Introduction
The declaration of the “liberation of Iraq from ISIS” in late 2017 marked a pivotal turning point in the history of terrorist threats within the country. However, it did not signify the end of the phenomenon as much as the beginning of a new, more complex and less visible phase.
Since 2018, ISIS has entered a different stage of activity characterized by territorial contraction alongside operational adaptation, shifting from a model of a “controlling organization” to that of a “latent threat.”
Between 2018 and 2026, ISIS’s residual activity intersected with profound political and security transformations within Iraq and the wider region. The Iraqi state underwent a gradual restructuring of the roles of its security forces, accompanied by changes in the nature of the international coalition’s presence. At the same time, domestic debate intensified over the issue of state monopoly on arms, amid growing regional tensions, particularly in the context of the prospective U.S.–Iran confrontation and the continuing repercussions of the Syrian conflict.
This report seeks to provide a comprehensive analytical reading of ISIS activity in Iraq during this period by tracing its temporal evolution, analyzing the geography in which it preserved operational capacity, and assessing the role of the international coalition in containing the organization. These elements are situated within their broader political and security context, deliberately avoiding mobilizing rhetoric or impressionistic characterizations.
From “Statehood” to Low-Intensity Insurgency
After losing control of major cities and the administrative structures it had established between 2014 and 2017, ISIS became incapable of reproducing its former “state” model inside Iraq. This failure did not translate into total collapse; rather, it pushed the organization toward a different strategy centered on survival, attrition, and maintaining a minimal level of presence.
Since 2018, ISIS activity has more closely resembled an asymmetric insurgency pattern based on small cells, limited operations, and the avoidance of direct confrontation. This transformation was less an ideological choice than a necessity imposed by shifting balances of power. The organization faced a more experienced state apparatus, more effective intelligence services, and sustained aerial and technical support from the international coalition.
Within this framework, ISIS’s objective was no longer territorial control or public declaration of authority, but the disruption of relative stability and the preservation of an image of “ongoing threat.” This image has played an important role in keeping the organization within security and political calculations despite the decline in its actual capabilities.
Temporal Evolution of Operations: From Escalation to Decline
Data on the number of operations claimed by ISIS between 2018 and 2026 reveal a clear trajectory that can be divided into three principal phases.
The first phase (2018–2020) was marked by a gradual escalation in the number of operations, culminating in a peak in 2020. This rise can be explained by a combination of overlapping factors, most notably political instability, the multiplicity of security decision-making centers at certain moments, and the state’s preoccupation with pressing internal issues such as widespread protests and the COVID-19 pandemic. During this period, ISIS focused on targeting vulnerable points, mobile patrols, and remote villages in an effort to reassert its operational presence.
The second phase (2021–2022) witnessed the beginning of a noticeable decline in operations as a result of intensified qualitative intelligence efforts and the adoption of precise pre-emptive operations by security forces. These measures led to the dismantling of numerous cells and reduced the organization’s room for maneuver.
In the third phase (2023–2026), ISIS activity fell to its lowest levels since 2003, with only very limited numbers of recorded operations. This sharp reduction reflects not only the organization’s weakness but also the success of a long-term containment strategy focused on preventing reconstitution rather than relying solely on reactive military responses.
Operational Geography: Why Did These Areas Persist
Despite the overall decline in the number of operations attributed to ISIS after the liberation of Iraq, the geographic distribution of this activity reveals a relatively stable pattern concentrated in specific provinces and areas that formed the backbone of residual activity.
Foremost among these were Diyala, Kirkuk, and Salah al-Din, which can be described as the “most active operational triangle” during the study period. This concentration resulted from a complex interaction of geographic, demographic, and security factors.
These provinces are part of an interconnected geographic system shaped by mountain ranges and extended valleys, beginning with the Makhoul Mountains in Salah al-Din, continuing through the Hamrin mountain chain linking Salah al-Din with Kirkuk and Diyala, and extending toward the Tigris River and its surroundings, then southward and eastward to the al-Adhaim area and the approaches to northern Baghdad.
This terrain—with its rugged features and intertwined natural routes—provided a suitable environment for the movement of small cells, inter-provincial mobility, and temporary concealment away from major security centers. The Hamrin Mountains are particularly significant in explaining the persistence of activity, given the valleys, caves, and expanses that are difficult to secure on a permanent basis. Their connection to densely cultivated areas, such as the Tarmiyah orchards north of Baghdad, offered natural cover with high political sensitivity despite the limited scale of actual activity there. Moreover, these areas function as administrative and security boundary zones between multiple provinces, creating gaps in sustained control, especially in rural and remote locations.
By contrast, Anbar represented a different kind of strategic depth for the organization, based on vast desert expanses rather than population density. The desert corridor linking southwestern Nineveh (al-Hadar and al-Jazira) to Anbar—extending toward Haditha, Rutba, and the Syrian border—constituted the organization’s oldest operational environment and a passageway for movement, concealment, and repositioning. However, it was less capable of sustaining frequent operations compared with mountainous and agricultural zones.
The northern Baghdad belt acquired heightened importance because of its political and security symbolism. Any activity there, however limited, is perceived as a direct threat to the center of decision-making and is often amplified in media narratives beyond its actual operational scale.
Overall, the persistence of ISIS activity in these areas does not indicate expansion or resurgence. Rather, it reflects a residual capacity to exploit a complex and interconnected geography of mountains, valleys, and deserts that is difficult to neutralize without sustained control and cross-provincial coordination that goes beyond temporary deployments.
Map (1) identifies the persistent hotspots of ISIS activity (2023–2026):
Table (1) presents the geographic distribution of ISIS operations in Iraq (2018–2026):
The International Coalition: From Open Warfare to Intelligence Containment
Following the declaration of liberation, the role of the international coalition changed fundamentally. It shifted from large-scale aerial campaigns to a more selective pattern centered on precision strikes based on high-quality intelligence. These strikes targeted field commanders, hideouts, and movement routes in remote areas, particularly in western and northern Iraq.
The concentration of strikes in certain regions indicates that they represented the organization’s last operational depth. Meanwhile, the large number of strikes categorized as “scattered within Iraq” reflects the decentralized nature of the threat, which relies on mobile cells rather than fixed bases.
The Political Dimension: Between Security Risk and Instrumental Discourse
ISIS’s residual activity coincided with recurring political rhetoric from some armed factions emphasizing that the “ISIS threat remains,” often linking it to developments in Syria. While this discourse is partially grounded in an existing security reality, it cannot be separated from a broader context that includes debates over the state’s monopoly on arms, the future of foreign military presence, and the prospects of regional escalation.
The gap between the actual security threat—as reflected in empirical data—and the threat portrayed in political discourse constitutes one of the defining features of the current phase. It suggests that ISIS has, at times, become an element within political contestation as much as a security challenge.
Conclusion
Data from the 2018–2026 period clearly indicate that ISIS in Iraq no longer represents an existential threat to the state. At the same time, it has not been completely eradicated. The organization is weak, limited in capability, and low in operational tempo, yet it persists as a latent threat that can be leveraged in security or political contexts.
The principal challenge in the coming phase lies less in military capacity than in maintaining sustained control, strengthening intelligence efforts, and preventing the politicization of the threat. These measures are essential to ensure that a limited security risk does not evolve into a source of broader political instability.
