Following is the March 2023 installment of “ISIS Redux: The Central Syria Insurgency,” a monthly chronicle of attacks by the terrorist group ISIS in central Syria. A review of developments throughout 2022 and 2021 can be found here and here. The February 2023 edition can be found here and January’s here. A full background and analysis of ISIS’s resurgence in Syria, including the methodology used to collect this data, can also be explored here, here, and here.

ISIS carried out at least 35 confirmed attacks in March in Homs, Hama, and Deir Ez Zor governorates. These attacks killed at least nine pro-Assad regime soldiers and at least 55 civilians and wounded at least 62 additional soldiers and civilians; another 38 civilians were kidnapped. Additionally, there were 10 high quality* attacks during the month. March had the most confirmed ISIS attacks since September 2021, surpassing February’s 21. March also set a two-year record for high quality attacks, though most involved the kidnapping of civilians. The first half of March saw consistent small arms attacks by ISIS cells across all regions of the Badia. At least 11 of 16 attacks involved small arms while only four used mines or Improvised Explosive Devices (IEDs). However, mine and IED attacks became the norm during the last half of the month, with only six of 19 reported attacks involving small arms and at least 12 reported mine or IED attacks. Many of these incidents occurred in the same areas where suspected ISIS cells had conducted small arms attacks earlier in the month. This may suggest an ISIS withdrawal from the so-called ‘frontlines’, leaving behind new explosives and a somewhat reduced level of activity heading into April.

As in January and February, ISIS itself claimed no attacks in central Syria in March. Similar to February, March’s activity was overall more aggressive than in earlier months (at least 16 of the 34 confirmed attacks involved small arms). Yet attacks this month were much more dispersed than they have been for the past two years, with high quality attacks occurring in every governorate of central Syria, including a mass kidnapping event as far north as Khanasir, Aleppo. March also continued the trend set in February of renewed small arms attacks in eastern Hama, with attacks (and thus cells) continuing to shift further north. Not fully captured in the March data were reports of continuous skirmishes during the last three weeks of the month east of al-Kawm, in eastern Homs, as ISIS cells attempted to prevent regime and Russian Wagner forces from establishing a foothold in the mountains around the strategic town. These events follow ISIS’s brief December 2022 capture of the town itself.

ISIS attacks rose sharply across most of the Badia in March, particularly in Deir Ez Zor (12), reaching a two-year high. ISIS continued to increase its activity in Hama (10) and to a lesser extent in Raqqa (3) and Aleppo (2), which witnessed its first attacks of the year. Attacks in Homs (8) dropped slightly from a 16-month high in February.

Deir Ez Zor and Raqqa

ISIS cells consistently conducted attacks against civilians in western Deir Ez Zor in March. Initially, these attacks involved small arms and kidnappings, but by the second half of the month most involved mines or IEDs. This shift could mean ISIS cells planted new explosives while conducting small arms attacks, then moved to a new region later in the month.

On March 2, a truck carrying truffle pickers into the desert hit a mine near Kababj, leaving six dead and 45 wounded. The next day, five young shepherds from the Busaraya tribe were attacked in the western desert near Musarib. Four of the boys were kidnapped, one managed to escape, and their sheep were stolen. Local members of the pro-government National Defense Forces (NDF) responded and reportedly clashed with the militants. According to one survivor, who spoke with a man interviewed by this author, the attackers used one truck and three motorcycles. Six days later, on March 9, a group of Busaraya truffle pickers were attacked farther west. All 12 were kidnapped and apparently executed. The bodies were discovered two weeks later. The next day, a group of pro-regime Usuod Sharqiyeh fighters from the Shaytat tribe were ambushed near Kababj. One fighter was killed, and several were wounded before reinforcements arrived. Unit members on Facebook claimed that no one from the army came to support them during the fighting. On March 14, a local man was killed by a mine while truffle picking outside his village south of Deir Ez Zor city. On March 19, another group of Busaraya locals, this time guarded by some local Liwa al-Quds members, were again attacked near Jabal Nazirat. Two civilians were killed and three kidnapped in the initial attack while everyone fled. Busaraya-linked NDF forces quickly responded and gun battles raged for four hours.

