With five reported attacks in July, and 67 since the beginning of 2026, some fear a resurgence of ISIS in Syria. Although 2026 has seen a historically low number of attacks, upticks in February and June have raised questions about the group’s remaining operational capacity. ISIS’ last held territory was retaken by the US-backed Kurdish Syrian Democratic Forces (SDF) in March 2019 after a nearly five-year-long US-led international coalition campaign. This has forced it to operate in a dispersed and decentralised manner, reducing its presence to clusters of cells in eastern and northern Syria. However, recent ISIS activity, which has included attacks against security services and government infrastructure, could indicate the group’s repositioning as the structural environment around it changes. Since ISIS’ defeat in 2019, Syria has seen the fall of the al-Assad regime, the emergence of a new political order, the ongoing integration of the SDF into the state security apparatus, and the withdrawal of US forces. Hence, this raises the question: is ISIS resurging, or is it merely repositioning?
Current ISIS Presence in Syria
At present, ISIS does not retain any territory as it did in 2013-2019. Instead, it operates through a decentralised network of small mobile cells carrying out individual attacks against the Syrian interim government, including the seizure of heavy weaponry. It is estimated that up to 3,000 dispersed fighters remain active in Syria and Iraq. Attacks in 2026 have largely been concentrated in northern and north eastern Syria, as well as in Damascus. These attacks have largely been perpetrated in territory that has been under transition from control by the Kurdish SDF to government forces in an attempt by interim President Ahmed al-Sharaa to stabilise the security situation in the country.
Tellingly, the presumed leader behind the group’s global operations has been suspected to reside in Somalia, as ISIS’ operational theatre has shifted toward Africa. ISIS today relies more on splintered autonomy for individual cells, rather than a strict hierarchical structure. As such, ISIS appears to have adopted a ‘remote management model’, in which – akin to a franchise business model – the core leadership provides branding, ideology, and media operations, while its regional branches (wilayats) maintain financial and operational autonomy. Consequently, the organisation has shown remarkable adaptability and resilience. Thus, how should this resilience be viewed in the Syrian context?
Claim or No Claim?
On 7 July, two bombs detonated near the Four Seasons hotel in Damascus, where French President Macron had spent the night shortly before meeting interim President al-Sharaa at the Presidential Palace. While authorities have apprehended members of an ISIS-linked cell over their suspected involvement in the bombings, ISIS has not officially claimed responsibility for the bombings. Five days earlier, an attack near the Palace of Justice – which is currently holding high-profile trials related to the al-Assad regime – killed 10 people and was seen as a deliberate attempt to destabilise the country via the heart of the judiciary. Unlike more rural attacks in the north of the country, however, both these attacks have been left unclaimed. While some point to ISIS, which in February declared a “new phase of operations” against al-Sharaa’s government (now a member of the US-led anti-ISIS coalition), the ambiguity surrounding the identity of the perpetrators may itself be intentional.
If such ambiguity were deliberate, one possible explanation could be that leaving a high-profile attack unclaimed reduces the risk of triggering a harsh government response that a group such as ISIS might not yet be operationally prepared to withstand. Second, when such attacks remain unclaimed, particularly when civilians are involved, they can sow chaos and create diverging opinions on attribution (including the idea of ‘false flag operations’), accountability, and the ability of government security forces to protect citizens. Within the context of al-Sharaa’s attempt to stabilise the country – particularly in light of its ongoing sectarian strife – such attacks can prove divisive at a time when national unity is considered a government priority.
Nonetheless, ISIS has claimed responsibility for other attacks, notably those against government personnel, weapons stockpiles, and critical infrastructure in former SDF-controlled territory. This could indicate a strategy to test and degrade the security environment currently under transition to government control. Moreover, this strategy could also indicate an attempt to appeal to the grievances of hardline Salafists that oppose the government’s rapprochement with Türkiye and the US.
Resurgence or Repositioning?
Despite an uptick in attacks last month, it would be an overstatement to claim that ISIS is resurging, particularly compared to the large swaths of territory it controlled in 2014-2015. Specifically, given the group’s shift to a more decentralised command structure as well as a geographical shift toward Africa, an immediate resurgence of the Caliphate seems currently implausible.
However, it would equally be misleading to claim that the group has been entirely defeated in Syria. Its claimed attacks demonstrate that it retains the operational capability to strike a diverse range of targets, including military sites and critical infrastructure. If the recent high-profile bombings in the capital are indeed attributable to ISIS, this would suggest an even broader operational reach.
Hence, the group appears to be repositioning itself slowly. On the one hand, it seeks to sow chaos in Ahmed al-Sharaa’s new Syria (which it has deemed under “Turkish-American occupation”). On the other hand, it seeks to test and degrade the government’s security apparatus, particularly in regions that remain in transition from SDF to government control. One plausible hypothesis is that ISIS views the unstable security environment surrounding it – the confluence of internal instability, US withdrawal, and an incomplete SDF transition – as a window of opportunity to regain a foothold in areas in the Syrian Badia where state authority remains thin. Nonetheless, its current posture of probing and ambiguity might suggest that it is cautiously testing the limits of the new security environment rather than betting on its collapse.
Recommended Readings
The Soufan Center (2026) – Not Resurgence, but Recalibration: ISIS in Syria
Basabe, D. (2025) – Ghost of the Caliphate: How Africa Became the Global Epicenter of the Islamic State
Al Nofal, W. (2026) – ‘Waiting for chaos’: IS adapts under pressure, betting on the failure of Syria’s transition
Cengiz, M. (2026) – Claimed or Unclaimed: Patterns of Attribution in Global Terrorism