Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo, Brian Cortes, Ayse Selma Yilmaz, Floyd Alex Cross, Mahmoud Khalil, and Chris Dayton.
This edition features two analytical articles examining the evolving global terrorism landscape and the growing security challenges facing Western nations. In “Terrorism in Transition: Six Trends Shaping Global Terrorist Activity in the First Half of 2026,” Mahmut Cengiz analyzes major trends from six months of Frontline Watch reporting, highlighting Africa’s continued role as the epicenter of jihadist violence, the high operational tempo in Pakistan, the diversification of ideological violence in Western democracies, the convergence of organized crime and terrorism in Latin America, and the growing influence of emerging technologies on terrorist tactics. Complementing this assessment, “Iran’s Proxy War Comes to NATO’s Doorstep” by Sajjan M. Gohel examines how Iran’s expanding proxy network increasingly threatens Europe and NATO member states, arguing that Tehran’s indirect strategy has evolved beyond the Middle East and poses significant challenges for Western security and counterterrorism policy. Together, these articles offer valuable strategic insights into the changing nature of contemporary terrorism and the policy responses required to address an increasingly complex global threat environment.
The edition also reviews military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded from June 27 to July 3.
Counterterrorism Insights
Terrorism in Transition: Six Trends Shaping Global Terrorist Activity in the First Half of 2026
Mahmut Cengiz, PhD
The first half of 2026 demonstrated that the global terrorist threat remains highly adaptive, geographically dispersed, and increasingly diverse in its motivations and tactics. Drawing exclusively on the Frontline Watch weekly editions published by Homeland Security Today between February and June 2026, this assessment examines the principal trends emerging from hundreds of terrorist incidents monitored during the reporting period. Rather than recounting every attack, it identifies the dominant patterns that shaped the international threat environment. The findings reveal that Africa remained the center of global jihadist violence, Pakistan experienced one of the highest operational tempos worldwide, ideological extremism diversified across Western democracies, the Middle East continued its transition toward hybrid conflict, and organized criminal organizations in Latin America increasingly employed tactics traditionally associated with insurgent and terrorist groups.
Africa Solidified Its Position as the Epicenter of Global Jihadist Violence
No region experienced more sustained terrorist activity during the reporting period than Africa. Across the Sahel, Lake Chad Basin, and East Africa, jihadist organizations continued expanding their operational reach while demonstrating an ability to conduct increasingly sophisticated attacks against military installations, civilian communities, transportation hubs, and government facilities. Jama’at Nusrat al-Islam wal-Muslimin (JNIM), Islamic State Sahel Province (ISSP), Islamic State West Africa Province (ISWAP), Boko Haram, Islamic State Central Africa Province (ISCAP), and al-Shabaab all maintained significant operational capabilities throughout the first half of the year.
Several attacks illustrated both the scale and intensity of this violence. JNIM launched coordinated offensives in Mali, including attacks in Bamako and Kidal that resulted in the death of Mali’s Defense Minister, while ISSP conducted devastating assaults on Nigerien military bases that killed more than 150 soldiers within two days. ISWAP repeatedly targeted Nigerian military bases, Christian communities, and local security partners, including attacks that killed a Brigadier General and dozens of soldiers. Boko Haram carried out suicide bombings in Maiduguri, attacked military bases in Chad, and continued targeting civilian populations. Meanwhile, ISCAP expanded attacks in eastern Democratic Republic of the Congo after a period of relative decline, and al-Shabaab maintained pressure on Somali and Kenyan security forces. Collectively, these incidents demonstrate that Africa has become the principal battlefield of contemporary jihadist violence and will likely remain the focal point of global counterterrorism efforts.
Read the rest of the analysis here.
Iran’s Proxy War Comes to NATO’s Doorstep
Sajjan M. Gohel, PhD
When NATO leaders gather in Ankara on 7–8 July 2026, the summit will inevitably be dominated by Ukraine, defence spending, alliance cohesion, and the Iran conflict. Türkiye’s hosting of the summit gives a strategic urgency to Iran’s expanding campaign of proxy, hybrid, and external operations against Western targets. The NATO summit is being held at the Beştepe Presidential Compound in Ankara places the meeting the hinge of Europe, the Middle East, the Black Sea, and the Caucasus.
Iran’s actions now touches several alliance concerns at once: missile and drone proliferation, Red Sea instability, threats to Gulf partners, plots in Europe and North America, and the use of criminal proxies for deniable violence. The case of Mohammad Baqer Saad Dawood al-Saadi, an alleged senior member of Kata’ib Hezbollah, should be understood in that wider context.
