Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo.
This week’s edition focuses on three articles examining the evolving nature of Iran’s strategy and its implications for global security. “The New Architecture of Terror: How Iran’s Strategy is Evolving – and Why the World Must Adapt” by Ebrahim Roshandel highlights how Iran has institutionalized terrorism as a tool of statecraft, combining ideology with pragmatic security goals while expanding into decentralized, technology-enabled and multi-domain operations. “War with Iran Raises Proxy Attack Risk and Cyber Threats in Southeast Europe” by Samet Shabani analyzes how rising tensions and Iran’s covert presence in the Balkans—through cyber operations, intelligence networks, and proxy activity—are increasing the risk of targeted escalation in a region marked by institutional vulnerabilities. Finally, “How Iran-Backed Proxy Networks and ‘Gig-Economy’ Terrorism Are Threatening Western Countries” by Mahmut Cengiz, PhD, and Sean Dilallo explores the emergence of deniable proxy “brand-name” groups and the outsourcing of low-cost violence to loosely connected individuals via digital platforms, reflecting a broader shift toward decentralized, hybrid threat models. Together, these articles underscore the convergence of statecraft, terrorism, and organized crime, as well as the urgent need for more adaptive and integrated counterterrorism approaches.
The edition also provides a review of U.S. military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded between April 4 and April 10.
Counterterrorism Snapshot: Operations and Policy Signals (April 4 – April 10)
On April 6-7, 2026, near the Golis Mountains in Somalia, U.S. Africa Command (AFRICOM) conducted airstrikes against ISIS-Somalia, coordinated with the Federal Government of Somalia.
On April 8, 2026, in New York City, New York, Muhammad Shahzeb Khan, also known as “Shahzeb Jadoon,” pleaded guilty to attempting to commit acts of terrorism. Khan planned to carry out a mass shooting at a Jewish center in New York City on the anniversary of the October 7th attack.
Notable Terrorist Attacks
On April 6, 2026, in Indianapolis, Indiana, a gunman opened fire on the home of a city councilman. The attacker left a note on the councilman’s doorstep that read, “No Data Centers.” No casualties were reported.
On April 7, 2026, in Istanbul, Türkiye, gunmen opened fire on the Israeli Consulate, injuring two police officers. The police quickly repelled the attack, killing one perpetrator and arresting the other two. Interior Minister Mustafa Çiftçi said that one of the suspects has ties to “an organization that exploits religion.”
On April 7, 2026, in Niger State, Nigeria, armed men attacked two villages in the Shiroro district, killing at least 20 people and abducting an unknown number. The attackers also destroyed civilians’ homes. Bandits and Islamists are known to operate in Niger State.
On April 8, 2026, in Borno State, Nigeria, Islamic State West Africa Province (ISWAP) launched coordinated attacks on multiple military bases. Several soldiers, including a Brigadier-General, were killed in the attacks.
On April 10, 2026, in Herat, Afghanistan, unknown gunmen opened fire on a group of civilians, killing at least 10 and injuring 30. The attack occurred in the Deh Mehri Area of Injil District, which has a large Shia population. No group has claimed responsibility for the attack. However, ISKP has targeted Shias in Afghanistan and Pakistan in the past.
Hotspots & Emerging Threats
The New Architecture of Terror: How Iran’s Strategy is Evolving – and Why the World Must Adapt
By Ebrahim Roshandel
- Iran’s model of terrorism is state-driven and institutionalized, combining ideological justification with pragmatic national security goals, making violence a sustained and adaptable instrument of statecraft rather than a temporary tactic.
- The operational architecture is multi-layered and covert, leveraging diplomacy, cultural institutions, cyber capabilities, and influence networks to blur the line between legitimate state activity and terrorism.
- A major shift is underway toward decentralized, technology-enabled “modern terrorism,” where autonomous cells, cyberattacks, disinformation, and psychological warfare expand the battlefield beyond physical violence.
- Traditional counterterrorism frameworks are increasingly inadequate, requiring integrated strategies that address hybrid threats, strengthen resilience, counter influence operations, and anticipate coordinated multi-domain attacks.
The nature of modern terrorism is undergoing a profound transformation—one increasingly shaped by state actors rather than purely by non-state groups. At the center of this evolution stands the Islamic Republic of Iran, whose decades-long integration of ideology, intelligence, and asymmetric warfare has produced a uniquely adaptive model of state-sponsored terrorism. Understanding this model is no longer optional; it is essential to anticipate the next phase of global security threats.
Read the rest of the analysis here.
War with Iran Raises Proxy Attack Risk and Cyber Threats in Southeast Europe
By Samet Shabani
- Rising tensions between Iran and pro-US/pro-Israel Balkan states have moved beyond rhetoric, with diplomatic warnings, cyberattacks, and terrorism designations signaling a real risk of spillover into Southeast Europe.
- Iran has a long-standing but evolving presence in the Balkans, shifting from limited religious and ideological influence efforts to more covert activities, including cyber operations, intelligence gathering, and use of the region as a logistical hub.
- Recent incidents—including cyberattacks in Albania, past operations like the Burgas bombing, and increased activity by Iran-linked groups—highlight the region’s vulnerability due to weak institutions, corruption, and security gaps.
- The most likely escalation scenarios involve targeted actions rather than mass-casualty attacks, including strikes on government infrastructure or assassination attempts against pro-US and pro-Israel political figures, potentially carried out through proxies or criminal networks.
The increased risk of escalation in the war with Iran raises security concerns not only in its region but beyond. A recent statement by the US Embassy in Tirana, Albania, warned that the country’s public venues, such as tourist sites, shopping malls, hotels, clubs, and restaurants, may be potential targets of groups associated with Iran. The previous week, Albania joined the US in designating Iran a “state sponsor of terrorism”. Meanwhile, Iran issued a direct diplomatic warning to Bulgaria regarding the U.S. military’s use of its airports, which Bulgarian officials have since confirmed. These developments prompt a serious discussion: Can Iran seriously plan retaliation with terrorist attacks beyond the Middle East, in the ‘hinterland of Europe’?!
Read the rest of the analysis here.
How Iran-Backed Proxy Networks and ‘Gig‑Economy’ Terrorism Are Threatening Western Countries
Mahmut Cengiz, PhD Sean Dilallo
- Iran-linked actors are increasingly relying on deniable, flexible proxy structures—such as groups like HAYI—that function more as “brand names” than traditional organizations, allowing Tehran to obscure responsibility while sustaining operations abroad.
- Terrorist activity is evolving toward a “gig-economy” model, where low-cost, task-based violence is outsourced to loosely connected individuals—often recruited via social media and paid small sums—reducing the need for ideology or formal group membership.
- The convergence of terrorism, organized crime, and state activity creates a hybrid threat environment, where existing criminal networks and digital platforms provide ready-made infrastructure for recruitment, logistics, and execution.
- This decentralized and transactional model of violence complicates detection and prevention, requiring counterterrorism efforts to shift toward monitoring digital ecosystems, tracking micro-financing, and addressing the exploitation of vulnerable populations, including minors.
The aftermath of the recent war involving Iran has sparked significant debate among policymakers, intelligence analysts, and security scholars about how Tehran might respond. While traditional retaliation—through regional proxies or direct military signals—remains a concern, more attention is being given to asymmetric and deniable forms of response. One new idea is that Iran could expand its use of newly formed or rebranded proxy groups designed to obscure attribution while enabling ongoing operations abroad. Among these, Harakat Ashab al-Yamin al-Islamiyya (Islamic Movement of the People of the Right Hand), often called Ashab al-Yamin or HAYI, has attracted particular focus.
