Islamic State Flash Report - 11 March 2026
Islamic State (IS) inspired actors attempted a mass-casualty bombing using TATP-based devices in New York City, while arrests in the UK, Italy, and India underscored the persistent global threat of online radicalization targeting youth on platforms like Instagram and Telegram. IS affiliates remained operationally active, with IS claiming a targeted attack in Syria, and IS-linked groups engaging security forces in deadly clashes in the Philippines and Nigeria. Concurrently, intelligence reports indicated IS-Khorasan Province (ISKP) is expanding its recruitment efforts by targeting Central Asian communities online, highlighting the evolving and transnational nature of the group's threat.
Significant Incidents and Articles of Interest
Foiled Bombing at Gracie Mansion – New York, USA: On March 7, Emir Balat, 18, and Ibrahim Kayumi, 19, were arrested after attempting to detonate two improvised explosive devices (IEDs) during opposing protests outside Gracie Mansion, the New York City Mayor's residence. Balat threw one device, containing the highly volatile explosive Triacetone Triperoxide (TATP) and packed with nuts and bolts for shrapnel, toward a crowd. In post-arrest statements, both men professed allegiance to IS, with Kayumi stating his actions were "partly inspired by IS" and Balat writing a pledge of allegiance. Balat also indicated a desire to cause mass casualties, stating they wanted an attack "bigger" than the Boston Marathon bombing, which he noted caused "only three deaths." The two men, residents of Pennsylvania, traveled from out of state to carry out the attack. This incident highlights the significant domestic threat posed by homegrown violent extremists inspired by IS propaganda who are capable of building and deploying viable destructive devices [1, 4].
Transnational Counterterrorism Arrests Highlight Online Radicalization: Authorities in the United Kingdom, Italy, and India made several terror-related arrests targeting IS supporters radicalized online. In the UK, Mohammed Abdulkalik Fadil Alazawi, 35, was charged on March 7 with encouraging terrorism through pro-IS posts on social media. In Italy, an Egyptian man with links to ISKP was arrested for participating in a terrorist association and planning attacks on churches and stadiums after investigators found he was part of an online group called "The Dangerous of Egypt" that shared jihadist content and operational plans. In India, authorities detained a 21-year-old engineering student and two others for alleged links to IS and Jaish-e-Mohammed, stating he was radicalized over several months in encrypted Telegram groups that circulated extremist content and discussed "injustices against Muslims." These cases demonstrate the continued effectiveness of online platforms in facilitating radicalization and recruitment for IS and other extremist groups, often targeting vulnerable and isolated young men [7, 8, 9, 11].
ISKP Operational Planner Killed – Peshawar, Pakistan: On or around March 8, unidentified gunmen shot and killed Zalmai Badakhshi, a senior operational planner for ISKP, in Peshawar, Pakistan. Badakhshi, also known as Salman, was reportedly involved in planning the February 11, 2025 attack on a Kabul Bank branch in Kunduz, Afghanistan. According to security sources, he fled Afghanistan in October 2025 and relocated to ISKP centers in Pakistan’s Khyber Pakhtunkhwa province. The killing of a senior planner may temporarily disrupt the group's operational capabilities, but his presence in Pakistan highlights the country's role as a haven for ISKP leadership [5].
Dawlah Islamiyah Leader Killed in Clash – North Cotabato, Philippines: On March 8, Philippine military forces killed Emarudin Kulaw, a key leader of the IS-linked terror group Dawlah Islamiyah (DI), during a clash in Banisilan town, North Cotabato. Kulaw, also known as Alpha King, was an expert in fabricating IEDs and was wanted for over 20 offenses, including multiple murders and violations of the Anti-Terrorism Act. The operation was launched based on intelligence regarding his location. The neutralization of Kulaw degrades the DI's leadership and IED-making capabilities in the region, though security forces continue to call for the surrender of remaining group members [10].
IS Claims Attack on Syrian Defence Ministry Member – Aleppo, Syria: On March 7, IS claimed responsibility for an attack the previous day targeting a member of the Syrian Ministry of Defence near Al-Saharah town in the western countryside of Aleppo. According to the Syrian Observatory for Human Rights, this was the 20th attack carried out by IS in areas controlled by transitional government forces since February 17, bringing the total death toll from these attacks to 21, including 17 security personnel. The continued attacks demonstrate IS’s persistent insurgent capabilities and focus on targeting security forces to undermine government control in Syria [6].
Nigerian Security Forces Clash With Militants – Katsina & Borno States, Nigeria: Nigerian security forces remain heavily engaged with various militant groups, including IS-affiliated factions. On March 7, the military announced it killed 45 militants in Katsina state after the gunmen launched a revenge attack following a failed cattle raid. Separately, Islamic militants, likely from Boko Haram or its IS-affiliated splinter group ISWAP, abducted over 300 people from the town of Ngoshe in Borno state on March 6. This mass abduction was reportedly in retaliation for a military operation that killed three Boko Haram commanders. The incidents reflect the complex, multifaceted security crisis in northern Nigeria, where jihadist insurgencies and armed banditry frequently overlap [12, 13].
IS Activity and Tactics
Pervasive Online Radicalization and Recruitment: IS and its supporters continue to exploit a wide range of online platforms, including mainstream social media sites like Instagram and TikTok, as well as encrypted messaging apps like Telegram, for propaganda and recruitment. An LBC investigation found over 125 pro-IS accounts on Instagram with a combined following of more than 136,000, easily accessible to teenage users. Tactics to evade moderation include mixing extremist content with innocuous footage, using coded language, and creating "fan-cam" style videos of well-known terrorists like 'Jihadi John'. In India, investigators noted a "hate crime brainwashing model" used in Telegram groups, where narratives of global Muslim persecution are used to radicalize participants. This online ecosystem is a primary driver of the lone-actor threat in the West [3, 7, 11].
ISKP European Recruitment: A national security assessment by Lithuania released on March 8 identified ISKP as a potential national security threat due to its increased efforts to recruit individuals inside the country via social media. The report states these online campaigns primarily target young people from Central Asian communities, a demographic whose numbers have grown in Lithuania in recent years. This finding indicates a strategic effort by ISKP to expand its recruitment pool beyond its traditional areas of operation and tap into diaspora communities in Europe [2].
Use of TATP in Western Plots: The attempted attack in New York City utilized IEDs containing TATP, a highly volatile homemade explosive colloquially known as the "Mother of Satan." A notebook recovered from the suspects' vehicle contained handwritten notes referencing "TATP explosive" and listing the required chemical ingredients. The use of TATP, which has been featured in multiple previous IS-linked attacks, along with the inclusion of shrapnel, confirms the continued adoption of established terrorist tradecraft aimed at maximizing casualties in attacks on soft targets [1, 4].
Indicators to Watch
Increased IS propaganda and recruitment efforts on mainstream social media platforms like Instagram and TikTok, particularly content tailored to appeal to younger Western audiences.
Evidence of ISKP expanding online recruitment campaigns targeting Central Asian and other diaspora communities within European nations.
Reporting on the acquisition of precursor chemicals for TATP (hydrogen peroxide, sulfuric acid, acetone) by suspicious individuals or groups in Western countries.
IS-inspired plots targeting public gatherings, protests, or religious sites (churches, stadiums) in North America and Europe.
Movement of ISKP operatives and planners between Afghanistan and Pakistan, indicating the use of cross-border safe havens.
Escalation of mass-casualty attacks or large-scale abductions by ISWAP or other jihadist groups in West Africa, indicating growing operational capacity or desperation.