Al-Saadi was arrested in Türkiye, extradited to the United States and charged in May 2026 for terrorism-related offences connected to his work as an operative of Kata’ib Hezbollah and Iran’s Islamic Revolutionary Guard Corps (IRGC). The U.S. Department of Justice said the case involved nearly 20 plots across Europe and the United States.
Read the rest of the analysis here.
Counterterrorism Snapshot: Operations and Policy Signals (June 27 – July 3)
During the reporting period, counterterrorism efforts focused on cross-border military operations, disrupting terrorist financing, dismantling extremist networks, and prosecuting terrorist supporters. Pakistan launched coordinated ground and air operations against militant hideouts along the Afghanistan-Pakistan border after a major terrorist attack, receiving U.S. support for its right to self-defense. In Europe, German authorities arrested suspects linked to both far-right extremism and the Islamic State, while the United Kingdom sentenced two men for an Iran-directed attack on a journalist. In the United States, authorities arrested a woman accused of providing financial support to Palestine Islamic Jihad (PIJ). Meanwhile, Iraqi security forces continued operations against ISIS, arresting key operatives, including an explosives specialist, and Syria initiated trials of individuals accused of involvement in the 2025 Suwayda clashes, including suspects with alleged ISIS ties. Together, these developments underscore the continued emphasis on intelligence-driven operations, international cooperation, judicial action, and financial disruption in the global fight against terrorism.
On June 28, 2026, Pakistan’s military carried out coordinated ground and air operations along the Afghanistan-Pakistan border in response to the terrorist attack in Karachi the day prior. The air operations included airstrikes in Afghanistan targeting militant hideouts. The Pakistani military claimed to have killed 29 militants during the operation. The U.S. Department of State said that the United States supports Pakistan’s right to self-defense in response to terrorism following Pakistan’s operations.
On June 30, 2026, German federal prosecutors announced the arrest of a Romanian national for attempting to form a foreign right-wing terrorist organization. The suspect is alleged to have operated two online channels that targeted young Romanians. The channels encouraged members to attack buildings used by migrants and members of the LGBTQ+ community.
On June 30, 2026, the U.S. Department of Justice announced the arrest of a New York woman for attempting to provide material support to Palestine Islamic Jihad (PIJ). Prosecutors allege that the suspect was a leader in the Direct Action Movement for Palestinian Liberation, described as an “extremist organization” that engages in “direct action – including acts of sabotage and property destruction.” The defendant is accused of sending more than $30,000 to PIJ.
On June 30, 2026, in the Kurdistan, al-Anbar, and Mosul provinces of Iraq, Iraqi Counter Terrorism Services (CTS) and Iraqi Kurdistan Asayish officials arrested three ISIS members. Among those arrested was a suspect believed to be the top explosives manufacturer in Saladin province. Officials also raided suspected ISIS safehouses in the Zghaitoun Valley, a major supply zone for ISIS remnants.
On July 2, 2026, German Federal Prosecutors announced the arrest of a suspected member of the Islamic State (IS). Prosecutors allege that the suspect fought with ISIS in Iraq from 2016 to 2017.
On July 3, 2026, the United Kingdom sentenced two Romanian men to 8 and 12 years in prison for stabbing a journalist from a Persian-language television station. The attack occurred in March 2024. The judge stated that the attack was carried out on behalf of the Iranian state.
On July 3, 2026, in Damascus, Syria, the Syrian Government announced the start of trials for those accused of participating in the July 2025 clashes in Suwayda province, including those with suspected ISIS ties.
Terrorist Attacks Worldwide (June 27 – July 3)
Between June 27 and July 3, 2026, terrorist and extremist activity remained widespread across multiple regions, underscoring the continued diversity of global security threats. In Europe, attacks included arson targeting a mosque in Ireland and politically motivated firebombings in Greece. Across the Middle East and South Asia, ISIS, Jamaat-ul-Ahrar (JuA), the Tehreek-e-Taliban Pakistan (TTP), Islamic State Khorasan Province (ISKP), and the Balochistan Liberation Army (BLA) carried out attacks against civilians, security forces, and critical infrastructure. Cross-border drone activity between Afghanistan and Pakistan highlighted escalating regional tensions. In Mexico, security forces intensified operations against organized crime, arresting several high-ranking cartel leaders and dismantling criminal cells, even as cartel violence persisted through targeted killings, attacks on security personnel, and the use of landmines against Mexican naval forces. Together, these developments underscore the persistence of jihadist violence, ideological extremism, and increasingly sophisticated criminal organizations that employ tactics blurring the line between organized crime and terrorism.
Europe
On June 29, 2026, in Dublin, Ireland, a man set fire to the entrance of a mosque. No casualties were reported. An Iranian national was arrested in connection with the attack.
