Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo, Brian Cortes, Ayse Selma Yilmaz, Floyd Alex Cross, Mahmoud Khalil, and Chris Dayton.
This edition features a timely analytical article examining an often-overlooked dimension of terrorist threat assessment. In The Explanation Before the Attack, Omar Mohammed and Asher Stern argue that the justifications attackers construct for selecting their targets should be treated as actionable threat indicators rather than merely ideological rhetoric. Drawing on recent cases spanning multiple extremist ideologies, the authors demonstrate how attackers increasingly publish the narratives that rationalize violence before mobilizing, offering valuable opportunities for earlier detection and prevention. By examining how grievance narratives shape target selection across ideological movements, the article provides important insights for homeland security practitioners seeking to strengthen intelligence collection, threat assessment, and preventive counterterrorism strategies.
The edition also reviews military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded from July 11 to July 17.
Counterterrorism Insights
The Explanation Before the Attack
By Omar Mohammed and Asher Stern
Attackers justify their targets before they move. That rationale is a threat indicator — and it crosses ideologies.
Counterterrorism is designed to detect movement. Travel, procurement, encrypted communications, surveillance, weapons, and training: those indicators separate noise from mobilization, and they matter. But they tend to appear after a more basic decision has already been made. Before an attacker moves, someone has decided which person, building, congregation, or piece of infrastructure will be held answerable for a grievance it does not control. That decision, and the explanation that justifies it, is itself an indicator, and U.S. homeland security planners should learn to read it as such.
Begin with what these cases are not about. They are not simply examples of attackers striking symbolic or soft targets, a pattern documented for decades. The point is narrower and has an operational edge. In each of the recent cases below, the target bears no responsibility for the grievance it is punished for: a Brooklyn synagogue does not set Israeli policy, an El Paso Walmart does not run immigration, and a Baltimore substation does not cause civilizational collapse. What links the target to the grievance is an explanation the attacker produces — and, increasingly, publishes. That explanation is the targeting decision. It takes collectible form, in a complaint, a claim of responsibility, a manifesto, a target list, or a recorded message. In at least one case, it traveled intact between movements that otherwise have nothing in common. And it is the one part of the attack cycle that the current system is least equipped to treat as intelligence rather than as speech.
The clearest current example was unsealed in the Southern District of New York on May 15, 2026. Federal prosecutors allege that Mohammad Baqer Saad Dawood al-Saadi, a senior Kata’ib Hizballah figure tied to Iran’s Islamic Revolutionary Guard Corps, directed and urged attacks on U.S. and Israeli interests, and that he and his associates planned, coordinated, and claimed responsibility for at least 18 terrorist attacks in Europe and two additional attacks in Canada under the name Harakat Ashab al-Yamin al-Islamiya, or HAYI, a front prosecutors describe as a component of Kata’ib Hizballah. Prosecutors also allege that al-Saadi attempted to coordinate attacks inside the United States, including in New York.
Read the rest of the analysis here.
Counterterrorism Snapshot: Operations and Policy Signals (July 11– July 17)
Between July 11 and July 17, 2026, counterterrorism efforts focused on preventing terrorist attacks, expanding international cooperation, targeting terrorist infrastructure, and strengthening legal measures against extremist organizations. French authorities launched a counterterrorism investigation after weapons were discovered in a stolen vehicle near a synagogue, while the Russian Africa Corps and the Nigerian Air Force conducted drone and airstrike operations against militant positions in Mali and Nigeria. Pakistan intensified counterterrorism efforts by arresting the alleged mastermind behind the June 27 Karachi attack and advancing security cooperation with the FBI on counterterrorism, illegal immigration, and law enforcement exchanges. Meanwhile, the United States announced visa restrictions targeting individuals supporting far-left terrorist groups, and the United Kingdom designated the Islamic Revolutionary Guard Corps (IRGC), the Islamic Movement of Companions of the Right (IMCR/HAYI), and Russia’s GRU Volunteer Corps as proscribed terrorist organizations, reflecting continued efforts to expand legal and policy tools against evolving transnational threats.
