The horrific Bondi Beach terrorist attack in Sydney, Australia, in December 2025 was carried out by two extremists inspired by the Islamic State. The attack targeted a Chabad celebration and killed 15 people, injuring dozens more. In the immediate aftermath of the attack, policymakers and security services worldwide grappled with the difficult question: How was a group that was supposedly defeated in 2019 still able to wreak havoc in a Western metropolis in 2025?
In our piece written last year for Foreign Policy following the New Year’s Day attack in New Orleans, we called attention to the highly lethal model of the Islamic State in recent years, wherein supporters use the group’s brand, tactics, and online guides to conduct attacks, often using simple, low-tech methods to unleash carnage—a franchising model leading to “inspired” rather than “directed” attacks.
The past year of successful and thwarted external operations confirms the threat of a globally dispersed group with strong ideological resonance beyond its territorial hot spots. Shortly after the New Orleans attack, a 23-year-old Syrian asylum-seeker killed a 14-year-old boy and injured five others in a stabbing spree in Villach, Austria, after pledging allegiance to the group following rapid online radicalization. In Germany, a Syrian asylum-seeker committed a knife attack at a Holocaust memorial in Berlin and had contact with the Islamic State, to which he sent a picture of himself before the attack. In the United Kingdom, the tragic Manchester synagogue attack caused three fatalities. The attacker called the U.K.’s emergency number to pledge allegiance to the Islamic State. In the United States, numerous plots linked to the Islamic State have been thwarted over the past year, including a planned New Year’s Eve attack by an 18-year-old in North Carolina who was radicalized online. These are but a few cases of Islamic State-inspired external operations in 2025.
-
A police officer kneels down on a paved street to a light a candle at a memorial with flowers and candles. - People light candles in Villach, Austria, on Feb. 16, 2025, at the site of a stabbing attack where a 14-year-old boy was killed and several others were wounded. Matej Povse/Getty Images
-
Two people sit and kneel in front a pile of flowers and an Israeli flag. One person is sitting on the ground with their arms curled up under their bent legs; the other is crouching and leans in close to speak to the first person. - People look at flowers and an Israeli flag laid in memory of the victims of a shooting at Bondi Beach in Sydney on Dec. 15, 2025. David Gray/AFP via Getty Images
In addition to these inspired attacks, the contemporary model of the Islamic State relies on its geographically dispersed global presence through its designated wilayat (provinces), overseen and integrated by the General Directorate of Provinces. The Islamic State Sahel, West Africa, Central Africa, Mozambique, Somalia, and Khorasan provinces all conducted deadly attacks in 2025.
In addition, the Islamic State’s home base branch in the Levant sought to reconstitute itself in 2025 and was responsible for nearly half of the violent deaths recorded in Syria in December 2025. So, what does an effective counterterrorism strategy look like when dealing with a terrorist threat landscape marked by globally dispersed provinces and inspired attacks outside of them?
A member of the Syrian Democratic Forces, backed by U.S. special forces, fires a rocket-propelled grenade during clashes with Islamic State group jihadis near the central hospital of Raqa, Syria, on Oct. 1, 2017. Bulent Kilic/AFP via Getty Images
A logical starting point is the counterterrorism strategy that the U.S. and partners pivoted to in the aftermath of al Qaeda’s pivot to a franchise-based model in 2003. While we do not seek to equate the Islamic State province model and the al Qaeda franchise model—the former has a significantly stronger integrated network of global provinces—it is important to remember that the franchising of al Qaeda was considered a sign of the group’s weakness in 2003, exhausted by U.S. counterterrorism, internal disagreements, and leadership hubris after 9/11.
The group’s embedding in multiple conflict theaters directly led to counterterrorism approaches tailored to these specific theaters, often in collaboration with local partners, and gave further weight to counterterrorism initiatives that were more targeted and not solely kinetic, including finance disruption and online monitoring of extremist content. While al Qaeda is not defeated—Sahelian affiliate JNIM (Jama’at Nasr al-Islam wal Muslimin) has been one of the deadliest groups for years now—its capability to conduct external operations has significantly weakened in recent years.
