When Disruption is Victory
Ahmad al-Sharaa’s government inherited a fragmented and collapsed state. I have written previously that any engagement or support to the new government must not view it as post-war Syria, but a post-state Syria. The state has been completely destroyed and now four wartime governments are collapsing into the same borders.
Services, reconciliation and the economy are the top priorities, but none of those can be achieved without first helping the state control its own security and safety guarantees. These guarantees are not only for potential investors, but for citizens themselves who have to be the bedrock of future stability.
ISIS’s activity targets security and safety directly. When you map out their attacks, methods, targets, timing, and reasons, it’s not random violence but a targeted campaign against Syria’s social cohesion, its economic recovery, and the new state’s claim to provide security.
To understand the group’s operational method, I examined ISIS’s online channels and closed Telegram groups, between January and June 2026. I focused on 2026 and not 2025, because ISIS’s strategy in 2025 was aimed at framing the new Syrian forces for attacks (especially against minority groups) and they avoided claiming them directly. In 2026 however, the strategy shifted towards recruitment and fundraising. Attacks thus became a stage for a group trying to revive its presence. I collected 276 incidents in eight governorates (so far) and built them into a live dashboard that I update weekly, to track ISIS, the government’s efforts against it, and the Syrian regions most at risk. The maps and charts below are screenshots from it. The live version goes deeper than what I can safely put on a public page, and I will state why that matters below.
I try to avoid sensational and empty analysis. I am not trying to answer “Is ISIS back?” Rather, I am mapping what ISIS is becoming in Syria post-Assad and what it is trying to destroy. These are the questions that should worry Damascus.
Three Targets You Should Know:
1. The Syrian State is the primary target
ISIS’s operations over the last six months have overwhelmingly focused on state security personnel and government officials. Of the 276 attacks I logged since January 2026, 110 are aimed directly at them, the single largest block in the data. Officers shot off of their motorbikes, checkpoints hit, personnel killed in their own homes. Local Syrian outlets and international analysts have covered this, but as a running tally of incidents rather than a pattern.
The most common method is a two-man motorbike team, a gun, and a single named target. In 98% of these attacks, the claim for the attack names either one victim or none. It is selective, assassinating specific people rather than random groups, in line with the group’s stated logic of disruption. But it also shows operational capabilities. Their ability to reach a specific officer at his own door with a hit team means they have data on who he is, where he lives and his movements. Intelligence is gathered through local penetration and informants, often within the forces of the new government. So while attention is on the cheap motorbike method, the target list is the worrying indicator.
ISIS’s assasination campaign is concentrated first in Aleppo and Raqqa, with about thirty attacks each, and then in Deir ez-Zor. These are the northeastern governorates which SDF handed to Damascus in January 2026, and the attacks followed that event. Attacks more than tripled in February from 7 to 25, and have stayed high since. The new government inherited the lands and buildings but without the CT infrastructure and experience to protect against attacks.
Finally, the highways tie the attacks geographically. A quarter of these attacks fall within twenty kilometres of a major road, concentrated on the M4 highway,the northern corridors, and especially Aleppo’s roads. This is the group’s oldest playbook. In Iraq after 2017, it turned the Hawija pocket and the Kirkuk–Baghdad belts into death traps. The road is chosen for the same reason in both countries. It is where the state is most exposed and the rider fastest. Where a checkpoint is a fixed target and a patrol runs a predictable route. Every strike on it does double work by removing the officer, while publicizing that whoever has to travel that way that the government cannot protect it. For a state trying to reopen trade and drive reconstruction, inability to secure highways becomes an economic failure.
2. Sectarian campaign now back in the open
Since January I have logged 54 claimed attacks in which the target is named by their sect. 44 Alawite, 8 Shia, 2 Druze, 52 dead, and a further seven former-regime figures hunted down after they took reconciliation papers. These were the shabeeha the killers claim to be punishing. They concentrate overwhelmingly in Homs, where the Alawite coast meets the new Sunni-led order, with a thin scatter into Rif Dimashq’s Shia villages and Suwayda.
For most of the year after Assad fell, ISIS deliberately did not claim several killings. Its strategy was to let each murder look spontaneous, let it look like the new state either cannot protect its minorities or is quietly settling scores. Let that impression do the work of igniting an uprising. It was not a far-fetched bet after the coastal massacres and the Druze killings. Damascus looked at worst complicit in the violence, at best unable to keep minorities safe. But this year, ISIS started claiming these attacks. Simply, the group is reading the disaffection both inside the government’s own hardline base and larger communities. They use the popular anger over the state’s reconciliation with some former regime figures, and then ISIS fights for hearts and minds on that issue for recruitment and funding.
ISIS is not the only actor promoting this target. Other jihadist factions and foreign-fighter networks, even those that despise ISIS and brand it Khawarij, are nonetheless celebrating the same killings. Dangerously, they are calling for communal violence against the same people. This is not some Jihadi coalition. There is no link, no joint command, no merger. These groups want each other dead. They share the target and the vocabulary to justify violence, making it much more dangerous than any coalition that can be broken. The Alawite-as-target has become a kind of commons: anyone may draw on it, for their own reasons, and each actor who does makes it more normalised for the next.
This is violence laundering. When ISIS alone kills an Alawite, the act carries an ISIS fingerprint the state can name and condemn. When rival factions, foreign fighters, and local crowds pile onto the same target with the same words, the killing becomes mob violence instead of terrorism. Precisely, the spontaneous, un-claimed appearance ISIS wanted in 2025.
