KEY INSIGHTS
Islamic State in Iraq and Syria (ISIS) has reemerged as a significant threat in post-Assad Syria, exploiting the fluid security environment to rebuild its ranks, seize abandoned weapons, and expand operations into urban centres. Multiple complex attacks on security targets and civilians highlights ISIS’s growing capability to conduct coordinated, high-impact incidents. ISIS’s transition from rural ambushes to technical urban operations indicates rising capacity, resources, and intent to destabilize the transitional government. Without a cohesive counterterrorism framework, ISIS is poised to escalate attacks and undermine Syria’s fragile post-regime stability.
KEY 2025 EVENTS
November 2: Suspected ISIS militants conducted a complex attack on the Syrian Ministry of Defense headquarters in Albu Kamal, Deir ez-Zor.
November 1: The U.S. special envoy reported Syrian President Ahmed al-Sharaa intends to join the U.S.-led coalition against ISIS.
June 22: ISIS carried out a suicide bombing on the Mar Elias Church, Damascus. The attack killed 31 and injured 54 others.
May 29: ISIS militants attacked members of the Syrian government 70th Division in as Suwayda. This marked the first ISIS claimed attack on Syrian government forces following the fall of Assad.
February: The U.N. assessed ISIS maintained approximately 3,000 active combatants.
ANALYSIS
Sustained counterterrorism operations in Syria significantly contained ISIS prior to the deposition of the Assad regime by the Southern Operations Room (SOR) and Turkish-backed Hay’at Tahrir al-Sham (HTS). ISIS, however, exploited the unstable security environment during the transition to reconstitute its cells, seize stockpiles of heavy weapons abandoned by Assadist forces, and expand into urban areas including Damascus. More than 500 ISIS detainees were released during the transfer of power, further strengthening the group’s ranks.
We assess an operational shift within ISIS occurred in June 2025, when ISIS militants redeployed from rural positions in Syria to major cities including Kirkuk, Aleppo, and Damascus. The suicide bombing at the Mar Elias Church in Damascus marked a shift in targeting from security forces to civilians. ISIS followed this with a complex assault on the 86th Division of the Syrian Ministry of Defense headquarters, underscoring ISIS’s transition from simple attacks to complex, multi-tiered operations.
OUTLOOK
We assess ISIS will likely continue to expand operations in Syria and conduct higher profile attacks generating mass casualty situations, whilst maintaining pressure on security services and attempting to incite sectarianism to inhibit the consolidation of the transitional government’s control in Syria.
Concentric recommends the following steps for anyone planning travel to Syria or the broader region:
- Prior to travel, conduct comprehensive risk assessments, secure reliable intelligence on political, criminal, and infrastructure-related risks, and coordinate movements with trusted local contacts or authorities.
- Ensure appropriate insurances are in place prior to any travel, which should include adequate kidnap ransom extortion coverage.
- Private security support is also strongly advised for personal safety and logistical coordination.
- Travel tracking tools and secure communication channels should be employed so movements are monitored in real time by a designated security contact.
Authored by: Alexander Edwards
