|
Suspected JNIM Assault on Villagers in Difita, Ivory Coast
On 24–25 August 2025, at approximately 2 a.m. local time, unidentified armed men launched a coordinated assault on residents of Difita village, Téhini Department, Bounkani Region, in northern Ivory Coast. The attackers killed four farmers, wounded one woman, abducted another resident, burned several homes, looted livestock, and destroyed or seized an unspecified number of vehicles. By the time Ivorian security forces responded, the assailants had already fled, highlighting once again the slow reaction capability of local forces in these remote northern borderlands.
Difita lies just 2 km from the Burkinabé border, a highly porous frontier where jihadist groups, particularly Jama’at Nusrat al-Islam wa al-Muslimin (JNIM), have steadily expanded influence. TRAC assesses that the village likely lies near Dalan, Poni Province (Burkina Faso)—a site where, on the same day, JNIM militants overran a Burkinabé military post. The timing and proximity of these two attacks suggest a cross-border operation, reinforcing the view that northern Ivory Coast is now firmly within JNIM’s operational theatre.
This development aligns with TRAC’s earlier warnings that JNIM had explicitly placed Ivory Coast among the coastal states it seeks to destabilise, in line with its broader Sahel-to-coast expansion strategy. While previous JNIM-linked attacks had concentrated around Banfora, Burkina Faso, the move through Gaoua and Poni Province provides jihadists with a clear infiltration corridor into the Bounkani Region. Difita’s assault demonstrates both the predictive accuracy of this assessment and the vulnerability of Ivorian security forces, who remain under-resourced and ill-equipped to counter sustained jihadist incursions.
These attacks serve JNIM as they lead to the destabilisation of border communities through terror, coercion, and economic disruption (via livestock looting and home destruction) and allow forced recruitment of local youth, who are left with the choice of joining the jihadist ranks or facing further intimidation. This tactic accelerates JNIM’s ability to implant permanent cells within the northern Ivory Coast, both to impose its ideology and to gain critical local intelligence on Ivorian military deployments. Beyond violence, JNIM also destabilises communities through its preaching, spreading its own version of Islam that wins over local loyalty and gradually shifts towns into their orbit of influence.
The Difita incident underscores a growing risk trajectory: without stronger border defences and community protection mechanisms, JNIM will very likely escalate both civilian massacres and direct attacks on Ivorian security installations in Bounkani. In the medium term, this pattern could transform northern Ivory Coast into another jihadist staging ground, mirroring the earlier expansion of jihadist insurgency across Mali and Burkina Faso.
| | | TRAC Insight: PromptLock and the Rise of Artificial Intelligence (AI)-Powered Ransomware | | |
Researchers have identified what appears to be the first AI-powered ransomware, named PromptLock. Unlike traditional malware that relies on pre-written code, PromptLock leverages an AI model to generate malicious scripts in real time. This means every execution can produce slightly different code, making detection and defence much more complicated. The malware is designed to work across multiple operating systems. Although some of its destructive features have not yet been implemented, its ability to encrypt or exfiltrate data already signals a significant shift in how malicious software can be developed and deployed. The discovery is less about its current functionality and more about the precedent it sets. AI models can now be integrated directly into malware to create adaptive, evasive threats.
For militant groups, including jihadists and other politically motivated actors, this development represents an opportunity to lower the technical barrier to cyber operations. In the past, such groups often relied on either sympathetic hackers or black-market tools; however, AI-driven malware can automate much of the programming work. This makes it easier for less technically skilled actors to launch attacks against infrastructure, government systems, or private targets. The adaptability of AI-generated scripts also allows malware to evolve more quickly than defenders can update detection systems, meaning a single tool could be used against a broader range of targets without extensive modification. TRAC has documented the Islamic States' quick adaptation to AI propaganda video making just 3 years ago.
Cybercriminal networks will also exploit this in more immediate and commercial ways. The ransomware-as-a-service (RaaS) economy could incorporate AI to provide customizable, subscription-based attack kits that generate unique payloads for every customer. Militants could adopt the same services, outsourcing technical complexity while focusing on selecting targets and distributing the malware. Beyond ransomware, AI could also be applied to phishing, automated reconnaissance, or the manipulation of digital propaganda, amplifying the reach of ideological or criminal campaigns.
While PromptLock is still considered a prototype, it demonstrates that AI can be embedded directly in malicious software , rather than being used externally by attackers. This signals a broader shift in cyber conflict: malware will increasingly be able to adapt its own behaviour dynamically, evade signature-based detection, and operate semi-autonomously. For groups seeking disruption rather than profit, such as militants, this opens the door to campaigns that are harder to trace, harder to stop, and easier to repeat.
