Old Wine in a New Bottle? ISIS in Syria in 2026

The fall of the Assad regime in Syria has been followed by extensive restructuring of institutions, particularly with regard to the security landscape. Nevertheless, it is still not possible to speak of the reinstatement of a stable order. On 11 August, for instance, two soldiers were killed at a remote military post in northeastern Syria. Within hours, Syrian security forces were searching nearby villages for an ISIS cell, even though it had not been established that ISIS had carried out the attack. The dead soldiers themselves had until recently belonged to a force operating outside the Syrian state. Why, then, did the authorities immediately turn their attention to ISIS? Was the group actually responsible for the attack—and if not, who was?

The incident is a starkly revealing indicator of the nature of the ISIS presence in post-Assad Syria. Despite significant territorial losses, ISIS remains, and is perceived by the authorities as, an active threat within Syria’s still deeply fragmented security environment. The group may no longer govern strategic territories, but it continues to operate through dispersed cells, assassinations, ambushes, improvised explosive devices and attacks on local security forces. These activities, in turn, continue to trigger counter-ISIS operations and underline how far Syria remains from a stable post-conflict security order.

From Caliphate to Insurgency

The Syrian conflict began in 2011, when anti-government protests inspired by the wider Arab uprisings were met with violent repression by the Assad government. What started as a protest movement soon developed into a fragmented civil war involving the Syrian government, a range of opposition groups, Kurdish-led forces, jihadist organizations and numerous foreign powers.

ISIS emerged as one of the most powerful armed actors of this conflict after expanding rapidly across Syria and Iraq from 2013 onward. At the height of its power, the group controlled major population centres, including Raqqa, and presented itself not merely as an insurgent organization but as a territorial state. That project collapsed under sustained military pressure from the US-led international coalition and its local partners. On 23 March 2019, the Syrian Democratic Forces captured Baghouz, ISIS’s last territorial stronghold in Syria, bringing the group’s self-declared “caliphate” to an end.

Territorial defeat, however, did not amount to organizational disappearance. Even in 2019, international assessments warned that ISIS was adapting to the loss of territory in both Syria and Iraq by relying on covert networks and dispersed cells. ISIS, it was said, is not simply a political or terrorist organisation, but more fundementally embodiment of radical Islamist ideology. Ideologies die hard.

In Syria, this transformation increasingly shifted the group from territorial governance toward insurgent tactics: ambushes, assassinations, improvised explosive devices and attacks on military and security personnel. By 2024, ISIS activity had again increased markedly, with attacks spreading geographically and targeting both government forces and civilians. The fall of the Assad government in December of that year further reshaped the environment in which the group operated, raising renewed concerns that political and security fragmentation could provide opportunities for its continued activity.

Where ISIS Operates and Whom It Targets

ISIS activity in Syria today is concentrated above all in the country’s east and northeast, but it is by no means confined there. According to the Syrian Observatory for Human Rights (SOHR), the group carried out 67 attacks between January and July 2026, killing 53 people. Deir Ezzor remained the main centre of activity, accounting for 34 attacks, followed by Aleppo with 14 and Al-Raqqah with ten. Yet attacks were also recorded in Al-Hasakah, Damascus, Hama, Homs, Idleb and Rif Dimashq. This geographic spread is significant: it shows that ISIS continues to operate beyond its traditional strongholds in eastern Syria and can maintain cells across a much wider security landscape.

The main targets have also become relatively clear. Rather than focusing primarily on civilians, ISIS now directs much of its violence against military, security and government personnel. In March 2026 alone, the group carried out 22 attacks, killing 13 members of the Ministry of Defense and forces affiliated with the transitional government. In May, attacks included assassinations, gunfire, a suicide attack and strikes against military vehicles, guard posts and security facilities. Among those killed were a Ministry of Defense officer and a diplomatic security official. Civilians nevertheless remain vulnerable, particularly in areas where ISIS uses intimidation and coercion to maintain influence.

What emerges is therefore not the picture of a group attempting to reconquer and govern large territories. Instead, ISIS relies on dispersed cells and relatively small-scale but persistent attacks that exploit local insecurity, target state and security structures, and force both Syrian and international actors to devote continuing resources to counter-ISIS operations.

A Changing Syria, A Persistent ISIS?

ISIS’s persistence is particularly striking because the political and security landscape around it has changed dramatically. Under Assad, the group fought regime forces while also confronting the SDF and other local security actors. After the fall of the Assad government in December 2024, these lines became even more fluid. Former opposition forces, Kurdish-led structures, local armed groups and newly reorganized state institutions now operate within a still unsettled security order. ISIS has adapted to this environment rather than disappearing from it.

The pattern visible in 2025 and 2026 reflects this shift. ISIS continued to attack SDF and Asayish personnel in northeastern Syria, but it also increasingly targeted forces and officials linked to the transitional government. At the same time, Syrian government-affiliated forces, the SDF, internal security forces and the US-led coalition continued arrest operations, raids and strikes against suspected ISIS cells. The group therefore remains under considerable pressure, but the need for such operations also demonstrates that it has not ceased to function as an organized security threat.

This brings us back to the attack of 11 August. The assailants were not immediately identified, yet the authorities’ response focused on suspected ISIS cells. That reaction says something important in itself. ISIS no longer needs to control territory or openly govern cities to shape the behaviour of security actors in Syria. Its continuing relevance lies precisely in its ability to operate in the shadows of a fragmented and still changing political order. The “caliphate” may be gone, but ISIS is not. Therefore, the rebuilding efforts in the region would do well to focus on counter-terrorism measures which may require significant reforms within the security sector.