Islamic State Flash Report - 27 February 2026
Islamic State (IS) activity in Syria has intensified with a series of deadly attacks on security forces in Raqqa and Deir Ezzor, coinciding with reports of senior IS commanders re-emerging in the region amidst a security vacuum. A significant geopolitical development saw 5,700 IS detainees, including senior Turkish figures, transferred from Syrian to Iraqi custody, prompting Ankara to seek their extradition and raising questions about its previous inaction [4, 5, 16, 17]. Meanwhile, IS propaganda has evolved, with IS-Khorasan publishing detailed guides on using Artificial Intelligence for operational purposes, and a new speech from the group's spokesman called for attacks against the new Syrian regime while praising global operations [15, 20- Primary Source]. In Australia, a resurgent IS-linked network has been connected to a series of violent, filmed homophobic attacks in Sydney, highlighting a specific and dangerous domestic targeting trend [2, 19].
Significant Incidents and Articles of Interest
IS Attacks and Counter-Terrorism Operations – Raqqa, Syria: On 23 February 2026, IS militants attacked an Internal Security checkpoint west of Raqqa, killing four security personnel [1, 4, 18]. In response, Syrian security forces conducted pre-dawn raids on 24 February, dismantling the cell responsible. The operation resulted in the death of the cell's leader and another militant, the arrest of four other members, and the seizure of weapons and ammunition [4]. This activity corresponds with a reported re-emergence of prominent IS commanders, including Sufyan al-Qasham, Faisal al-Balawi, and Salem Turki al-Amari, who have been seen operating openly in Raqqa [5]. Separately, on 25 February, Syrian forces in al-Mayadeen, Deir Ezzor, arrested IS member Mahmoud Eid al-Ali, who allegedly confessed to his involvement in an attack that killed a member of the Defense Ministry’s 86th Division [1, 13]. On 27 February, another IS member, Jassem Ibrahim al-Ahmad, was arrested in Jarablus, Aleppo, and allegedly confessed to multiple murders and bombings [3]. The series of attacks and high-profile commander sightings in Raqqa indicate IS is actively exploiting security vacuums created by the withdrawal of US forces and the political transition to the Hay'at Tahrir al-Sham (HTS)-led government [5, 18]. The ability of Syrian forces to swiftly dismantle the responsible cell demonstrates a reactive counter-terrorism capability, but the broader trend points to a growing IS resurgence in its former heartland.
IS-Linked Homophobic "Bait-and-Bash" Attacks – Sydney, Australia: An investigation revealed a surge of violent attacks in Sydney targeting gay and bisexual men and teenagers by a youth network linked to IS spiritual leader Wisam Haddad and the perpetrators of the Bondi Beach massacre [2, 19]. Attackers lure victims using dating apps like Grindr and Wizz, then assault and rob them on camera while yelling homophobic slurs and IS slogans. In one case, a 17-year-old attacker filmed himself stomping on the head of his 20-year-old victim, "Nathan," causing severe facial injuries; the attacker, suspected in similar bashings and with relatives who fought for IS, received only nine months' probation with no conviction recorded [2]. Police figures show at least 64 people have been charged in NSW and Victoria since 2023 over similar app-based attacks [2, 19]. These attacks represent a dangerous convergence of extremist ideology and targeted hate crime, reflecting a specific IS-inspired targeting directive against the LGBTQIA+ community. The use of social media to film and share the violence serves as both propaganda and intimidation. The lenient sentencing in at least one case raises significant concerns about the legal system's capacity to address ideologically motivated violence, potentially emboldening extremists and leaving the targeted community vulnerable [2].
Transfer of IS Detainees from Syria to Iraq Sparks Turkish Extradition Push: Between 21 January and 12 February 2026, a total of 5,700 IS detainees were transferred from SDF-run prisons in northeastern Syria to facilities in Iraq. The transfer included 166 Turkish citizens, among them İlyas Aydın, a senior IS figure known as the group's "İstanbul emir" who is wanted on an INTERPOL Red Notice [16, 17]. Following the transfer, Ankara has accelerated diplomatic efforts to secure the extradition of its nationals, with Turkish and Iraqi officials confirming a mutual understanding has been reached [16]. Under Iraqi law, suspects convicted of IS-related offenses face the death penalty [16]. The transfer marks a significant shift in the handling of foreign terrorist fighters in the region. Turkey's sudden push for extradition, after years of failing to formally request the return of these same suspects from SDF custody, has fueled speculation that Ankara seeks to prevent potentially sensitive details about past contacts between Turkish intelligence and IS operatives from emerging in Iraqi court proceedings. Repatriating these high-value detainees would allow Turkey to retain control over the judicial process and the flow of information [17].
IS-Khorasan Publishes Guidance on "Responsible" Use of AI: The two most recent editions of IS-Khorasan's (ISKP) English-language magazine, Voice of Khorasan, contain detailed sections instructing supporters on how to use Artificial Intelligence (AI) and chatbots as a "responsible mujahid." The articles frame AI literacy as a religious obligation (fard al-ayn) and provide guidance on using AI for anonymous research, religious preaching, and creating propaganda while avoiding security risks. The magazine compares various AI models, recommends the privacy-focused Brave Leo for "sensitive queries," and warns against sharing personal information [15]. This lowers the barrier for creating sophisticated, tailored propaganda in local languages and could lead to new forms of radicalization, such as "terrorist chatbots," posing a new and accelerating challenge for counter-terrorism officials [15].
