civilians, which is nearly double the total number of civilians killed in the first third of 2023.[25] The targeting of civilians—including village evictions—indicates the group is trying to strengthen and expand its support zones by coercing civilians.[26] Many attacks targeted villages along the contested N14 road in the northeastern district of Boucle du Mouhoun, showing JNIM is trying to expand its support zones to cover the road.[27]

Figure 4. JNIM Attacks in the Boucle du Mouhoun Region

Source: Liam Karr.

JNIM is using its support zones in northwestern Burkina Faso to expand toward central Burkina Faso and the Burkinabe capital, Ouagadougou. The group has conducted several attacks along the roads between northwestern Burkina Faso and Ougadougou since December 2022, which shows its intent to open new attack zones closer to the capital from the northwest.[28] JNIM has already established a sanctuary around the Tiogo forest on the eastern edge of Boucle du Mouhoun to link support zones in northwestern Burkina Faso to the center of the country. JNIM has had a presence in the forest since late 2021 but has only attacked the surrounding area a few times.[29] Burkinabe forces claimed to destroy at least seven bases and kill at least 29 militants when clearing the forest and surrounding area in late May, indicating that JNIM is using the area as a forward support zone.[30]

JNIM will also use the support zone along the border of central Mali and northwestern Burkina Faso to expand south along the border in the coming years. JNIM already launched a campaign targeting southwestern Boucle du Mouhoun that captured a district capital in the last quarter of 2022.[31] Burkinabe forces reasserted control of major population centers in December 2022, but JNIM has likely retained some support zones in the Mouhoun River Valley and is continuing to attack the main roadways connecting northwestern and southwestern Burkina Faso.[32]

Previous JNIM patterns indicate the group will likely increase operations on the Malian side of the border as part of any effort to expand south. JNIM increased its rate of attacks in central Mali in the last quarter of 2022 to consolidate its support zones there before escalating attacks across the border in Boucle du Mouhoun in January 2023.[33] Expanding south would allow JNIM to more easily support its campaign to degrade Malian lines of communication around the capital in southern Mali while also expanding attack zones toward Burkina Faso’s second largest city and economic capital, Bobo Dioulasso.

Somalia. Al Shabaab overran a Ugandan African Union base in southern Somalia on May 26 likely due to poor Ugandan troop performance. Al Shabaab stormed the base with at least three suicide vehicle-borne improvised explosive devices (SVBIED) and 800 fighters.[34] The group captured the base, killed at least 50 Ugandan soldiers, and still had control of the surrounding town as of May 28.[35] The Ugandan company defending the base was outnumbered but relatively well prepared for the attack. The Ugandans had advanced warning of an imminent al Shabaab attack in the area and sufficient defenses and claimed to destroy the SVBIEDs before they breached the base perimeter.[36] However, Ugandan officials said many of troops panicked and fled to a nearby base, allowing al Shabaab to overwhelm the remaining defenders.[37] Al Shabaab has used complex attacks involving SVBIEDs and overwhelming numbers of fighters to overrun African Union bases five times since 2015.[38]

The Ugandan contingent’s intelligence gaps contributed to al Shabaab’s success. The Ugandan contingent had advanced intelligence of the attack, but it was still caught by surprise because it inaccurately assessed that al Shabaab would attack a different base in the area.[39] Some locals often know about imminent al Shabaab attacks because al Shabaab uses local informants to gain information about the bases.[40] More and better contact with the local population could have improved the Ugandan contingent’s intelligence gathering and their knowledge of the attack.

The defending Ugandan contingent’s lack of close air support may have also enabled al Shabaab to overrun the base. US Africa Command and African Union air forces both claimed to engage retreating al Shabaab militants that had looted the base.[41] These statements imply that neither was able to provide close air support while al Shabaab was attacking the base. Ethiopian helicopters provided critical close air support the one time African Union forces successfully repelled a large-scale al Shabaab attack in 2016.[42] Uganda has similar helicopter assets in southern Somalia.[43] However, the base may have collapsed too rapidly for air support to arrive, given that many of the defenders fled the base early in the fighting.

