Salafi-Jihadi Movement Weekly Update, April 27, 2023

To receive the Salafi-Jihadi Movement Weekly Update via email, please subscribe here. Follow CTP on Twitter, LinkedIn, and Facebook.

Data Cutoff: April 27, 2023, at 10 a.m.

Key Takeaways:

Iraq and Syria. ISIS activity in Syria increased in the first quarter of 2023, in contrast with statements by the commander of the US-led counter-ISIS coalition, who that ISIS attacks in Iraq and Syria had “decreased dramatically.”[1] ISIS attacks increased in the Syrian desert since 2022. ISIS attacks in northeastern Syria did decrease, but the decrease is likely due to the group’s prioritization of central Syria. ISIS’s continued ability to maintain support zones in Syria means that it remains a risk to Iraq’s hard-won stability, especially due to Iraq’s inability to successfully destroy ISIS support zones in rural areas.

Sahel. Overstretched security forces cannot contain al Qaeda–linked and IS-affiliated militants across Mali. Al Qaeda–linked militants have very likely established new support zones in central Mali despite increased counterterrorism efforts. The group is likely using these havens to support attacks on security forces in central and southern Mali—including the region surrounding Mali’s capital. Security forces are also unlikely to disrupt IS-affiliated militants growing support zones in northeastern Mali as they give more priority to the challenges in more politically sensitive areas of central and southern Mali.

Somalia. Al Shabaab suicide vehicle-borne improvised explosive device (SVBIED) attacks are continuing to pose a significant long-term threat to Somali counterterrorism efforts in north-central Somalia. The SVBIED attacks are exacting unsustainable human costs on US-trained Somali special forces and will undermine crucial local support for the Somali government. Al Shabaab will continue to halt Somali forces and exact an unsustainable human cost, barring improved Somali tactics or a second front that diminishes al Shabaab’s ability to concentrate its resources.

Assessments:

Iraq and Syria.  

ISIS activity in Syria has increased in the first quarter of 2023, in contrast with statements by Combined Joint Task Force Operation Inherent Resolve Commander Maj. Gen. Matthew MacFarlane. He said ISIS attacks have decreased in Iraq and Syria in 2023.[2] ISIS attacks increased by at least a third in the Syrian desert between the first quarter of 2022 and the first quarter of 2023.[3] In the first quarter of 2023, as compared to the first quarter of 2022, ISIS attack claims decreased in territory controlled by the Syrian Democratic Forces (SDF), but ISIS is capable of coercing support for ISIS from local communities and therefore may not need to conduct attacks at the same rate to sustain that support.[4] ISIS does not claim all of its attacks and does not report non-kinetic activity. ISIS may also have decreased attacks in northeastern Syria to increase attacks in central Syria in the first quarter of 2023. ISIS activity decreased by half in northeastern Syria between January and February 2023, while ISIS attacks in the central Syrian desert quadrupled over the same time frame.[5] 

Figure 1. Assessed ISIS Activity in Central Syria

Source: Brian Carter.

Figure 2. Claimed ISIS Attacks and Unclaimed ISIS Activity

Source: Brian Carter.

ISIS retains support zones in Syria that enable it to remain a risk to Iraq’s hard-won stability despite the group’s lowest attack rates in Iraq since 2003.[6] The UN assesses there are about 2,500–3,500 ISIS fighters across Syria and Iraq—orders of magnitude larger than the 200 “hard-core” fighters remaining in 2010 on the eve of the US withdrawal from Iraq.[7] ISIS fighters have support zones in Syria where they are able to train, rest, refit, and launch attacks against regime forces.[8] ISIS also uses its rural support zones in Syria to move forces back into Iraq, and it can retreat to support zones in Syria when its cells in western Iraq come under pressure from Iraqi Security Forces.[9] A US withdrawal from northeastern Syria could permit ISIS to rapidly strengthen in Syria and enable it to threaten Iraq.

Iraq likely lacks the ability to eliminate ISIS’s rural support zones in the western desert and disputed internal boundaries (DIBs) between Iraq and Iraqi Kurdistan. ISIS exploits border disputes and challenging terrain to carve out rural support zones from which it can mount opportunistic attacks.[10] ISIS lines of communication flow from the Syrian border into Iraq’s DIBs. ISIS uses these lines of communication and a lack of coordination between Iraqi and Iraqi Kurdish forces in Iraq’s DIBs to mount attacks against security forces and civilians.[11] Iraqi and Kurdish security forces deeply mistrust one another, imperiling cooperation, which makes greater and more effective coordination between the two unlikely.[12] The two main Kurdish parties’ security forces are unlikely to cooperate with one another due to increasingly violent competition and mistrust between the two parties, which makes US efforts to build a unified Kurdish security force also unlikely to succeed.[13]

