ISIS in Iraq: Declining Activity, Persistent Threat

Executive Summary

ISIS no longer exercises the kind of territorial control it established in Iraq in 2014. Yet its diminished presence does not mean that it has lost the ability to carry out attacks. Monitoring conducted by the Iraq Center for Foresight Studies documented 27 operations for which ISIS claimed responsibility between the beginning of January 2025 and 14 October 2026. These included 16 operations in 2025 and 11 in 2026 up to the report’s cut-off date. The incidents occurred across six provinces, with Anbar standing out for the persistence of activity over the monitoring period and Kirkuk emerging as the centre of the most recent cluster of security incidents.

Improvised explosive devices predominated in ISIS’s claims, alongside direct-fire attacks, ambushes, assassinations, damage to agricultural property, and attacks on surveillance equipment. Most incidents targeted members of the security forces or auxiliary formations. This pattern points to a continuing capacity to conduct low-intensity attacks rather than a renewed ability to wage a large-scale campaign.

October 2026 witnessed a succession of incidents in Kirkuk, most notably the ISIS-claimed attack in al-Barghliyah, followed by armed engagements, Iraqi airstrikes, and incidents involving explosive remnants. Taken together, these developments confirm that the threat persists. On their own, however, they are insufficient to establish either a nationwide ISIS resurgence or a causal connection with the conclusion of the international coalition’s mission in Iraq.

Operational Trend: Historic Decline, Continued Presence

The Center’s monitoring indicates that ISIS continued to claim sporadic operations throughout 2025 and 2026. Sixteen operations were recorded in 2025, compared with eleven during the elapsed portion of 2026. The figures suggest that activity has persisted despite a sharp decline from the years in which attacks were considerably more frequent. The 2026 figure must nevertheless be treated as covering an incomplete year.

Period	ISIS-claimed operations documented by the Center
2025	16
1 January–14 October 2026	11
Total	27

Geography of Activity: Limited Spread and Predominantly Rural Terrain

The operations documented by the Center were distributed across Anbar, Kirkuk, Salah al-Din, Nineveh, Diyala, and Baghdad. Descriptions of these incidents point to a recurring presence in rural and desert areas, as well as along roads connecting different districts. Incidents within major urban centres were comparatively limited. The recurrence of attacks in any one province should not, in itself, be interpreted as evidence that ISIS controls territory there.

Province	Number of operations	Principal locations recorded
Anbar	9	Rawa, Haditha, al-Qa’im
Kirkuk	5	Hawija, Dibis, the vicinity of Altun Kupri
Salah al-Din	5	Baiji, south of Tikrit, desert areas
Nineveh	4	al-Hadr, al-Jazira
Diyala	3	Buhriz, Jadidat al-Shatt, al-Udhaim
Baghdad	1	Tarmiyah

Anbar accounts for the largest share of incidents in the Center’s database. Incidents there included attacks targeting the Iraqi Army, the Tribal Mobilization Forces, and the Popular Mobilization Forces. Kirkuk, meanwhile, came to the fore in October 2026 because several security incidents occurred in quick succession in Hawija, al-Barghliyah, and Wadi Zghaytun. This geographic pattern indicates the persistence of dispersed pockets of risk, rather than the formation of a contiguous zone under ISIS control.

Methods of Attack and Nature of Targets

Improvised explosive devices recur frequently in descriptions of the operations claimed by ISIS. Other incidents involved gunfire, assassinations, sabotage, the burning of crops, and attacks on surveillance equipment. The consequences varied: some incidents caused deaths or injuries, while others resulted solely in material damage. This diversity reflects an ability to inflict limited harm, but it does not mean that all recorded incidents were comparable in severity.

