The Islamic State militant group (ISIS) has once again seized international headlines following two very different kinds of deadly attacks conducted days apart in Syria and Australia, both of them indicating the jihadis’ reach is resurging.
For both the shooting that killed two U.S. soldiers and a civilian contractor in Palmyra last Saturday and separate shootings that killed 15 people at a Hannukah celebration the following day at Sydney’s Bondi Beach, ISIS has taken direct credit, even mocking those who debate the group’s true connection.
Reports suggesting that the Bondi Beach attackers may have had some more direct ties to the Islamic State East Asia Province’s (ISEAP) presence in the southern Philippines have only intensified discussions over the group’s influence.
Christopher Costa, executive director of the International Spy Museum who previously served as special assistant to the president and senior director for counterterrorism at the White House’s National Security Council, said that “the fact that the Bondi Beach attackers spent time in the southern Philippines should be troubling to investigators and it’s very possible that the attackers made contact with ISIS planners.”
“Not surprisingly, these recent attacks demonstrate how ISIS continues to propagandize Israel’s war against Hamas to galvanize and radicalize would-be attackers,” Costa told Newsweek. “In short, it’s consistent with ISIS operations to incite and inspire violence against Jewish targets.”
Rise in Calls for Violence
Meanwhile, ISIS-linked channels and networks have undergone an extensive uptick in messaging calling for new violence coinciding with the holiday season as Christmas and New Year’s approach. The troubling pattern, established by scores of articles, messages and other forms of media affiliated with ISIS and reviewed by Newsweek, indicates a troubling pattern that experts and former officials warn pose an imminent threat of new violence.
Costa said the recent U.S. strikes targeting ISIS positions across Syria in an apparent response to the Palmyra attack may further heighten the risk of new jihadi operations in the coming weeks from East Asia to Western Europe, and potentially even the United States.
“Counterterrorism, intelligence and security services are always uneasy during the holidays, because revelers and tourists worldwide are both soft and symbolic targets during this season,” Costa said. “In light of breaking news on U.S. strikes against ISIS targets in Syria, it’s increasingly likely there will be terror plots disrupted in the coming weeks and perhaps even carried out during the holiday season.”
Command and Control of the Caliphate
The global threat posed by ISIS has undergone significant transformations since founding leader Abu Bakr al-Baghdadi first declared his self-styled “caliphate” from Iraq’s second largest city of Mosul in 2014.
Once constituting a quasi-nation state and standing army that controlled vast parts of Iraq and Syria, the group was largely defeated by an array of foes, with a U.S.-led coalition, Russia and Iran all contributing significant efforts to support local partners to crush the militant entity. Today, ISIS’ presence in both nations is reduced to cells, though with lingering capacities to strike, particularly in Syria, as witnessed in the recent attack in Palmyra and previous operations in the past year since the fall of longtime President Bashar al-Assad.
Even ISIS leadership has yet to recover from the loss of Baghdadi in a 2019 U.S. Special Operations Forces raid in Syria, with three successors also killed over the years. ISIS’ current chief, announced in August 2023, has been identified as Abu Hafs al-Hashimi al-Qurashi, yet very little is known about him and his actual role in the group’s day-to-day operations.
But the decentralization of ISIS infrastructure has also proven beneficial to the group on other fronts.
While suffering severe setbacks in the Middle East, ISIS has flourished in Africa, where the Islamic State West Africa Province (ISWAP), Islamic State Sahel Province (ISSP) and Islamic State Somalia Province mark some of the most active and powerful of the group’s outfits on the ground, as well as in Afghanistan, where the Islamic State Khorasan Province (ISKP, or ISIS-K) has carried out some of the group’s deadliest attacks abroad, notably the Kerman bombings in Iran in January of last year and Crocus City Hall attack in Russia just two months later.
These factions, along with ISIS central, have demonstrated a capacity to maintain extensive operations in the digital realm aimed at recruiting new acolytes, raising funds and inspiring attacks across the globe.
ISEAP, for its part, has drawn considerably less attention in recent years, particularly since the Philippines announced a decisive victory last year over the insurgency led by the group formerly known as Abu Sayyaf. Since Australian authorities have released information regarding a visit to the southern Philippines by the father and son duo behind the Bondi Beach shootings, Philippines authorities have stated that “no evidence has been presented to support claims that the country was used for terrorist training.”