Suicide Bombing Targets Police in Moscow, Russia: A group calling itself the "Salafi Caucasian Jamaat" and claiming allegiance to IS's Caucasus Province claimed responsibility for a suicide attack in central Moscow [8, 9-Primary Sources]. Russian authorities confirmed that a 22-year-old man from the Udmurt Republic detonated an explosive device on Tuesday, 24 February, at Savyolovsky Station Square, killing himself and one police officer and seriously injuring two others [7]. The unofficial claim identified the attacker by his kunya, Abu Zainab al-Ruwaysi, and specified the primary target was 34-year-old Police Lieutenant Denis Bratuschenko, a senior traffic police inspector [8, 9- Primary Sources]. The incident demonstrates the capability of IS-inspired actors to conduct lethal operations in the Russian capital, with Russian President Vladimir Putin suggesting the perpetrator was recruited online [7].
IS Activity and Tactics
Targeting and Operational Methods:
"Bait-and-Bash" Tactic: In Australia, an IS-affiliated network is pioneering a "bait-and-bash" tactic targeting the LGBTQIA+ community. Assailants use dating apps to lure victims to secluded locations, where they are violently assaulted, robbed, and humiliated on camera, with videos often bearing IS watermarks or featuring IS slogans [2, 19].
Targeting Security Forces and New Regime: In Syria, IS cells continue to focus on attacks against security forces. The 23 February attack in Raqqa that killed four security personnel, and an earlier attack that killed a Defense Ministry member in Deir Ezzor, underscore a persistent insurgency targeting symbols of state authority [1, 4]. The group's official al-Naba newsletter and a new speech by spokesman Abu Hudhayfah al-Ansari reinforced this, with al-Ansari explicitly calling for followers to make fighting the new HTS-led Syrian regime their priority [10, 20- Primary Sources].
Geographic Resurgence and Exploitation of Instability:
IS Exploits Syria Security Vacuum: IS is actively exploiting the security and political vacuum in northern Syria. The HTS-led government's struggle to consolidate control and the withdrawal of US forces have created an environment ripe for an IS comeback. The open re-emergence of senior IS commanders like Sufyan al-Qasham and Salem Turki al-Amari in Raqqa, the group's former de facto capital, is a clear indicator of its growing confidence and operational freedom in the area [5, 18].
Caucasus-Linked Attacker Used Inter-City Travel: While the attack occurred in Moscow, the claiming group's name points to a connection with the Caucasus region. The perpetrator traveled by train from St. Petersburg to Moscow prior to the attack, indicating inter-city movement to stage the operation [7, 8- Primary Source].
Global Operations and Propaganda Narratives:
Al-Naba Newsletter: IS's weekly al-Naba newsletter (Issue 536) and a new speech by spokesman Abu Hudhayfah al-Ansari, "Righteousness has become distinct from falsehood," highlight the group's global reach and unified narrative [10, 20- Primary Sources]. The publications claimed responsibility for numerous attacks across Africa, including operations against military forces in Nigeria, Mozambique, the Democratic Republic of Congo, and Niger [10- Primary Source].
Official Ramadan State: The recent Ramadan speech from the IS's official spokesman, delivered explicit operational guidance for Western attacks, praising recent operations in Sydney, New Orleans, and Moscow while urging continued strikes against "Crusader and Jewish targets" using "blades, bullets, and vehicles." The address emphasized tactical secrecy and specifically promoted "Inghimasi" assault-martyrdom operations as the most effective attack method, noting that "Crusader Europe" has transformed streets into "war zones" through heightened security during holidays. Beyond tactical directives, the speech encouraged foreign fighter migration to Islamic State territories [20-Primary Source].
New English Magazine: An IS media affiliate in Pakistan released a new, English-language magazine called "Invade" that provides step-by-step instructions for producing and deploying various poisons, including botulinum toxin and cyanide. The guide suggests targeting crowds at festivals or parties by spiking food and drinks or smearing toxins on door handles [6-Primary Source].
Indicators to Watch
Propaganda and Messaging Campaigns: Monitor for increased dissemination of senior IS speeches, evolving tactical guidance (including AI exploitation), and shifting target prioritization across online platforms and official media channels.
Operational Tempo Changes: Watch for surges in attack frequency, complexity, or geographic expansion, particularly in Syria, West Africa, and other contested territories, indicating strengthened command structures or resource flows.
Detainee and Foreign Fighter Movements: Track diplomatic negotiations, prison transfers, repatriation efforts, and potential escapes of high-value detainees that could yield intelligence insights or signal containment strategies.
Emergence of New Targeting Trends: Be alert for potential copycat "bait-and-bash" attacks targeting LGBTQIA+ individuals in other Western countries, as the propaganda and videos from the Australian network may inspire sympathizers elsewhere.
Exploitation of Security Vacuums: Observe IS's ability to capitalize on political transitions, governance gaps, security force integration failures, and regional instability to expand territorial control or recruitment networks.
