Aaron Y. Zelin is the Gloria and Ken Levy Senior Fellow at the Washington Institute for Near East Policy, where his research focuses on Sunni Arab jihadist groups in North Africa and Syria, foreign fighting, and online jihadism.
Brief Analysis
To prevent the type of jihadist resurgence seen after past U.S. military departures, Washington will need to sustain counterterrorism support and close any political, security, and detention gaps that IS could exploit.
On September 30, the last U.S. forces left Erbil Air Base in Iraq, ending the coalition mission against the Islamic State (IS) that began in 2014. By almost every measure, the jihadist organization’s Iraq “province” is now at its weakest point. Yet the group was also at a historic low in 2010, before a U.S. departure in 2011 enabled it to seize territory and build a proto-state within three years. Conditions today differ in important ways, as shown by the failed IS comeback bid in 2019-20. Nevertheless, there are signs that the group may be building a new campaign to exploit last month’s U.S. departure.
The State of IS in Iraq
IS attack claims in Iraq have plummeted in recent years, from 1,459 in 2020 to just 16 in 2025. This drop can be partly attributed to the fact that four IS “caliphs” were killed between 2019 and 2023, while a March 2025 U.S.-Iraqi strike in Anbar killed Abu Khadija, the group’s chief of global operations. In addition, leaked correspondence published by an anti-IS outlet shows that in July 2024, the group’s Iraqi “emir” described a “financial ordeal” and urged fighters to extract money from local businesses, including Sunni establishments. If this is authentic, it would mark both a major dent in the group’s coffers and a notable departure from its longstanding claim to protect Sunnis. Furthermore, an August 2025 editorial in the IS weekly al-Naba read more like a tribute to the Iraqi province’s past than a boast about its present capabilities, lamenting hardships that “would turn hair white.”
That said, arrests have not fallen nearly as fast as attacks. According to The Washington Institute’s Islamic State Worldwide Activity Map, Iraqi and Kurdish authorities made 98 IS-related arrests between November 2024 and September 2026, about 4.5 a month, compared with roughly 5.6 a month in 2023-24. This suggests that the network persists but that most of its activities remain below the threshold of violence.
Lessons from 2011-14 and 2019-20
The group’s 2011-14 resurgence rested on five pillars: the U.S. departure and the Iraqi security weaknesses it exposed; criminal financing; Sunni alienation under Prime Minister Nouri al-Maliki; the Syrian civil war, which delivered recruits, weapons, and foreign fighters; and mass prison breaks. For example, Abu Khadija himself was reportedly freed during a series of 2012 prison raids.
IS ran the same playbook in 2019-20, increasing attacks, rebuilding a rural intimidation program against village notables and informants, burning harvests, and reconstituting cells in the Kirkuk-Diyala-Salah al-Din triangle and western desert. However, this time it hit a ceiling that rested on five different pillars: U.S. forces stayed; the Iraqi security forces proved far more capable, especially the Counter Terrorism Service (CTS); Sunni communities, having lived under IS twice, had little appetite for its return; the Hashd al-Shabi militias permanently garrisoned the Sunni provinces; and leadership attrition and collapsing recruitment hollowed out the group’s veteran cadre in Iraq.
September 30 removed the first of those pillars; the question is whether the other four will hold without it. Upon departing, U.S. Central Command stated that IS “no longer poses a systemic threat to Iraq’s national security,” and that Iraqi forces, including the Kurdish Peshmerga, can now “unilaterally manage threats to their homeland.” Iraq’s security forces have indeed shown they can act independently: this June, for example, Iraqi F-16s killed a senior IS figure in Diyala following months of intelligence work. But much of Baghdad’s capability has rested on U.S. intelligence and strike support, which IS recognizes. After a July ambush in Kirkuk, al-Naba mocked the CTS for faltering whenever it lacks air cover.
Moreover, Hashd support is double-edged. Although militia garrisons help constrain IS, abuses at Hashd-run detention sites and other locales feed the sectarian grievances that IS exploits.
Current Warning Signs
Some of the indicators that preceded the 2019-20 surge have begun to reappear. In August and December 2025, IS publicized the execution of an alleged informant southwest of Mosul and the killing of a village notable in al-Bu Dor, suggesting possible steps toward rebuilding its rural intimidation campaign. Its few attacks this year have concentrated on the forces that helped suppress the group in 2019-20—the CTS and Sunni tribal paramilitaries—including a May bombing near Hatra that killed three CTS personnel.
Last month brought an uptick in attacks, with IS claiming five in the first three weeks, more than in the previous eight months combined. In addition to bombings against army and tribal forces in Kirkuk and Anbar, the group toppled a power-line pylon between Haditha and Bayji on September 18—an “economic war” target of the kind IS has not often attacked in recent years.
According to the September 24 issue of al-Naba, this string of attacks was meant to dispel perceptions that IS operations had decreased. In that same issue, an editorial titled “Show God the Good in Your Deeds” declared a “great victory,” claimed that the return of the “caliphate” is “on the horizon,” and urged more outreach and attacks while enemies are divided. It did not mention the U.S. withdrawal, but supporters have openly tied both the increase in attacks and the supposed return of the caliphate to that development. On September 12, Kurdish forces arrested twenty-two suspects in Halabja and Sulaymaniyah (including a “sharia emir”) who were allegedly preparing mid-September attacks. And on September 28, two days before the U.S. departure, counterterrorism forces killed two IS operatives wearing explosive belts in a rare urban firefight in Altun Kupri, north of Kirkuk.
