The terrorism threat landscape has changed substantially since September 11, 2001. Over the last quarter of a century, counterterrorism efforts disrupted terrorist networks and decapitate several senior leaders, including the founder of al Qaeda, Usama bin Laden, and his successors, as well as ISIS leadership. Despite al Qaeda being pushed out of strongholds in Afghanistan and Pakistan, and the Islamic State in Iraq and Syria (ISIS) losing territorial control in Syria and Iraq, the successor affiliates or splinter groups have proven extremely resilient and adaptive, and their defeat has remained elusive.
This piece aims to provide an overview of jihadist evolution in the last 25 years, focusing on al Qaeda and ISIS’ global reach. It offers a historical review and analyzes hotspots of terrorist activity in the terrorism landscape.
Two of the most consequential outcomes of the past 9/11 period were al Qaeda’s expansion through franchises and affiliates around the world, and the emergence of Islamic State in Iraq in 2006. The group later expanded its territorial control into Syria under the ISIS banner. Once ISIS attempted to bring al Qaeda under one organization, al Qaeda core leadership severed its ties with ISIS in 2014. Since then, they have been rivals, each claiming to lead the jihadist cause and seeking to become the world’s leading so-called jihadist brand.
Moreover, ISIS’ visible victory and larger territorial control, supported by a successful global recruitment campaign and al Qaeda core’s leadership-from-afar posture, further empowered ISIS, which declared the so-called Islamic caliphate in Syria and Iraq in 2014. Especially after ISIS emerged as a dominant actor in Syria and Iraq, al Qaeda lost its appeal among jihadists. However, ISIS’s terror campaign and territorial expansion in Syria faced pushback from the US-led Global Coalition against Daesh, which led to the loss of its territorial control in Syria and Iraq, along with the so-called caliphate, its leader Abu Bakr al-Baghdadi, and several of his successors.
While both ISIS core and al Qaeda core have diminished and lost their centralized hierarchy, several offshoot and affiliated groups persisted in engaging in propaganda, recruiting new members, gathering financial resources, and acquiring new operational capabilities. According to the United Nations’ 38th Monitoring Team report on al-Qaeda and ISIS, “the overall threat level remained broadly the same. Nevertheless, it intensified in the Sahel and South Asia”. In other words, despite significant losses, both al Qaeda and ISIS have managed to establish affiliates in the Middle East, Africa, Central and South Asia, while continuing to inspire individuals to carry out their violent campaigns.
Shifting Nature of Jihadist Terrorism
Our analysis of the Armed Conflict Location & Event Data (ACLED) reveals that jihadist terrorism has undergone three regional shifts since 2008. The first major regional hot spot emerged during the 2008-2014 period, when al-Shabaab in Somalia and Boko Haram in Nigeria dominated jihadist terrorist attacks as perpetrators, with Somalia witnessing the highest number of attacks.
This trend has shifted from Africa to the Middle East, in particular Syria and Iraq, during the 2015-2020 period, when two-thirds of all events have been attributed to jihadist groups in the MENA region.
The third major shift has occurred between 2021 and 2025, when Africa, in particular the Sahel, has experienced emergence of multiple jihadist groups and a surge of violent campaigns. However, East Africa, and especially Somalia, remained a hot spot. “According to the Global Terrorism Index, Islamic State and its affiliates remained the deadliest terrorist organization in 2024.”
The most concerning aspects of jihadist presence in Africa are social, economic, political, and rising strain and grievances among the region’s growing youth population, and weak or lack of strong functioning governments. Many experts attribute the expansion of violent extremism in the Sahel to persistently weak governance, corruption, human rights violations, and legitimacy deficits. The European Union Terrorism Situation and Trend Report 2026 (EU TE-SAT 2026) states “affiliates of IS and Al-Qaeda (AQ) expanded their geographical reach and operational capabilities.” The same report states that “Jihadist terrorism accounted for the largest share of attacks in 2025 in Europe, representing about half of all incidents,” with the highest number of arrests occurring in Spain and France. The jihadist terrorist threat targeting the United States, on the other hand, involves lone-actor attacks, which may be inspired by al Qaeda or ISIS or exposed to propaganda or recruitment activities of these organizations. According to the CSIS research, “Between 2013 and 2019, jihadists conducted 27 attacks, and 46 jihadist plots were disrupted—an average of about 10 attacks or plots per year,” and between 2020 and 2025, “CSIS counted 8 jihadist attacks and 10 disrupted plots—an average of about 3 attacks or plots per year.”
