Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo, Brian Cortes, Floyd Alex Cross, and Chris Dayton.
This edition features two analytical articles examining enduring and emerging challenges in terrorism and homeland security. In Back to the Future: What the 1977 Terror Film Black Sunday Still Teaches About Homeland Security, Chris Costa explores the continued relevance of the film’s terrorism scenario, highlighting lessons for contemporary homeland security, critical infrastructure protection, and counterterrorism preparedness. In The Left-Wing Threat: What Data Shows, and What It Does Not, Huseyin Cinoglu and Dean C. Alexander analyze available data on left-wing extremism, assessing prevailing narratives, threat perceptions, and the complexities of measuring ideological violence. Together, these articles provide valuable perspectives on both historical lessons and current debates shaping the evolving security landscape.
The edition also reviews U.S. military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded between May 23 and May 29.
Counterterrorism Insights
Back to the Future: What the 1977 Terror Film Black Sunday Still Teaches About Homeland Security
By Chris Costa
The recent theft of 15 crop-spraying drones in New Jersey—which scrambled federal authorities and triggered an investigation—has sharpened concerns about the misuse of commercially available aerial systems. Even though the drones were recovered, the broader implication is already clear to homeland security professionals: The barrier to entry for aerial threat systems continues to decline, as commercially available technologies become cheaper, more accessible, and easier to weaponize.
What once centered on 9/11-era concerns about lone actors modifying small aircraft or crop dusters now increasingly involves scalable, networked systems—commercial drones, autonomous platforms, and emerging artificial intelligence applications. The risk is no longer limited to a single platform being weaponized but extends to the possibility of coordinated or semi-autonomous systems operating in concert. In that sense, the threat environment is becoming more distributed, more accessible, and potentially more difficult to detect and deter.
Against this backdrop, it is worth revisiting an unlikely but instructive popular culture touchstone for fears of spectacular terrorism: the 1977 film Black Sunday.
Read the rest of the analysis here.
The Left-Wing Threat: What Data Shows, and What It Does Not
By Huseyin Cinoglu and Dean C. Alexander
Abstract
Drawing on 556 far-left cases in the Profiles of Individual Radicalization in the United States (PIRUS) Version 5 dataset, we examine the individual-level profile of left-wing radicalization in the United States and how it has shifted since 2015. The evidence supports neither a simple surge narrative nor a simple decline narrative. What emerges is a profile that is less lethal than the deadliest ideological streams, but more decentralized and more internet-involved than older left-wing patterns. More recent far-left cases outside the dataset point to a more aggressive posture among some actors, while still requiring careful case-by-case classification.
What incident counts can and cannot tell us
In September 2025, the Center for Strategic and International Studies (CSIS) reported that left-wing plots and attacks had outpaced the far right in the first half of the year. Within weeks, Just Security pushed back, pointing out the CSIS finding rested on five incidents over nearly seven months and cautioning against strong trend claims on that basis. Five incidents can still carry analytic weight. The matter is how much. What these few incidents cannot do, on their own, is support a broad trend claim without a longer evidentiary runway.
Two incidents from 2025 give the abstract count debate some concrete weight. In December of that year, federal prosecutors alleged law enforcement disrupted a coordinated bombing plot by four members of the Turtle Island Liberation Front (TILF). The government described TILF as a far-left, anti-capitalist, anti-government, and pro-Palestinian group. TILF purportedly planned simultaneous pipe bomb attacks on at least five logistics center locations in the Los Angeles area at midnight on New Year’s Eve, as well as follow-on attacks targeting U.S. Immigration and Customs Enforcement (ICE) agents and vehicles. According to the complaint, the four defendants, arrested in the Mojave Desert while constructing test devices, had produced a detailed operational document titled “Operation Midnight Sun.” It was alleged that the group had already spent weeks acquiring materials when the Federal Bureau of Investigation intervened.
Read the rest of the analysis here.
