The Rising Islamic State Threat to Europe and the West

Abdul Ballout was a name already known to German authorities in Berlin, though not in the way it might seem. In May 2025, the then-20-year-old German citizen of Lebanese descent made a failed attempt to reach Mauritania, reportedly as part of a broader effort to join the Islamic State in Mali. He subsequently traveled to Lebanon with the same goal, aiming to continue on to Syria. Lebanese authorities arrested him there, and a military court sentenced him to three months for incitement to sectarian conflict. He returned to Germany in November 2025 and was detained again at the airport, later convicted by a Berlin juvenile court in May 2026 of preparing a serious act of violence and disseminating Islamic State propaganda, receiving a suspended sentence. Two months later, in July 2026, Ballout drove a rented van into a crowd at Berlin’s Christopher Street Day Pride celebration and continued the attack with a knife. The attack killed one person and injured 29 before Ballout was shot dead by police.

For Europe, the Sahel is no longer a remote war zone in an austere region but, rather, is slowly developing into a pipeline to Europe, and Islamic State-Sahel Province (ISSP) has evolved from a regional insurgency into a transnational terror hub. Ballout’s trajectory traces the contours of a support corridor that ISSP has constructed, stretching from its core zones in Mali, Niger, and Burkina Faso through northern Morocco into Spain, leveraging smuggling routes, diaspora networks, and online radicalization to recruit, finance, and launch operations on both sides of the Mediterranean. Although the number of volunteers joining ISSP is far smaller than the wave of foreign fighters that traveled from around the globe to join the Islamic State caliphate during its peak, with intelligence agencies and law enforcement focused elsewhere, it does have the potential to produce more terrorist attacks in the West.

Far from an isolated incident, Ballout’s initial failed plan to travel to Mauritania is part of a larger pattern of foreign fighters entering the Sahel that Moroccan and Spanish intelligence have been tracking for years. Since 2025, Moroccan authorities have dismantled multiple ISSP-linked cells, including a Tangier-Mallorca network that funded fighters in the Sahel and Somalia while planning attacks in Spain, as well as a July 2026 cell that stockpiled weapons and a vehicle rigged for a suicide vehicle-borne improvised explosive device or ramming attack. Islamic State propaganda now explicitly calls for attacks in Morocco, Tunisia, and Spain, and investigators in Austria and France have recently uncovered plotters who oscillated between plans to join ISSP and preparations to conduct attacks at home, underscoring how Ballout did not “radicalize online” in isolation as a homegrown violent extremist but was instead part of a pipeline actively cultivated by ISSP.

The Morocco-Spain Corridor

ISSP began as the Islamic State in the Greater Sahara, when it pledged bay’ah (allegiance) to the Islamic State in 2015. It was later incorporated as the Sahelian wing of the Islamic State-West Africa Province (ISWAP) in March 2019. Seeking to establish a caliphate governed by the Islamic State’s interpretation of Sharia, the organization is focused on consolidating its territorial control across its area of operations in Mali, Niger, and Burkina Faso, with an eye on gaining ground in northwestern Nigeria.

While benefiting from logistical support and coordination with the northeastern Nigeria-based ISWAP, the organization maintained its autonomy until it was elevated to provincial status as ISSP in 2022.

Transnational connections have been part of ISSP since its earliest days and the leadership of its first emir, Adnan Abu Walid al-Sahrawi, a longtime Sahrawi militant and grandson of an influential Sahrawi politician. Since al-Sahrawi’s death in 2021, the group has restructured to incorporate a more diverse mix of foreign and local members, as well as leadership from a variety of ethnic and national backgrounds. These include the Fulani, Arab, Tuareg, Dawsahak, Songhai, and Djerma ethnic groups, who often reflect the populations of ISSP’s operational theaters.