To understand the current and future trend of jihadist terrorism, it is useful to examine the hotspots of major ISIS and al Qaeda affiliates across Africa, Middle East, and Central Asia.
The Sahel as the Emerging Epicenter
From West Africa to the East, from Central and South to the MENA region, Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM), Islamic State West Africa Province (ISWAP), Boko Haram, the Allied Democratic Forces (ADF), Islamic State Greater Sahara (ISGS), Ansaru, Ahl al-Sunna wal-Jama’a (ASWJ), al Shabaab, ISIS-Somalia, Al-Qaida in the Islamic Maghreb (AQIM), al Qaeda in the Arabian Peninsula (AQAP) and other groups with their ties to ISIS and al Qaeda affiliates in other regions portray a deeply concerning picture.
Our analysis of the Armed Conflict Location & Event Data (ACLED) revealed that since 2022, al Qaeda affiliates are expanding faster and involved in more violence than ISIS, but ISIS and its affiliates are still the deadliest group among jihadist organizations. Terrorism is more geographically dispersed and armed assaults dominated the attack type.
“In the Sahel, the Islamic State Sahel Province (ISSP) grew considerably, expanding territorial control and increasing its headcount,” while ISWAP has been very active in the Lake Chad Basin. Another ISIS affiliate, and ISGS, “a growing threat in the region” with “significantly increased its operational capabilities” has been escalating its attacks in Niger.
Moreover, according to our analysis of the Armed Conflict Location & Event Data (ACLED), while Somalia, Burkina Faso, Mali, Nigeria, Niger, and Mozambique are among the countries with the higher fatalities between 2021 and 2025, the Sahel region is the deadliest theater on the continent during this period.
Al Qaeda affiliates in the Sahel region have been pursuing local agendas, exploiting grievances in their respective regions and “downplaying the narrative of the global jihad.” JNIM has emerged as a driving force for al Qaeda in the Sahel region, expanding its territorial reach and political and military activities in Burkina Faso, Mali, Niger, Benin, and Nigeria. JNIM has established tactical cooperation with Front de libération de l’Azawad (FLA), a Tuareg-majority group in Mali and beyond the Sahel region. By embracing a conciliatory approach, these actors have managed to overcome their ideological differences to maintain their unity against the Malian government, and ISIS-affiliates; ISGS and ISWAP.
ISIS and al Qaeda have managed to attract thousands of foreign terrorist fighters (FTFs) to Syria, Iraq, and Afghanistan in more than two decades. But since ISIS has lost its territorial control and its caliphate, the flow of FTFs is limited. According to the UN report, there were no signs of a substantial number of FTFs traveling to West Africa recently. However, JNIM’s rise in the Sahel mirrors the momentum that has given rise to ISIS in Iraq and Syria in the 2012-2014 period. The Sahel region does not represent the same ideological and strategic nostalgia that Iraq and Syria once had as a global magnet for the FTFs. Still, it could serve as a staging ground for more ambitious and assertive regional aspirations that could eventually develop into a broader struggle. These developments could attract FTFs and increase the possibility of external operations against the EU.
Adversarial Convergence as a New Strategic and Tactical Approach
Al Qaeda core, which has long overshadowed by ISIS, appears to be emerging again as a stronger jihadist group. After former al Qaeda leader Ayman al Zawahiri was killed by a US drone strike on July 31, 2022, in Afghanistan, Sayf al-Adl is now considered “the de facto leader of al-Qaida.” He has been reported to be in the Islamic Republic of Iran, which could present a challenge for al Qaeda core leadership, given the alleged host country- Iran’s position to Salafi-jihadist ideology. In other words, some al Qaeda members as well as ISIS will question legitimacy of Sayf al-Adl’s leadership.
