Following is the December 2022 installment of “ISIS Redux: The Central Syria Insurgency,” a monthly chronicle of attacks by the terrorist group ISIS in central Syria. A review of developments throughout 2021 can be found here, and previous editions in 2022 can be viewed through the following links: January, February, March, April, May, June, July, August, September, October, and November. A full background and analysis of ISIS’s resurgence in Syria, including the methodology used to collect this data, can also be explored here, here, and here.

ISIS militants carried out at least 15 confirmed attacks in December in all governorates of the Syrian Badia: Raqqa, Hama, Deir Ez Zor, Aleppo, and Homs. These attacks killed at least 30 pro-Assad regime soldiers, 15 civilians, and wounded at least two others. Additionally, there were seven high quality* attacks in December, the most since September 2021. An increase in overall attacks and a significant increase in both high quality attacks and regime casualties in December reflected an overall rise in ISIS attack complexity and aggressiveness. This is in line with the general trend that began in August, when ISIS started to consistently claim some of its Badia attacks for the first time since 2021 and shifted toward a more aggressive posture, targeting regime forces with small arms ambushes in more urban environments. As with August and September, December’s activity was concentrated in Raqqa and Deir Ez Zor, with a decrease in observable attacks in Homs. ISIS also claimed a significant number of attacks in December, marking the first month the group has claimed eight or more Badia attacks since June 2021.

While ISIS shifted its focus in October and November to northeast Homs, particularly the Kawm sector, December saw the group shift back to its emphasis on southern Raqqa and the urban sector of southwest Deir Ez Zor. Both of these areas had been targets for ISIS cells in August and September, but in December militants were even more aggressive, kidnapping and executing regime soldiers at least twice, conducting multiple small arms ambushes in towns long held by regime forces, and carrying out an extremely rare Anti-tank Guided Missile (ATGM) attack on buses carrying dozens of oil workers from the Tayyem Oil Field. This shift back to the urban belt that divides the regime-held Badia with Syrian Democratic Forces (SDF)-held northeast Syria preceded a serious attack in Raqqa city. On December 26, two ISIS members reportedly disguised themselves as SDF fighters and infiltrated the SDF Internal Security Headquarters next to a major prison in Raqqa, killing at least six security forces before detonating suicide belts. This was the most significant attack in Raqqa since 2019 and almost certainly is tied to the strengthened position of ISIS cells in regime-controlled areas just south of the city.

ISIS attacks decreased in Homs (2) following a spike in October and November, but rose sharply in Deir Ez Zor (5), Raqqa (4), and south Aleppo (2). Improvised Explosive Devices (IED) and mine incidents remained steady in east Hama (2). ISIS claimed attacks in December in all governorates except Hama and Homs.

Raqqa, Aleppo, and Hama

ISIS began its renewed Badia media strategy in August with a string of southern Raqqa claims. The group claimed nine attacks in southern Raqqa between August 7 and October 30. After a six-week break, ISIS again began claiming attacks in Raqqa, now including multiple pictures of dead soldiers and destroyed vehicles.

On December 8, regime media reported the death of a soldier from a mine near Resafa. ISIS claimed an IED attack on a regime truck near Resafa on December 14, publishing pictures of three dead men and the destroyed vehicle. Only one of the soldiers’ deaths was reported by pro-regime media (again demonstrating that relying on pro-regime media to track ISIS attacks only provides a partial picture). ISIS claimed a second attack on December 19, this time kidnapping and executing two soldiers in a house outside the town of Resafa. ISIS again published pictures of the dead men. Lastly, ISIS militants attacked a barracks in Bir al-Sadran, west of Resafa, late on December 30. Regime pages reported the deaths of two soldiers in southern Raqqa that same day, likely killed in the attack.

ISIS also claimed two attacks in southern Aleppo, both near the town of Khanasir. The group claimed it detonated an IED against a regime truck south of the city on December 5, and that it ambushed a patrol using small arms in a similar area on December 13, killing at least one soldier.

There were two mine incidents in Hama in December. On December 21, a child was killed by a mine in a village outside Salamiyah and on December 28, four civilians were killed by a mine outside Tel Salama, east of Salamiyah.

Map of ISIS attacks in southern Aleppo and south Raqqa in 2021 and 2022. December 2022 attacks are highlighted.

Homs and Deir Ez Zor

ISIS activity in Deir Ez Zor surged in December following no confirmed attacks in November. ISIS claimed four attacks in December, all in the southwest of the governorate, two of which were reported by regime media as well. Three of these attacks occurred around the town of Dweir on December 17, while the fourth came in the desert south of the town the following day.

ISIS claimed its fighters killed two regime soldiers in a small arms attack on a barracks near Dweir on December 17, while a second cell ambushed two soldiers near the nearby al-Ward Oil Field, capturing and executing them. Pro-regime pages in Deir Ez Zor reported the attack on the barracks, claiming it was “repelled” with one loyalist killed and one wounded. Militants also fired on a regime truck in the same area that day. On December 18, a truck full of regime soldiers hit a mine in the desert south of Dweir, killing at least eight. ISIS later claimed the attack. A trusted regime source stated the incident had occurred while the truck was driving through a regime defensive minefield. There are therefore two possibilities, the first being that the truck indeed hit a regime mine by accident and that ISIS simply claimed the attack (the deaths of the men was widely reported by pro-regime and pro-opposition media). The second possibility is that ISIS added its own mines to the regime minefield, a common tactic for the group and one that would make sense given their series of attacks nearby a day earlier.

