Disclaimer: The information and opinions expressed in this Report are the views of Talos and constitute a judgment as at the date of the Report and are subject to change without notice. The information and opinions expressed in this Report have been formed in good faith on the basis of the best information and intelligence available at the time of writing. Vesper Group accepts no liability arising out of or in connection with the comments made or the information set out in this Report and the reader is advised that any decision taken to act or not to act in reliance on this Report is taken solely at the reader’s own risk. 

For questions regarding this report or regarding a subscription, please contact us here:
https://talosinformation.com/contact-us/

HIGH PROFILE ATTACK TARGETS US FORCES IN SYRIA

CENTCOM Confirms Attack on US Forces
On 13 December, U.S. Central Command confirmed that a lone gunman carried out an attack on a joint U.S.–Syrian patrol south of Palmyra, killing two U.S. servicemembers and one U.S. civilian, wounding several additional U.S. and Syrian personnel. The attacker was subsequently killed by Syrian forces. Following the incident, Syrian forces closed nearby roads, U.S. aircraft conducted low-altitude flights in the area, and casualties were medically evacuated to al-Tanf Garrison.

US MEDEVAC Helicopter Evacuates Casualties

In the days that followed, U.S. and Syrian authorities implemented additional security measures around Palmyra and launched investigations into possible facilitation networks. Conflicting accounts emerged regarding the attacker’s background, including allegations of links to Syrian internal security and prior concerns over extremist sympathies. Syrian security forces later detained multiple individuals in the Homs countryside, several of whom were assessed to have ties to Islamic State activity and potential connections to the Palmyra attack, indicating that authorities viewed the incident as part of a broader network rather than an isolated act.

The attack prompted coordinated political and security responses from U.S., Syrian, and Syrian Democratic Forces leadership, all reaffirming their commitment to continued counter-Islamic State operations. The incident highlighted the group’s continued presence in central Syria and its ability to exploit security gaps along key transit corridors such as the Palmyra–Homs axis, reinforcing assessments that Islamic State remains an active, though degraded, threat in the Syrian Badia.

US Forces Conduct Low-Altitude Operations

US Operations in Northeastern Syria Target IS Members
On or around 17 and 18 December, U.S. and Syrian Democratic Forces, supported by the international coalition, conducted multiple counter-Islamic State security operations across northeastern and central Syria. In the southern Raqqa countryside near Ma‘adan, coalition forces carried out late-night raids in the al-Nu‘aymat area and nearby villages, supported by manned aircraft and unmanned aerial vehicles. Reporting indicates that at least one individual accused of IS affiliation was killed during a clash, with weapons and explosives recovered, while additional raids in Mashtaha and Qasabi in the western Deir ez-Zor countryside resulted in further arrests. Coalition aircraft reportedly remained in the area until dawn, suggesting sustained security coverage during the operation.

During the same reporting period, a separate coalition-backed airborne operation took place in northeastern Syria near the Iraqi border in Hasakah province. Iraqi authorities stated that an Intelligence Falcons Cell unit, with technical support from the U.S.-led coalition and coordination with Syrian security forces, detained two individuals wanted by the Iraqi judiciary inside Syrian territory. Open-source reporting identified the detainees as Iraqi nationals and former IS members residing in the area, with Kurdish internal security forces and coalition-aligned units reportedly involved in the raid.

Collectively, these operations illustrate a coordinated U.S., SDF, and partner response aimed at disrupting remaining IS networks, targeting former operatives, and addressing cross-border threat dynamics linking eastern Syria and Iraq. The use of precision raids, air support, and joint intelligence coordination reflects an ongoing effort to limit IS freedom of movement and prevent the reconstitution of support cells in key rural corridors.