Meanwhile, recent arrest data points to a changing attacker profile. Alongside caliphate-era veterans, recent cases include operatives wearing suicide belts, an Anbar cell producing explosive drones, operatives plotting attacks against Shia pilgrims during Arbain, youths radicalized online, and Syrian nationals engaged in IS-linked activities. Moreover, about a quarter of Iraqi arrests are now taking place in the Kurdistan Region.
The most significant risks are related to IS detainees. In January, at Baghdad’s request, U.S. forces moved more than 5,700 such individuals from camps and other detention sites in northeast Syria into the Iraqi prison system, where guards have been convicted of selling prisoners’ phones and inmates have actively sought to resurrect IS cells. In addition, returnees from Syrian detention facilities have been caught moving weapons and cash. IS has made Iraqi prisons central to its Iraq messaging, telling detainees in a June Sahel “province” video that “we shall meet soon in Baghdad.”
The Syria Factor
In 2011-14, Syria was the accelerant for the IS resurgence. Today, the picture is more mixed. IS remains stronger there, with twenty-nine attacks claimed this year. Moreover, the group’s Iraq and Syria “provinces” remain linked administratively, which includes working together on issues related to members imprisoned in both countries.
But unlike the Assad regime, which tolerated jihadist transit before 2011 and later neglected the fight against IS, President Ahmed al-Sharaa’s government treats the group as an enemy. In return, IS calls Syrian authorities the “Sahawat of Thomas,” a jab at both U.S. envoy Thomas Barrack and the Iraqi “Awakening” movement that nearly destroyed the Islamic State’s predecessor group between 2006 and 2009.
Promisingly, Baghdad has begun coordinating with the young Syrian government on border security and detainees, including the January prisoner transfer. There was no such cooperation previously, though it remains nascent and untested without a U.S. broker.
Measuring the Threat
The state of IS in Iraq should be assessed less by territory or annual attack claims than by whether political conditions in Sunni Iraq—including representation, justice, security, and reconstruction—have changed enough to deny the jihadists another act. Whether the September attacks mark the start of a long campaign or a signaling burst will become clear over the coming months as Iraqi forces operate without U.S. support.
IS messaging shows where it sees openings: prisons, executions, and a Sunni political class it dismisses as “falsely called Sunnis.” Authorities should also recall that this month marks twenty years since the IS predecessor group in Iraq first announced itself as an “Islamic State”—an important and potentially actionable anniversary for the organization.
Policy Recommendations
To sustain the four remaining pillars described above, Washington should do what it can to empower three bodies: the U.S. Military Group-Iraq, the joint civilian and military unit at the embassy in Baghdad; the U.S. consulate in Erbil, which needs to remain well-staffed; and the political arm of the Global Coalition Against IS, which is still intact and able to help despite the end of its military mission. These bodies can help the Trump administration meet the following imperatives:
Preserve the enabling edge. The U.S. forces that left on September 30 provided intelligence, surveillance, and strike support more than combat power. Accordingly, U.S. and Iraqi officials should formalize intelligence sharing, targeting assistance, and a consent-based strike option against high-value IS figures.
Prioritize detention issues. The Counter-Islamic State Train and Equip Fund (CTEF) should continue offsetting Iraq’s detention and trial costs. And now that Global Coalition partners pledged more than $75 million at this month’s Rome meeting for detention capacity and other needs, Washington should urge them to turn those pledges into multiyear commitments. U.S. officials should also push for quicker repatriation of detainees without clear IS links. In addition, the Trump administration should make sure that its security dialogue with Baghdad includes the following standing items: vetting of prison staff, monitoring of suspects’ communications, and separation of senior cadres (both from each other and from any lower-ranking cadres they might consult with for planning or recruitment). Pressing for transparent trials and the closure of Hashd-run detention sites is crucial as well.
Watch the right indicators. Washington should reach agreement with Baghdad and Erbil on monitoring the warning signs of any 2019-style IS rebuild, including further killings of notables and informants, infrastructure sabotage, prison incidents, and/or an increase in claimed attacks. Any spikes in these indicators should trigger expanding intelligence and strike support. The United States and Iraq should not wait till it is too late, as happened in the 2012-14 buildup.
Close the gap between Iraq’s central government and the Kurdistan Region. IS cells exploit divisions between federal and Kurdish forces in Kirkuk, Diyala, Salah al-Din, and Nineveh. Washington should use its security dialogues with Baghdad and Erbil to keep joint coordination centers functioning and facilitate combined Iraqi-Peshmerga operations in disputed territories.
Broker Iraqi-Syrian cooperation. Washington should back the “Syrian detainee committee” that Baghdad and Damascus agreed to in August. It should also help sustain their cooperation on border security, camp returnees, and financial networks that move money through returnee families.
Ask for something in return. Continued U.S. support should come with expectations tied to Iraqi political reform and protection for vulnerable Sunni communities. The Global Coalition endorsed this approach in Rome on October 1, calling for institutions “capable of representing and protecting all communities.” In practice, this means curbing Hashd militia abuses; fairly allocating reconstruction resources; paying the compensation that Baghdad legally owes to civilians whose homes and livelihoods were destroyed in the war against IS, without excluding families over perceived IS ties; and providing for genuine Sunni representation in areas once held by IS. Washington should also seek agreement on a small U.S. advisory presence for deeper intelligence capacity-building.
Aaron Zelin is the Gloria and Ken Levy Senior Fellow at The Washington Institute and creator of its interactive Islamic State Worldwide Activity Map.