Central Somalia. Al Shabaab overran an SNA base in central Somalia, underscoring the continued vulnerability of holding forces in central Somalia. Al Shabaab stormed the base of newly deployed Eritrean-trained SNA units in central Somalia on May 30.[44] The group published pictures of dozens of dead SNA soldiers.[45] Al Shabaab attacked the same base town using SVBIEDs on April 22.[46] The May 30 attack is at least the third time that al Shabaab has overrun Somali forces in recently liberated areas of central Somalia in 2023.[47] CTP has previously assessed that these attacks are causing unsustainable casualties that are stalling offensive counterterrorism operations in central Somalia. This lack of counterterrorism activity is creating opportunities for al Shabaab to undo the losses it has sustained in central Somalia since 2022 by allowing the group to continue organizing these large-scale attacks and undermine local confidence in counterterrorism forces.[48] Somali forces may be improving their response to the attacks, as a quick reaction force from a nearby town ambushed the al Shabaab militants after the attack and inflicted dozens of casualties.[49]

Figure 5. The Salafi-Jihadi Movement in Africa

Source: Kathryn Tyson.

Pakistan. The Pakistani military may have postponed a nationwide counter-TTP campaign to focus on countering major protests in early May.[50] The military has not announced the scope of these operations as it indicated it would in late April or early May. The Pakistani military deployed to assist local security forces with suppressing protests in early May and arrested high-level political leaders supporting the protests, which constrained the Pakistani security establishment’s ability to address the threat from Salafi-jihadi groups.[51]

The military’s deployment across Pakistan to quell protests in May could have allowed the TTP to increase attacks by weakening counterterrorism pressure on the group.[52] The TTP nearly doubled the number of its attacks in May compared to monthly attack averages in 2023. The TTP claimed 70 attacks in May, compared with an average of 40 attacks per month in 2023.[53]

The TTP may expand its attacks by targeting politicians in Islamabad, where the government is holding meetings on the political crisis. Pakistani news cited anonymous sources that claimed the TTP is planning attacks on high-level political leaders, including the Pakistani interior minister and members of the ruling Pakistan Muslim League Party.[54] The TTP continues to use the political crisis in Pakistan to discredit the Pakistani government and military and recruit. A senior TTP leader condemned the Pakistani military for creating a “civil war” in Pakistan on May 30.[55] The leader also released statements praising the protests in early May and calling for protestors to join the TTP and attack the military.[56] The TTP attempted to attack government targets in Islamabad in December 2022, and it maintains attack cells in the city.[57]

Afghanistan. Iran and the Taliban are signaling they seek to avoid further border clashes over water disputes, though they are both preparing for further border clashes. Iranian and Taliban officials employed de-escalatory rhetoric on May 31, emphasizing border clashes were under control.[58] Iran reinforced the Iran-Afghanistan border to pressure the Taliban to make concessions regarding an ongoing water dispute.[59] The Taliban mobilized reinforcements in response and contested Iranian efforts to construct additional border defenses. Both Taliban and Iranian officials have said they seek to deescalate the current border tensions.[60]

Further Iran-Taliban clashes or Taliban support for anti-Iran Baloch militants could escalate the situation and prevent diplomatic efforts to address the crisis.[61] High-level talks between Taliban and Iranian commanders would signal both sides are continuing military cooperation to prevent future clashes. A diplomatic resolution would allow the Taliban to preserve its economic relationship with Iran, which remains important given Afghanistan’s dire socioeconomic crisis.[62] The Taliban’s ability to release additional water to Iran will remain limited due to drought, but it may marginally increase water flow to Iran as a gesture of goodwill, which the Taliban did in 2022.[63]

Figure 6. The Salafi-Jihadi Movement in Central and South Asia

Source: Kathryn Tyson.