A number of observers, such as Sidney Jones, senior adviser to the Institute for Policy Analysis of Conflict (IPAC) in Indonesia and adjunct professor at New York University, have also expressed skepticism as to the degree to which the Bondi Beach attackers had direct ties to ISEAP.
“We don’t know what the Australians thought they were doing in Mindanao. They certainly weren’t getting military training, though they may have been misled into thinking they could,” Jones told Newsweek. “Their presence in a hotel room for almost a month does not mean ISIS is resurgent in the Philippines or anywhere else in Southeast Asia, although it is increasing its attacks in Syria.”
She described ISEAP as only having been recognized by ISIS’ central leadership following the dramatic monthslong battle between militants claiming ISIS affiliation and the Philippines Armed Forces over the city of Marawi in 2017. Since then, she said, ISEAP has continued to claim lower-level operations through at least October 2024, though without any standing territory or influx of foreign fighters from nearby Indonesia.
Still, Jones argued that both countries would likely be boosting security measures given that “extremist groups have sometimes seen the holiday season as an opportune time to mount attacks,” such as the deadly series of bombings claimed by Al-Qaeda and the Indonesia-based Jemaah Islamiyah against churches on Christmas Eve 2000.
“Since the coordinated Christmas Eve bombings in Indonesia in 2000, Indonesia’s police have been extra-vigilant about a possible threat, and their monitoring and surveillance activities will probably go into overdrive now because of the Bondi attacks,” Jones said. “I would imagine that churches in some parts of central Mindanao will also be nervous and may seek (and get) additional protection. No one will have to urge the security forces in either country to be on high alert.”
‘The Jihadi Code’
While the extent to which ISEAP remains active on the ground and capable of conducting external operations remains subject to uncertainty, a number of messages circulating on pro-ISIS networks came from users and accounts claiming to originate in the Philippines, Thailand and Indonesia, and from as far away as Saudi Arabia and elsewhere. Many were in Tagalog, which is spoken in the Philippines.
ISIS’ central media apparatus has also acknowledged an opportunity to conduct follow-up attacks and has addressed directly the questions surrounding its connection to the Bondi Beach shootings.
“No operation carried out by the Islamic State in the heartland of the infidels has been spared from doubt and accusations of betrayal, whether the Islamic State officially claimed responsibility for it, implicitly praised it, or deliberately remained silent, leaving the enemy bewildered and hesitant,” the author of an article on the Bondi Beach attack appearing in the latest edition of ISIS’ online Al-Naba magazine wrote.
“This is true regardless of whether the attackers received guidance and support from the Islamic State or were simply a product of its incitement and ideology, and regardless of whether the targets were apostates, crusaders, or even the accursed Jews,” the article continued. “All your heroic acts, O strangers, will not please the rabble and the masses.”
The article also delved into the shifting nature of ISIS operations, where the use of technology, including AI, has enabled the group to plot and execute attacks with far fewer resources and preparations than may have been necessary in the past.
“The mujahid today no longer needs all these preparations and complications that existed in the ‘pre-Islamic State’ stage, and there is no longer a pressing need to bear all those distracting burdens,” the article stated. “The matter only requires a mujahid who has imbibed Tawhid [an Islamic concept] and escaped from the net of the groups before the knot of the governments and has then received ‘jihadi code’ here or there, Arabic or translated into Arabic!”
“And so he has set out like the whirlwind, looking for a Jewish or Crusader target, in which he implements what he has learned on the prophetic methodology,” the author wrote, noting that the group’s battle has entered “more difficult and complicated stages” in which its opponent’s “skills prove unable to stop it, and perhaps they will be a reason for its enablement!”
ISIS International
This battle extends far beyond Southeast Asia, with particular attention being paid now to Europe, where Christmas events have previously been a favored target for ISIS supporters, including a deadly 2016 vehicle ramming attack in Berlin. Just last week, German authorities announced they had foiled an “Islamist” plot involving one Egyptian, one Syrian and three Moroccan nationals to plow a vehicle into a Christmas market one year after a similar attack was conducted by an allegedly anti-Islam activist in the city of Magdeburg.
Another alleged plot to strike a Christmas market in Warsaw was intercepted days earlier by Polish law enforcement.