On July 1, 2026, in Thessaloniki, Greece, three homes belonging to members of Greece’s New Democracy party were firebombed. As a result of the third attack, one person was killed and three others were injured. No group has claimed responsibility for the attacks; however, anarchist groups periodically carry out arson attacks in Greece.
Middle East
On July 1, 2026, in al-Baghouz Town, Deir Ezzor, Syria, suspected ISIS members opened fire with small arms on civilians. One victim was killed and another was injured.
On July 2, 2026, in Damascus, Syria, unknown perpetrators detonated an IED targeting a café. The café was notably adjacent to the Palace of Justice. 10 victims were killed in the blast, and 21 were wounded. Among the deceased were 6 lawyers. The suspected perpetrator was apprehended while approaching the Palace of Justice.
On July 3, 2026, in Jaramana, Rif Dimashq, Syria, unknown perpetrators attacked a security checkpoint with a handgun and grenades. The perpetrator was killed when a grenade detonated in his hand.
Asia
On June 27, 2026, in Karachi, Sindh, Pakistan, Jamaat-ul-Ahrar (JuA) attacked a security forces facility, killing three soldiers and injuring four others. The attack began with a vehicle-borne IED ramming the base, followed by gunmen storming the compound. Pakistani forces killed three militants and captured one during their response. JuA claimed responsibility for the attack. Following the attack, JuA announced its separation from the Tehreek-e-Taliban Pakistan (TTP). JuA has historically had a difficult relationship with the TTP.
On June 29, 2026, in Lower Chitral District, Khyber Pakhtunkhwa, Pakistan, the Tehreek-e-Taliban Pakistan (TTP) attacked a security forces post. The TTP claimed to have killed six security personnel and injured nine others. The TTP also released a video featuring an individual they abducted during the attack.
On June 29, 2026, in Narathiwat Province, Thailand, suspected southern separatists planted a roadside bomb targeting a Volunteer Defense Corps vehicle, which detonated and wounded two Malaysian tourists who were occupying a passing vehicle on the road at the time of the attack.
On June 30, 2026, the Afghan Taliban launched four drones into Pakistan’s Balochistan Province. Afghan authorities said the drones were targeting Islamic State sites in Pakistan. They also claimed to have struck targets in Khyber Pakhtunkhwa. Pakistan’s military said it shot down all of the drones.
On July 1, 2026, in Kunduz, Kunduz Province, Afghanistan, the Afghanistan Freedom Front (AFF) claimed to have attacked a Taliban patrol vehicle, killing two Taliban fighters and wounding one.
On July 2, 2026, in Bajaur District, Khyber Pakhtunkhwa, Pakistan, Islamic State Khorasan Province (ISKP) shot and killed a Frontier Constabulary member. ISKP claimed responsibility for the attack.
On July 3, 2026, in Gwadar, Balochistan, Pakistan, the Balochistan Liberation Army (BLA) carried out a suicide bombing targeting a Pakistani Coast Guard facility, killing three soldiers and injuring 15 others. The BLA claimed responsibility for the attack.
On July 3, 2026, in Chaparhar Dstrict, Nangarhar Province, an unknown assailant shot dead a Taliban guard commander inside his residence before he was arrested by the Taliban police command.
Mexico and Latin America
On June 27, 2026, in Uruapan, a joint operation by federal and state security forces resulted in the arrest of Óscar “N,” alias “El Pelón,” identified as the leader of a criminal cell operating in the region. Authorities report that the detainee is the regional leader of the Los Caballeros Templarios Cartel and is under investigation for his involvement in multiple homicides in the Uruapan area. The operation was part of coordinated efforts by Mexican security forces to dismantle armed groups operating in western Michoacán. Following his capture, “El Pelón” was placed at the disposal of investigative authorities, who are continuing inquiries into his role within the organization and his possible participation in violent incidents reported in the region.
On June 28, 2026, in Tlajomulco de Zúñiga, Jalisco, Mexico, suspected members of the Jalisco Cartel Jalisco Nueva Generacion (CJNG) killed a man between 40 and 45 years old in the El Capulín neighborhood. Municipal police responded to an emergency call and found the victim lying on a public roadway near the intersection of José Hernán and Parque San Rafael streets, near Casa de Campo Ávalos García. Authorities confirmed the victim had sustained an apparent gunshot wound. Initial reports indicating the victim showed multiple signs of violence were later dismissed after a detailed examination of the scene, with investigators confirming only the gunshot injury. The victim was transferred to the appropriate authorities for forensic examination and identification. No group claimed responsibility.
