|
TRAC Overview of Islamic State Global Operations for September 2025
Islamic State (IS) operations in September 2025 reflected a renewed sense of confidence and coordination across multiple regions, marked by a surge in attacks and propaganda output. The group’s operational expansion was most visible in Mozambique, the Democratic Republic of Congo, and Nigeria, each showing signs of strategic reactivation after earlier periods of decline. This resurgence suggests IS has resolved prior logistical and communication challenges, enabling a more synchronised campaign across its provinces.
A corresponding spike in propaganda production reinforced this momentum. Following recent media releases by ISGS and ISWA, Islamic State Central Africa Province (ISCA) issued a rare, highly graphic video emphasising sectarian violence. Such content, amplified through al-Naba and affiliated channels, indicates a deliberate attempt to boost morale, attract recruits, and project renewed vitality across IS’s regional affiliates.
Mozambique (IS-M)
In Mozambique, IS-M reemerged strongly across Palma, Montepuez, Balama, and even into Nampula Province, signalling an intentional expansion beyond traditional strongholds in Cabo Delgado. Attacks in Nampula, including the burning of over 100 homes and the execution of a Christian civilian, underscored the group’s growing confidence and ability to operate with near impunity. This escalation exposes the Mozambican government’s persistent inability to secure its northern regions and highlights IS-M’s use of violence as both intimidation and propaganda. The southward advance also threatens to transform the Cabo Delgado insurgency into a wider regional security crisis, fueled by porous borders, limited state control, and weak intelligence coordination.
Democratic Republic of Congo (ISCA)
ISCA significantly intensified its campaign this month, carrying out a large-scale massacre of more than 100 civilians in Ntoyo, the deadliest attack in the DRC this year. The assault demonstrates enhanced logistical coordination and a shift toward high-impact violence intended to reaffirm ISCA’s relevance within the broader IS network. Additionally, ISCA’s claim of an attack in Tshopo Province, a rare outlier, suggests an effort to test new areas and stretch state forces already overburdened in Ituri and North Kivu. This geographic diversification suggests strategic experimentation, with ISCA leveraging its weak state reach to expand its footprint more deeply into the central DRC.
Nigeria (ISWA)
ISWA operations nearly doubled from August levels, with activity concentrated around Monguno (Borno) and Buni Yadi (Yobe), former key hubs that had seen reduced militant presence. The renewed focus on these zones signals an organised effort to reclaim influence and restore logistical corridors. Beyond Nigeria, ISWA also executed a cross-border raid in El Goumri, Cameroon, killing a village leader accused of spying. This cross-frontier strike reinforces ISWA’s drive to extend its reach throughout the Lake Chad Basin, exploiting porous borders and limited inter-state coordination.
Overall, September 2025 marked a notable resurgence across IS’s African provinces, with each displaying expanding operational reach, revived propaganda cohesion, and strategic ambition. The convergence of military and media efforts indicates that IS’s regional branches are transitioning from survival to reassertion, potentially setting the stage for a new phase of synchronised jihadist activity across sub-Saharan Africa.
| | | TRAC Incident Report: Al-Shabaab Militants, Disguised as National Intelligence and Security Agency (NISA) Members, Conduct Suicide Vehicle-Borne Improvised Explosive Device (VBIED) Attack Followed by Armed Assault Targeting Godka Jilicow Prison Under “Operation to Support the Oppressed”, Mogadishu, Somalia | | |
On 4 October 2025, al-Shabaab militants executed a coordinated and highly sophisticated assault on the Godka Jilicow Prison in Mogadishu, in what they termed “Operation to Support the Oppressed.” The attackers were disguised as members of the National Intelligence and Security Agency (NISA) and travelled in a vehicle bearing official NISA markings, allowing them to pass through multiple checkpoints undetected; a clear indication of deep reconnaissance and insider-level intelligence before the attack. Upon reaching the target, the militants initiated the assault with a suicide vehicle-borne improvised explosive device (SVBIED), breaching the prison’s outer defences and creating an entry point for the assault team. Approximately six to seven militants then stormed the compound, engaging Somali security forces in a six-hour gun battle that left parts of the facility severely damaged.
Somali authorities later announced that all attackers had been neutralised, that no prisoners escaped, and that the situation was under control. However, al-Shabaab claimed to have killed 41 security personnel, mostly NISA officers, injured 19 others, and destroyed nine vehicles. Al-Shabaab also asserted that they had freed numerous detainees, including both civilians and jihadists. While these claims could not be independently verified, the group released statements and purported testimonies from alleged freed prisoners, reinforcing their narrative and using the attack for propaganda and morale-building purposes. Al-Shabaab further accused NISA of torturing civilians within the facility, stating that the operation was aimed at punishing “executioners” involved in such acts. The group claimed to have killed one, injured another, and forced the third to flee, details aimed at reinforcing their image as defenders of oppressed Muslims, a key component of their ideological justification for violence.
The Godka Jilicow Prison is one of Somalia’s most secure and symbolically significant detention centres, known for housing high-value detainees, including al-Shabaab and Islamic State Somalia (ISS) members, as well as other individuals convicted of terrorism-related offences. Successfully breaching this facility represents a major symbolic victory for al-Shabaab, striking at the heart of Somalia’s intelligence and counterterrorism apparatus. It underscores critical lapses in internal security, particularly the ease with which militants exploited procedural weaknesses and insider vulnerabilities within NISA’s ranks.
