In 2019, US forces declared the so-called Islamic State (IS) terrorist group to be defeated. However, as the past year has shown, this only marked the end of its quasi-state territorial rule in Iraq and Syria – not the end of the threat it still poses.
This extremist group is showing resilience and experiencing a resurgence in other parts of the world, while its operational capabilities are developing.
Since January 2024, the group has claimed responsibility for a series of high-profile attacks around the world, from Iran and Russia to Germany and the United States.
"The group remains a persistent global security threat and the deadliest terrorist organization in the world," Adrian Shtuni, a security expert and director of Washington-based consulting firm Shtuni Consulting, told RFE/RL.
"Now the organization relies primarily on a dynamic network of regional branches that operate independently," he added.
What is the current state of the 'Islamic State'?
The group's vision and ambitions have not changed, but, according to analysts, it has undergone a radical structural and operational transformation following its territorial defeat in 2019.
In recent years, various ID companies have emerged around the world, especially in regions where counter-extremism capacities are limited.
Colin Clark, director of policy and research at the New York consulting firm Soufan Group, says the IS has become an organization whose parts are stronger together than the whole.
"The 'Islamic State' could pose an even greater threat as a decentralized organization than it was as a proto-state. While it was running a proto-state, it was a big target," Clark told Radio Free Europe (RFE).
In the past year, IS and its affiliates have made their presence felt through deadly attacks around the world.
In January 2024, twin suicide attacks in the Iranian city of Kerman claimed about 100 lives.
Two months later, four attackers attacked the Crocus City Hall concert hall near Moscow, killing 145 people in a mass attack that included shootings, knife attacks and arson.
In August, a suicide attack in the Somali capital, Mogadishu, killed at least 20 people. A few days later, an IS member stabbed festivalgoers in Solingen, Germany, killing three people.
The group's reach extends as far as the United States. On New Year's Day, an ISIS-inspired attacker drove a truck into a crowd celebrating New Year's Eve in New Orleans, killing 14 people and injuring dozens more. The attacker, Shamsud-Din Jabar, a Texas-born U.S. Army veteran, was killed by police.
"These attacks testify not only to the continued appeal of IS's version of terrorist violence, but also to the resilience, adaptability and global reach of this organization," said Štuni.
According to data from London-based intelligence security firm Dragonfly, IS and its affiliates have carried out an average of 600 attacks per year over the past three years.
While that's a decrease from an average of 770 attacks per year in the previous three-year period, these incidents are becoming increasingly deadly – the number of victims per attack has increased by 40 percent, according to Dragonfly's TerrorismTracker database.
According to the data, one cannot necessarily speak of a resurgence of IS (and its branches) in recent years, but rather of a certain degree of resilience, Dragonfly told Radio Free Europe (RFE). "However, international media are expressing concern about IS's intention to increase the number of attacks with large numbers of casualties globally," the security intelligence group added.
Where are the extremists active and how do they recruit?
Through its companies, the group maintains a strong presence and level of engagement in specific hotspots in Africa, Asia, and the Middle East. One group that has emerged as one of the most active companies is the Islamic State-Khorasan Province (ISKP), which has expanded its operations beyond Afghanistan and is attracting militants from Central Asian countries, particularly Tajikistan and Uzbekistan.
Meanwhile, Somalia has become a key point for the group's global expansion in Africa. The group is exploiting instability in Somalia to establish strongholds and networks that attract militants from Ethiopia, Sudan and Tanzania, while expanding its ideological reach into multiple languages such as Amharic and Swahili.
But the group is also growing rapidly in the Sahel, where the Islamic State West Africa (ISWA) remains one of the dominant terrorist organizations in the Lake Chad region.
Recruitment takes place not only in the field, but also online.
"In the digital space, IS continues to use social media and encrypted messaging tools very effectively to spread its ideology, radicalize, recruit, raise funds, and plan attacks," Štuni said.
He highlighted the recent spate of IS-inspired attacks in Europe, which he said showed three worrying trends: that radicalisation is largely taking place online, that it is happening at an accelerated pace, and that it is increasingly involving minors and young adults.