The Iraqi army and Counterterrorism Service (CTS) are capable of conducting large-scale unilateral operations, but Iraqi political instability and remaining capability limitations could challenge these forces’ ability to perform their duties. These operations have been successful—during Ramadan 2022, the Iraqi Security Forces disrupted ISIS’s ability to mount a major urban attack—and the Iraqi Security Forces are eager to improve their capabilities.[14] However, the Iraqi army continues to face challenges clearing and then holding rural terrain, allowing ISIS cells to reoccupy rural areas after retreating ahead of Iraqi offensives.[15] CTS is more effective than the Iraqi army, but it is undermanned in part because the Iraqi government does not approve and allocate budgets with sufficient regularity.[16] CTS also faces bandwidth constraints during periods of instability in Iraq, such as in the summer 2022, when it stopped reporting operations to the coalition amid protests.[17]

Iran-backed Iraqi political groups are also creating conditions that could benefit ISIS in key areas while simultaneously undermining Iraqi political stability. Iran-backed militants are massacring Sunni civilians and encouraging sectarian cleansing in Sunni communities.[18] Iran-backed militants have previously used sectarian cleansing in Sunni communities, such as in Jurf al Sakhr.[19] ISIS has reacted to these trends in propaganda, by highlighting the Iraqi government’s sectarian tendencies.[20] This propaganda may not find fertile ground during Iraq’s current stable economic and political situation but could be more effective if instability increases.

The International Organization for Migration reported that a third of internally displaced persons returning to their communities said they could not express opinions without fear of violence. This includes 70 percent of returnees in Balad district, where Iran-backed militias have a large presence.[21] The Iraqi government’s choice to defund provincial reconstruction, which overwhelmingly focused on Sunni provinces, to shift funding to government ministries will further alienate the Sunni population.[22] Iraq’s corrupt political class is increasing funding of government ministries to enrich themselves at Iraq’s expense.[23]

Figure 3. The Salafi-Jihadi Movement in the Middle East

Source: Kathryn Tyson.

Sahel.

Overstretched security forces cannot contain al Qaeda–linked and IS-affiliated militants across Mali. On April 22, al Qaeda–linked Jama’at Nusrat al Islam wa al Muslimeen (JNIM) launched its first complex attack involving SVBIEDs in central Mali since April 2022.^[24] The attack used at least three SVBIEDs and dozens of fighters against the main Wagner Group-Malian army and Wagner Group base in the Mopti region while attempting to fix nearby UN forces during the attack.^[25] JNIM claimed to kill “tens” of Wagner and Malian forces, while Malian officials said the fighting killed 10 civilians and 28 JNIM fighters and injured 61 civilians.^[26] JNIM carried out another high-publicity attack several days earlier when it killed the Malian junta leader’s chief of staff in southern Mali on April 18.^[27] These attacks are emblematic of JNIM’s expansion across the country. IS’s regional affiliate also encircled Mali’s easternmost district capital in mid-April.^[28]

JNIM likely established new support zones in central Mali since the fourth quarter of 2022 that it is using to sustain attacks on security forces in central Mali and expand attacks into southern Segou. JNIM has subdued the civilian populations in these new support zones in the center of the Segou region and along the Segou and Mopti regions’ border with Burkina Faso. JNIM predominantly targeted civilians in these areas in the fourth quarter of 2022 but has ceased these attacks in 2023.^[29] Security forces were not active in these areas in the fourth quarter of 2022 or in 2023.^[30] The downturn in attacks on civilians despite the lack of security-force presence indicates that JNIM has coerced the population. JNIM has simultaneously increased the rate of its improvised explosive device (IED) attacks on roads surrounding these support zones in 2023 and expanded attacks into adjacent areas of southern Segou region.^[31] The group requires nearby support zones to sustain these attacks, which further supports the assessment that it has established new support zones in Segou and Mopti.

Counterterrorism efforts in 2023 have not degraded JNIM’s support zones or capabilities across much of central Mali, despite the Malian army and Wagner Group increasing the rate and scope of their operations in central Mali from December 2022 to March 2023.^[32] The Malian army claimed an average of 39 operations per month over this time frame, nearly tripling its baseline rate since the withdrawal of French forces in August 2022.[33] Security forces notably increased their activity in the Niger and Niono River Valleys and between Bandiagara and Bankass districts during this spike in operations.[34] JNIM has responded to the increased counterterrorism activity by increasing IED attacks on security forces since February, conducting these attacks over twice as often as they had since October 2022.[35] These attacks require nearby support zones to host bomb makers.