On June 28, 2026, in Pueblo Nuevo, Durango, elements of the Mexican Armed Forces and the National Guard (Mexico) conducted a coordinated land operation that led to the arrest of four individuals, including Francisco Javier “N,” alias “El Flechas” (also known as “El Frank 38”), a suspected criminal leader linked to the group Los Flechas. According to the Secretariat of National Defense (SEDENA), “El Flechas” is allegedly associated with criminal operations tied to the Cabrera Sarabia Cartel, which operates in Durango under the broader influence of the Sinaloa Cartel (Mayito Flaco faction). Authorities also identify him as a suspect in the 2022 killing of medical intern Eric David Andrade Ramírez at the hospital in El Salto, Pueblo Nuevo. During the operation, security forces reportedly seized a significant arsenal, including a Minimi machine gun, multiple long guns, grenade launchers, grenades, thousands of rounds of ammunition, tactical gear, communication equipment, and several vehicles, some reportedly stolen. The detainees, including the main suspect, were taken into custody and placed under federal investigation.
On June 28, 2026, in the tourist area of Mexiquillo, Durango, a coordinated intelligence operation conducted by federal forces of the Mexican Armed Forces on land and in the air reportedly resulted in the detention of more than 30 individuals. Among those detained were allegedly two to three high-priority targets linked to organized crime. Preliminary reports indicate the operation took place in the mountainous region of Pueblo Nuevo, following intelligence tracking movements associated with a faction of the Sinaloa Cartel (Mayito Flaco faction). Security forces reportedly deployed coordinated aerial surveillance and ground units to secure the area and carry out the detentions.
On June 28, 2026, in the mountainous region between La Ciudad and Mexiquillo, a federal security operation led by the Mexican Armed Forces and the National Guard (Mexico) resulted in the arrest of Guillermo “N,” alias “El Cholo Flechas,” identified as a suspected high-ranking member and second-in-command of the Grupo Flechas, an armed wing allegedly linked to the Cabrera Sarabia Cartel. Authorities described the detainee as a priority target and a key figure in regional violence. He is also reportedly a relative of Francisco Javier “El Flechas,” another alleged leader arrested in the same area during the broader operation.
On June 28–29, 2026, in the Mexicali Valley region of Mexicali, two intelligence officers from the Fuerza Estatal de Seguridad Ciudadana (Baja California) were reportedly killed in separate, coordinated attacks carried out within less than 24 hours. According to investigations by the Fiscalía General del Estado de Baja California, the attacks are being treated as possible retaliation by a criminal cell known as Los Rusos, identified as an armed faction operating in the region and linked to the Sinaloa Cartel under the alleged influence of the Ismael “El Mayo” Zambada faction. Authorities believe the violence was triggered by recent security operations in the area, including the killing of a key criminal operator, the dismantling of clandestine airstrips used for drug trafficking, significant cocaine seizures, and the arrest of suspected foreign hitmen operating in the region. The Valle de Mexicali has been identified by security officials as a strategic trafficking corridor, and the incidents have intensified an ongoing confrontation between state security forces and organized crime groups operating there.
On June 30, 2025, in Ocotlan, Jalisco, Mexican authorities arrested César Augusto “N,” also known as ”Tondiro,” a member of the Cartel Jalisco Nueva Generacion and an alleged participant in the June 10 ambush against Guardia Civil de Michoacán personnel in Nahuatzen. According to the Fiscalía General del Estado de Michoacán, investigative efforts and strategic intelligence led authorities to locate the suspect, who was reportedly hiding in Ocotlan. He was taken into custody without publicly reported resistance and transferred to the appropriate authorities to face legal proceedings related to the ambush.
On June 30, 2025, in Navolato, suspected members of the Sinaloa Cartel reportedly stormed the Integral Hospital and killed two young men who were being treated for gunshot wounds. According to local reports, at approximately 8:00 p.m., authorities received a 911 call reporting gunfire inside the hospital. Municipal police and military personnel responded to the scene, but the armed assailants had fled before security forces arrived. The victims were pronounced dead at the hospital. Authorities opened an investigation into the attack. No criminal group claimed responsibility.
On July 3, 2026, near El Tecomate, Mazatlan, Sinaloa, suspected members of the Sinaloa Cartel’s Chapitos faction detonated a landmine, killing one member of the Secretariat of the Navy (SEMAR) and seriously injuring three others. According to reports, the naval personnel were conducting a patrol alongside members of a civilian search collective looking for missing persons when they reportedly heard gunfire in the surrounding area. As the Marines moved to investigate the source of the gunfire, an explosive device, believed to be a landmine, detonated. The wounded personnel were evacuated by fellow service members and transported to a hospital for specialized medical treatment. No group claimed responsibility.
