Global Terrorism Threat Looks Uncomfortably Familiar 

Global Terrorism Threat Looks Uncomfortably Familiar 

Executive Summary:

• Al-Qaeda in the Arabian Peninsula’s (AQAP) May 2026 Inspire propaganda releases coincided with the new U.S. Counterterrorism Strategy’s identification of al-Qaeda—particularly AQAP—as a primary external threat. 
• Several indicators that preceded earlier external attack cycles are again visible today across al-Qaeda and Islamic State (IS) networks: namely, explicit calls for Western attacks, permissive sanctuaries, cross-theater facilitation, leadership guidance, rising arrests, and disrupted plots. 
• The current threat environment is not a replica of the pre-9/11 period; it is more dispersed, technologically enabled, and networked. The danger lies in dismissing fragmented warning signs when fragmentation is now central to how the threat is evolving.

On May 8, al-Qaeda in the Arabian Peninsula’s (AQAP) media arm, al-Malahem, released a new Inspire video, “Why Jihadi operations in the West?” The video urged Muslims in Western countries to conduct lone-wolf attacks and to fight on “behalf of the Ummah [community] with everything at their disposal” (Homeland Security Today, May 8). The video also emphasized the political, economic, and social effects of such attacks, which AQAP claimed can “bring the strongest government to its knees” (Homeland Security Today, May 8). Then on May 24, AQAP released another Inspire video inciting Muslims to jihad and martyrdom (MEMRI, May 24).

The timing was significant. Between those two releases, the White House published the 2026 U.S. Counterterrorism Strategy, naming the targeting of Islamist terror groups with the intent and capabilities to conduct external operations against the United States as its second priority, “starting with al-Qaeda,” and especially “its most aggressive subgroup, AQAP” (White House, May 13). In short, the same month AQAP renewed its call for attacks in the West, the United States formally identified the group as a leading external operations threat.

That convergence is not evidence of an imminent attack, but it should be read as a warning indicator. Terrorist attack warnings rarely arrive as a single, conclusive piece of intelligence. They usually accumulate in fragments: declarations dismissed as rhetoric, online mobilization that appears diffuse, announced shifts in target selection, propaganda that evolves from grievance to guidance, and the emergence of safe havens that give militants time, space, and freedom to plan. AQAP’s May videos and statements fit that pattern. They show how warning signs can be visible before they are fully legible. Many of the same indicators that preceded earlier external attack cycles—operational propaganda, explicit calls for violence, permissive sanctuaries, cross-theater facilitation, and a rising tempo of disrupted plots—are again visible across today’s terrorism landscape.

Before the 1998 U.S. Embassy bombings, the 2000 USS Cole attack, the disrupted Millennium plots, and September 11, no single piece of intelligence or warning sign foretold catastrophe. Rather, there was a convergence of indicators. Osama bin Laden publicly declared war on the United States, framed U.S. civilians as legitimate targets, and redirected al-Qaeda’s focus from local conflicts toward the “far enemy” (Intelligence Resource Program IRP FAS, February 23, 1998; CTC West Point, October 2013). Those declarations coincided with organizational consolidation, the creation of a Taliban-controlled sanctuary in Afghanistan, and cooperation with other militant actors, all of which expanded al-Qaeda’s operational reach (FDD, August 18, 2018; Council on Foreign Relations, September 27, 2022; George Washington University, February 16, 2023). Rhetoric alone does not predict attacks, but it becomes more consequential when it converges with capability, sanctuary, facilitation, and repeated signals of disruption.

We are seeing many of the same indicators today. Extremist propaganda has rebounded in volume and tempo, while its operational specificity has noticeably increased after Western withdrawals from Afghanistan and parts of Africa in 2021, as well as Hamas’ October 7, 2023, attacks and Israel’s subsequent response (Europol, October 25, 2021, December 30, 2023; War on the Rocks, November 22, 2023; United Nations’ Report, January 29, 2024). In 2021, jihadist groups resumed guidance for attacks in the West. AQAP revived Inspire—the magazine that influenced the Boston Marathon bombers—after a four-year hiatus (PBS, April 30, 2013; Europol, 2021; ABC, July 29, 2021). Al-Shabaab in Somalia expanded its global media reach, and the Islamic State (IS) revived “media jihad” campaigns (Europol, October 25, 2021; Africa Defense Forum, July 30, 2024). In 2022, al-Qaeda and IS supporters launched new English-language magazines designed to radicalize Western audiences (Anti-Defamation League, August 9, 2022). In 2023, al-Qaeda released a video of its Inspire series explicitly inciting attacks in the West (Europol, December 30, 2023). Later, in 2025, it released more Inspire issues, while new “Open-Source Jihad” guides emphasized bomb-making and attack methods (MEMRI, July 24, 2025). In past run-ups to attacks, this transition from exhortation to instruction marked an inflection point.

