ISIS Sleeper Cells Lurking in Iraq's Security Gaps

Mohammad Mahdi Maleki

The end of the military mission of the international coalition in Iraq, on September 30, 2026, is considered a turning point in the security equations of Iraq; But the simultaneity of this development with the increase of ISIS movements has doubled the necessity of separating the realities on the ground from the propaganda goals of this terrorist group.

The territorial defeat of ISIS in Iraq in 2017 did not mean the destruction of its operational structure. Moving away from the pattern of city capture and land administration, the group has relied on a scattered network of secret cores, local support, limited operations, and cross-border propaganda. Therefore, the current threat of ISIS is more rooted in its ability to erode security, undermine public trust, and exploit political and social divisions than in an immediate return to territorial power.

In Iraq, the western deserts of Anbar and Nineveh provinces, the areas around Hamreen and Makhmour, parts of Salah al-Din and Diyali, and the rural areas of Kirkuk are among the centers prone to the activities of ISIS cells. The importance of the disputed areas between Baghdad and the Kurdistan Region also comes from the fact that the inconsistency in the deployment and exchange of information between the federal forces and the Peshmerga can provide more freedom of action to the secret elements. Recent developments in Hawija Kirkuk city have highlighted this vulnerability once again.

In Syria, the central desert areas and parts of Deir ez-Zor and Raqqa remain important in the ISIS threat assessment. In addition to the activity of armed groups, the state of prisons and camps related to the members and families of this group is a strategic issue; Because the instability in the management of these centers can provide the basis for escape, reconstruction of networks and recruitment.

Turkey should also be examined in the framework of communication, financial and cross-border transfer networks; With the difference that without reliable evidence, it cannot be introduced as the operational center of ISIS on the same level as Iraq and Syria. On a global scale, branches are active in Afghanistan and Africa, which are not necessarily directly subordinated to the developments in Iraq in terms of command and operational capacity. Therefore, ISIS is a regional and global threat, but the intensity and nature of its presence is different in different countries.

The reports of the days leading up to the withdrawal of the coalition have made this hypothesis more serious. Reuters reported on September 29 that Iraqi security officials have announced the possible plan of an ISIS cell to carry out suicide attacks at the same time as the withdrawal of coalition forces. Also, a Kirkuk security official said that this group wants to convey the message of its continuing strength and ability to carry out bloody attacks. The recent attacks in Hawija also show the continuation of the threat.

This evidence is consistent with the analysis that ISIS intends to exploit a political and military transformation to rebuild its lost credibility. Demonstrating operational capability, inducing the weakness of the government, creating doubts about the security of the liberated areas and highlighting the return claim can be part of this group's propaganda strategy.

However, a distinction should be made between two propositions; That ISIS is deliberately trying to induce the government's inability and that it has specifically designed the attacks to bring back foreign forces or prove the necessity of their presence. The first statement has analytical support and evidence; But proving the second statement requires operational documents or valid evidence about organizational targeting. The simultaneity of the attacks with the withdrawal of the coalition alone does not prove such a connection.

Also, the end of the coalition mission should not be considered as the automatic collapse of Iraq's anti-terrorist capability. The main criterion is the ability of the Iraqi apparatus to gather information, identify hidden networks, control borders and carry out independent operations.

First, security and information integration. It is necessary to strengthen the coordination of the army, intelligence agencies, federal police and Peshmerga, especially in the disputed areas. Establishing common mechanisms for information exchange, covering security gaps and developing the ability to identify and monitor independently prevents organizational differences from becoming an operational opportunity for ISIS.

Second, cutting off financial resources. Dealing with extortion, blackmail, kidnapping for money, smuggling and non-transparent money transfer networks should be prioritized. Monitoring of suspicious transactions, cooperation between financial institutions of the countries of the region, and tracking financing intermediaries, limits the ability to rebuild ISIS networks.

These measures should be based on evidence and legal processes so that legitimate economic exchanges and people's livelihoods are not harmed.

Third, dealing with Internet advertising and attraction. ISIS uses images of attacks, exaggerating successes and using social networks and communication platforms to recruit. An effective response, in addition to legally dealing with terrorist content, requires quick and documented information, preventing the group's advertisements from being republished, and using the capacity of local and religious figures. Concealing security weaknesses or spreading unsubstantiated claims about the complete defeat of ISIS undermines public trust.

Fourth, preventing the social reproduction of ISIS. Reconstruction of damaged areas, development of public services, creation of job opportunities and reduction of deprivation are part of sustainable security policy. The collective treatment of local communities, discrimination and disregard of civil rights can strengthen the field of propaganda and recruitment by ISIS. It is also important to give a fair trial to the accused and to provide mechanisms for social acceptance.

Fifth, prison management and regional cooperation. The transfer of thousands of prisoners suspected of belonging to ISIS from Syria to Iraq this year has increased the burden of security, judicial and financial responsibility of Baghdad. Protection of detention centers, prevention of escape, determination of judicial assignment of cases and cooperation of countries to return their nationals should be pursued simultaneously.

ISIS tries to create an opportunity for its operational and propaganda reconstruction from every security gap. The withdrawal of the coalition can be an opportunity and an excuse for this group to show its strength and test the security capabilities of Iraq, which the Baghdad authorities will not allow once again to threaten and challenge the security and stability of Iraq and, as a result, other countries in the region, and prepare the ground for the re-appearance of foreign forces, because the Iraqi security and military forces are sufficiently capable and powerful to deal with terrorism in its various forms and dimensions.