Counterterrorism Snapshot: Operations and Policy Signals (May 23 – May 29)
Between May 23 and May 29, 2026, counterterrorism operations and security measures were conducted across multiple regions to target jihadist networks and transnational criminal organizations. In Syria, Turkiye, in coordination with the Syrian Caretaker Government, arrested ten Turkish ISIS-linked individuals, including suspected facilitators of operations inside Turkiye tied to the 2015 Ankara bombings, further weakening Islamic State networks in the region. In Nigeria, security forces conducted multiple successful operations against Islamic State West Africa Province, including the rescue of 92 kidnapped civilians along the Buratai–Kamuya axis and later airstrikes on insurgent hideouts in Borno State by the Nigerian Air Force. In Iraq, the government—backed by the United States—advanced efforts to restructure and bring the Popular Mobilization Forces under tighter state control, amid ongoing political divisions over militia disarmament and integration. In the United States, the Federal Bureau of Investigation and U.S. Immigration and Customs Enforcement arrested a senior Sinaloa Cartel operative in California as part of broader efforts against transnational organized crime. In parallel, Guatemala agreed to joint counterdrug strike operations with the United States, while Spain conducted nationwide raids arresting at least ten ISIS-linked suspects accused of facilitating weapons transfers abroad. Additionally, the U.S. government announced forthcoming terrorist designations for Brazilian criminal organizations Comando Vermelho and Primeiro Comando da Capital, reflecting an expanded counterterrorism approach to major Latin American criminal networks.
On May 23, 2026, Turkiye, in coordination with the Syrian Caretaker Government, arrested ten Turkish ISIS members residing in Syria. The detainees include leaders of ISIS operations inside Turkiye, and individuals tied to the 2015 Ankara Bombings. The loss of secure zones of support in Syria is likely to seriously erode the capabilities of IS.
On May 23, along Buratai–Kamuya road, Borno State, Nigeria, Nigerian soldiers rescued 92 kidnapping victims. The soldiers reportedly engaged the perpetrators who fled.
On May 23, along Buratai–Kamuya road, Borno State, Nigeria, Nigerian soldiers rescued 92 kidnapping victims. The soldiers reportedly engaged the perpetrators who fled.
On May 24, 2026, the Iraqi government, endorsed by the United States, continued its attempts to disband or integrate the PMF (Popular Mobilization Forces) Shiite militias. Since the end goal is to consolidate weapons in the state’s hands. Mutqtada al Sadr placed Saraya al Salam under state authority, separating the militia from his political organization and transferring control over the militias to the state. More moderate Shiite groups have attempted to rebrand themselves as moderate, non-sectarian groups by distancing themselves from militias and coordination with the national government. More hardline groups, often with ties to Iran, have opposed disarmament.
On May 26, 2026, in Biramiri, Borno State, Nigeria, the Nigerian Air Force launched airstrikes against Islamic State West Africa Province (ISWAP) hideouts.
On May 27, 2026, in San Bernardino, California, United States, Federal Bureau of Investigation (FBI) agents and U.S. Immigration and Customs Enforcement (ICE) officers arrested Irving Froilán León Alvarado, alias “El 18,” a member of the Sinaloa Cartel’s Chapitos faction. León Alvarado was identified by U.S. authorities as a former chief of security and personal bodyguard to Ovidio Guzmán López, one of the sons of imprisoned Sinaloa Cartel leader Joaquín “El Chapo” Guzmán. The arrest was conducted as part of ongoing U.S. efforts targeting transnational criminal organizations and individuals associated with the Sinaloa Cartel. No injuries were reported during the operation, and authorities have not released additional details regarding the circumstances of the arrest. No group claimed responsibility for any related criminal activity.
On May 28, 2026, the New York Times reported that the Guatemalan Government had agreed to carry out joint strikes with the United States against drug trafficking groups. The agreement occurred last week, with operations expected to begin in the coming months.
On May 28, 2026, U.S. Secretary of State Marco Rubio announced that the United States would be designating the Brazilian gangs Comando Vermelho (CV) and Primeiro Comando da Capital (PCC) as Specially Designated Global Terrorists (SDGTs) and Foreign Terrorist Organizations (FTOs). The designations will go into effect on June 5, 2026.