Senior leaders are reinforcing the message. After years in which al-Qaeda’s attack rhetoric receded, key figures between 2021 and 2025 returned to explicit “far enemy” framing. Senior leaders began reiterating al-Qaeda’s strategy of striking the West and disclosing plans for new attacks involving experienced operatives, including veterans from the September 11th, 2001, terrorist attacks (War on the Rocks, November 22, 2023; Harmouch, 2025). [1] In 2022, the late Abu Muhammad al-Masri—writing while sheltered alongside Saif al-Adl, al-Qaeda’s de facto leader—reaffirmed the group’s commitment to attacking the United States, asserting that the next homeland attack would be far larger than 9/11 (Lawfare, April 4, 2023). In 2023, al-Adl published a book resembling a military manual that emphasized preparation, training, operational sequencing, and attack methods (Modern War Institute, March 3). In 2025, senior AQAP figure Ibrahim al-Qosi referenced attacks exceeding 9/11 and acknowledged ongoing preparations, while Saad bin Atef al-Awlaki, in his first public appearance since assuming leadership of AQAP, explicitly called for violence against Western targets (MEMRI, June 5, 2025; see Militant Leadership Monitor, September 10, 2025). Leadership rhetoric prioritizes and legitimizes target sets, providing dispersed supporters with a framework for action. Before earlier al-Qaeda attacks, public declarations by senior leaders were dismissed as rhetoric. They later proved to be part of a broader mobilization cycle. The same caution is warranted now: rhetoric alone does not equal capability, but repeated calls from senior figures can align affiliates, supporters, and lone-wolf actors around common targets.

Environments permissive to terrorist activities are also expanding. In Afghanistan, al-Qaeda has rebuilt parts of its infrastructure under Taliban protection, including training networks, leadership nodes, and operation routes, while Western intelligence visibility has declined (War on the Rocks, November 22, 2023; Harmouch, 2025). Al-Qaeda’s calls for foreign fighters to travel to Afghanistan echo late-1990s mobilization rhetoric (FDD, June 8, 2024). Islamic State Khorasan (ISIS-K) continues to operate from Afghanistan and the Afghanistan-Pakistan borderlands despite Taliban pressure (CTC West Point, August 3, 2023; The Conversation, March 28, 2024). Across Africa—including in the Sahel, Somalia, and Nigeria—jihadist groups have entrenched themselves in areas where they can recruit, raise funds, control territory, and refine tactics (UN Security Council, September 30, November 30, 2025; Harmouch, 2025; see Terrorism Monitor, February 27, April 17, June 5; July 3). These spaces matter because external operations require time. Operatives need room to meet, train, test methods, move money, cultivate facilitators, and assess targets (U.S. Department of State, 2015). The pre-9/11 lesson was that sanctuary allowed intent to mature into capability (CTC West Point, September 2021). Today’s safe havens are more fragmented and geographically dispersed, but they provide many of the same enabling conditions within a larger and closely networked jihadist ecosystem of fighters, revenue streams, media outlets, and logistical networks. Major operations unfold over months and years, not weeks.

The growth of cross-theater facilitation is compounding the danger. Al-Qaeda affiliates and IS branches operate within overlapping ecosystems of smugglers, financiers, media operatives, trainers, and weapons facilitators. In southern Libya, there have been growing concerns about tactical cooperation between al-Qaeda and IS (Erem News, April 2, 2026). In Yemen, the Houthis are cooperating with al-Qaeda (see Terrorism Monitor, April 17; NatSec Matters, December 11, 2024).  In Somalia, al-Shabaab has also collaborated with the Houthis and, at times, with IS-linked facilitators (NatSec Matters, December 11, 2024; United Nations, March 3, October 17, 2025; Africa Center, May 28, 2025; UN Security Council, July, 2025; Africa Defense Forum, November 25, 2025). In the Sahel, Jama’at Nusrat Al-Islam wal-Muslimeen (JNIM) has shown increasing governance capacity and resilience, and al-Qaeda branches have again strengthened ties with one another (BBC, July 6, 2025; Modern War Institute, March 3). IS affiliates, meanwhile, continue to benefit from decentralized media and financial channels that allow local branches to survive leadership losses (CTC West Point, August 2024; Congressional Research Service, September 8, 2025). These relationships expand access to skills, materials, and experience, strengthening operational capacity. This type of cross-domain access has historically increased jihadist groups’ ability to project violence beyond their immediate theater (Harmouch, 2025). 

