Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo and Brian Cortes.
This edition features three analytical articles examining evolving trends in terrorism financing, sanctions enforcement, and criminal convergence. In A Quarter Century of Counterterrorism Finance, Unwound in a Year, Jason M. Blazakis examines the erosion of long-standing counterterrorism financing frameworks and the implications for global security cooperation. In Mapping the Network: Treasury’s New Approach to Iranian Sanctions Evasion — What Treasury Secretary Bessent’s Paris Remarks Reveal About the Next Phase of Terrorism Financing Enforcement, Dawson Law analyzes evolving U.S. Treasury strategies targeting Iranian sanctions evasion networks and the broader transformation of terrorism financing enforcement mechanisms. Finally, in Terrorist Financing and Criminal Convergence in Africa’s Expanding Security Crisis, Pearl Matibe explores the growing intersection between terrorist organizations and transnational criminal networks across Africa, emphasizing the security implications of illicit economies and regional instability.
The edition also reviews U.S. military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded between May 16 and May 22.
Counterterrorism Snapshot: Operations and Policy Signals (May 16 – May 22)
On May 19, 2026, Nigerian forces, working alongside U.S. forces, killed 175 Islamic State militants in recent operations. On May 16, a joint U.S.-Nigerian operation killed Abu-Bilal al-Minuki, ISIS’s second-in-command. Senior Islamic State West Africa Province (ISWAP) leaders were also killed last weekend.
On May 19, 2026, Pakistani security forces launched operations in Khyber Pakhtunkhwa, Pakistan, killing 23 members of the TTP, including a senior commander.
Notable Terrorist Attacks
Between May 16 and May 22, 2026, multiple regions experienced significant violence driven by politically and economically motivated terrorist and criminal groups, underscoring the growing convergence between insurgent organizations and transnational criminal networks. In Mexico, the Cartel Jalisco Nueva Generación (CJNG) and the Sinaloa Cartel–MF faction carried out a sustained wave of killings, disappearances, ambushes, and intimidation attacks in Michoacán and Culiacán, while CJNG-linked violence also escalated in Honduras, including the killing of plantation workers and anti-gang officers.
In parallel, terrorist violence persisted across other regions. In Pakistan’s Khyber Pakhtunkhwa province, Islamic State Khorasan Province (ISKP) killed a tribal elder in a bombing, while intra-jihadist clashes between Tehreek-e-Taliban Pakistan (TTP) and Jamaat-ul-Ahrar left multiple militants dead. In Syria, a suspected ISIS car bombing in Damascus killed one soldier and injured several others. In the United States, a far-right extremist attack on a mosque in San Diego killed three people.
On May 17, 2026, in Sevina, a municipality in Nahuatzen, Michoacán, Mexico, suspected members of the Cartel Jalisco Nueva Generación (CJNG) killed two indigenous community guards, locally known as “kuarichas,” in a violent attack targeting the community guard force. Authorities launched an investigation into the killings.
On May 17, 2026, in the community of La Cantera, municipality of Tangamandapio, Michoacán, Mexico, members of the Cartel Jalisco Nueva Generación (CJNG) were reported to have forcibly disappeared ten individuals after armed men allegedly took them from the area. Authorities initiated an investigation into the incident.
On May 18, 2026, in San Diego, California, two far-right shooters carried out an attack on a Mosque, killing three people. The attackers killed themselves. The perpetrators’ weapons and clothing had far-right/neo-nazi symbols and writing on them.
On May 18, 2026, in Lower South Waziristan, Khyber Pakhtunkhwa, Pakistan, Islamic State Khorasan Province (ISKP) carried out a bombing that targeted a prominent tribal elder, killing the elder and two others and injuring four people. ISKP attacks have increased in Khyber Pakhtunkhwa in recent months.
On May 19, 2026, in Aquila, Michoacán, Mexico, suspected members of the Cartel Jalisco Nueva Generación (CJNG) reportedly carried out an armed attack on an indigenous community. Authorities reported that armed individuals opened fire in the area, prompting a security response. No casualties were reported after the incident. Authorities initiated an investigation into the attack.
On May 19, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–Mayito Flaco faction shot and killed two men in the Santa Rocío neighborhood. One victim was found lying on a public roadway in front of a park, while the second was found inside a residence. No group claimed responsibility for the killings.
On May 19, 2026, in the Emiliano Zapata neighborhood of Culiacán, Sinaloa, Mexico, suspected members of the Sinaloa Cartel–MF faction killed a man with gunfire. The victim was found handcuffed, showing signs of torture, and positioned next to a written message in the morning. No group claimed responsibility for the killing.
On May 19, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa-MF shot and killed two men inside a vehicle. The attack occurred at approximately 5:00 p.m. on Aztecas Street, between Francisco J. Mújica and Cándido Aguilar streets, where the victims were ambushed and repeatedly fired upon with assault rifles by an armed group. No group claimed responsibility for the attack.
