Failed journeys to foreign conflict zones can redirect radicalized individuals toward targets in their own countries
The July 25 attack near Berlin’s Pride celebrations brought Europe’s changing Islamic State threat into sharp focus. German authorities said 21-year-old Abdul Ballout drove a van into a crowd and attacked people with a bladed weapon, killing one person and injuring 29 others before police fatally shot him the following day.
Investigators said they found a video on Ballout’s phone in which a masked person appeared to pledge allegiance to Islamic State (IS). Authorities believed the person in the video was Ballout, who had previously been convicted over attempts to travel abroad to join the organization, including unsuccessful journeys in 2025.
The case raised a familiar but increasingly complicated counterterrorism question: What happens when a person attracted to an extremist organization fails to reach the conflict zone?
In some cases, the focus just shifts closer to home
For Kiria Borak, a security analyst focused on West Africa and the Sahel, preventing the journey does not necessarily remove the underlying risk.
“I think the Berlin attack follows a pattern we keep seeing: an individual tries to reach a conflict zone, gets stopped before they arrive, but that does not mean the threat disappears or is necessarily well managed. In some cases, the focus just shifts closer to home,” Borak told The Media Line.
She said the expansion of IS theaters and the links between them can become a European security issue even when those drawn to the organization never reach the battlefield.
Europol’s latest terrorism assessment, released in July, recorded 45 terrorist attacks across 10 European Union member states during 2025, including 24 classified as jihadist. Of the 486 suspects arrested for terrorism-related offenses, 347 were linked to jihadism. Europol also warned that online environments increasingly allow dispersed networks, lone actors, and self-initiated cells to radicalize and mobilize without the large organizational infrastructure once associated with terrorist groups.
European authorities are also confronting networks whose operational roots lie far beyond the continent.
Between June 1 and 5, Europol coordinated a counterterrorism operation with eight European law enforcement agencies and the FBI targeting Islamic State Khorasan Province (ISKP) and its support networks in Europe. Europol said the operation resulted in several arrests but did not disclose a precise number. It focused particularly on individuals of Chechen and Central Asian origin and examined travel routes extending through Europe, South America, and the US.
Lucas Webber, a senior research fellow at The Soufan Center, said the operation illustrated an important distinction between pressure on ISKP inside Afghanistan and Pakistan and the branch’s continued international reach. Webber’s research focuses in part on Western domestic terrorism, extremist propaganda, and violent nonstate actors in South and Central Asia.
“I think the Europol-FBI joint efforts against ISKP are quite significant due to the branch’s activity declining in Afghanistan and Pakistan, where it primarily operates. The new UN monitoring report notes the decrease in activity in the actual conflict theater, but these arrests show that there are still robust international networks,” Webber told The Media Line.
The branch still has external operations capabilities, propaganda production, financing, fundraising, and influence networks outside of its actual area of provincial operations
“The branch still has external operations capabilities, propaganda production, financing, fundraising, and influence networks outside of its actual area of provincial operations,” he added.
That assessment broadly corresponds with the UN Security Council’s Thirty-Eighth Report of the Analytical Support and Sanctions Monitoring Team, published Aug. 10, 2026, and covering developments through June 9. The report said counterterrorism operations by Pakistan and the Taliban had dealt ISKP serious setbacks and reduced its attacks in Afghanistan, although its attacks increased in Pakistan. It assessed that the branch remained intent on conducting operations abroad and retained the ability to carry out occasional high-profile mass-casualty attacks.
The report found that the broader threat from IS and al-Qaida had intensified in the Sahel and South Asia, with regional affiliates assuming greater importance as the organizations’ senior leadership became more geographically dispersed.
Webber said that geographic dispersion makes the threat difficult to assess solely through the traditional measure of battlefield strength.
“The roll-up of this network, the arrests and so on, show that it is still a security concern. There is still an active threat posed, but the mainstream media attention or political statements made publicly don’t align with, or are not proportionate with, the actual threat posed by ISKP and other groups,” he said.
Africa has become another focus of concern.