The state is not standing outside of this. Two examples contradict each other, and both condemn the state. First is the settlement in Homs that government forces demolished this week. It was Sunni-owned land whose owners were displaced during the war. The Assad regime then moved Shia families onto it - resettlement as reward and demographic engineering. So, the story carries three sedimented layers of sectarian sorting. 1) Sunni owners cleared out by the war, Shia settled there by the old regime, and now the settlement razed by the new regime. The lawful answer would have been adjudication. Restore the displaced owners, and give the resettled residents due process and time. What the state chose instead was the bulldozer, which restores no one and simply stacks a third displacement on the first two.
The second case is in Hasakah. Armed Sunni Arab men took to the streets , filming a message that warned locally displaced Kurds against any attempt to return home. Here, the state did the opposite of what they did in Homs. Nothing. No move to disarm them, no action against the open intimidation, no effort to facilitate the return of the forcibly displaced. These examples expose a deeper failure. The state is courting the radicals rather than governing them. A demolition here, a withheld intervention there, a spotlighted case of a former regime figure. This is state theater to maintain legitimacy among the hardliners who wanted exactly this. The same disaffected base is courted which ISIS and its rivals are also pursuing. Damascus is competing for the angry instead of protecting the vulnerable.
3. Economy and Reconstruction
The third target is the economy which the government is staking its survival on. Since January, my map shows 22 crop fires, 11 infrastructure-sabotage attacks, a run of strikes on oil tanker convoys, the Al-Uzbah and Khrata fields, pipelines and tankers burned around Homs, and a crude tank in Hasakah. All these fall within key sectors I’ve covered. I’ve also covered the crop fires here.
Predictably, two main cluster areas emerge on the live dashboard. First, the Badia corridor, an oil road also called the M20 between Deir ez-Zor and Homs. Crude and tankers move from the eastern fields across the desert to the Homs refinery, past the phosphate country of the central Badia, and exactly along it was where the tanker convoy hits, field bombings, and the Homs pipeline fires occurred.
Second is the Euphrates corridor, running through Deir ez-Zor, Raqqa, and Hasakah. It is the Jazira spine, oil to the east, wheat to the north, and it is where the crop fires clustered with the field strikes. The M4 across the top and the Daraa–Damascus road in the south are the grain-haulage routes, and the crop fires in Hasakah, Raqqa and Daraa sat along them. The highways are both the kill-zones and the economic arteries. That single stretch cuts both the state’s security and economic engines.
ISIS is not trying to seize the Al-Uzbah field or hold the Homs refinery. It can’t, and it knows it. So, it hits the tanker on the road, a section of pipeline, and a convoy on the way to the refinery. A group too weak to hold the Jazira can still make the Jazira unusable. It’s much cheaper and easier to be a spoiler.
The highway is the most efficient target because it is a single variable that drives three areas - security, economy, and public perception.Control the safety of a corridor and you strike the security force that patrols it, the oil and grain that move on it, and the population that watches the state fail to protect it. One chokepoint, three disruptions.
It also locks Damascus into a geographical bind. The only way to protect the artery is to put men and checkpoints on it. Men and checkpoints on the road become valuable targets. Securing the economic corridor heightens the security exposure. The more the state garrisons the highway to keep the oil moving, the more targets it provides in the kill-zone. The oil vulnerability is around Deir ez-Zor and the eastern Badia, where ISIS launches its most complex operations. The economic front and ISIS’s operational rear are one place. This is exactly why this corridor needs to be watched.
My Take
A lot of analysis on Syria, argues that ISIS is weaker (compared to 2013), due to fewer attacks compared to the past . These arguments are fundamentally flawed, in my opinion. They measure the new 2026 strategy with a 2014 ruler.
Yes, the group is materially weak. It holds no town, no large cadre of foreign fighters, runs no economy. There is no ‘state’ ruled by the Islamic State. But the group now chooses disruption as a strategy. Once the group strategy changes, we need to evaluate it with a new approach. “Historic low” is not a measurement since the actions differ so much. ‘Historic low’ is just counting, but not analysis.
For roughly six months, in closed ISIS groups, the group admins continue sharing recorded lectures on guerilla and urban warfare. This is not new. But the context is no longer to take and hold the country. It is to make sure that no one else is able to.
Since I started writing here, I have argued that we need to look at trends, and not headlines. We all over-emphasize breaking news, and we underestimate the impact of long-term changes.
The dashboard finds the convergence between the two with street level percision. It looks at where attacks pile up using multiple methods over time, not just where the count is high. It shows where the thinly stretched and fragmented government meets its limits in countering ISIS.
It also projects likely ISIS safe-havens. The ISIS cells do not live where they strike. Using a simple, transparent mobility model, the dashboard pushes each cluster’s centre away from the nearest town or garrison into where a cell can actually shelter. It then calculates the area of reach around it. Once you have that, you see the vulnerable highway stretches.
This is why we don’t need analysis that just crunches numbers waiting for a decade-old indicator. By the time the group becomes “resurgent” based on the 2014 indicators, you won’t need an analyst, you’ll need special forces with a whole lotta bullets.
Note: This public page shows the counts, the corridors, the direction of travel. What it deliberately withholds are the exact coordinates, the projected safe-haven zones, the mobility-model parameters, the corridor-risk index and the weekly emergence scoreboard that flags the markers above before they surface in the news. All of these live in the working dashboard. Precise locations and methods are exactly what a hostile actor would want. If you need the operational layer, governments, newsrooms, and organisations working inside Syria, contact me directly at FullspectrumJordan@gmail.com