ISSP proved dynamic and adaptive in replacing its leadership during punishing French counterterrorism operations, and since the operational tempo ceased when many Sahelian governments ended Paris’s role in military operations between 2022 and 2023, ISSP has established a logistical pathway running from the Sahel to Morocco and into Spain. ISSP uses the route to recruit personnel, move capital, and transport materials, developing it into a crucial external operational corridor. The network’s reach into the Western Mediterranean is vital to its strategic goals of funneling volunteers to its front lines and coordinating operations against enemy states in North Africa and Europe. It is important to note that ISSP relies heavily on existing criminal infrastructure and smuggling routes that it uses for the logistics of terrorism.

In some of its territories, ISSP has adopted a strategy to increase its acceptance among local populations, providing more sustainable avenues for recruiting and fundraising. Often offering itself as a protector to marginalized ethnic groups, such as the pastoral Fula peoples, ISSP effectively capitalizes on resentment in underserved regions toward national governments and other militant groups. United Nations monitoring reports indicate that this approach has increased the group’s power and influence, particularly in Mali.

Increased local support has allowed the organization to focus more of its efforts outward from the Sahel and provide support to other branches of the Islamic State. Part of this external development has been the use of a Morocco-Spain axis, particularly the Tangier–Strait of Gibraltar–Balearic Islands line, as a functional corridor. The route takes advantage of the region’s geography for movement, as the core Sahelian zones used by ISSP to reach North Africa via trans-Saharan smuggling routes create a natural pathway into Europe. With the Strait of Gibraltar serving as a chokepoint, ISSP uses land crossings at Ceuta and Melilla, as well as maritime routes to mainland Spain and the Balearic Islands.

ISSP has already begun to use the corridor to work toward attacks. In addition to the March 2026 arrests of the Tangier-Mallorca cell, a previous operation by Morocco’s Bureau Central d’Investigation Judiciaire (BCIJ) apprehended a 12-man ISSP network known as the “Lions of the Caliphate in the Maghreb,” which was spread across nine cities. Moroccan officials described the group as an effort by ISSP to set up a network inside the country, intended in part to funnel local recruits into the Sahel and Somali conflicts. The group’s other purpose was to operate as a dedicated operational wing, and authorities said that the cell was moving toward carrying out remote bombing attacks as part of a “desire to target Morocco.”

ISSP’s External Operations and Guided Threat Doctrine

ISSP’s core activities in Mali, Niger, and Burkina Faso have centered on local governance: taxation, Sharia enforcement, and control over rural economies. Since 2022, the group has layered a second track onto this model: external operations and foreign fighter facilitation directed at Morocco and Spain. UN and open-source intelligence reporting describes ISSP-linked networks establishing transit corridors between the Sahel and southern Europe, and UN monitoring through mid-2026 confirms sustained cross-border ties between Moroccan networks and Sahel-based ISSP elements, including the March 2026 Tangier-Mallorca cell (three arrests in Tangier, one in Mallorca) for financing fighters in Somalia and the Sahel while planning an attack in Spain. The same reporting period recorded a further six-member cell disrupted in Morocco in April 2026, with recruitment spreading into rural areas beyond prior urban concentrations.

Islamic State propaganda has grown more direct, with editorial content explicitly naming Morocco and Tunisia as targets. Spain’s exposure stems from the corridor’s role in financing and logistics. This fits a guided-plot doctrine in which recruits are instructed to stay in place and attack locally rather than travel to the Sahel, echoing Islamic State Core’s 2015-2017 European attack model, now adapted to African geography and diaspora networks rather than returning Syria-Iraq foreign fighters or so-called “frustrated foreign fighters.”

The March 2026 Tangier-Mallorca cell employed a transnational division of labor, with Morocco-based members reportedly providing financing and logistical support to Islamic State affiliates in the Sahel and Somalia, while a Mallorca-based member was accused of planning an attack in Spain. The July 2026 dismantling of another ISSP-linked cell dispersed across seven Moroccan cities—including the Atlantic coastal cities of Agadir and Safi—revealed a more developed domestic attack capability, with authorities reporting the seizure of explosive-related materials and a modified vehicle believed to be intended for a suicide bombing or vehicle-ramming attack. Together with the dismantling of an ISSP-linked network across nine Moroccan cities in February 2025, these cases provide evidence of repeated efforts by ISSP-linked actors to establish operational networks inside Morocco, placing them in striking distance of Europe’s southern flank.