On May 19, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction shot and injured an unidentified young man inside Plaza Novum, located on Álvaro del Portillo Boulevard in the Valle Alto neighborhood in the city’s northwestern part. According to initial reports, the attack occurred around 9:00 p.m., when armed individuals confronted the victim inside the shopping plaza and fired multiple shots before fleeing the scene. Authorities reported that the victim sustained four gunshot wounds to different parts of the body, allegedly caused by a handgun. No group claimed responsibility for the attack.
On May 19, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction killed an unidentified man along the Benito Juárez highway (La Costera) in the Aguaruto municipal district. Authorities reported that the victim was found with gunshot wounds and a cardboard sign bearing a written message. The body showed visible impacts from gunfire, including injuries to the back. An investigation was initiated at the scene. No group claimed responsibility for the killing.
On May 19, 2026, in Damascus, Syria, a car bomb exploded outside a government building, killing one soldier and injuring 18 others. The attack is believed to have been carried out by ISIS.
On May 20, 2026, in Kurram, Khyber Pakhtunkhwa, Pakistan, a clash erupted between members of Tehreek-e-Taliban Pakistan (TTP) and Jamaat-ul-Ahrar (JuA), leaving 18 JuA members dead. JuA blamed Noor Wali, the current emir of the TTP, for the clash. Although officially allied, relations between JuA and the TTP have historically been fraught.
On May 20, 2026, in Michoacán, Mexico, members of the Cartel Jalisco Nueva Generación (CJNG) ambushed federal security forces on a highway between the communities of Cocucho and Ocumicho in the Purépecha Plateau region, triggering an armed clash that left three presumed CJNG members dead. The confrontation occurred during ground and aerial patrols in response to a recent increase in violence in the area. After the exchange of gunfire, authorities seized firearms, communications equipment, and tactical vests bearing CJNG insignias, along with patches resembling Colombian flags. Federal authorities launched an investigation into the incident.
On May 20, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction shot and killed two men in the evening near the Monumento a la Pelota by the Tomateros Stadium. According to initial reports, the victims were traveling in a vehicle when they were intercepted and attacked in a drive-by shooting. After the attack, one victim died inside the vehicle, while the second attempted to flee on foot, was struck by gunfire, and collapsed a short distance away, where he died. No group claimed responsibility for the attack.
On May 20, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa killed an unidentified adult man along the side of the Mexico 15 highway (Culiacán–Los Mochis free road), near the community of La Campana in the Villa Adolfo López Mateos (El Tamarindo). Authorities reported that the victim was found lying on his back beside the roadway, with a yellow rope around his neck and visible signs of violence. An investigation was initiated at the scene. No group claimed responsibility for the killing.
On May 21, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction left a cooler containing human remains in the late evening in the Industrial El Palmito neighborhood. The discovery was reported shortly before 11:00 p.m. in the parking area of a pharmacy branch on Tarahumaras Avenue, between Constituyente Pastor Rouaix and Constituyente Francisco J. Múgica streets, near the grounds where a traditional public fair is held. According to preliminary reports, the suspects arrived at the location in an unidentified vehicle and abandoned the cooler, along with a piece of cardboard containing human remains. No group claimed responsibility for the incident.
On May 21, 2026, in the Lomas del Boulevard neighborhood of Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction killed an unidentified young man with gunfire in the late evening. The victim was found alongside a handwritten message on a piece of cardboard. Authorities responded to the scene and launched an investigation. No group claimed responsibility for the killing.
On May 21, 2026, in Culiacán, Sinaloa, Mexico, suspected members of the Cartel de Sinaloa–MF faction shot and killed an unidentified man inside a residence in the Gustavo Díaz Ordaz neighborhood during the late evening. According to official information, a single armed suspect arrived at the property and fired multiple shots at the victim, who died inside the home. After the attack, the suspect fled the scene in an unknown direction. No group claimed responsibility for the killing.
On May 21, 2026, in Trujillo, Colón Department, Honduras, members of the Cartel Jalisco Nueva Generación (CJNG) carried out an armed attack at an African palm plantation, killing at least eleven workers. According to reports, a group of armed individuals stormed the finca and opened fire on personnel. An investigation into the mass killing is ongoing.
On May 22, 2026, in Culiacán, Sinaloa, Mexico, a suspected Cartel de Sinaloa-MF armed attack left one man dead and another injured. The incident occurred in the early morning near volleyball courts, following reports of gunfire. According to authorities, Mexican Army (SEDENA) personnel responded to the scene and found two men with multiple gunshot wounds. Red Cross paramedics arrived and confirmed that one of the victims had already died at the scene. The deceased was pronounced dead at the scene of the attack. The injured victim was transported to a hospital for emergency treatment and remains hospitalized. Several shell casings from high-caliber firearms were recovered at the scene. No group claimed responsibility.
