A series of attacks, attempted operations and counterterrorism raids across Iraq, Syria and Jordan has raised renewed concerns about the activities of Islamic State (ISIS) sleeper cells, with security authorities confronting an increase in operations targeting military personnel, police officers, civilians and religious sites. Although the group remains fragmented and its activities largely confined to smaller-scale operations, developments over the past month indicate that its networks retain the capacity to conduct attacks across national borders and exploit weaknesses in regional security cooperation.
In Iraq, the latest escalation has been concentrated in Hawija district, southwest of Kirkuk, where ISIS fighters conducted attacks against government security forces on two consecutive days in October. On October 5, militants disabled thermal imaging cameras before attacking the Iraqi Federal Police’s 9th Brigade. The following day, October 6, they targeted the Popular Mobilisation Forces’ (PMF) 61st Brigade. One Iraqi police officer, Bakr Majid Mohammed, was killed while defending his guard post. The attack was the first attributed to ISIS against government authorities since the withdrawal of US military forces and the conclusion of the Counter-ISIS Mission in Iraq on September 30.
The attacks continued despite the heightened security response. On October 10, just four days after the initial two-day assault, ISIS militants again targeted the Federal Police facility, attacking surveillance cameras before fleeing following clashes with security forces. On October 14, Brigadier General Ahat Yasser Khudair Hussein, commander of the Communications Command of Iraq’s 11th Infantry Division, and Warrant Officer Mutaz Shahid Abbas were killed when an explosive device detonated at an ISIS hideout in a rural valley in Kirkuk.
The increase in attacks prompted Iraqi authorities to introduce additional security measures across affected areas. Surveillance was strengthened around rural farms and villages, while overnight curfews were imposed in several villages and districts in Kirkuk province to restrict movement and facilitate security operations. On October 13, Iraqi security forces also conducted airstrikes against suspected ISIS hideouts in Wadi Zghaitoun, killing two militants, according to official reports. Nevertheless, the group continued operating in the area. On October 29, suspected ISIS militants abducted a civilian from Al-Sayha village in Hawija, triggering a widespread search operation by security forces.
The developments have prompted warnings from Iraqi security officials about the possibility of sleeper cells reorganising. Ahmed Ramzi Koprulu, chairman of the Kirkuk Provincial Council’s Security and Defence Committee, called for stronger security arrangements and cooperation between agencies to prevent ISIS networks from regrouping. Prime Minister Ali al-Zaidi has also urged greater coordination between federal Iraqi and Kurdish security agencies, calling for increased operational readiness, updated procedures and improved cooperation. The agencies have historically operated through fragmented and competitive security structures, complicating efforts to coordinate responses across their respective areas of responsibility.
In neighbouring Syria, authorities have intensified operations against suspected ISIS networks following a series of attacks during the summer. Security forces have conducted raids and arrests in Homs, Damascus and Deir ez-Zor, targeting individuals suspected of involvement in attacks and assassinations during 2025 and 2026, as well as networks allegedly preparing further operations against civilian and security targets.
On October 6, Syrian security forces arrested Khaled Raed Birouni, also known as Abu Hassan Dushka, identified as the ISIS commander in Homs and a key operative in several attacks in the area. These included the December 2025 attack on the Wadi al-Dhahab mosque. A separate operation took place on October 22 in Rankous, west of Damascus, where security forces attempted to dismantle a nine-member ISIS network. Six members were arrested, while two Syrian security officers were killed and five others wounded during a three-hour exchange of gunfire with militants who refused to surrender. Two members of the network were killed, while another two allegedly escaped. Authorities subsequently imposed a curfew in the area.
On November 3, security forces arrested two suspected ISIS members and seized weapons and ammunition from a hideout in Deir ez-Zor. The network was allegedly connected to the 2025 assassination of Ministry of Defence official Ibrahim al-Jasim near the al-Rasheed Mosque in al-Mayadin.
The Syrian operations have acquired additional significance following a deadly attack in Jordan attributed by Amman to an ISIS network operating from southern Syria. On October 23, three gunmen attacked a funeral procession at St George Greek Orthodox Church in the village of Hmood, in Jordan’s Karak Governorate. Nine people were killed and up to 40 wounded. Jordanian security forces arrested the three attackers following a gunfight on October 26.
Although the gunmen were Jordanian citizens, the Jordanian government said they belonged to an ISIS network suspected of operating from neighbouring southern Syria. The allegation prompted Jordanian military strikes against suspected ISIS positions in Syria’s Daraa governorate. Jordan’s Armed Forces said the operations neutralised 20 ISIS militants. However, seven civilians were also killed in the strikes, generating diplomatic tensions between Amman and Damascus. The two governments subsequently agreed to establish a joint investigative committee to examine the incident. The dispute has highlighted deficiencies in intelligence-sharing and security coordination between the neighbouring countries.
These developments have occurred only weeks after the withdrawal of US military forces participating in the Combined Joint Task Force – Operation Inherent Resolve (CJTF-OIR), alongside the removal of its advisory mission intended to prevent an ISIS resurgence in Iraq and Syria. The Soufan Center, which has examined the recent developments, identifies the changing regional security environment and the withdrawal of the US military presence as important factors in assessing the group’s renewed activity. Its analysis also points to the possibility that ISIS networks are seeking to exploit regional escalation and the diversion of security resources amid the US-Iran war.
The group’s recent targeting patterns indicate a broader range of operational targets than those associated with conventional attacks against military positions. Its operations have extended to civilians, activists, religious sites, infrastructure, transport networks, militia formations, police officers, judges, government officials and administrative institutions. The Soufan Center assesses that ISIS is increasingly relying on ad hoc operations against a wider spectrum of targets rather than exclusively pursuing extensive, long-term operational planning.
Nevertheless, the prospect of a resurgence comparable to the territorial expansion witnessed in 2014 remains low, according to the assessment cited in the analysis. ISIS is fractured, with its remaining networks largely restricted to smaller, rural and less sophisticated operations. However, the recent attacks and arrests demonstrate that these networks retain the ability to exploit security vulnerabilities across national boundaries. The challenge facing regional authorities is compounded by the limited coordination between Iraq, Syria and Jordan, particularly in intelligence-sharing and the identification of networks operating across their borders.
