Online radicalization, lone-actor violence, and Iran-linked networks are placing European security services under pressure from distinct but increasingly simultaneous threats
The deadly attack near Berlin’s Pride celebrations in late July reopened a difficult question for European authorities: How should security institutions assess individuals whose commitment to extremist violence is visible online but has not yet developed into a specific, detectable attack plan?
IOn July 25, a man drove a van into a crowd near the closing events of Berlin’s Christopher Street Day, one of Europe’s largest LGBTQ+ Pride celebrations. Investigators say the suspected attacker then continued on foot and was later found armed with a machete. A Polish woman was killed, and at least 29 people were injured. The 21-year-old suspect, Abdul Ballout, was killed the following day during a confrontation with police. German federal prosecutors subsequently confirmed that investigators had recovered a video in which a masked individual believed to be Ballout announced his intention to carry out an attack and pledged allegiance to the Islamic State (ISIS).
The attack was not directed or operationally coordinated by ISIS, based on information publicly disclosed so far. It nevertheless reflects a model of violence that has become increasingly central to the jihadist threat in Europe: an individual radicalized through propaganda, acting with accessible weapons and apparently without requiring sustained contact with the organization’s central leadership.
This distinction matters because Europe is not necessarily witnessing a return to the coordinated, high-casualty campaigns associated with the Islamic State’s territorial expansion between 2014 and 2017. The more immediate threat is dispersed across individuals and small groups whose ideological formation, communication and sometimes operational preparation take place largely online.
“What we are observing in Europe is not so much a return to jihadist terrorism in the form we experienced between 2014 and 2017, but rather its transformation. This is probably the most important distinction to make,” Daniele Garofalo, an expert on extremist groups and jihadism, told The Media Line.
Europol’s latest terrorism assessment reinforces that conclusion. According to the EU Terrorism Situation and Trend Report 2026 published in July, European Union member states reported 45 terrorist attacks in 2025 and 486 terrorism-related arrests. Jihadist terrorism accounted for 24 of the attacks and 347 arrests. Most attacks and plots involved lone actors or small, self-initiated cells using relatively simple methods.
The imbalance between arrests and successful attacks does not necessarily indicate that the threat is expanding at the same rate as arrests. It may also demonstrate that intelligence and police services are intercepting suspects during the preparatory phases, including while acquiring materials, conducting surveillance, disseminating propaganda or attempting to contact foreign organizations.
“This might appear paradoxical, but in reality it indicates that European authorities are intercepting a significant part of the threat before it materializes,” Garofalo said. “The increase in arrests does not necessarily mean that terrorism has suddenly surged, but that there is an active base of radicalization that security forces are monitoring more effectively.”
European authorities are intercepting a significant part of the threat before it materializes
The Berlin case, however, illustrates the limitations of prevention when warning signs do not produce a sufficiently clear assessment of imminent intent.
German prosecutors said Ballout had published prohibited Islamic State propaganda on Instagram twice in June 2024. In 2025, he traveled to Lebanon while allegedly intending to reach Syria and join the organization. He was detained in Lebanon before returning to Germany, where he was arrested and held in pretrial detention.
In May 2026, a juvenile court convicted him and imposed a sentence of one year and 10 months for preparing a serious act of violence endangering the state and for offenses involving prohibited ISIS propaganda. The court postponed for six months a final decision on whether the sentence would be suspended, released him under the supervision of a probation officer and lifted the existing arrest warrant. It took into account his time in detention, his confession, his stated distancing from ISIS and the absence of a concrete threat resulting from the offenses. Prosecutors appealed, seeking a longer sentence that could not be suspended and the continuation of his detention.
For Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, the case demonstrates how online activity may be underestimated when assessed in isolation from the broader process of radicalization.
“The Berlin Pride attack underscores the enduring threat of ISIS-inspired violence, where propaganda consumed and shared online sustains ideological commitment independent of any operational command link to ISIS leadership,” Webber told The Media Line.