Countering a decentralized global terrorist network requires, first and foremost, sustained kinetic strikes against the organization’s key nodes. The U.S. drone campaign against al Qaeda was effective in attenuating the quality of the group’s personnel, forcing its members to limit communications, and forcing militants to flee from their safe haven in Pakistan’s tribal areas.
One of the most common critiques of counterterrorism campaigns is that they fall short of being comprehensive and focus too narrowly on kinetic strikes. And while that critique is valid—after all, few would argue that an armed drone campaign would be enough, in and of itself, to combat terrorist groups—it is also true that drone strikes and other punitive measures are a necessary component of a well-rounded counterterrorism campaign, which cannot be prosecuted with nonkinetic approaches alone.
As currently postured, the Islamic State offers a range of attractive targets for U.S. and allied counterterrorism planners. The al-Karrar Office in Somalia and the al-Furqan Office in Nigeria function as critical nodes in the Islamic State’s broader global network, facilitating the organization’s financing endeavors, assisting with its propaganda output, and coordinating the travel of foreign terrorist fighters to various conflict zones where its affiliates remain active.
Drone strikes and special operations forces raids can keep terrorist groups off balance, force them to dedicate more bandwidth and resources to operational security, and contribute to what global conflict scholar Jacob Shapiro has labeled “the terrorist’s dilemma,” which is attempting to manage organizational demands while under siege from a highly skilled adversary with high-tech weaponry and global reach, such as the United States.
Another essential part of a comprehensive counterterrorism campaign is thinking in the longer term. This means engaging in security cooperation and building partner capacity initiatives with local forces in the host nations where terrorist groups operate. This is no easy task. By their nature, terrorist groups seek out failed states and ungoverned spaces, eager to take advantage of governance gaps, weak security forces, and high levels of corruption that make border guards bribable and lead to widespread ineptitude among all but the most elite security forces, which are typically reserved to insulate and protect the ruling regime. The U.S. Army’s elite special forces unit, the Green Berets, is an expert in helping train partner nation forces in foreign internal defense and other counterinsurgency approaches, including training a range of irregular forces such as tribal militias.
Security cooperation is not strictly about military force; efforts geared toward defense institution-building, improving governments’ ability to strengthen the rule of law and promote good governance, and counter-corruption initiatives can all help reduce grievances within a population. In turn, this helps reduce the pool of individuals willing to join terrorist groups, which leverage local grievances to recruit new members and supporters.
The depletion of the United States Agency for International Development, whose activities typically augment or complement more kinetic counterterrorism approaches, will negatively affect the ability of countries to provide basic services to their populations. A dearth of economic development programs will inevitably increase the number of young men who look to join terrorist groups.
While most Western nations are drawing down their overseas presence, including in dangerous regions such as sub-Saharan Africa’s Sahel, there is a dire need for stabilization-type initiatives. These include not only improved border security but also a range of nonkinetic requirements that necessitate close oversight by well-trained and well-resourced professionals, from the military to civil society. Obstacles to stabilization can vary by locale but include issues such as ensuring access to potable water; resettling displaced communities; preventing retributive violence against certain ethnic groups, minorities, or other demographics; and other human security challenges.
As groups such as the Islamic State diversify not only their funding sources but also their means and methods of financing, it is pertinent to continue disrupting terrorist groups’ use of virtual currencies and illicit supply chains.
This means understanding how various Islamic State affiliates finance their operations as well as secure weapons and equipment, then directly countering those methods. Countering Islamic State financing and resupply requires denying the group access to funds online, levying sanctions against entities that allow the group to store or transfer money, and interdicting weapons shipments that are smuggled across borders. This means that U.S. and allied efforts to combat the Islamic State should also focus on countering the so-called crime-terror nexus, which enables these groups to sustain their operations and activities.
Children play at al-Hol camp, which holds relatives of suspected Islamic State group fighters in the northeastern Hasakeh governate of Syria, on April 18, 2025. Delil Souleiman/AFP via Getty Images
To weaken the persistent global threat posed by the Islamic State, it is important to think generationally and address the glaring security risks posed by the thousands of Islamic State foreign fighters held in under-resourced and overcrowded prison facilities in Northeast Syria. Many of their family members remain in squalid camps for the internally displaced in Northeast Syria, such as al-Hol, effectively a breeding ground for further radicalization of the younger generation.
