|
Militants Target PTT 11 Gas Stations Across Yala, Pattani, and Narathiwat Provinces in Thailand
On 11 January 2026, during the early morning hours, coordinated attacks were carried out against 11 PTT gas stations and associated convenience stores across Thailand’s southern border provinces of Pattani, Yala, and Narathiwat, leaving four people injured. The incidents involved a combination of improvised explosive devices (IEDs) and arson, indicating a high level of planning and operational coordination.
Narathiwat: IED Targeting Fuel Infrastructure
In Narathiwat, one of the most serious incidents occurred at a petrol station where an explosion was reported near an underground oil reservoir, damaging a perimeter wall and a fuel pipeline. At approximately 01:00 local time, five armed and masked assailants arrived on motorcycles, restrained on-site security guards, and planted a 5kg IED at the pipeline access point before fleeing the scene.
In response, authorities imposed a curfew from 21:00 to 05:00 and significantly reinforced security patrols along the Thai–Malaysian border.
Pattani: Simultaneous Explosive and Arson Attacks
At roughly the same time, a parallel operation unfolded in Pattani Province. Around ten armed and masked attackers, also using motorcycles, split into two teams. One group targeted a PTT petrol station with explosive devices, while the second carried out an arson attack on a convenience store in the Kapho district. The near-simultaneous execution across multiple provinces shows a deliberate effort to stretch local security resources and maximise disruption.
Official Narrative vs. Ground Reality
Thai authorities initially downplayed the attacks, stating they were linked to local political tensions surrounding upcoming subdistrict administrative organisation elections, rather than terrorism. Traditionally, state media and military officials attribute such incidents in southern Thailand to the long-running separatist insurgency led by Barisan Revolusi Nasional (BRN).
TRAC Assessment: Indicators Beyond Local Insurgency
However, TRAC assesses that the scale, coordination, and targeting profile of these attacks point beyond routine insurgent activity. In particular, the deliberate focus on fuel infrastructure aligns closely with tactics historically employed by the Islamic State East Asia (ISEA) network.
TRAC continues to assess that an ISEA-Pattani cell is active in southern Thailand and likely operates in parallel with, or in limited cooperation with, BRN elements, leveraging local grievances while applying Islamic State strategic doctrine.
TRAC Note: To be clear, Islamic State Central Command has never acknowledged a franchise in Thailand, but there have been multiple unofficial propaganda releases of ISEA in Thailand that include arsenals with bombs.
Strategic Targeting of Fuel and Economic Disruption
Targeting gas stations and fuel distribution networks is a well-documented Islamic State tactic aimed at economic destabilisation, population intimidation, and the degradation of state authority in contested regions. Such attacks are designed not only to cause immediate damage but to undermine everyday life, logistics, and confidence in government security.
This pattern mirrors previous large-scale coordinated attacks on 22 March 2024, when militants simultaneously targeted 7-Eleven stores, gas stations, vehicles, CCTV systems, heavy machinery, sawmills, and telephone poles across southern Thailand.
Taken together, these incidents suggest an evolving hybrid threat environment, where local insurgency intersects with transnational jihadist strategy. TRAC assesses that dismissing these attacks as purely election-related risks underestimates the broader militant trajectory in southern Thailand, particularly as Islamic State-inspired actors increasingly embed themselves within long-standing local conflicts to pursue strategic depth and operational cover.
| | | TRAC Incident Report: Authorities Arrest 34 Members of the Nigeria-Based ‘Black Axe’ Cult, in Seville, Madrid, Malaga, Barcelona, Spain | | |
On 9 January 2026, Spanish authorities announced the results of a major, multi-national law-enforcement operation targeting the Nigerian criminal organisation Black Axe. The operation was led by the Spanish National Police in close coordination with the Bavarian State Police and Europol, resulting in the arrest of 34 suspects across Spain. Authorities detained 28 individuals in Seville, three in Madrid, two in Málaga, and one in Barcelona, where a senior leader of the organisation was reportedly apprehended. During the raids, law enforcement seized over €66,000 in cash, five vehicles, and froze bank accounts containing nearly €120,000. The suspects face a wide range of charges, including human trafficking, prostitution, kidnapping, online fraud, money laundering, and vehicle theft. Investigators estimate that the broader criminal network is linked to €5.94 million in fraud losses, with €3.21 million directly tied to this operation. The investigation remains ongoing, with authorities continuing to identify financial flows and additional accomplices across Europe.
A central element of the group’s activity was its reliance on sophisticated cyber-enabled fraud, particularly Man-in-the-Middle (MitM) schemes and Business Email Compromise (BEC) attacks. These methods involve intercepting legitimate business communications, impersonating trusted individuals such as executives or suppliers, and covertly altering payment details to divert large corporate transfers into criminally controlled accounts. Investigators confirmed that Black Axe members compromised legitimate corporate email systems, enabling them to execute fraud without immediate detection.
Beyond cybercrime, the network operated a structured financial and logistical system across multiple European countries. Members were assigned defined roles, including raising funds, recruiting money mules, managing illicit funds, laundering proceeds through layered transactions, and creating shell companies to obscure ownership and accountability. The group also allegedly used intimidation and threats to enforce internal discipline and ensure compliance during collections. In parallel, investigators uncovered an illegal vehicle-trafficking operation in which cars were acquired under the names of front men or shell companies, deliberately left unpaid, and then sold, rented, or used internally by the organisation.