On May 28, 2026, Spanish police carried out counterterrorism operations across multiple provinces, arresting at least 10 people linked to ISIS. The suspects were allegedly supporting ISIS by sending weapons abroad. It hasn’t been revealed which branch of ISIS the suspects were supporting.
Terrorist Attacks Worldwide (May 23 – May 29)
Between May 23 and May 29, 2026, a series of terrorist and cartel-related attacks were reported across Africa, Asia, the Middle East, Europe, and Latin America, reflecting continued transnational patterns of insurgent and organized criminal violence. In Nigeria, suspected militants linked to Islamic State West Africa Province carried out multiple attacks, including kidnappings in Kwara State, an IED killing of a Civilian Joint Task Force commander near Baga, and an assault on Nigerian soldiers in Borno State, while the Islamic State – Sahel Province also claimed attacks against security forces in the northwest. In Asia, the Balochistan Liberation Army conducted a deadly suicide bombing targeting a train in Quetta, Pakistan, killing at least 23 people and injuring dozens. In the Middle East, suspected Islamic State militants killed a Syrian government official in Deir Ezzor, while in Europe, a stabbing attack in Switzerland was treated by authorities as terrorism with suspected jihadist motivation. In Latin America, violence was dominated by cartel activity in Mexico, including coordinated ambushes, killings, drone explosive attacks, and internal factional violence involving Cartel Jalisco Nueva Generación and factions of the Cartel de Sinaloa, highlighting ongoing lethal competition and attacks against security forces and civilians.
Africa
On May 25, 2026, in Yashikira, Kwara State, Nigeria, gunmen kidnapped the emir of Yashikira’s palace and several others. The gunmen also attacked a police station in the village.
On May 26, 2026, near Baga, Borno State, Nigeria, Islamic State West Africa Province (ISWAP) killed a prominent Civilian Joint Task Force (CJTF) commander with an IED.
On May 27, 2026, in Yarchida, Borno State, Nigeria, Islamic State West Africa Province (ISWAP) attacked Nigerian soldiers, but were repelled.
On May 28, 2026, Islamic State – Sahel Province (ISSP) publicly claimed responsibility for two attacks against security forces in North-West Nigeria for the first time.
Asia
On May 24, 2026, in Quetta, Balochistan, Pakistan, the Balochistan Liberation Army (BLA) conducted a suicide bombing targeting a train, killing at least 23 people and injuring more than 70. Members of the Security Forces and civilians were killed in the attack. The BLA claimed responsibility for the attack.
Middle East
On May 27, 2026, in al Baghuz, Deir Ezzor, Syria, suspected IS (Islamic State) members shot and killed Ratib al Hashem al Atiwi, an official of the Syrian Caretaker Government. The suspected ISIS members were riding a motorcycle and were attacked with small arms.
Western Hemisphere
On May 28, 2026, in Winterthur, Switzerland, a man stabbed three people at a train station. The perpetrator reportedly yelled, “Allahu Akbar” during the attack. Swiss police say the attack was an act of terrorism. They also stated that the perpetrator had previously been reported for spreading ISIS propaganda.
Mexico and Latin America
On May 22, 2026, in Michoacán, Mexico, two separate armed ambushes targeting security forces were reported. In the first incident in La Estancia de Amezcua, municipality of Zamora, Cartel Jalisco Nueva Generación (CJNG) members ambushed Civil Guard officers, leaving seven personnel injured. Authorities reported that four officers sustained serious injuries, while the remaining victims were listed in stable condition and received medical treatment.
In a second incident during the early morning hours, CJNG armed individuals ambushed a convoy of Civil Guard and Municipal Police on the Apatzingán–Acahuato highway in Apatzingán. Two municipal police officers were injured and transported for medical care, where they were reported to be in stable condition. No arrests were reported in either attack.
On May 24, 2026, in Culiacán, Sinaloa, Mexico, suspected Cartel de Sinaloa–MF members shot and seriously injured a 17-year-old identified as Elmer Octavio near the intersection (Ingenio de Navolato). The attack occurred around 12:00 p.m. while the victim was at the location, reportedly working or selling goods. Armed individuals opened fire multiple times, striking him at least four times. The victim attempted to flee toward nearby railroad tracks but collapsed after being hit and remained injured at the scene. No group claim responsibility.