The Malian army and Wagner may have had some success degrading JNIM support zones between the Bandiagara and Bankass districts since January 2023. JNIM attacks have occurred farther away from Bandiagara and Bankass towns since January 2023. The group has only conducted one attack in the immediate vicinity of Bandiagara in 2023 and no attacks near Bankass after attacking civilians outside of Bandiagara four times in fourth quarter of 2023 and once near Bankass in that same time period.^[36] This trend could indicate counterterrorism operations have degraded the support zones in this area that JNIM uses to orchestrate attacks near the towns. However, JNIM has continued targeting security forces with IEDs in this area and orchestrated the April 22 complex SVBIED attack less than 50 miles from this zone. JNIM requires nearby support zones to manufacture the VBIEDs and IEDs used in these attacks and stage its fighters, indicating JNIM still has functioning support zones nearby.

Figure 4. JNIM Contests Malian Army and Wagner Group in Central Mali

Source: Liam Karr.

The Malian army and Wagner Group’s tactics are unlikely to produce lasting counterterrorism gains. Malian and Wagner forces have used collective punishment in their counterterrorism approach since Wagner arrived in Mali in 2021.[37] Many of their operations are raids or drone strikes, which do not hold territory or permanently remove insurgent presence—things that are required to degrade insurgent support zones.^[38] Security-force abuses and a lack of sustained pressure led many central Mali villages to negotiate deals with JNIM in the months following Malian army and Wagner operations in 2021 and 2022.^[39]

JNIM’s campaign in southern Mali illustrates that the Malian army is unable to ensure security outside of major base towns. JNIM has been targeting Malian lines of communication around Mali’s capital since January 2023, including several attacks less than 10 miles from the outskirts of Bamako.^[40] The killing of the Malian junta chief of staff highlights the seriousness of the deteriorating situation along southern Mali’s roads. JNIM required space along the road to stage the ambush and presumably used scouts along the road to spot and track the convoy. JNIM has used its havens in the Niger and Niono River Valleys in central Mali to support its 2023 southern Mali campaign. The group has regularly targeted roadways in southern Mali that are adjacent to or connect to these support zones.[41]

Figure 5. JNIM Increases Attacks Surrounding Mali’s Capital in 2023

Source: Liam Karr.

Continued JNIM attacks on the roads in southern Mali will further strain Malian forces’ ability to travel and contest JNIM in the region. A resulting decrease in counterterrorism pressure in southern Mali will allow JNIM to strengthen and expand support zones it could use to stage large-scale attacks near the Malian capital.^[42] The group’s last major attack in southern Mali targeted a major Malian base less than 20 miles from Bamako with an SVBIED in July 2022.^[43]

The Malian army is also unlikely to disrupt the IS Sahel Province’s (ISGS) growing support zones in northeastern Mali. ISGS has encircled Mali’s easternmost district capital since late April, the group’s latest milestone since beginning an offensive in the area following the French withdrawal in 2022.^[44] Malian and Wagner Group forces in the town rarely leave their base and lack the capability to challenge ISGS’s gains, because neither force gives priority to northern Mali.^[45] The few counterterrorism operations security forces in the area carry out have been drone strikes that do not permanently disrupt ISGS support zones and misguided ground operations near the town that have mistakenly targeted anti-ISGS militia groups.^[46] The lack of pressure on ISGS support zones presents ISGS the opportunity to set conditions to impose territorial control with support from the global IS network in the coming months.^[47]

Burkina Faso. Burkinabe security-force abuses are continuing to push communities to support Salafi-jihadi groups. Burkinabe security forces and volunteer militia massacred a village on April 21, killing at least 160 civilians.[48] The attack was in retaliation for an ambush by al Qaeda–linked militants that killed over 40 Burkinabe soldiers and volunteer militia on April 15.[49] This is the first time that Burkinabe forces have massacred civilians from the country’s majority Mossi ethnic group instead of Fulani civilians.

The Burkinabe junta’s counterterrorism approach is pushing more communities to cooperate with Salafi-jihadi groups for protection. The junta has emphasized arming poorly trained and largely ethnically homogeneous volunteer militias as part of its counterterrorism strategy to bolster its capacity, growing ethnically motivated violence that insurgents use to recruit.[50] The junta has also increased its rate of drone strikes since early March.[51] Social media reports allege some strikes have indiscriminately targeted areas with suspected insurgent presence and caused civilian casualties.[52] CTP cannot independently verify these claims. Al Qaeda– and Islamic State–linked groups in the area regularly use these kinds of abuses to position themselves as local protectors to increase local support and recruitment.[53] The junta has also forcibly conscripted civil-society critics and announced general mobilization, which could also undermine its support in politically sensitive areas currently facing less pressure from Salafi-jihadi insurgents.[54]

Somalia.