The long-term implication is that cyber defence will need to pivot away from chasing static signatures and instead monitor for abnormal behaviours or unusual AI activity patterns. Meanwhile, threat actors will continue to experiment with embedding AI in malware, leading to faster development cycles and more resilient forms of attack. What begins as a proof of concept like PromptLock could evolve into a new baseline for cyber weapons, blending automation with adaptability in ways that traditional malware never could.
| | (Right Wing Extremism / Video) Neo-Nazi Accelerationist Memewaffen Shares Poster: ‘Make America White Again – No Other Life Matters’ | | |
On 29 August 2025, a neo-Nazi accelerationist network circulated a propaganda poster featuring the slogan “Make America White Again – No Other Life Matters” (#MAWA). The poster fused swastika-styled fascist banners with modern far-right aesthetics, deliberately echoing the familiar MAGA (“Make America Great Again”) phrase. Still, it reframed into an openly white supremacist and antisemitic call to action.
This poster demonstrates how accelerationist groups deliberately co-opt and distort mainstream political rhetoric, weaponising its familiarity to lower psychological barriers to extremist ideas. By rebranding a widely recognised slogan into a racialised battle cry, the poster seeks to blur the line between populist nationalism and outright neo-Nazism. The slogan’s secondary phrase, “No Other Life Matters,” is particularly telling: it directly subverts the inclusive language of social justice movements such as Black Lives Matter while framing exclusionary violence and racial supremacy as a moral imperative.
This type of propaganda acts as a radicalisation gateway, targeting individuals already sympathetic to nationalist or anti-immigration politics and attempting to nudge them further toward accelerationism. At the same time, it deliberately provokes outrage on the broader public, a tactic designed to generate visibility, media coverage, and ultimately free amplification of their messaging.
By directly linking MAWA to MAGA, the poster intends to exploit mainstream grievances while pushing adherents toward open calls for racial violence. This illustrates the broader trend within the international accelerationist movement: normalising extremist rhetoric through cultural mimicry, cloaking lethal ideology under the familiar language of populism, and in doing so, expanding its recruitment reach.
| | TRAC Incident Report: Islamic State Khurasan Pakistan (ISKP) Suicide Bomber Ali Al-Muhajir Targets the Baloch National Party (BNP) Rally in Quetta, Balochistan, Pakistan | | |
On 3 September 2025, an Islamic State Khorasan (ISKP) suicide bomber identified as Ali Al-Muhajir targeted a Baloch National Party (BNP) rally in Quetta, Balochistan, near the vehicle of party leader Sardar Akhtar Mengal. While Mengal’s condition remains unconfirmed, the explosion killed at least 11 civilians and injured 29 others, many of whom had just left the BNP congregation. The scale and symbolism of the attack underline ISKP’s capacity and intent to stage politically significant strikes deep inside Pakistan’s urban centres.
This marks ISKP’s second large-scale bombing in Pakistan within two weeks, signalling a calculated shift back toward high-casualty, high-visibility operations after a period of relative silence. For much of the past year, ISKP had appeared weakened, mainly restricted to targeted assassinations, small arms ambushes, and isolated IED attacks in both Afghanistan and Pakistan. The reemergence of spectacular suicide bombings represents not just a tactical escalation, but also a strategic attempt to reassert relevance, project strength, and destabilise both state authority and non-violent political movements.
The choice of Quetta, the capital of Balochistan, adds significant weight. Quetta is both a political hub for Baloch nationalist movements and a long-standing fault line in Pakistan’s insurgent and sectarian conflicts. By striking the BNP and its leader, Sardar Mengal, ISKP directly targeted the moderate, parliamentary face of Baloch nationalism. This current advocates for autonomy and rights within Pakistan’s political framework rather than through militancy. Undermining or intimidating the BNP risks eroding the space for peaceful politics, potentially driving disillusioned Baloch youth toward insurgent groups that compete with ISKP for recruits and influence.
Strategically, the attack serves a dual purpose:
- Eroding public trust in state protection by demonstrating that neither political rallies nor senior figures are safe, even in a heavily securitised city like Quetta.
- Delegitimising moderate nationalist movements, positioning ISKP as a radical alternative while fueling instability that benefits extremist recruitment.
Although ISKP’s overall operational tempo remains lower than during its peak years, this bombing illustrates that its capacity for suicide and VBIED attacks remains intact. The group continues to be regarded as one of the most lethal IS affiliates in terms of large-scale, mass-casualty strikes. Its selective deployment of such attacks reflects both resource constraints and strategic prioritisation, using high-profile violence to amplify its presence far beyond the frequency of operations.
| | (Videos) Tehreek-e-Taliban Pakistan (TTP) Infighting: Hafiz Gul Bahadur Group & Noor Wali Mehsud’s TTP Militants Exchange Drone Strikes Across Paktika, Nangarhar, & Khost Provinces, Afghanistan | |
TRAC Incident Report: Al-Shabaab Militants Led an Armed Assault on Ugandan Army Forces in Afoogye, Lower Shabelle, Somalia
| | TRAC Incident Report: Baloch Raaji Aajoi Sangar (BRAS) Killed 37 Pakistani Soldiers, Seized Weapons, Took Control of Zehri & Launched Coordinated Attacks in Kirdgap, Mastung, Surab & Mashkay, Balochistan, Pakistan | | | | |