From a TRAC perspective, Black Axe represents more than a conventional fraud ring. In Nigeria, such groups are often referred to as “cults,” reflecting the ritualised loyalty, secrecy, and violence required for membership. Black Axe has evolved into a mafia-style transnational organisation, combining cybercrime, drug trafficking, facilitation of illegal migration, and political infiltration. The group is believed to generate millions of dollars annually and has expanded far beyond Nigeria’s borders into Europe and North America.
The organisation has also demonstrated a long-standing capacity for extreme violence. It was responsible for the 1999 Obafemi Awolowo University massacre in Osun State, Nigeria, in which an organised death squad killed five students and injured eleven others. More recently, members were arraigned in Benue State in February 2023 on charges including criminal conspiracy, acts of terrorism, membership in an unlawful society, and culpable homicide. Western law-enforcement agencies further assess that Black Axe is closely linked to the Neo-Black Movement of Africa (NBM). While NBM denies any connection, both the United States Department of Justice and the Royal Canadian Mounted Police have publicly stated that NBM and Black Axe are effectively the same organisation operating under different labels.
This January 2026 operation follows the October 2025 deportation of a Nigerian convict linked to Black Axe from Italy. While the two cases have not been formally linked, TRAC contends they highlight the network’s cross-border nature. Notably, the investigation that culminated in the Spanish raids began in September 2023, when authorities identified Nigerian nationals coordinating illicit operations across several European jurisdictions.
Black Axe remains one of the most organised and resilient Nigerian criminal networks operating in Europe, blending cyber-enabled fraud, financial crime, human trafficking, and violence. The scale of the January 2026 arrests highlights both the group’s extensive reach and the growing effectiveness of European cross-border law-enforcement cooperation, though sustained pressure will be required to meaningfully disrupt its financial infrastructure and recruitment pipelines.
| | (Poster) Unofficial Islamic State (IS) Halummu Media / Al-Murhafat Foundation: ‘You Be That Man’ | | |
This unofficial Islamic State (IS) Halummu Media / Al-Murhafat Foundation poster is a clear example of incitement-focused propaganda aimed at inspiring lone-actor violence in Western countries. Branded with the slogan “You Be That Man,” the visual and textual elements deliberately glorify low-tech, high-impact attacks, explicitly calling for vehicle rammings and bludgeoning assaults against civilians during Christian and Jewish holiday periods.
The imagery reinforces the message: a heavy vehicle advancing toward a victim and a raised sledgehammer mid-strike, both symbolic of readily available “everyday” weapons. This aligns with long-standing IS messaging that promotes attacks requiring minimal preparation, training, or resources, thereby lowering the barrier to action for sympathisers. The highlighted language urging attackers to “run them down with buses” and assault victims with “heavy hammers” removes ambiguity and directly encourages mass-casualty violence.
Ideologically, the poster frames violence as a religious obligation, contrasting “words” with “action” and portraying attacks as the highest expression of loyalty and belief. This rhetoric is designed to shame passive supporters, elevate attackers as moral exemplars, and accelerate the transition from online radicalisation to real-world violence. The focus on Europe and North America underscores IS’s continued emphasis on external operations through decentralised, self-directed actors, particularly during symbolic or crowded public moments.
From a threat perspective, the poster reinforces concerns around stochastic terrorism: it does not direct a specific individual or location, but it normalises and encourages violence in a way that increases the likelihood of spontaneous attacks by radicalised individuals.
| | TRAC Incident Report: Stephen Spencer Pittman (19) Conducts Arson Attack Damaging the Beth Israel Synagogue in Northeast Jackson, Mississippi, United States | | |
In the early hours of 10 January 2026, a deliberate arson attack severely damaged Beth Israel Congregation in northeast Jackson, Mississippi, the largest synagogue in the state. The fire destroyed the synagogue’s library and administrative offices, burning two Torah scrolls and damaging five others, while one Holocaust-era Torah stored in a glass case remained intact. The attack occurred during Shabbat, but no one was injured as the building was empty. Authorities quickly ruled the fire an act of arson, and by the following day, confirmed that a suspect had been taken into custody. The incident carried strong historical symbolism, as the same synagogue was bombed by the Ku Klux Klan in 1967 for its rabbi’s support of civil rights.
The suspect was later identified as Stephen Spencer Pittman, a 19-year-old local resident. The evidence shows that the attack was clearly premeditated: Pittman removed his license plate, scouted the synagogue, purchased gasoline, broke a window, and intentionally set the building on fire. Surveillance footage, location data, and text messages corroborated his movements, and he later admitted his actions to his father. Pittman was injured during the attack and was hospitalised before appearing in court.
Pittman’s motive was explicitly antisemitic and rooted in extremist Christian and far-right ideology. He told investigators he targeted the synagogue because of its “Jewish ties,” referring to it as the “synagogue of Satan,” a phrase commonly used in modern antisemitic and white-supremacist circles to demonise Jews. His courtroom statement, “yes, Jesus Christ is Lord”, reinforced the ideological framing of the attack. The evidence clearly indicates that the arson was not linked to broader geopolitical grievances but was instead a lone-actor hate crime, reflecting the persistent threat posed by ideologically radicalised individuals targeting Jewish institutions in the United States.
| | TRAC Incident Report: Neo-Nazi Group ‘Núcleo Nacional’ Opens New Physical Office Amid Mass Protests, Sentmenat, Catalonia, Spain | | TRAC Incident Report: Suspected Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM) Target the CCM-Mali SA-Operated Stone Factory in an Arson Attack, Karaga, Bafoulabé Area, Kayes Region, Mali | | (Chatter) UAE-Backed Militias Switch Sides Amid Saudi Takeover, Collapse of Southern Transitional Council (STC), Yemen | | | | |