"The online space requires a lot of attention, especially as military operations have been somewhat scaled back... compared to... the global war on terrorism," Lukas Weber, senior analyst at Tech Against Terrorism, told RFE/RL.
How does the group finance its operations?
The group maintains financial resilience through diverse revenue streams and evolving tactics.
Despite losses in leadership, the core hub in Iraq and Syria still holds between $10 million and $20 million in reserves, while regional companies generate funds through kidnapping for ransom, extortion, taxes and robbery, according to U.S. Treasury Department reports from last year.
At its peak, when the group controlled large swaths of territory in Iraq and Syria under its self-proclaimed caliphate, oil sales were its dominant source of revenue. But IS now depends on criminal activity and local exploitation to generate revenue.
In Africa, companies like the "Islamic State - Somalia" are extorting millions from businesses and financial systems.
In Asia, ISKP initially suffered a blow when its financial network was disrupted by the arrests and killings of key intermediaries across the Middle East. However, it recovered by shifting to virtual resources to fund external operations, including the attack on Crocus City Hall.
Global connectivity remains crucial, as ISIS increasingly uses cryptocurrencies to transfer reserves and donations. The group's financial sustainability depends on maintaining safe havens, evading financial controls, and maintaining global networks.
How are efforts to combat terrorism progressing?
The global record of terrorism requires multilateral cooperation in the fight against terrorism, which means that countries must share intelligence, coordinate strategies, and strengthen security capacities in regions most vulnerable to extremist activities.
If any of these factors are absent, opportunistic extremist groups like ISIS find ways to thrive, as was the case in Afghanistan after the US withdrawal and in the Sahel in Africa after France's gradual withdrawal from the region.
In the Sahel region, the withdrawal of French forces has also resulted in a shift in regional alliances.
"The military regimes installed in Burkina Faso, Niger and Mali after recent military coups have attempted to fill the vacuum in counterterrorism efforts by turning to Russia, which has significantly increased its influence in the region," Stuni said.
The United States continues to lead global efforts to combat terrorism alongside regional partners, as demonstrated by recent attacks on IS targets in Iraq, Syria, and Somalia.
This month, the US-led coalition helped Iraqi forces kill Abdullah Maki Musleh al-Rif, known as Abu Qadi. The Iraqi government described him as "one of the most dangerous terrorists in Iraq and the world" and he was the leader of IS in Iraq and Syria.
However, there is growing concern that shifting priorities in Washington could make the global fight against extremism more difficult "as it becomes clear that the US is shifting its focus inward and rethinking its role on the global stage," Stuni warned.
General Michael E. Kurila, commander of the US military's Central Command, said that thousands of IS fighters being held in Syria in facilities protected by the Kurdish Syrian Democratic Forces represent "a literal and figurative [IS] army in custody" and warned of dangers "for the region and beyond" if large numbers of them escaped.
Kurila said during a visit to Syria in January - a month after the fall of Syrian dictator Bashar al-Assad - that the US military "remains committed to our mission, to our people, to the lasting defeat of [IS] and to stability in the region and beyond."
Devora Margolin, a senior fellow at the Washington Institute, told RFE/RL that IS is "playing a waiting game" in Syria.
"Their intention is to exploit the insecurity of the new Syria to destabilize the situation and impose their agenda," Margolin said.
Clark of the Soufan Group, on the other hand, said that the absence of a US presence in Afghanistan after the 2021 withdrawal has left a "major intelligence gap" in the fight against IS.
"The US is forced to rely on signals intelligence, and they have extremely limited human intelligence in Afghanistan," he said.
Clark described IS as "a much different organization than it was seven years ago, when it still had a caliphate," saying it was now "far more dependent on external operations and attacks to generate publicity."
"They have deliberately changed their strategy to focus on launching high-profile attacks in the West," he said. "They have been aggressive and relentless in their plans and are determined to carry out a spectacular attack in Europe or the United States."
Bonus video:
