During the current month of March, Syria has witnessed a series of security incidents and armed attacks, some of which were attributed to ISIS cells, while the perpetrators of others remain unknown. The latest took place last night in al-Safira in the eastern countryside of Aleppo, reflecting the continued failure of government security in several parts of the country, amid warnings of a resurgence in the group’s activity through small cells that rely on ambushes and swift attacks.
Al-Safira attack
Two members of the Syrian customs police were killed on Tuesday, and two others were wounded in an armed attack targeting their patrol in the al-Safira area east of Aleppo. Security sources said a cell linked to ISIS was behind the attack, with gunmen targeting the patrol before clashes broke out with security forces that intervened at the scene.
During the clashes, one member of the cell blew himself up with an explosive vest after being pursued, killing himself. The Syrian Interior Ministry, affiliated with the interim government, confirmed that security services had begun operations to track down the fleeing members of the cell that carried out the attack.
This attack is one of the most significant operations witnessed in the country during March, as part of a series of attacks that have recently targeted members of the Ministry of Defense, some of which were claimed by ISIS. It points to the group’s continued ability to carry out surprise attacks despite having lost territorial control years ago.
Previous attacks during March
This month saw multiple attacks, some attributed to ISIS and others to unidentified gunmen. In the first week of March, two Internal Security checkpoints affiliated with the Syrian Interior Ministry were targeted in two separate armed attacks in the eastern countryside of Deir ez-Zor. According to local sources from the town of al-Shuhayl, unidentified gunmen riding a motorcycle opened fire with a machine gun on the “al-Attal” checkpoint at the entrance to the town, leading to clashes with checkpoint personnel. The attack injured two civilians, a woman and a young man who were near the site.
In a separate incident on the same day, gunmen targeted another Internal Security checkpoint near the town of al-Busayrah, east of Deir ez-Zor, using machine guns, causing material damage but no casualties.
After the two attacks, Internal Security patrols imposed a security cordon around the towns of al-Shuhayl and al-Busayrah and began combing operations in search of the attackers.
ISIS also claimed responsibility for another attack that took place in the northern countryside of Aleppo during the month and resulted in the killing of two Syrian army personnel. In a statement published through the Amaq agency, the group said its fighters had ambushed the two men on the Aleppo–al-Bab road near the village of Aabed, using machine guns, which led to their deaths. That attack was confirmed at the time by the Syrian Ministry of Defense.
ISIS attacks in 2026
ISIS has carried out dozens of limited attacks in Syria since the beginning of 2026, most of them concentrated in the Syrian desert and east of the Euphrates. These operations were spread across several Syrian provinces, including Deir ez-Zor, Aleppo, Raqqa, Idlib, and al-Hasakah, and targeted forces affiliated with the Ministry of Defense and Internal Security, as well as military and security points and sites.
Most of these operations relied on armed ambushes and gunfire targeting patrols and security checkpoints, in addition to some explosive devices, resulting in deaths and injuries among military and security forces in several areas.
The nature of these operations indicates that the group is currently operating through small mobile cells that carry out limited attacks and then withdraw, taking advantage of vast desert expanses that are difficult to secure. It no longer relies on territorial control or large-scale operations, but instead on small sleeper cells carrying out limited attacks. This strategy allows the group to maintain its presence and keep security forces off balance despite the blows it has suffered in recent years.
Security failure
These developments come at a time when fears are growing of the group’s gradual return to activity, taking advantage of security vacuums in some Syrian areas, particularly in the desert and along contact lines between several military forces.
With the increase in attacks carried out by the group and those attributed to unknown actors, fears are being renewed over the ability of the new Syrian authorities, led by transitional President Ahmed al-Sharaa, to control the security situation and confront the activity of ISIS cells, amid the widening scope of unstable areas and the difficulty of controlling the desert regions the group uses as corridors for movement and hiding. This is especially the case given suspicions about the presence of the group’s cells inside the new Syrian army, which facilitates its access to information about its operations and helps it carry them out.
The attacks by the forces of the Syrian transitional government on areas of northern and eastern Syria also coincided with increased activity by ISIS cells in different parts of Syria.
The Financial Times reported that more than 20,000 people escaped from al-Hol camp, which houses supporters and families of the terrorist ISIS organization in northeastern Syria. In addition, hundreds of ISIS members escaped from prisons that had been under the protection of the Syrian Democratic Forces (SDF), after the area came under the control of the Syrian transitional government.
- How the Houthis Are Choking Yemen’s Peace Efforts with a Broad Escalation on the Ground
- Economy in the Wind: How Yemenis Are Paying the Price of Disrupted Shipping Routes
- Houthi Summer Centers: Factories for Indoctrination and Raising a “Scream” Generation
- The “Coalition of Necessity”: What Costa Rica’s Terrorism Designation of the Houthis Signifies
- Mojtaba Khamenei Runs Iran from His Bed as Photos Vanish and the Supreme Leader Makes a “Voice-Only” Appearance