These sites, previously administered by the Syrian Democratic Forces (SDF) but now being transferred to the Syrian government and United Nations, face mounting pressure from Damascus to integrate into the central government’s security apparatus, but clashes between Damascus and Kurdish militias are essentially making these facilities even more vulnerable to breakouts. According to the U.S. Department of State, approximately 8,400 Islamic State‑affiliated detainees from more than 70 countries remain in SDF‑run detention facilities.
Extensive analysis has already shown why leaving Islamic State fighters and their families in overcrowded, degraded conditions is a deeply unwise decision. Not only does it risk fueling the radicalization of a new generation, what some have dubbed the “IS cubs,” but it also poses a risk of a breakout if fighters are not tried; kept to account; and then transferred to secure, long‑term detention facilities in their home countries. As the president of Iraq succinctly put it: “[C]lose al-Hol and similar camps, stop the resurgence of terrorism, and offer hope and dignity to those who have suffered for too long.”
The political unwillingness to repatriate dangerous individuals to try them and protect the dignity and rights of minors may shield governments from short-term public backlash but will likely lead to significant security risks down the line that will cause more backlash. Clear paths forward to execute repatriation have been established in various reports. Western governments engaging with Syrian partners should continue to push for stable governance of these camps in the meantime, especially in light of the recent clashes between Kurdish-backed groups and the central government.
While kinetic action matters, the societal and informational roots or facilitators of Islamic State recruitment matter too when dealing with a global, geographically dispersed threat. The information environment cannot be ceded to the Islamic State or hostile nation-states that seek to discredit and invalidate legitimate counterterrorism and counterinsurgency operations targeting the group.
As has been demonstrated in detail in various studies on radicalization and recruitment, terrorist groups are adept at positioning themselves as the dominant source in the information environment in conflict zones and ungoverned spaces, complementing their kinetic operations and helping their recruitment campaigns by capitalizing on legitimate grievances and injustices relevant to the conflict theaters that they embed in.
Wassim al-M., a Syrian refugee accused of stabbing a visitor from behind with a knife at a Holocaust memorial, sits in court in Berlin on Nov. 20, 2025. Sebastian Gollnow/picture alliance via Getty Images
However, it is not just the Islamic State’s information operations that matter; hostile nation-states exploit grievances in conflict zones where terrorist groups are active to undermine Western support, including counterterrorism aid. In the Sahel, Russian influence operations have aimed to signal to citizens that French and U.S. counterterrorist operations were a form of neocolonialism, for example, and have touted Russia as a nonimperial, equal partner for Africans. These state-backed operations encroach on offline life, too. “Russian Houses,” institutions established by Russia across the world that, under the guise of cultural diplomacy and outreach, have sought to further pro-Russian narratives across the country’s strategic interests, are also contributing to a muddled information environment in areas where the Islamic State is embedded.
It is crucial to out‑communicate terrorist groups by competing more aggressively in the information environment. This is not a call for leaflet droppings or simple “debunking” websites, but rather for strategic and well-vetted aid programs that address grievances in areas where terrorist groups are active and signal to the population which external states are addressing socioeconomic conditions and security concerns, and which states are predominantly there for access to natural resources.
As part of a broader effort to compete more aggressively in the information environment, a comprehensive campaign is needed to disrupt the Islamic State’s continued use of the internet—something that governments, nonprofits, and technology companies have been pursuing for years since it became clear how integral the Islamic State’s use of media was for its success reputationally and operationally.
This challenge extends beyond traditional “content moderation” or “takedown requests,” which have become increasingly controversial on some major social media platforms due to concerns about censorship and the decimation of trust-and-safety teams. The group’s sprawling, leviathan-like media ecosystem spans social media platforms, self-hosted servers, encrypted messaging apps, deep and dark web forums, media production units, news outlets, newsletters, magazines, archiving tools, multimedia content, and province-specific bulletins—all produced in virtually every relevant language.