On July 11, 2026, in Sarcelles, France, police discovered a stolen vehicle containing weapons parked near a synagogue. After the discovery, police evacuated 300 people from the area and conducted a large-scale search. Prosecutors have launched a counterterrorism investigation following the discovery, though no suspects or motive have been identified.
On July 12, 2026, in I-n-Afarak, Kidal Region, Mali, the Russian Africa Corps used drones to target an FLA position.
On July 13, 2026, Pakistan’s Interior Minister, Mohsin Naqvi, met with FBI Director Kash Patel at the FBI’s headquarters in Washington, D.C. Interior Minister Naqvi stated that the two discussed cooperation on counterterrorism, illegal immigration, and officer exchange programs.
On July 14, 2026, Pakistani police said they arrested the mastermind behind the June 27th attack on a Rangers camp in Karachi. The attack was carried out by Jamaatul Ahrar (JuA). The police also said the perpetrators received training in Afghanistan.
On July 16, 2026, the U.S. Department of State announced visa restrictions targeting “Far-Left terrorists and other aligned groups.” The restrictions apply to those who recruit, finance, or support far-left militant groups.
On July 17, 2026, in Yaganari, Borno State, Nigeria, the Nigerian Air Force conducted airstrikes against Islamic State West Africa Province (ISWAP) positions.
On July 17, 2026, the United Kingdom’s Home Office announced the designation of the Islamic Revolutionary Guard Corps (IRGC), the Islamic Movement of Companions of the Right (IMCR), and Russia’s GRU Volunteer Corps. The designation makes expressing support for, or in any way supporting, these groups a criminal offense. IMCR is also known as Harakat Ashab al-Yamin al-Islamia (HAYI). HAYI is a pro-Iranian group backed by the IRGC and Kata’ib Hezbollah that carried out attacks against Jewish targets following the start of the Iran-U.S. War.
Terrorist Attacks Worldwide (July 11 – July 17)
Between July 11 and July 17, 2026, counterterrorism efforts focused on preventing terrorist attacks, expanding international cooperation, targeting terrorist infrastructure, and strengthening legal measures against extremist organizations. French authorities launched a counterterrorism investigation after weapons were discovered in a stolen vehicle near a synagogue, while the Russian Africa Corps and the Nigerian Air Force conducted drone and airstrike operations against militant positions in Mali and Nigeria. Pakistan intensified counterterrorism efforts by arresting the alleged mastermind behind the June 27 Karachi attack and advancing security cooperation with the FBI on counterterrorism, illegal immigration, and law enforcement exchanges. Meanwhile, the United States announced visa restrictions targeting individuals supporting far-left terrorist groups, and the United Kingdom designated the Islamic Revolutionary Guard Corps (IRGC), the Islamic Movement of Companions of the Right (IMCR/HAYI), and Russia’s GRU Volunteer Corps as proscribed terrorist organizations, reflecting continued efforts to expand legal and policy tools against evolving transnational threats.
United States
On July 13th, 2026, in West Valley City, Utah, an individual perpetrator stabbed and injured a Muslim man in Valley Fair Mall. The victim survived the attack. The perpetrator told investigators that he targeted the victim because of his religion.
Middle East
On July 13, 2026, in Abha, Saudi Arabia, Houthi militants launched a coordinated missile and drone (UAV) attack targeting Abha International Airport. The Houthis stated the attack was retaliation for airstrikes that struck Sanaa International Airport earlier the same day. Saudi authorities reported intercepting the incoming projectiles, and no casualties or significant damage were reported. Houthis claimed responsibility for the attack.
On July 16, 2026, in the Port of Eilat, Isreal, Houthi militants launched a ballistic missile and multiple unmanned aerial vehicles (UAVs) targeting Ben Gurion Airport. Israeli air defense systems intercepted the ballistic missile before impact, and no casualties were reported. The Houthis claimed responsibility for the coordinated attack.
Africa
On July 11, 2026, in Cross Kauwa, Borno State, Nigeria, Islamic State West Africa Province (ISWAP) attacked a Nigerian Army camp. No casualties were reported.