However, this challenge could also be seen by some as “adversarial convergence,” and present opportunities for both al Qaeda and Iran along with Houthis, Iran’s proxy in Yemen. A collaboration could boost Iran’s reach in the region, while providing al Qaeda affiliates in the Arabian Peninsula, the Horn of Africa, the Sahel, and South Asia with the logistical support and know-how from Iran and its proxies in the Middle East and Africa. In recent years, AQAP has continued to serve as a vanguard of global al-Qaida and remains “committed to external operations.” The collaboration between AQAP and the Houthis extends beyond intelligence sharing, logistics, and the acquisition of weapons technology, including drones. Despite its limitations, the AQAP-Houthis alliance could create a broader strategic path for both groups as well as Iran, which has been seeking to mobilize its proxy network in the Middle East and beyond. This collaboration could expand Iran’s influence beyond the Arabian Peninsula and across the Red Sea to develop more transactional relationships with AQAP, al Shabaab, and ISIS-Somali. It could provide AQAP with access to Iran’s illicit networks, allowing the group benefit from Iran’s transnational illicit networks to move its operatives beyond its traditional areas of operation, including into Europe.
Nature of Jihadists in Central and South Asia: The Expansionist, Ambitious, and Opportunist,
The threat is not confined to Africa. ISIS and al Qaeda affiliates in Central and South Asia remain a major epicenter of Salafi-jihadist presence. The Islamic State Khorasan Province (ISKP), according to the EU TE-SAT 2026 report, “remained resilient and continued to pose potential security threats, both in the region and externally.” In a similar vein, the UN report noted the group’s operational capacity and strength, increased propaganda and recruitment, and its ability to infiltrate the de facto authorities’ ranks. ISKP’s ambitious positioning is partly rooted in its establishment by the former members of al Qaeda, Taliban, and Tehreek-e-Taliban Pakistan in 2014, followed by its declared affiliation with ISIS Core in 2015. The composition of its members has also shaped its ideological objectives, targeting the Taliban regime, Pakistan, Iran, Russia and other countries involved in the Syrian conflict. The group has carried out several deadly attacks in Afghanistan, Iran, Russia, and Turkey, with “several high-profile foiled plots, including in France and Austria, and elsewhere in Western Europe.”
In addition to ISKP, Tehrik-e Taliban Pakistan (TTP), al Qaeda elements in Afghanistan, and Al-Qaida in the Indian Subcontinent (AQIS) remain highly resilient and active. Their resiliency is due to several factors, including the Taliban’s support for al Qaeda and TTP, which has contributed to military confrontation between the Taliban and Pakistan, further destabilizing the region. More importantly, collaboration among the latter groups poses a greater risk and could deepen the conflict in the region. For example, Al-Qaida provided “ideological guidance, training and support to TTP” and trained Baloch Liberation Army (BLA) members, which offer al Qaeda broader regional outreach, influence, and legitimacy.
Transnational Nature of Affiliates and Emerging Trends
As discussed earlier, the flow of FTFs into conflict zones is limited, the existing FTFs in Iraq and Syria and the relocators in the regional countries, such as Turkey present security challenges. For example, the UN report states that “ a large number of foreign former detainees remained unaccounted for” and “1,000 of the unaccounted individuals may have joined ISIL (Da’esh) or other armed groups” after the closure of detention camps in northeast Syria.
When it comes to FTFs, two issues-intra-regional travel and relocators– might have been overlooked. For example, some of these FTFs reportedly traveled from Syria or Somalia to Afghanistan, which potentially could lead to stronger ties between ISIS and al Qaeda affiliates in Afghanistan. Returnees, on the other hand, remain a challenge for countries of origin, where these former foreign fighters could become a major attraction for would-be jihadists.