The targets included the Iraqi Army, Federal Police, Counter Terrorism Service, Popular Mobilization Forces, and Tribal Mobilization Forces, as well as a local mukhtar, facilities, and private property. The Center’s monitoring also recorded an ISIS claim that it had burned agricultural crops in the al-Qal’a/al-Udhaim area of Diyala on 24 May 2025. The group alleged that the crops belonged to a member of the Tribal Mobilization Forces. This account is attributed to ISIS and should not be understood as an independent determination of the landowner’s identity.

Temporal and Geographic Shifts in Operations, 2018–2026

The annual comparison reveals a pronounced change in both the scale and geographic distribution of ISIS’s declared activity. After 1,233 operations were recorded in 2018 and 1,245 in 2019, activity peaked at 1,459 operations in 2020. It then entered a downward trajectory, falling to 1,113 operations in 2021, 487 in 2022, 151 in 2023, and 70 in 2024. According to the historical series used in this analysis, the 2024 figure represents a decline of approximately 95.2 per cent from the 2020 peak.

The change was not confined to the volume of activity; its geographic centres of gravity also shifted. Kirkuk recorded the highest level of activity in 2018, before Diyala moved to the forefront in 2019 and 2020. Kirkuk again ranked first in 2021 and 2022, while Anbar led the geographic distribution in 2023 and 2024. These shifts indicate a contraction in the overall scope of declared activity and a change in the areas where it was concentrated. The decline in numbers, however, does not mean that ISIS has lost the capacity to conduct sporadic attacks.

The Center’s available monitoring of claimed operations in 2025 and 2026 records 16 and 11 incidents respectively. These figures are drawn from a different monitoring database than the preceding historical series. They should therefore not be treated as its direct statistical continuation, nor should a single rate of decline be calculated across the entire nine-year period.

Nevertheless, the comparison offers a broad indication that activity has shifted from the more extensive distribution seen in earlier years to a smaller number of more dispersed incidents in the recent record. This assessment must continue to distinguish between a decline in declared operations and a decline in ISIS’s actual organizational capacity.

Security-Force Casualties: Assessing the Verified Incidents

Security-force casualties are central to understanding the impact of ISIS activity. The casualty figures announced by the group, however, cannot automatically be treated as official totals. In some cases, discrepancies emerge between ISIS claims and Iraqi security reporting. Any presentation of the findings must therefore attribute each account to its respective source.

Incident	Reported outcome	Significance
Tarmiyah, 21 January 2025	Five security personnel killed and eight wounded, according to a subsequently published security tally	ISIS claimed responsibility, but its account of how the explosion occurred differed from the initial official version
al-Barghliyah, 5 October 2026	One Federal Police member killed and four wounded, according to Iraqi reports	Iraqi media reported on 6 October that ISIS had claimed responsibility
Northern Rawa Desert, 4 October 2026	Two security personnel killed and two wounded, according to the Ministry of Defence	An explosion occurred during a search operation and was linked to explosive remnants left by ISIS
Wadi Zghaytun, 14 October 2026	Two Iraqi Army personnel killed, according to the Ministry of Defence	The incident occurred while security forces were inspecting a site targeted in an airstrike

The Tarmiyah incident illustrates the importance of distinguishing between confirmation that a group has claimed responsibility and confirmation of the details contained in that claim. The initial official statement attributed the explosion to ordnance encountered during a search operation. ISIS subsequently claimed responsibility, alleging that it had lured the security force to a farm. This study documents the statement as a claim of responsibility while continuing to attribute the account of the incident’s precise mechanism to the source advancing it.

Conversely, the deaths of security personnel while inspecting explosive remnants do not automatically constitute a newly claimed attack. Casualties arising from incidents involving remnants left by ISIS should be included in the broader security picture, but they should not be counted in the same manner as casualties caused by direct attacks.

October 2026: A Short Cluster of Incidents in Kirkuk

On 5 October, Federal Police personnel came under attack in al-Barghliyah, in Hawija district. Iraqi media reported the following day that ISIS had claimed responsibility. On 6 October, reports emerged of an attack on a Popular Mobilization Forces position and its surveillance equipment in the area. On 10 October, Iraqi media published differing accounts of an armed confrontation between the security forces and ISIS members in al-Barghliyah, including conflicting descriptions of how the engagement began.

On 13 October, Iraqi security authorities announced that airstrikes had been conducted against ISIS positions in Wadi Zghaytun, Kirkuk. The following day, Brigadier General Ahat Yasser Khudair Hussein and Warrant Officer Mu’taz Shahid Abbas were killed when an explosive remnant left by ISIS detonated as they inspected the site of one of the strikes, according to the Ministry of Defence.

The significance of this sequence lies in the need to distinguish between attacks claimed by ISIS, Iraqi security operations, and incidents caused by explosive remnants.

The concentration of incidents over a short period confirms a notable level of security activity in Kirkuk. It does not, however, independently demonstrate the emergence of a sustained escalation across Iraq. Reaching such a conclusion would require a longer observation period and consistent monthly data on claimed operations and casualties.

The Threat Following the End of the International Coalition’s Mission

The incidents in Kirkuk occurred after the international coalition concluded its mission in Iraq on 30 September 2026. This timing raised questions about the effect of the transition in security-cooperation arrangements. Chronological proximity alone, however, is insufficient to establish a direct causal relationship between the two developments.

The continuation of Iraqi operations against ISIS also underscores the importance of distinguishing between the termination of a specific coalition mission and the end of all forms of military or intelligence cooperation.

The available evidence points to a continuing threat from armed cells in certain areas, but it does not establish that ISIS has restored territorial control or regained the ability to mount a major campaign. Any evaluation of changes in the security environment must examine the persistence, geographic spread, and consequences of attacks rather than rely on a single incident or an unusually news-intensive week.

What Does an “ISIS Return” Mean?

In its narrow sense, a return may refer to renewed attacks or a temporary increase in their frequency within a particular area. A broad operational resurgence, by contrast, would require a sustained increase in the number of attacks, their geographic reach, and the group’s ability to inflict casualties.

A territorial resurgence would require additional indicators related to control over land and populations. The incidents examined in this study provide no evidence that this final threshold has been reached.

The available data are best understood as indicating the persistence of a low-intensity threat, accompanied by a localized cluster of incidents in Kirkuk that warrants attention. They do not amount to verified evidence that ISIS has returned to the level of strength it possessed in 2014. Nor is the brief monitoring period since the end of September sufficient to assess the medium-term effects of any changes in Iraq’s security landscape.

Conclusion

Monitoring by the Iraq Center for Foresight Studies of operations claimed by ISIS confirms that the group retained a limited capacity to carry out attacks in Iraq during 2025 and 2026, following several years of substantial decline in its activity. Anbar represents the most sustained geographic presence within the monitoring period, while Kirkuk witnessed the most recent cluster of incidents occurring in close succession.

In terms of tactics, improvised explosive devices and limited attacks predominate in the documented pattern, alongside incidents involving damage to property and surveillance equipment.

The existing threat is real, but it must be described with conceptual precision. The continued presence of cells is not synonymous with renewed territorial control, just as an increase in casualties caused by explosive remnants does not necessarily indicate an increase in newly launched operations.

The study therefore concludes that ISIS continues to pose a limited security threat whose geographic distribution remains variable. There is, however, insufficient evidence to establish that the group has regained its former level of capability.

Sources and References

• Iraq Center for Foresight Studies, Data and Information Department, monitoring of operations claimed by ISIS in Iraq, 2025–2026.
• Iraqi Security Media Cell and Iraqi Ministry of Defence, statements concerning the Tarmiyah incident and the operations and security incidents of October 2026.
• ACLED, Down but Not Out: Islamic State and al-Qaeda Remain a Threat in the Middle East:
  https://acleddata.com/report/down-not-out-islamic-state-and-al-qaeda-remain-threat-middle-east