ISIS Attacks on Syrian Forces Rise to 52 in 2026, Revealing Security Vacuum After U.S. Withdrawal

On June 26, the figure published by the ACLED Observatory regarding Syria was not just a new statistic in an old war ledger. The rise in ISIS attacks against Syrian government forces from 16 attacks in 2025 to 52 attacks in the first half of 2026 means that the organization is no longer just testing the edges, but is testing the state itself. Just two days after CENTCOM announced the death of leader Ali Hussein Al-Alawi in a precision strike on June 19, the picture becomes clearer: Washington is still capable of killing a specific leader, but Damascus remains unable to close the vacuum within which smaller leaders and local cells operate.

Militarily, this is not a return to the caliphate of 2014, and this term should not be used lightly. ISIS today does not control major cities, armored columns, or have a public ability to govern Raqqa or Mosul. However, it possesses something more dangerous in a weak state phase: freedom of movement in the countryside, local intelligence, smuggling networks, and fighters, some of whom have emerged from prisons or from camps that have lost oversight. The old soldier knows that the danger does not begin when the adversary raises a flag over the governor's building, but when they can reach the police station with a suicide vest without being stopped.

Numbers That Change the Perspective

According to The National, ACLED recorded a total of 274 politically motivated violent events related to ISIS in Syria in 2025, of which 203 were directed against the Syrian Democratic Forces, and only 16 against government forces. In the first half of 2026, the trend changed: 70 attacks by the organization, 52 of which were against government forces, and only five against the SDF. This shift indicates that the organization has not only become stronger but that its target has changed with the shifting control map.

After the fall of Bashar al-Assad's regime in December 2024 and the expansion of Damascus's new authority into areas previously held by the SDF, the government inherited vast territory without adequate security apparatus. Controlling the map in news bulletins is one thing, while controlling dirt roads, villages, and nighttime checkpoints is another. If Raqqa has only about 20 percent of the required police force, as researcher Muath Al-Abdullah told The National, it is not surprising that the organization sees an operational opportunity that does not require missiles or drones, but rather two men with suicide vests.

The Raqqa Attack Was a Warning, Not an Isolated Incident

On June 15, ISIS fighters targeted the main police headquarters in Raqqa, killing two police officers and injuring three others. The details are more important than the number of casualties. Two fighters entered towards an exposed security target, both wearing suicide vests, one was killed before the explosion and the other detonated himself. Any military personnel who served in the area knows that this type of attack requires not only volunteers willing to die but also reconnaissance, surveillance, knowledge of the guard routine, and perhaps a silent environment that does not want to cooperate with the state or does not trust that it can provide protection.

Here, the triangle of capability I always talk about emerges: equipment, training, and institution. Damascus may receive information from the Americans, may conduct joint raids, and may show new vehicles for security forces in the cities. But without sufficient local police, clear chains of command, and discipline at checkpoints, the equipment becomes mere decoration on an open road. In internal security, a rifle alone does not make a state. A state is made by the patrol that the residents know, the informant they trust, the judge who holds them accountable, and the officer who does not sell the checkpoint to the highest bidder.

CENTCOM Strikes the Target but Does Not Close the Environment

CENTCOM's announcement of the killing of Ali Hussein Al-Alawi in a precision strike on June 19 is significant because it proves that the American targeting network is still operational despite the closure of remaining U.S. bases in Syria in April. As Defense News reported, this came amid a confused security landscape following the closure of bases, the escape of about 150 ISIS detainees at the beginning of the year, the transfer of more than 5,000 detainees to Iraqi facilities, and the exit of up to 20,000 residents from the al-Hol camp without adequate oversight.

But this is the old American paradox in the Levant. The United States can kill a leader at a precise moment, but it cannot replace the Raqqa police officer or the village mayor in eastern Deir ez-Zor. An airstrike cuts a branch, while the local vacuum reproduces the root. Therefore, CENTCOM's tactical success does not negate the failure of the local security system to prevent the organization from reorganizing. Practically, Washington has the eye of the hawk, and Damascus needs the soldier's foot on the ground.

Deir ez-Zor and Its Countryside Are the Real Center of Gravity

The organization's movement is concentrated in central Syria and the eastern countryside of Deir ez-Zor, with some activity shifting towards the Aleppo area, where 12 incidents were recorded in the first half of the year. This is not a geographical coincidence. Eastern Deir ez-Zor suffers from weak services, poverty, open roads, and social boundaries not drawn by official maps. When residents say that some farmers paid taxes to the organization until recently, it means that ISIS is not only imposing itself through fear but is also exploiting the absence of the state to become a shadow authority.

In my estimation, the danger here is not that the organization will control a large city tomorrow, but that it will reach a position where it can choose the time and place of the attack without high costs. An attack on a checkpoint, the assassination of a local official, the bombing of a security center, and then disappearing into the countryside. This is a low-cost attrition model, perfectly suited for an organization that has lost the state but retained its doctrine and organizational memory.

The New Syrian Government Faces a Test of Security Legitimacy

President Ahmad al-Shara wants to present his government as a reliable partner in the fight against terrorism, especially in front of Washington and Arab capitals that fear a return to chaos. The problem is that legitimacy in combating ISIS is not granted by conferences or photos with coalition officers, but by daily security in Raqqa, Deir ez-Zor, and Aleppo. If the areas that transitioned from SDF control to government control remain less secure than they were, the organization will use that as both propaganda and a weapon.

It must be said that some capitals may not like: security cooperation with the United States is necessary, but it is not sufficient. Relying solely on precision strikes is like relying on a surgeon to treat a disease caused by a lack of clean water. Every successful strike delays the danger, but it does not eliminate the reasons for its return. What is needed is not just to purchase more surveillance equipment, but to build local police, pay regular salaries, restore services, and connect the elders of Deir ez-Zor and Raqqa with a governing center that does not treat them as reclaimed land but as a community that must be won over.

Conclusion

The rise of ISIS attacks to 52 against government forces in half a year is an early test for the Syrian state after Assad. The organization does not need a major victory to succeed; it is enough for it to prove that the government cannot protect its security centers or its rural roads. As for Washington, it will continue to kill leaders when their names appear on the targeting screen. Between a successful airstrike and an incomplete police patrol, Syria stands before its true contradiction: it can quickly reclaim land, but it cannot restore the state at the same speed.