He continued, “The attacker had been convicted of publishing Islamic State propaganda online, yet received a suspended sentence because judges weighed his confession and apparent distancing from the group against the fact that no concrete threat had materialized, a judgment his subsequent actions have now overtaken.
Ballout’s precise legal sentence was more complex than a suspended sentence that was immediately finalized, because the court had postponed that decision for six months. The central issue raised by Webber nevertheless remains: how much evidentiary weight should courts and security services assign to the repeated production, consumption or distribution of extremist propaganda when no specific target or operational plan has yet been identified?
“That gap between digital activity and perceived risk is the core problem: online propaganda sharing is too often treated as a lesser offense, a symptom to be monitored rather than a direct indicator of intent, when in practice it is frequently the only visible marker of radicalization before an individual moves to violence,” Webber said.
That gap between digital activity and perceived risk is the core problem
Europol has identified the same digital environment as a central component of contemporary terrorism. Its 2026 report states that online platforms allow extremist actors to reach, recruit and mobilize large audiences while coordinating activity both online and offline. Algorithmic distribution can amplify extremist content, while initial exposure on mainstream services may lead users towards closed groups and encrypted platforms containing more explicit material. Young and vulnerable individuals are considered particularly susceptible.
Among jihadist suspects, Europol found that most arrested individuals had been inspired by ISIS propaganda, although direct organizational connections were less common. Radicalization often began with user-generated jihadist material on social networks, youth-oriented platforms or gaming environments before moving towards more secure communications.
“In recent years, the distinction between propaganda and operational planning has become increasingly blurred,” Garofalo said. “Many individuals begin by consuming extremist content, gradually come into contact with digital networks, establish relationships with online facilitators and, in some cases, eventually begin preparing an attack. The radicalization process is far more individualized than it was in the past and often does not pass through clandestine mosques or structured territorial networks.”
This transformation also affects attack methods. Complex, coordinated operations require communications, financing, logistics, and personnel, which increase the likelihood of detection. Vehicles, knives, improvised weapons and arson require fewer resources and can be deployed with limited preparation.
“The relatively limited number of successful attacks should not be interpreted as an indicator that the threat is low,” Garofalo said. “On the contrary, it also reflects the high effectiveness of the preventive work conducted by intelligence services, counterterrorism units and international cooperation. Many plots are disrupted during their initial stages, when individuals are still acquiring materials, carrying out reconnaissance or communicating with other extremists.”
The Berlin attack has not been connected to Iran, Hezbollah, Hamas or any Iranian state structure. Conflating ISIS-inspired terrorism with Iranian or Iran-aligned operations would obscure significant ideological and operational differences.
Its relevance to the wider Iran-Israel-United States conflict lies instead in the cumulative burden on European security services, which must now monitor several distinct threat environments at once.
The war has intensified propaganda, political polarization and threats against Jewish, Israeli, Iranian opposition and Western targets. Europol has warned that groups linked to Iran’s regional network could seek to conduct destabilizing activities in Europe, potentially including terrorism, intimidation, financing and cybercrime. The agency also warned that the rapid spread of polarizing material could accelerate short-term radicalization among individuals and diaspora communities.
According to the EU’s 2026 terrorism report, pressure on Iran and its proxy network could generate more direct threats inside Europe. While Iran-aligned organizations had historically used European territory primarily for fundraising and logistical activity, Europol warned that some could increasingly consider attacks against Jewish, Israeli or other targets. The report also referred to indications that Iranian actors and proxies had used criminal networks in incidents across several member states.
In February, the European Union formally added Iran’s Islamic Revolutionary Guard Corps to its terrorism list, subjecting the organization to asset freezes and restrictions on access to economic resources inside the bloc. Britain has separately sanctioned individuals and entities allegedly connected to an Iran-linked criminal network accused of planning attacks and facilitating hostile activity. Tehran has repeatedly denied involvement in attacks and plots in Europe.