Al Shabaab SVBIED attacks continue to pose a significant obstacle to Somali forces in north-central Somalia. Al Shabaab launched two complex SVBIED attacks in Somalia’s Galgudud region targeting Somali special forces and local militia on April 19 and 22.[55] Al Shabaab claimed to overrun a US-trained Somali forces base and kill 50 soldiers in the April 19 attack and posted a video supporting its claims several days later.[56] The April 22 attack killed at least three tribal elders who were at the local forces base that al Shabaab targeted.[57] Somali forces intensified the rate of operations in early April after a several-month pause following another complex SVBIED attack that overran a US-trained special forces base in the same area in January.[58]

Figure 6. Somali forces and al Shabaab Contest the Galgudud Region

Source: Liam Karr.

The SVBIED attacks are imposing significant human and material losses on Somali special forces. The January attack inflicted at least 100 casualties.[59] Officials have not specified the losses from the April 19 attack, although al Shabaab’s videos indicate it is at least in the dozens.[60] These casualties amount to over a third of Danab’s most recent recruiting class and a significant number of the group’s 1,500-strong total force, which is spread across the country.[61] These forces are hard for the Somali Federal Government (SFG) and US partners to replace because US contractors have rigorous recruiting standards, which has also made the group much more effective and apolitical compared to other Somali units.[62] Al Shabaab also looted the US-trained special forces base after overrunning it, stealing numerous vehicles and weapons that it will use in future attacks on Somali forces.[63]

The SVBIED attacks will undermine local confidence in the federal government. Security forces must protect civilians and demonstrate they are stronger than the insurgents to establish themselves as the legitimate force in the area to convince local populations to cooperate.[64] Tribal elders play a leading role in their communities, and their death could undermine their clan’s belief that the SFG can protect them from al Shabaab. Weakened belief in the SFG could lead them to negotiate with al Shabaab. Other subclans in central Somalia have done this to secure hostage releases and other concessions from al Shabaab in exchange for ceasing support for the government.[65] A loss of local support for the SFG offensive would significantly weaken the SFG’s ability to sustain offensive operations, as local clan militia have been integral to supporting clearing operations and holding liberated territory since the offensive began in 2022.[66]

Al Shabaab will continue to halt Somali forces and exact an unsustainable human cost, barring improved Somali tactics. Somali forces, including elite US-trained forces, remain vulnerable to these attacks. Successful SVBIED raids have led to significant pauses in SFG operations previously.[67] Increased drone support from Somalia’s international partners could enable counterterrorism forces to disrupt the group’s ability to manufacture VBIEDs in central Somalia. Nonlethal drone support could also help Somali forces’ interdiction efforts against al Shabaab forces by providing more intelligence, surveillance, and reconnaissance.

The SFG could also challenge al Shabaab’s ability to concentrate its resources by opening another front in central or southern Somalia. There are several obstacles to this effort. Another front in central Somalia would require local support in other areas of the region that the SFG currently lacks.[68] However, Somali forces in the neighboring Mudug region captured an al Shabaab stronghold in January with minimal local support and moved toward the district border with Galgudud on April 15.[69]  These forces are the SFG’s best option for opening another axis in central Somalia, barring increased local support in other areas. The SFG is also waiting on the deployment of Kenyan and Djiboutian troops that are supposed to arrive in Somalia by the end of April before escalating counterterrorism operations in southern Somalia.[70] However, seasonal flooding will continue to restrict the scope and rate of counterterrorism operations in the area over the next several months.[71] 

Figure 7. The Salafi-Jihadi Movement in Africa

Source: Kathryn Tyson.

Pakistan. An explosion destroyed a Pakistani police compound and killed at least 16 police officers and civilians in Swat, northwestern Pakistan, on April 24.[72] Pakistani leadership initially said the explosion was a suicide attack but later said an electrical accident caused the blast.[73] The local government is investigating the incident.[74] The Tehrik-e-Jihad (TJP) militant group claimed responsibility for the attack and said it infiltrated Pakistani security forces to enter the compound. Pakistani officials have not responded to this claim.[75] TJP may be overstating its role in the attack. The TJP is a newly formed militant group that has claimed attacks primarily in southwestern Pakistan. The TJP has overstated its role in previous attacks in Pakistan, including issuing a statement it was responsible for an attack the Islamic State Pakistan Province conducted.[76] Civilians in Swat protested against terrorism and Pakistani security forces following the blast, accusing both sides of causing violence.[77]

Afghanistan. Former Afghanistan National Army Lt. Gen. Sami Sadat said al Qaeda uses ground and maritime lines of communication between Afghanistan, Iran, Somalia, and Yemen to move personnel during an interview with former US National Security Advisor H. R. McMaster.[78] Al Qaeda continues to work with the Taliban leadership in Afghanistan and operates training camps in southern Afghanistan.[79] The United States and United Nations Security Council have both reported that al Qaeda’s leader Saif al-Adl is based in Iran.[80] Maritime smuggling of people and weapons between Iran and Yemen and Somalia is common.[81]

Figure 8. The Salafi-Jihadi Movement in Central and South Asia

Source: Kathryn Tyson.