In addition to returnees and active FTS, relocators also presents a distinct security risks as they may use their existing connections in the al Qaeda and ISIS networks to facilitate logistical, financial and recruitment activities, or act as operatives planning and carrying out attacks. One example is Mohammad Ali al Habbo, an ISIS financial facilitator, who was reported to be located in Turkey, illustrating the critical role relocators can play.
Al Qaeda and ISIS have been successfully leveraging cyberspace for communication, fundraising, recruitment, and propaganda. These groups are increasingly using artificial intelligence (AI), including ChatGPT, to create propaganda materials tailored to specific audience, translate content rapidly, access information related to target selection, and travel, evade surveillance, and support recruitment activities. AI and social media platforms are also useful tools for those seeking to join jihadist groups.
This technological adaptation extends beyond online activity. Several al Qaeda and ISIS affiliates have already been using drones for reconnaissance, carrying explosive payloads, conducting attacks, while others are investing in acquiring drones and receiving training. To finance their activities, these groups continue to use traditional methods, such as kidnapping for ransom, extortion, or illicit taxation, to finance their activities, while also utilizing cryptocurrency to transfer funds.
Discussion and Conclusions
Majority of the al Qaeda and ISIS affiliates seem to have more localized focus, downplaying global aspirations and taking on local struggles, while groups ISKP and AQAP have more assertive external operations. The shifting regions of hot spots in Salafi-jihadist terrorism is a sign of adaptation and resilience more than just a retreat. In each shift or move to another region, these groups carry their experiences and know-hows with them which facilitates proliferation of terrorist strategic and tactical knowledge and transfer them to successors.
There seems to be an incubation period for an ideology or a group before it elevates to more aggressive and assertive actors. For example, al Qaeda has had long years of incubation period in Afghanistan before engaging in terrorism attacks in the Middle East and Africa before carrying out the 9/11 terrorist attacks. ISIS, on the other hand, had a shorter such period because it has been the successor of what al Qaeda has built. So, for JNIM and ISWAP, which are driving actors in their areas of control, the incubation period could be even shorter before they elevate into attraction zones, inspiring others to join the Salafi-jihadist networks.
There are four regions to watch to assess how ISIS and al Qaeda affiliates would respond. First, how the ongoing war between Iran and US/Israel will evolve and will shape not only the regional dynamics in terms of how the state-actors will realign their positions but also the non-state actors, including Iran’s proxies and ISIS and al Qaeda affiliates. If the situation escalates into conventional ground invasion- potentially- after November 2026 midterm elections in the United States, the destabilization could also mobilize jihadist groups in the region, including ISIS elements in Iraq and Syria. Second, the HTS government in Syria has been facing significant challenge to run the government due to domestic and regional tensions, which could present another lifeline for ISIS affiliates in Syria. Third, in connection with the Iran war, the conflict in Yemen and Somalia could provide more opportunity for AQAP, al Shabaab, and ISIS-Somalia to engage in more aggressive campaigns. Fourth, the political fragility and instability in Sahel, exacerbated with the military coups have offered the jihadist groups vast ungoverned or under-governed territories to establish their de-facto rule.
The situation has gotten more difficult due to the US and Europe distancing themselves from the military juntas in Mali, Burkina Faso, and Niger which have been aligned with Russia. The last but not the least, the clashes between the Taliban in Afghanistan-Pakistan, if escalates, could encourage Taliban’s allies- al Qaeda, TTP, and BLA- to increase terrorist attacks in Pakistan, creating a cycle of violence and more propaganda and recruitment opportunities for these terrorist organizations.
While some may see current terrorism threat level as relatively low or regionally contained because, for example, we have not seen terrorism spillover from Sahel region one of the lessons we observed from the Syrian conflict is that seemingly distant conflict could evolve into an imminent threat, as we have seen several devastating terrorist attacks in major cities in Europe. The current threat landscape requires a more engaged approach with the actors in Africa and beyond and to prioritize allocation of more resources to deal with the root causes of growing violent extremism while at the same time invest in counterterrorism and intelligence sharing.
