The security landscape in Syria reveals a clear decline in the new Syrian government’s ability to assert control following the fall of the Assad regime, amidst a notable surge in Islamic State (ISIS) attacks. Field data indicates that the government’s mismanagement of the security portfolio and detention centers has enabled the group to resume its operations, shifting its activity from desert regions to striking fortified positions within urban centers.
A Formal Merger and Loss of Control Over Detention Centers
Data published by the Armed Conflict Location & Event Data Project (ACLED) confirms that the military deployment of government forces earlier this year was accompanied by a fundamental security flaw. In January and February 2026, following the agreement to merge the Syrian Democratic Forces (SDF) with government forces—a process that was not actually implemented on the ground and remained theoretical without genuine operational coordination—government forces assumed the administration of sensitive detention facilities holding ISIL members. The most prominent of these are the al-Hol and al-Shaddadi camps in al-Hasaka Province, and al-Aqtan Prison in Raqqa.
Taking over these sensitive facilities without security readiness and prior planning, coupled with the absence of actual field coordination, led to severe security gaps during the handover operations. This resulted in the escape of a large number of key ISIL members and active commanders. This administrative and security failure provided the “Islamic State” with the human resources necessary to rebuild its supply networks and launch intensive attacks across northern and northeastern Syria during the first quarter of 2026.
Attacks Focused on Government Forces
Documented statistics indicate that the group exploited the weak government deployment to intensify its direct strikes. ACLED recorded 83 political violence events involving the group between 1 January and 20 June 2026, with armed clashes accounting for 80% of them.
These attacks have been entirely concentrated on government forces starting from February. They were targeted in 52 attacks during the first half of the current year, compared to only 16 attacks throughout 2025. The operational map distributed these attacks as follows: Deir ez-Zor accounted for 50% of the attacks, followed by Raqqa with 20%, while Aleppo emerged as a new front recording 15% of the incidents (12 attacks). This reflects the failure of government apparatuses to secure the newly deployed areas.
Breaching Security Fortifications
The government’s security shortcomings were not limited to peripheral areas but extended to fortified sites. During the current month of June, the group carried out attacks targeting government and police forces, including an assault on a fuel tanker near Manbij, operations against personnel in Damascus and Raqqa, and culminating in the killing of two army soldiers in the village of Salha in the Manbij countryside on 20 June.
The Raqqa operation on 15 June serves as a clear indicator of the declining security effectiveness of government facilities. The group used suicide explosive belts for the first time since December to target a police headquarters, resulting in the deaths of two officers and injuries to three others.
In this context, Muaz Al Abdullah, Middle East Research Manager at ACLED, explains that the group’s targeting of this fortified security facility in the western sector of Raqqa carries tactical objectives. The group opted to bypass softer targets in order to strike heavily guarded ones, aiming to demonstrate the weakness of government defenses and showcase its ability to breach them—a tactic that actively serves the group’s recruitment efforts.
Potential Expansion and Escalating Bombings
Given the current government disarray and the absence of any actual security campaigns to curb the group’s activities, assessments indicate that the failure to close these security gaps will lead to severe repercussions in the near term. As this operational weakness persists, ISIS is expected to successfully expand its territorial control and operational scope, moving beyond its traditional areas of activity.
This organizational expansion will inevitably be accompanied by an escalation in offensive tactics. Current indicators warn that the upcoming phase will witness a noticeable increase in the frequency of bombings using improvised explosive devices (IEDs), vehicle-borne improvised explosive devices (VBIEDs), and double suicide operations within urban centers and government headquarters. In addition to pressuring city centers, the group will continue to exploit the weak government military coverage to strike strategic targets in peripheral areas, most notably the oil supply routes coming from Iraq. This places the stability of the entire country under a growing security threat that current government apparatuses are simply incapable of containing.