On May 24, 2026, in Culiacán, Sinaloa, Mexico, suspected Cartel de Sinaloa–MF members shot and killed a man identified as Bartolo, approximately 45 years old, during a religious ceremony at the Parish of the Divine Mercy in the Colinas del Rey neighborhood, Las Cañadas sector. The victim was found dead behind a parked gray vehicle. Forensic personnel recovered multiple spent shell casings from a high-caliber firearm at the scene, which were collected as evidence and added to the investigation file. No group claim responsibility.
On May 24, 2026, in San Ignacio, Sinaloa, Mexico, suspected Cartel de Sinaloa–Chapitos faction members ambushed Mexican Marines before fleeing the area following a brief pursuit that resulted in multiple suspects being captured. According to reports, authorities later discovered an arsenal inside two pickup trucks abandoned by the suspects. Seized items included 11 long guns, 76 magazines, 23 improvised explosive devices (IEDs), more than 2,000 rounds of ammunition, and multiple plate carriers. Several suspects reportedly escaped on foot, while others were detained by security forces. The incident occurred a day after thirteen members of the same faction were captured following a similar confrontation along the Tepic–Mazatlán highway.
On May 24, 2026, in Tlaquepaque, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) members carried out an armed attack that resulted in the death of a 20-year-old woman inside her home in the Las Juntitas neighborhood. According to reports, armed and hooded individuals entered the residence and shot the victim multiple times, striking her in the head. Authorities responded to the scene and initiated an investigation. No group claimed responsibility for the attack.
On May 25, 2026, in Valle de Juárez, Jalisco, Mexico, Cárteles Unidos (R5) members carried out a drone-bomb attack targeting a vehicle belonging to the Cartel Jalisco Nueva Generación (CJNG). According to reports, the attackers used a commercially available DJI drone equipped with an improvised air-dropped explosive device. The explosive reportedly detonated near the targeted vehicle but slightly missed the car. No casualties were reported.
On May 25, 2026, in Tecomán, Colima, Mexico, Cartel Jalisco Nueva Generación (CJNG) members engaged in an armed confrontation with security forces, leaving two suspected cartel members dead and two police officers injured, the incident began in the community of Caleras when a specialized unit of the State Attorney General’s Office (FGE) conducting investigative operations came under gunfire from armed individuals. During the exchange, two officers were wounded, one critically. Authorities reported that vehicle burnings continued for several hours in the municipalities of Armería and Cerro de Ortega, near the border with Michoacán. Security forces also seized an arsenal and detained a U.S. citizen who reportedly had an active homicide warrant in the United States.
On May 26, 2026, in the Valle de los Olivos neighborhood of Ixtlahuacán de los Membrillos, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) is being considered in connection with the area after members of the search collective Desaparecidos sin Justicia located skeletal human remains inside a residence during a search operation. According to preliminary information, the remains may correspond to a complete human body in an advanced state of decomposition, though authorities have not ruled out the possibility of additional human remains at the scene.
On May 25, 2026, in Quintana Roo, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) involvement is being considered based on known patterns of criminal influence in parts of the region, a law enforcement operation at a nightclub resulted in the identification and protection of 28 women who were allegedly victims of human trafficking in the form of forced prostitution. According to authorities, the victims were found performing activities under conditions of coercion, subordination, and elevated risk. The premises were secured by authorities, and the individuals were placed under protection while investigations continue into the trafficking network and any responsible actors. No group claim responsibility
On May 24, 2026, in the Las Juntitas neighborhood of San Pedro Tlaquepaque, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) armed individuals forcibly entered a residence located at the intersection of Privada Juan de la Barrera and Colima streets and directly fired multiple gunshots at a woman approximately 20 years old. Emergency services responded to the scene following reports of the shooting. The victim’s condition and identity were not immediately confirmed.The area was secured by local authorities, and an investigation is ongoing to determine the circumstances of the attack and identify those responsible. No group claim responsibility
On May 24, 2026, in Tonalá, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) conducted a direct armed attack resulted in the death of a man approximately 25 to 30 years old in the colonia La Jalisco neighborhood. The incident occurred at the intersection of Tlajomulco de Zúñiga and Jilotlán de los Dolores streets, where residents reported hearing multiple gunshots followed by a loud crash consistent with a vehicle impact. No group claim responsibility
On May 25, 2026, in the colonia Nueva Santa María neighborhood of San Pedro Tlaquepaque, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) left the body of a person wrapped in a blanket and covered with a transparent plastic bag on a public street. The discovery occurred on Isaac Arriaga Street, near the intersection with Avenida 8 de Julio, when individuals arriving to open a nearby business noticed a suspicious bundle abandoned next to a gate. According to initial reports, the victim’s feet were visibly exposed, prompting witnesses to alert authorities. No group claim responsibility.