On July 13, 2026, in Niono, Ségou Region, Mali, Jama’at Nusrat al-Islam wal-Muslimin (JNIM) ambushed a FAMa convoy, killing three soldiers.
Asia
On July 12th, 2026, in Mashkail, Washuk District, Balochistan, Pakistan, unknown perpetrators shot and killed five laborers from Punjab. The victims were working in shops when armed men on motorcycles opened fire. Baloch militant groups have historically targeted workers from Punjab.
On July 15th, 2026, a suicide bomber rammed a vehicle into a police station, killing one police officer and injuring six others. Additionally, four civilians were injured in the attack. After the bombing, militants attempted to storm the station but were repulsed. Earlier in the day, militants bombed a bridge leading to the station in an attempt to isolate it from reinforcements. The Ittihad-ul-Mujahideen Pakistan (IMP) claimed responsibility for the attack.
On July 15, 2026, in Lower Dir, Khyber Pakhtunkhwa, Pakistan, the Tehreek-e-Taliban Pakistan (TTP) ambushed a police convoy, killing three police officers and injuring five others. The TTP claimed responsibility for the attack.
On July 16, 2026, in Mastung District, Balochistan, Pakistan, the Baloch Liberation Army (BLA) attacked a military convoy, killing at least eight soldiers and injuring five others. The BLA claimed responsibility for the attack.
In northeastern Afghanistan, a significant development occurred last week when a newly formed anti-Taliban group, “Sepahiyan-e Mihan (Patriotic Soldiers Front),” launched an attack on the administrative headquarters of Yaftali Sufla District, took over the building, and disarmed the Taliban fighters securing it. However, the Taliban government claimed to have recaptured the building later that day. While little is still known about this nascent group, media reports indicate that it consists of former security personnel under the previous Afghan government, as well as local residents and activists dissatisfied with the Taliban’s rule and its treatment of ordinary citizens.
On July 17, 2026, in Yaftali Sufla District, Badakhshan Province, Afghanistan, Sepahiyan-e Mihan (Patriotic Soldiers Front) briefly seized the District’s headquarters for several hours and disarmed its Taliban security personnel. It remains unclear whether any casualties resulted from the attack.
Mexico and Latin America
On July 12, 2026, in Alvaro Obregon, Michoacan, suspected members of Cartel Jalisco Nueva Generacion carried out an armed attack during a funeral wake in the community of Tzintzimeo, killing three people and injuring four others. According to reports, several armed men entered the residence where family members, friends, and neighbors had gathered for the wake, opened fire, and fled the scene. The fatalities included a minor and an elderly adult, while the injured included a young girl who sustained a gunshot wound to the leg and was transported to a hospital along with the other victims. The motive for the attack remains unknown. No arrests have been reported, and the incident remains under investigation. No group claimed responsibility.
On July 12, 2026, in Penjamo, Guanajuato, suspected members of the Cartel Jalisco Nueva Generacion carried out a mass shooting at a family gathering in the Miguel Hidalgo neighborhood, killing four people, including two minors, and injuring two others. According to reports, several armed individuals arrived in multiple vehicles, forced their way into the residence on Solidaridad Street, ordered the victims to kneel, shot them in front of their relatives, and fled the scene. Authorities recovered approximately 50 spent shell casings at the scene. Municipal police, state security forces, the National Guard, and the Mexican Army responded to the attack. No group claimed responsibility.
On July 13, 2026, in Morelia, Michoacan, suspected members of Cartel Jalisco Nueva Generacion carried out a targeted shooting at a roadside eatery in the José María Morelos neighborhood, killing one man and injuring another. According to reports, at least two gunmen arrived at the establishment and opened fire, fatally wounding the intended target. A second man, reportedly not involved in the incident, sustained a gunshot wound to the chest during the attack and was transported for medical treatment. The suspects fled the scene. No group claimed responsibility.
On July 14, 2026, in Arteaga, Michoacan, an armed confrontation on the Arteaga–Tumbiscatío highway near “El Invernadero” left three suspected members of a criminal organization dead. According to local reports, one of those killed may have been “El Miguelito,” a plaza leader operating in the area. The confrontation was reportedly linked to an alleged internal dispute, with local accounts suggesting a possible betrayal involving Fernando Cruz Mendoza, alias “El Tena,” who has been identified in previous reports as a former member of Los Caballeros Templarios and later as the leader of a criminal faction in the Sierra-Costa region that has been associated with operational ties to the Cartel Jalisco Nueva Generacion.