These developments represent a different security model from the largely self-directed ISIS supporter. Iran-linked activity may involve state intelligence structures, proxy organizations, financial networks, surveillance operations, criminal intermediaries and deniable acts of violence. Yet both threat environments may exploit similar vulnerabilities: encrypted communications, decentralized online recruitment, informal financial channels and individuals who initially appear peripheral to organized terrorism.
“The traditional jihadist threat has recently been joined by an additional layer of risk linked to the growing tensions among Iran, Israel and the United States,” Garofalo said.
“European authorities have intensified their monitoring of individuals connected to the Iranian apparatus, Hamas, Hezbollah and other affiliated organizations, not only because of the risk of attacks but also because of intelligence activities, surveillance, financing and logistical support. This is a different threat from the one represented by the Islamic State or al-Qaeda, but it is potentially complementary.”
The word “complementary” does not necessarily imply cooperation between ideologically hostile organizations. ISIS has repeatedly portrayed Iran and Shiite groups such as Hezbollah as enemies. Rather, it describes the cumulative pressure placed on European institutions when several unrelated networks operate within overlapping digital, financial and criminal ecosystems.
International conflicts also offer extremist movements a constant supply of images and grievances that can be reframed for recruitment. Europol found that conflicts in the Middle East continued to be exploited in 2025 by jihadist, far-right, left-wing and other violent extremist actors, sometimes contributing to threats or attacks against Jewish and Muslim communities.
The challenge for European governments is therefore broader than identifying members of a particular organization. They must distinguish between lawful political expression, possession or dissemination of illegal propaganda, ideological commitment and concrete preparation for violence—often on the basis of fragmented digital evidence and before a suspect has selected a target.
Webber said the case shows why authorities should maintain long-term scrutiny of people with documented histories of creating or circulating extremist material, rather than ending monitoring at conviction or release. In his view, online expressions of ideological commitment can persist despite apparent remorse or claims of disengagement and should remain part of risk assessments.
“Platforms, courts, and security services all have a stake in closing that gap, treating sustained online extremist activity as a persistent risk factor rather than a resolved one once a sentence is served,” he said.
Platforms, courts, and security services all have a stake … in treating sustained online extremist activity as a persistent risk factor rather than a resolved one once a sentence is served,
Such monitoring also raises questions of proportionality, judicial oversight and the allocation of limited counterterrorism resources. Not every individual who views or shares extremist material will proceed to violence, and treating digital consumption alone as proof of operational intent risks weakening legal safeguards and producing assessments that are too broad to be effective.
The Berlin attack nevertheless demonstrates the consequences of the opposite failure: dismissing online extremist behavior as peripheral when it may be the clearest available evidence of an individual’s ideological trajectory.
Europe’s emerging security environment is not defined by a single organization or a single conflict. It combines persistent Islamic State inspiration, increasingly individualized radicalization, Iran-linked state and proxy activity, and the exploitation of geopolitical crises by multiple forms of extremism.
It is less reminiscent of a single, organized terrorist campaign than of a fragmented, continuous threat environment. The principal test for European institutions will be whether they can identify when digital allegiance becomes operational intent—without conflating distinct actors, criminalizing communities or waiting until the final stage of radicalization becomes visible through violence.
![A protestor lifts a mock drone with flags of Yemen and Palestine under a billboard depicting the picture of targeting an Israel-linked ship by Yemen's Houthi forces in the Red Sea, during a demonstration staged against the latest aerial attacks hit Yemen's port city of Hudaydah by Israel and its ongoing war on Palestine, on July 26, 2024, in Sana'a, Yemen. [Mohammed Hamoud/Getty Images]](https://i0.wp.com/www.middleeastmonitor.com/wp-content/uploads/2024/09/GettyImages-2163838063.jpg?fit=920%2C613&ssl=1)