From a tactical perspective, the operation demonstrated a sophisticated hybrid approach combining deception, suicide tactics, and direct assault: hallmarks of al-Shabaab’s evolving urban warfare playbook. The militants’ ability to impersonate security officials and operate within Mogadishu’s most heavily guarded zones reveals an elevated intelligence capability and operational confidence. Their attack method mirrored past incidents, such as assaults on the Mogadishu Presidential Palace and Halane Base Camp, showing continuity in targeting high-value, high-visibility institutions to project strength and undermine public trust in the government.
Strategically, the attack fits within al-Shabaab’s broader propaganda and recruitment campaign, emphasising resistance against “state oppression” and the “foreign-backed intelligence apparatus.” By claiming to free prisoners and avenge detainees’ alleged torture, the group taps into grievance narratives that resonate among marginalised or disillusioned Somali communities.
| | TRAC Incident Report: Suspected Religiously-Motivated Individual Arrested for Planning a Bombing in Bistrița-Năsăud County, Transylvania, Romania | | |
On 2 October 2025, Romanian authorities arrested a 33-year-old radicalised male in Bistrița-Năsăud County, Transylvania, for allegedly planning a terror-related attack using improvised explosive devices (IEDs). The suspect had been under surveillance following reports of unusual procurement and experimentation with explosive materials.
Investigations revealed that between 2022 and May 2025, the man had manufactured and tested two small IEDs near his residence, suggesting both technical capability and intent to operationalise his skills. From August to early October 2025, he reportedly built two additional IEDs, which were later discovered and seized during a search of his home. Authorities also confiscated chemical containers and more than 630 pyrotechnic and explosive items, including industrial firecrackers, indicating sustained efforts to stockpile components suitable for assembling functional explosive devices.
Romanian investigators further determined that the suspect had accessed online materials detailing bomb-making techniques, toxic chemical synthesis, and jihadist propaganda. While authorities have not disclosed the man’s identity or direct affiliations, the available evidence strongly suggests online radicalisation, likely influenced by Islamic State (IS) media ecosystems. The suspect’s progression reflects the classic lone-actor trajectory encouraged by IS’s digital propaganda networks.
The Islamic State continues to maintain a persistent online presence, with its media units regularly publishing recruitment appeals and instructional content encouraging sympathisers to carry out autonomous attacks using easily accessible materials. IS’s calls for “do-it-yourself” terror operations are particularly aimed at Western and European audiences, emphasising low-cost but high-visibility attacks involving explosives, vehicles, or edged weapons. TRAC assesses that this Romanian case aligns with this pattern, underscoring the enduring threat posed by self-radicalised individuals inspired remotely rather than directed by formal militant networks.
While no specific targets were publicly identified, the case occurred amid heightened security awareness across Europe, especially around U.S. and NATO military installations. Notably, in June 2025, the United States elevated its threat posture at bases in Bulgaria, Italy, Romania, and Germany, following intelligence warnings about potential jihadist plots against American or allied facilities. The suspect’s location in Romania raises the possibility that his activities may have been influenced by this broader jihadist narrative of targeting Western military presence in Europe.
| | TRAC Incident Report: Tehreek-e-Taliban Pakistan (TTP) Suicide Bomber Rams VBIED into the Paramilitary Frontier Corps (FC) Headquarters (HQ) in Quetta, Balochistan Province, Pakistan | | |
On 30 September 2025, a Tehreek-e-Taliban Pakistan (TTP) suicide bomber carried out a vehicle-borne improvised explosive device (VBIED) attack targeting the paramilitary force headquarters in Quetta, Balochistan Province. The powerful explosion killed three military personnel and five civilian bystanders; security forces reportedly neutralised the bomber and four accompanying militants following a brief exchange of fire. The attack caused significant structural damage to the compound and surrounding area, underscoring a continued vulnerability of even high-security installations in urban centres.
Initially, no group claimed responsibility, but TRAC strongly suspected TTP's involvement given its entrenched networks across Balochistan and its long history of orchestrating complex, high-impact suicide operations against military and intelligence targets. The group formally claimed responsibility hours later, framing the assault as revenge for “martyrs” killed by the Pakistani military, and specifically as retaliation for recent counter-terror operations in Zhob District, where security forces dismantled a large TTP cell in August 2025.
The bombing demonstrates the TTP’s enduring operational capability and adaptability despite persistent military pressure. By striking in Quetta, the provincial capital and one of Pakistan’s most heavily guarded cities, the TTP sent a symbolic and strategic message: that its networks remain capable of penetrating hardened targets and conducting lethal, coordinated attacks in urban areas far from its traditional tribal strongholds.
The 30 September Quetta attack marks a deliberate shift back toward targeting urban environments intended to undermine public confidence in the government’s counterterrorism measures while reinforcing the TTP’s propaganda claim of survival and strength. Such operations are likely to continue, especially as the group seeks to compensate for battlefield setbacks in Khyber Pakhtunkhwa by escalating attacks in Balochistan’s urban centres.
| |
TRAC Incident Report: Azawad Liberation Front (FLA) Militants Bomb the Angamali Military Camp with a Suicide Drone, Kidal Town Area, Kidal Region, Mali
| | (Video / Right Wing Extremism) Active Club Uuimaa Publishes Call to Action to “Take Over The Streets”, Uuimaa, Finland | | TRAC Incident Report: Hayy’at Tahrir al-Sham (HTS) Led Government Blockades Syrian Democratic Forces (SDF) Controlled Sheikh Maqsood Neighborhood, Aleppo, Aleppo Governorate, Syria | | | | |