On July 14, 2026, in Chiapas, authorities arrested nine members of the Sinaloa Cartel in connection with the July 8 killing of eight people, including six men and two women. According to the state prosecutor, the suspected motive for the mass killing was a dispute over local retail drug sales. The victims were found in a rural area, with a threatening message related to drug trafficking. Authorities reported that the victims showed gunshot wounds and signs of torture. During their arrest, the suspects allegedly claimed affiliation with the Sinaloa Cartel, an organization that has experienced internal conflict between factions identified as Los Chapitos-Los Mayos since 2024. Authorities reported seizing three vehicles, 29 firearms, including AK-47 and AR-15-style rifles and handguns, ammunition, tactical equipment, tire-deflation devices, camouflage vests, handcuffs, drones, documents, communication equipment, mobile phones, and suspected narcotics, including marijuana and cocaine.
On July 14, 2026, in Mexico City, Cartel Jalisco Nueva Generacion released a social media video declaring war on the suspected La Unión Tepito and the suspected Cártel de Tláhuac. In the video, masked, armed individuals claiming to represent the CJNG accused the two criminal groups of falsely using the cartel’s name to conduct extortion and protection rackets in Mexico City and the State of Mexico. The group threatened to “restore order” and denied engaging in extortion or collecting protection payments.
On July 14, 2026, in Zapopan, Jalisco, suspected members of the Cartel Jalisco Nueva Generacion carried out a targeted armed attack on a vehicle at the intersection of Avenida Aviación and Calle Tuxpan, killing a 42-year-old man and seriously injuring another occupant. According to reports, armed assailants intercepted a Hyundai Creta with Veracruz license plates and opened fire. The driver died at the scene from multiple gunshot wounds, while the second victim was transported in critical condition. The shooting also caused a secondary traffic collision involving a third vehicle. No group claimed responsibility.
On July 14, 2026, in Tlajomulco de Zuñiga, Jalisco, suspected members of the Cartel Jalisco Nueva Generacion shot and killed a man inside a pickup truck in the San Agustin neighborhood. According to reports, the approximately 30-year-old victim was found inside the vehicle at the intersection of José María Morelos and San Antonio streets, with multiple gunshot wounds. Responding police officers and paramedics confirmed he had died at the scene after sustaining two gunshot wounds to the head and two to the chest. No group claimed responsibility.
On July 15, 2026, in Zapopan, Jalisco, suspected members of Cartel Jalisco Nueva Generación fatally shot a man inside his residence in the Paraisos del Colli neighborhood. According to reports, the victim sustained a headshot and died at the scene. Neighbors alerted authorities after hearing gunfire, prompting an emergency response. The suspects fled the area before police arrived. No group claimed responsibility.
On July 16, 2026, in Tacambaro, Michoacán, search collectives reported a suspected Cartel Jalisco Nueva Generacion clandestine burial site that may contain the remains of at least 375 individuals. According to search activists, the preliminary estimate is based on the number of bone fragments recovered during excavation and does not represent an official victim count. Authorities continue conducting forensic analyses to determine the total number of victims and identify the recovered remains. The investigation remains ongoing. No group claimed responsibility.
On July 17, 2026, in San Pedro Tlaquepaque, Jalisco, a suspected Cartel Jalisco Nueva Generacion carried out a fatal shooting in the Guayabitos neighborhood, which was later linked to the discovery of a body in the Toluquilla district. According to reports, authorities initially responded to reports of a man shot on Juan de la Barrera Street between Hidalgo and Prisciliano Sanchez. Shortly afterward, officers found the body of a man with a gunshot wound to the head at the intersection of 16 de Septiembre and Matamoros in Toluquilla. Witnesses reported seeing several individuals exit a vehicle, abandon the body in the street, and flee the area. Authorities are investigating both incidents as part of the same case. No group claimed responsibility.