Moroccan nationals remain among ISSP and the Islamic State-Somalia’s largest foreign fighter cohorts—numbering more than 130 individuals in recent years. Spanish authorities arrested roughly 90 people on suspicion of jihadist-related activity in the first eight months of 2025, some of whom had intended to travel to Mali before pivoting to attack planning inside Spain. Diaspora communities in Spain, built over decades of North African migration, provide a consistent and steady recruitment pool that multilingual propagandists can reach without inserting operatives from abroad, bridging African and European audiences.

The recurring pattern is a blocked or failed journey toward an active theater, followed by redirection toward attack planning at home. French and Austrian cases fit this directly: A French suspect scouted sites throughout Paris after failing to reach Mali, while in Austria, an 18-year-old Islamic State supporter convicted of planning to carry out a terrorist attack also discussed plans to travel to West Africa to join Islamic State fighters. Morocco has earned a reputation as the starting point of the path into ISSP’s area of operations, a fact that is reflected in the arrests made of individuals seeking to mobilize for the Islamic State. In spring and summer 2024, an American man told an FBI informant that he intended to travel to join ISSP and had booked a flight to Rabat, Morocco. He was charged in the United States with knowingly providing “material support and resources” to a designated foreign terrorist organization. In December of the same year, two Moroccan nationals living in Spain were arrested in a joint operation between the two countries as the pair planned to travel to Mali after pledging loyalty to the Islamic State.

French authorities also arrested an Algerian man living in Paris in October 2025 for conspiracy to commit terrorist acts, after he reportedly downloaded tutorials on poison and bomb making, was in contact with members of the Islamic State in Iraq and Syria, and expressed a desire online to travel to the Sahel to fight. He allegedly also posted several images of himself, masked, standing in front of various Parisian landmarks.

Implications for European Security

The emergence of a foreign fighter pipeline between the Sahel to southern Europe has clear implications for European security. To date, European counterterrorism efforts have focused on the Islamic State-Khorasan Province and Middle Eastern remnants of the broader Islamic State network, and less on the threat emanating from the Sahel, despite the steady accumulation of data points suggesting a growing trend. There appears to be only limited visibility into trans-Saharan logistics and a burgeoning Morocco-Spain nexus, with fragmented coordination between the European Union, Moroccan, and Spanish intelligence services, despite the shared challenge of preventing an attack.

Concerns of terrorist infiltration of migrant routes—which occurred with Islamic State foreign fighters that attacked the Bataclan in November 2015—were highlighted again with the flood of Moroccan migrants into the Spanish territory of Ceuta in July 2026. Although the migrants returned to Morocco, Spanish media reported that the security services had identified several individuals who were being investigated for “jihadism-related offenses,” although Spain’s Interior Ministry declined to confirm those reports.

The attack carried out by Ballout in Germany earlier this year was bad, but it could have been far worse. Juveniles or extremists who have maintained a low profile, travel to conflict zones and back, and evade monitoring by the intelligence services pose an ongoing concern. With ISSP’s growing capacity to inspire, guide, and direct attacks, the group could seek to exploit legal and operational seams within European counterterrorism defenses. Ballout’s attack is a critical warning, highlighting the need for closer cooperation between Morocco and Spain to ensure the ability to further disrupt an evolving logistical corridor. Treating the Sahel as someone else’s problem will invariably come back to haunt Europe, which must make significant strides to shore up its defenses against jihadists’ external operations.

– Lucas Webber, Peter Smith, Colin P. Clarke, Published courtesy of Lawfare.