An ISIS cell conducted a fifth attack in Deir Ez Zor on December 30. In what was one of the most significant attacks of 2022, ISIS fighters utilized at least two ATGMs to target and destroy between two and three minibuses carrying more than 40 oil workers from the Tayyem Oil Field, close to Deir Ez Zor. Regime media initially reported 10 dead, though this number will likely rise. The Tayyem attack was significant for two reasons: First, it is the first confirmed use of ATGMs in two years; and second, it was a brazen high profile attack against a critical regime target very close to the heavily militarized Deir Ez Zor city. ISIS cells have almost certainly been armed with ATGMs for the past several years, yet rarely chose to use the deadly weapon. These cells could easily have destroyed tanks at lone regime outposts (as they had two years ago). Instead, ISIS chose to use ATGMs on a civilian soft target, clearly prioritizing the “war of attrition” they publicly declared against the regime in 2021. ISIS cells had targeted oil fields and workers somewhat regularly in late 2020, and then intermittently in 2021, but has largely been unable and/or unwilling to expend resources on such targets since the regime bolstered its presence and patrols across central Syria. The return of these types of attacks—if indeed they continue—would signal a significant shift in the Badia power dynamic back in favor of ISIS.

ISIS activity dropped sharply in Homs in December after a high tempo October and November, with only two incidents recorded. On December 1, a mine or IED killed three soldiers near Palmyra. On December 30, ISIS cells attacked a regime outpost north of Palmyra, killing at least six members of the Syrian army’s 18th Division. As November’s report indicated, ISIS captured the village of Kawm from regime forces on November 30 before retreating to the countryside in the face of a Russian Wagner-led offensive launched on December 12. There were likely additional ISIS attacks around Kawm during this time that were not reported by ISIS or pro-regime media.

Map of ISIS attacks in Deir Ez Zor in 2021 and 2022. December 2022 attacks are highlighted.

Regime Operations

The year 2022 ended with limited regime operations taking place across central Syria. Units of the 25th Division continued de-mining and sweeping operations in southern Aleppo (likely the units that were hit by the two claimed ISIS attacks there). The only serious regime operation in December was the Russian Wagner Group-led offensive to re-take Kawm. On December 12, members of the Rostov formation of Wagner led a night operation to advance on Kawm, finding the town abandoned but heavily mined. Security forces spent the next several days de-mining the southern approach, fully securing the town on December 17.

Looking Ahead

The massive ISIS surge across central Syria in 2020 was preceded by a simultaneous increase in activity in south Aleppo and south Raqqa. These two regions represent areas of weak regime presence straddling key transit routes and oil fields, and connect directly to ISIS’s northeast networks. ISIS cells have always been present here, yet the areas remain among the least active in central Syria. The steady increase in aggressive attacks in south Raqqa beginning in August, and the return of ambushes in south Aleppo in December would seem to indicate a strengthened and emboldened ISIS in this region. This could be due to the arrival of new fighters and resources, or by the reduction of regime patrols and air support, or both. It is likely no coincidence that the emboldened attacks around Tabqa and Resafa over the past four months preceded a major attack within Raqqa city on December 26, when two ISIS fighters killed 10 SDF members.

This once again underscores the crucial gap in the SDF’s and the Coalition’s anti-ISIS strategy—that ISIS’s northeast insurgency is deeply intertwined with its central Syrian cells, and the two networks feed off of and strengthen one another. Just as the increase in kinetic activity in southern Raqqa preceded a significant attack in SDF-held Raqqa, the growth in the insurgency in SDF-held Deir Ez Zor appears to now be spilling over into regime-held areas. The series of attacks on Dweir village and the high profile attack on Tayyem follow a gradual shift of ISIS activity in the governorate from the western desert to the long-secured urban belt along the Euphrates River. An ISIS that is confident enough to carry out multiple same-day attacks in ‘secure’ urban areas is certainly an ISIS that is confident in its supply and transit lines crossing the Euphrates. Furthermore, it must be remembered that, since ISIS’s 2021 attack on the Damascus power plant, the group has consistently framed its anti-regime activity as a “war of economic attrition.” A strengthened ISIS may therefore seek to capitalize on Damascus’ present crushing energy and financial crises, focusing its resources on further degrading the regime’s ability to extract and process oil and gas from its Badia facilities. This may mean that this winter ISIS will shift its activity away from northeast Syria and into central Syria, or at least shift its targets in northeast Syria to more consistently focus on SDF fuel being transported to the Syrian regime.

Map of locatable ISIS attacks (highlighted) in December 2022 alongside attacks in 2022 and 2021. To view an interactive version of this map, please click here.

---

*High quality attacks are defined as attacks behind frontlines, those that result in seized positions, target regime officers, involve coordinated attacks on multiple positions, fake checkpoints, ambushes on military convoys, or attacks on checkpoints that kill at least three soldiers or lead to POWs.