“For ISIS, attacking a Christmas or holiday market is like a bonus,” Colin Clarke, executive director of the Soufan Center who has advised Congress and the White House on counterterrorism issues, told Newsweek. “First, there is the symbolism of attacking Christianity. Second, these are historically soft targets with large gatherings of civilians, so even rudimentary attacks like vehicle rammings can be extremely lethal.”
“There are so many of these markets across Europe that there are an unlimited number of targets,” Clarke said. “Not all of these markets can be secured to the same level, so there will always be security vulnerabilities, especially if the attackers are willing to conduct surveillance beforehand.”
The U.S., too, has not been spared from ISIS-inspired vehicle rampages coinciding with the holiday season. At the beginning of this year, a lone attacker deliberately drove a truck into New Orlean’s crowded Bourbon Street on New Year’s Day, killing 14.
The sudden increase in ISIS online activity openly calling for such actions since the Bondi Beach shootings adds another layer of concern for those tracking the militant threat landscape.
“In the aftermath of the Bondi Beach attack, online spaces sympathetic to the Islamic State have actively celebrated the incident and amplified calls for additional violence against Western targets, Jews, and Christians,” Lucas Webber, senior research fellow at the Soufan Center and senior threat intelligence analyst at Tech Against Terrorism, told Newsweek.
“Analysts at Tech Against Terrorism have observed a sharp surge in activity within these extremist communities over the past 72 hours, with numerous users explicitly encouraging further attacks,” Webber said. “The tone in these channels has shifted to one of heightened morale, as participants portray the Bondi attacker as an inspiration for others to act. This surge in online extremist enthusiasm represents a worrying escalation in both momentum and intent heading into the holiday period.”
He warned that the risk was particularly acute for ISIS “targeting religious institutions, Jewish and Christian gatherings, and other public celebrations” across Western countries.
Adam Hadley, founder and director of Tech Against Terrorism, warned that the “scale of the problem is unprecedented.”
“In November alone, a single Tech Against Terrorism analyst identified 10,000 examples of terrorist content on major platforms. This is the worst we have observed in a decade,” Hadley told Newsweek. “Islamic State East Asia Province maintains a visible presence on Facebook and other mainstream platforms—a fact well known within jihadist circles, where ISEAP’s poor operational security has drawn criticism.”
“If one analyst at a small nonprofit can locate this volume of material through basic searches, so can those actively seeking connections with extremist networks,” Hadley said. “Content at this scale radicalizes people.”
The Invisible Enemy
The recent U.S. strikes against ISIS targets in Syria, accompanied by an intensified campaign of attacks against the group’s targets in Somalia under President Donald Trump, constitute a familiar tactic for a U.S. leader who continues to cite his proclaimed victory over ISIS during his first administration as a legacy making achievement.
But past experience has shown that kinetic operations have only limited success in uprooting ISIS’ increasingly underground and online presence across continents.
“Military operations can disrupt physical infrastructure, but the propaganda and communication apparatus persists online,” Hadley said. “This creates a profound asymmetry: it takes only a small number of individuals with internet access to radicalize, instruct, and inspire attacks across borders. A digital caliphate operates in parallel to any territorial gains or losses—and its reach risks undermining the considerable successes governments have achieved in dismantling these networks on the ground.”
The discussions surrounding ISEAP’s potential ties to the Bondi Beach shootings emphasize this. Whether or not the affiliate had a direct hand in the attack, the swell of online support has brought new life to its digital momentum, bringing with it the threat of a flood of new supporters with intentions to carry out real-world attacks.
Jason Blazakis, a former director of the U.S. State Department’s Counterterrorism Finance and Designations Office now serving as director of the Middlebury Institute of International Studies at Monterey’s Center on Terrorism, Extremism, and Counterterrorism, is among those who believed that, when it comes to the Bondi Beach shooting, “there is probably a more direct ISIS connection than inspirational,” given the group’s modus operandi and the attackers’ travel to the southern Philippines.
Whether this signals a resurgence for ISIS, however, he pointed out that “ISIS has never completely gone away.”
“They certainly have increased their cyber operations, leveraging AI technology and large language models to convey information to potential acolytes and followers at scale in varying languages that they weren’t able to before, until the advent of AI technology being much more advanced…” Blazakis told Newsweek.
“So, as we approach the holidays,” Blazakis said, “security services need to remain on high alert.”