On May 25, 2026, in the colonia La Cuchilla neighborhood of Zapopan, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) shot and killed a man in the afternoon after being attacked while parking his vehicle on Emiliano Zapata Street at the intersection with Pípila. According to initial reports, the victim was traveling in a gray-colored vehicle when he was intercepted by armed individuals who fired multiple shots at him. Witnesses reported hearing several gunshots, prompting a strong response from emergency services and security forces in the area. No group claim responsibility.
On May 26, 2026, in the Hacienda Santa Fe subdivision in the municipality of Tlajomulco de Zúñiga, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) left a human body wrapped in black plastic trash bags and abandoned approximately ten meters away from the sidewalk, in close proximity to several residential homes. According to preliminary information, members of a search collective may have been directly involved in locating the body. No group claim responsibility.
On May 26, 2026, in Guadalajara, Jalisco, Mexico, suspected Cartel Jalisco Nueva Generación (CJNG) performed an armed attack against a man while he was outside his residence. According to initial reports, the attack was a targeted shooting carried out by individuals traveling in a red pickup truck. After intercepting the victim outside his home, the suspects opened fire before fleeing the scene in an unknown direction, leaving the man wounded as neighbors alerted authorities. The victim sustained two gunshot wounds one to the hand and another to the leg. After his vital signs were stabilized, he was urgently transferred to a nearby Cruz Verde medical unit, where his condition was reported as stable. No group claim responsibility.
On May 28, 2026, in Escuinapa, Sinaloa, Mexico, the Cartel de Sinaloa’s Los Chapitos faction killed two suspected operatives affiliated with the Los Mayos faction of the Sinaloa Cartel. The victims were found decapitated amid the ongoing conflict between Los Mayos and Los Chapitos. According to reporting and preliminary investigations, the victims had allegedly been sent to persuade or recruit an individual known as “El 80,” a figure reportedly aligned with the Los Chapitos faction. The effort was unsuccessful, and the two men were allegedly intercepted, captured, and subsequently killed by members of Los Chapitos. The killings were widely viewed as a retaliatory act and a demonstration of territorial and organizational control amid the factional struggle within the Sinaloa Cartel.
On May 28, 2026, in Escuinapa, Sinaloa, Mexico, members of the Cartel de Sinaloa’s Los Chapitos faction displayed a narcomanta containing threats directed at Alberto David Rubio Zamora, alias “El Mudo Ántrax,” an individual identified as being associated with the Los Mayos faction. The message referenced the ongoing dispute between the rival factions and served as a warning amid the escalating internal conflict within the Sinaloa Cartel. Authorities removed the banner and continue to monitor developments related to the factional violence. The Chapitos faction claimed responsibility for this incident.
On May 28, 2026, in Culiacán, Sinaloa, Mexico, armed individuals allegedly affiliated with the Sinaloa Cartel’s Los Chapitos faction reportedly vandalized a seafood business known as “Los Cuñados.” The establishment was alleged to have connections to Alberto David Rubio Zamora, a suspected member of the Los Mayos faction, and was reportedly used as a financial operations center, drug distribution point, and lookout location for members of Los Mayos. The attack is believed to be part of the ongoing internal conflict between rival factions of the Sinaloa Cartel.
