The ConversationNo. 9 · Jihadist threat

Islamic State’s core has been degraded, but its African affiliates are building routes into Europe. The Berlin Pride attacker’s journey shows how.

By TiNYg Editorial · 6 November 2026

It is easy to read the past two years as a period of Islamist decline in the West: fewer directed plots, more lone actors, a terrorist landscape dominated by teenagers and state proxies. That reading is dangerous. Islamic State arguably remains the most likely source of a mass-casualty attack in Europe, and the geography of the threat is shifting south.

The Berlin case

In an October 2026 analysis for Lawfare, Lucas Webber, Peter Smith and Colin Clarke traced the path of Abdul Ballout, who attacked Berlin’s Pride celebration in July (see article 7). In May 2025 he tried and failed to reach Mauritania, reportedly to join Islamic State in Mali. He then went to Lebanon hoping to reach Syria, was arrested and jailed, returned to Germany, and was convicted in May 2026 of preparing a serious act of violence. He received a suspended sentence. Two months later he attacked.

The authors argue Ballout did not simply radicalise online in isolation. He was moving along a pipeline that Islamic State Sahel Province (ISSP) has deliberately built.

The corridor

Since France’s withdrawal from Sahelian military operations in 2022 to 2023, ISSP has developed a logistics route from Mali, Niger and Burkina Faso through Morocco and into Spain, using existing smuggling networks and diaspora communities. Moroccan authorities have dismantled a series of ISSP-linked cells, including a Tangier-Mallorca network in March 2026 that financed fighters while allegedly planning an attack in Spain, and a cell in July 2026 that held explosive-related material and a modified vehicle intended for a suicide or ramming attack. Islamic State propaganda now names Morocco, Tunisia and Spain as targets.

The recurring pattern, the authors note, is a failed journey to a war zone followed by redirection to attack at home. That is precisely the profile of the “frustrated traveller” European services struggled with in 2015 to 2017.

The other fronts

Islamic State Khorasan Province (ISKP) remains the most externally focused branch, with plots across Germany, France, Austria, Sweden and Belgium since 2020. In June 2026 Europol announced a multinational operation targeting ISKP-affiliated individuals of Chechen and Central Asian origin. In Syria, open-source monitors note an absence of official IS claims through mid-2026 alongside continued local violence, which suggests clandestine reconstitution rather than defeat. And one of the deadliest IS-inspired attacks of the period, the Bondi Hanukkah shooting that killed 15 in December 2025, was far from any of these theatres.

The professional view

For private-sector security, the lesson is not to plan for one ideology at a time. Under a SEVERE threat level, Islamist terrorism remains the primary threat by volume in the UK, and its attack methods (vehicles, knives, firearms where available, and occasionally IEDs) are the ones Martyn’s Law procedures are designed for. Organisations with operations in Spain, Morocco, the Sahel or the Gulf should treat the corridor as a live consideration in travel and site risk assessments.

What to do now

The Conversation is TiNYg’s members’ blog. Members and premium partners are invited to respond to, extend or challenge this article. Get in touch to contribute.

◀ Back to The Conversation newsletter: all 12 articles