On May 22, 2026, in Omoa, Cortés Department, Honduras, members of the Cartel Jalisco Nueva Generación (CJNG) were involved in a violent confrontation that killed five officers from the Directorate for the Fight Against Gangs and Organized Crime (DIPAMPCO). According to reports citing intelligence and prosecutorial sources, the officers were participating in a covert operation allegedly intended to seize drugs and cash for their own benefit, but they were killed during the incident involving suspected CJNG-linked networks. An investigation into the incident is ongoing.
Emerging Threats and Hot Zones
A Quarter Century of Counterterrorism Finance, Unwound in a Year
By Jason M. Blazakis
Counterterrorism financing was never glamorous work. For most of my career at the State Department, it was national security’s back office: essential, technical, and mostly invisible. In my case, that was almost literally true. The counterterrorism finance and terrorist designations office I ran at State for more than ten years was housed in an annex across the street from the Harry S. Truman Building, or “Main State,” as we called it.
Suspicious activity reports, beneficial ownership filings, designation packages, and mutual evaluations at the Financial Action Task Force. These measures generated friction, and friction is what bad actors pay a premium to avoid. The U.S. architecture is being dismantled, not in a single piece of legislation but in a series of decisions since January 2025 that together reverse a quarter century of practice. The Trump administration paused enforcement of the Foreign Corrupt Practices Act. Treasury suspended penalties under the Corporate Transparency Act for domestic reporting companies, gutting the beneficial ownership rule that would align the United States with FATF recommendations. Foreign assistance freezes left counterterrorism capacity building in Africa, where jihadist violence is surging, in limbo. And the State Department designated six Mexican cartels, a Venezuelan gang, and an El Salvadoran gang as Foreign Terrorist Organizations in roughly a month, a pace that should be impossible if the standard interagency process were being honored.
Each decision is defensible on its own terms by someone. Taken together, they describe a country deliberately lowering friction in its own financial system at a moment when the cost of terrorism is dropping, and the tools available to terrorists are multiplying. Terror Disrupted, my book out this year from Cambridge University Press, argues that this architecture works not because it is dramatic, but because it turns legal authorities, financial intelligence, sanctions, and interagency coordination into sustained pressure.
Read the rest of the analysis here.
Mapping the Network: Treasury’s New Approach to Iranian Sanctions Evasion
What Treasury Secretary Bessent’s Paris Remarks Reveal About the Next Phase of Terrorism Financing Enforcement
By Dawson Law
In May 2026, Treasury Secretary Scott Bessent made a striking admission at a G7 “No Money for Terror” conference in Paris. Despite over 1,000 US designations of Iranian entities, vessels, and facilitators since February 2025, despite Treasury’s aggressive campaign of what officials call “maximum pressure,” Bessent felt compelled to urge America’s allies to “stand with us in full measure” against Iran’s terrorism financing. Translation: we are not winning.
The Financial Crimes Enforcement Network’s (FinCEN) alert on May 11 about the Islamic Revolutionary Guard Corps’ (IRGC) use of front companies, exchange houses, and shadow fleet vessels provides important operational detail. The FinCEN alert describes a system that blends front companies, procurement agents, oil smuggling, exchange houses, shipping facilitators, and opaque commercial intermediaries operating across multiple jurisdictions. The focus was on network discovery, including financial activity from logistics, procurement, transportation, and sanctions evasion.
Taken together, the message was difficult to miss despite years of sanctions escalation and increasingly aggressive enforcement. Treasury does not believe the current pressure campaign is producing sufficient strategic effect and is shifting its enforcement and designation attention.
Read the rest of the analysis here.
Terrorist Financing and Criminal Convergence in Africa’s Expanding Security Crisis
By Pearl Matibe
Africa’s security challenge is no longer best understood as a set of separate crises. Across Somalia, Nigeria, and the wider Sahel, violent extremism and illicit commerce are increasingly operating as interconnected systems that exploit governance gaps, move across borders, and outpace conventional responses.
Somalia remains a stark reminder of how insurgent violence persists under pressure. In 2025 alone, Al-Shabaab struck a meeting of Somali National Army personnel, politicians, and local elders in Beledweyne; targeted President Hassan Sheikh Mohamud in Mogadishu; and briefly seized a Somali National Army base at Wargaadhi. These incidents matter not only because of their tactical effects but also because they show how the group continues to contest state legitimacy, undermine confidence, and demonstrate its reach across both urban and peripheral spaces.
That convergence should concern policymakers. Somalia shows what enduring insurgency looks like when armed groups can still strike symbolic targets and sustain pressure on the state. Nigeria shows what criminal globalization looks like when foreign expertise, local collaborators, and weak oversight combine to enable industrial-scale narcotics production. The common denominator is not ideology, but adaptation. This May 2026, Nigeria’s National Drug Law Enforcement Agency interdicted a Nigerian-Mexican network—an Ogun State methamphetamine laboratory. It dismantled a massive clandestine meth lab in the Ogun forest. Operatives seized over 2.4 metric tonnes of methamphetamine and precursor chemicals with an estimated international market value exceeding $362 million. Both insurgents and traffickers thrive where the state is fragmented, enforcement is uneven, and informal power fills the gaps.