US Forces Load Detainees During Operation in Syria

IS FIGHTERS TARGET IRAQI MUKHTAR IN SALAH AD DIN

IS Claims Attack on Mukhtar in Salah ad Din
Early on 12 December, multiple sources reported that two to three unidentified gunmen stormed a house in the Zalayah/Albu Dur area of Salah ad Din and fatally shot the homeowner moments after he opened the door. Neighbors in the area subsequently opened fire, forcing the assailants to flee. The victim was identified as Fakhri al-Abbasi, a local Mukhtar and father of six family members executed in the same area in 2021. Available footage showed three suspects participating in the attack, presumably fleeing into rural areas shortly thereafter. IS-linked channels later claimed the attack, publishing graphic images of the victim’s body, characterizing the victim as a “spy” for the Iraqi government.

Security Responses in Iraq
In the days following the attack, Iraqi security forces stepped up operations against IS, searching the immediate area for signs of the fireteam-sized element. Notably, Iraq’s National Security Service confirmed the arrest of an IS Commander on 16 December, confirming a ten-month intelligence operation leading to the arrest. The detainee, identified as Abu Alyaa, was described as an IED specialist and communications figure who allegedly supplied more than 100 detonators used in attacks across Iraq. While operating under an alias, Abu Alyaa fled to a neighboring country but was arrested upon his recent return to Iraq.

Map of IS Initiated Incidents (Including ERW Detonations) Over 90 Days

IS Activity Continues Despite Security Operations
Recent incidents also saw unconfirmed and evolving reporting around an IED incident west of Mosul near Jenif Airport and a separate account of an IED striking an army vehicle during a security operation in southwestern Nineveh, injuring personnel and destroying the vehicle, with some reporting suggesting the vehicle accompanied a Qatari hunting group. Separately, social media sources—including IS-affiliated accounts—circulated additional claims of clashes in Nineveh and reported clashes on Palkana Mountain in Kirkuk during foggy conditions – a tactic historically used by IS elements to avoid detection, moving personnel and materials under the cover of inclement weather.

HIGH PROFILE ATTACK IN AUSTRALIA MOTIVATED BY IS

Mass Casualty Attack in Australia Motivated by Islamic State
On 14 December 2025, a mass shooting occurred at a Hanukkah celebration near Bondi Beach in Sydney, Australia, in what authorities are treating as an Islamist-inspired terrorist attack. Two gunmen, identified as 50-year-old Sajid Akram and his 24-year-old son Naveed Akram, opened fire on crowds at the “Chanukah by the Sea” event, killing 15 people and injuring more than 40 others, including children and adults. Police shot and killed the elder Akram at the scene, and the younger suspect was critically wounded and later charged with multiple offences, including counts of murder and terrorism. Investigators found improvised explosive devices and homemade Islamic State flags in a vehicle registered to the suspects, and Australian officials, including Prime Minister Anthony Albanese, stated the attack was “motivated by Islamic State ideology,” though there has been no public claim of direct operational control by the group.

Islamic State Media Praises Attack – Encourages Similar High Profile Actions

In the aftermath, national leaders condemned the violence, mourners held vigils, and authorities began probing the background and possible radical influences on the attackers, including recent travel to the Philippines. The incident represents one of the deadliest terrorist acts in Australia in nearly three decades

Additional operations were reported days later when Australian police intercepted vehicles in Sydney based on intelligence of a potential violent act, though officials stressed there was no confirmed link to the Bondi Beach attack. Islamic State media subsequently praised the Bondi massacre as a “source of pride” without explicitly claiming responsibility, signaling ongoing concern over the group’s ability to inspire acts of violence internationally.

Tip-Based Report Sees Detentions Days After Attack

GERMAN AUTHORITIES THWART ATTACK ON CHRISTMAS MARKET

Arrests Come Amidst Heightened Concerns Around Christmas Markets
On 14 December, German authorities announced the arrest of five men suspected of planning an Islamist-motivated attack on a Christmas market in the Dingolfing area of Bavaria. According to the Munich public prosecutor’s office, four of the suspects were placed under formal arrest warrants, while a fifth individual was taken into preventive custody. Investigators assess that the planned attack would have been carried out using a vehicle and was ideologically motivated. The suspects include a 56-year-old Egyptian, a 37-year-old Syrian, and three Moroccan nationals aged 22, 28, and 30. German media reported that the Egyptian suspect had previously called for an attack at a mosque in the Dingolfing-Landau area. Bavarian Interior Minister Joachim Herrmann stated that rapid coordination among security authorities enabled the disruption of the plot.