The Sahel is now one of the principal areas of expansion for jihadist organizations, including IS affiliates and al-Qaida-linked Jama’at Nusrat al-Islam wal-Muslimin (JNIM, meaning “Support Group for Islam and Muslims”). The Soufan Center said in a June assessment that IS had entered a new phase in the region as it sought to consolidate its West Africa and Sahel provinces.
The implications are not confined to the territory those groups control or contest.
North Africa provides a clear example of how Sahel-based networks can extend beyond their immediate region. In February 2025, Moroccan authorities arrested 12 suspected members of an IS-linked cell across nine cities. Authorities said the group was preparing attacks inside Morocco and had links to an IS figure operating in the Sahel. Investigators found weapons, explosive materials, and other equipment.
“Morocco is probably one of the places where this has been clearest,” Borak said. “Moroccan authorities have repeatedly dismantled networks with links to the Sahel that were also involved in planning or facilitating attacks closer to home.”
Networks extending from the Sahel into North Africa do not automatically become operational networks in Europe. Still, the movement of people, financing, propaganda, and facilitators across those regions requires European authorities to monitor developments well beyond the EU’s physical borders.
Webber said there are signs that the IS branch in the Sahel is assuming a larger role beyond its immediate battlefield.
“Islamic State in the Sahel remains largely regionally focused, of course, but it is taking on a greater external-operations role,” he said.
Authorities have disrupted plot cells and support networks connected to the branch in Morocco and Spain, he said.
“You are seeing increased online chatter, for instance, about Western foreign fighters wanting to join Islamic State, and they are being referred increasingly to Islamic State in West Africa, in the Sahel, and in Somalia,” Webber said.
Somalia presents a somewhat different model.
The UN Security Council’s Aug. 10 monitoring report estimated that IS’s Somali branch had between 150 and 250 fighters, primarily concentrated in Puntland’s Cal Miskaat mountains. The estimate represented a sharp decline from figures reported before Puntland began its sustained counterterrorism campaign.
The report said the movement of foreign fighters into Puntland had declined and that IS was discouraging prospective recruits from traveling there. It warned that migration routes and illicit transit networks previously used by the organization could be reactivated if counterterrorism pressure weakened.
Puntland forces have mounted a sustained offensive against IS positions in the Cal Miskaat mountains, recapturing territory and bases. The US and the United Arab Emirates have supported the campaign with airstrikes, including attacks targeting senior IS members.
Borak cautioned against treating Somalia and the Sahel as identical recruitment environments.
“I think the Somali branch of IS is a somewhat different case. Its ranks have become increasingly international,” she said.
“Puntland’s campaign against the group has turned up foreign fighters from multiple countries, including Ethiopia and Morocco, suggesting a recruitment network that extends beyond Somalia,” she added.
“While there is some evidence of international recruitment, a lot of what we see with the Sahelian groups is still primarily local recruitment, with facilitation and support networks extending north into North Africa and Europe.”
The evidence does not indicate a simple mass transfer of fighters from Africa toward Europe. Analysts instead describe a layered system in which local insurgencies, foreign fighter movements, online recruitment, financing channels, and international facilitation networks can overlap without being controlled from a single center.
Battlefield losses alone therefore provide an incomplete measure of the threat.
Webber pointed to ISKP after the Taliban returned to power in Afghanistan as an example of how parts of the IS network can assume greater international responsibilities as conditions change.
“After the Taliban takeover, ISKP took on a more prominent operational role in propaganda production, recruitment, incitement, guiding attacks, and external operations,” he said. “It took a while for security coverage and preparations to catch up. And now we are seeing something similar happen with Islamic State networks in the Sahel.”
For European security services, the challenge is one of simultaneity. A threat originating in Afghanistan can coexist with recruitment in Somalia, territorial expansion in the Sahel, facilitation networks in North Africa, and self-radicalized or remotely influenced individuals inside Europe.
There is a broad range of nonstate threats that are tying up resources, and there is always a risk of security coverage gaps and resource gaps being exploited successfully by any one of these groups, or multiple
“There is a broad range of nonstate threats that are tying up resources, and there is always a risk of security coverage gaps and resource gaps being exploited successfully by any one of these groups, or multiple,” Webber said.