Additionally, leadership behavior resembles other pre-attack periods. Before earlier attacks, senior figures dispersed, tightened security, and reduced their public footprint as plotting advanced. Across extremist propaganda and social media platforms, jihadist groups are emphasizing operational security measures and encrypted communications, alongside unverified reports suggesting similar relocations among senior al-Qaeda leaders today. 

Another indicator is the tempo of terrorist activity, arrests, and disrupted plots. In 2024, terrorism-related arrests rose across Europe, while attacks have spread across more countries globally than at any point since 2018, with jihadist groups driving much of the violence (Europol, 2025; CTC West Point, November/December 2025). Global terror attacks increased by 8 percent from 2023 to 2024 (CTC West Point, November/December 2025). Islamist terror incidents increased in the United States in 2024 after years of decline, alongside a marked surge in removals of suspected terrorists (U.S. Immigration and Customs Enforcement, December 19, 2024; Anti-Defamation League, February 1, 2025). In 2024-2025, authorities in the United States, the United Kingdom, Austria, and Canada arrested individuals and thwarted plots that included mass-casualty attacks linked to al-Qaeda and IS (CBS News, August 29, 2024; U.S. Department of Justice, September 6, 2024; May 14, September 24, 2025). Individually, such cases are often dismissed as isolated and unrelated. Collectively, they reflect a familiar pre-attack phase: a source of experimentation and learning. Failed or disrupted plots reveal target preferences, security gaps, tactical adaptations, and propaganda effects. Over time, this creates a feedback loop in which propaganda inspires attempted attacks, those attempts generate operational lessons—as al-Adl noted in his book—and those lessons then inform subsequent propaganda. Finally, as in periods preceding past attacks, public threat reporting is surging across security agencies.

In 2023, former FBI Director Chris Wray warned that al-Qaeda had issued its most specific call to attack the United States in five years (FBI, October 31, 2023). In 2025, U.S. counterterrorism assessments cautioned that al-Qaeda is renewing calls for attacks on the homeland and exploiting conflicts to mobilize Western-based operatives, while officials assess that IS continues to pose a serious homeland threat, with a marked increase in its activities (War on the Rocks, November 22, 2023; Voice of America, July 17, 2024; Washington Post, September 9, 2024; U.S. Department of Homeland Security, October 2, 2024; 2025; U.S. Director of National Intelligence, September 2025). At a recent U.S. Department of Homeland Security hearing, officials described an elevated terrorism threat environment (House Committee on Homeland Security, December 11, 2025). Russian, Pakistani, and Western authorities have likewise warned that threats emanating from Afghanistan, particularly from ISIS-K, are growing (Atlas Press, November 20, 2025; United Nations, June 8). 

The current terrorism environment is not a replay of the pre-9/11 period. The threat no longer centers on one al-Qaeda core operating from Afghanistan but rather on a wider jihadist ecosystem of al-Qaeda and IS affiliates, branches, and inspired networks. Washington still recognizes this danger, but counterterrorism no longer organizes U.S. national security as it did after 9/11 (Harmouch, 2025). Attention, resources, and strategic planning have shifted toward great power competition and broader concerns, even as jihadist networks have adapted to a more fragmented operating environment (CTC West Point, October/November 2023). The relevant comparison, however, is not between two identical eras but rather the convergence of warning indicators.

Before earlier attack cycles, public signs appeared in fragments, and today many of those indicators are again visible across al-Qaeda, IS, and their affiliates. No single disrupted plot, propaganda release, or leader statement proves that a major attack is imminent. Taken together, these indicators suggest that the external attack environment is becoming more permissive, more networked, and more operationally specific. The danger lies in dismissing those indicators because they are dispersed, as dispersion is precisely how the threat takes shape.

Notes:

[1] Sara Harmouch (2025) Al-Qaeda and WMD Terrorism: Has the Worst Case Returned?, The Washington Quarterly, 48:4, 43-64, DOI: 10.1080/0163660X.2025.2595890