The arrests come amid heightened security concerns surrounding Germany’s Christmas market season, which remains a priority focus for law enforcement due to past attacks. In December 2024, a vehicle-ramming attack at a Christmas market in Magdeburg killed six people and injured more than 300, prompting scrutiny of warning signs and intelligence coordination failures. Earlier, in December 2016, an asylum seeker who had pledged allegiance to the Islamic State carried out a truck attack at a Berlin Christmas market, killing 12 people and wounding dozens, an incident later linked to gaps in intelligence sharing. German authorities continue to emphasize preventative measures and inter-agency cooperation to mitigate similar threats during the holiday period.

ISRAELI SECURITY SERVICES ARREST IS SUSPECTS

IS Recruitment Consistently Targets Younger Populations
On 18 December, Israeli authorities announced plans to indict a 20-year-old man suspected of Islamic State affiliation and contact with a foreign agent linked to the group. The suspect, identified as Kenan Azaiza from the northern Arab town of Daburiyya, was arrested in a joint operation by police and the Shin Bet alongside a second suspect from Acre. Prosecutors stated that the charges will focus on membership in a terrorist organization and maintaining contact with a foreign operative connected to the Islamic State.

According to investigators, Azaiza pledged allegiance to Islamic State during questioning and expressed willingness to carry out attacks against Israeli security forces. Authorities further reported that he sought to acquire operational capabilities, including learning how to manufacture pipe bombs and other explosive devices. Investigators also determined that Azaiza and the second suspect had discussed traveling to an enemy country to receive training under Islamic State, underscoring concerns over attempted external facilitation and radicalization pathways rather than an imminent domestic attack.

Materials Recovered During Arrest

CLIENT CONSIDERATIONS GOING INTO THE HOLIDAYS

Reviewing Previous Incidents During Holiday Periods
With the recent string of attacks perpetrated or motivated by the Islamic State, follow-on or copycat-style attacks could be considered by like-minded actors. Historically, the Islamic State has sought to radicalize vulnerable young populations through familial connections and online forums, aiming to at least recruit sympathetic audiences – though at times these set conditions for financial support or even direct recruitment.

Moving into the holiday season, the Islamic State could aim to leverage the recent string of headlines to maintain the perceived operational tempo. As such, reviewing historic Islamic State operations, incidents such as attacks on Christmas Markets in Europe come to mind. Such attacks leverage easy-to-obtain materials such as vehicles, ramming them into crowds.

In locations where firearms are more easily accessible, incidents such as the Islamic State-motivated attack in New Orleans, United States, come to mind. The incident occurred on 1 January 2025 and saw the use of a pickup truck to ram crowds celebrating the New Year. The attack developed further as the suspect began opening fire on crowds, killing a total of 14 and wounding 35 others.

Looking at places such as Erbil, the Islamic State has sought to conduct attacks during the holidays as recent as December 2023. Kurdish officials confirmed that Islamic State members were planning attacks to coincide with New Year celebrations in Erbil, with targets including locations in Ankawa, within close proximity to the US Consulate.

Keeping all of these factors in mind, clients should maintain heightened vigilance moving into the holiday period, as high-traffic locations across the world could be viewed as potential targets. While security services are typically able to identify planning efforts, so-called “lone wolf” attacks remain a concerning gap, as planning can be carried out with limited opportunity for intelligence interception. Nonetheless, proper planning, persistent vigilance, and adequate risk assessment and management can help limit some of these factors.

For questions regarding this report or regarding a subscription, please contact us here:
https://talosinformation.com/contact-us/