Following these attacks, mines and IEDs became the main danger for civilians in western Deir Ez Zor. On March 22, a civilian was killed by a mine while driving his motorcycle near Jabal Nazirat. Three days later, five men from the Busaraya tribe were wounded by a mine while driving in the same area looking for truffles. On March 26, an ISIS militant was killed while attacking a regime checkpoint outside Mayadin. He was reportedly involved in truffle smuggling and may have initiated the attack after being discovered. A regime soldier was reported killed in the governorate on the same day, likely during the attack. On March 29, a child was killed by a mine, again around Jabal Nazirat. On March 31, a local member of the regime security forces was killed by a mine while driving in southern Deir Ez Zor, and on the same day, another mine killed a truffle picker driving somewhere near Jabal Bishri.

Confirmed ISIS activity in southern Raqqa continues to be more muted this year than in late 2022, when ISIS was regularly publishing information on IED and small arms attacks in the Tabqa region. There were three confirmed ISIS attacks in southern Raqqa in March, only one of which was significant. On March 4, ISIS cells launched a night-time attack against regime positions on the northern edge of the Bishri Oil field. The attackers reportedly used around eight motorcycles and two technicals, seizing and looting first line positions held by Qaterji Guards before withdrawing as Syrian Arab Army (SAA) units arrived from the west. Earlier that day, suspected ISIS militants had attacked a group of Buhamad shepherds further north, killing one and kidnapping another before stealing as many as 800 sheep. Lastly, on March 28, a civilian was wounded by a mine somewhere in the desert south of Maadan.

Map of locatable ISIS attacks in Dier Ez Zor and Raqqa (highlighted) in March 2023 alongside attacks in 2023 and 2022.

Homs

The bulk of attacks against regime security forces in March occurred in eastern Homs. By March 8, regime and Russian Wagner forces had advanced several kilometers east of al-Kawm—the village ISIS briefly captured in late December 2022 and retaken by the regime in January. At least three ISIS militants were captured and executed by pro-regime forces during this initial advance into the mountains as security forces attempted to create a defensive buffer around the strategic town. However, per local security reports, ISIS cells continued to skirmish with regime forces here throughout the month, preventing them from establishing any firm foothold in the mountains. As there were no specific dates or details of the battles, so reports of repeat skirmishes have been recorded as two attacks.

Separately, on March 6, a soldier was killed in “an ambush” somewhere in the Sukhnah countryside and on March 15, another soldier was reported killed somewhere in the Tanf countryside. On March 17, a gas engineer was killed by a mine while working in the Arak field, the site of sustained fighting in February. Two days later, two soldiers were killed by a mine in Jabal Marah, far to the north near Bir Tuwaynin. It’s worth noting that local security forces reported sighting ISIS militants traveling in this area throughout the month, though no clashes were reported. On March 28, one ISIS fighter was captured during fighting north of Arak between militants and units of the Iranian-commanded Pakistani Liwa Zainebiyoun. The next day, six civilians were killed and several wounded when their car hit a mine on the road north of Sukhnah near the village of Taibeh.

Map of locatable ISIS attacks in Homs (highlighted) in March 2023 alongside attacks in 2023 and 2022.

Hama and Aleppo

ISIS activity continued to increase in eastern Hama in March and, as in February, involved many small arms attacks. Most importantly, ISIS attacks steadily moved northward during March, suggesting that cells have further disbursed throughout the governorate.

On March 3, a local civilian was shot dead near Huwaysis, southeast of Uqayribat on the Homs-Hama border. The next day, two siblings were killed by a mine near Duwayzin, farther to the east, while a second group of civilians in the same area were reportedly “besieged” by ISIS militants while truffle picking, with at least three killed. On March 8, three shepherds were killed and 1,000 sheep stolen in the Tel Salama-Seeb Dam area, north of Duwayzin. Two days later a man and his wife hit a mine while driving in the same area, leaving one dead and one wounded. Two more mines further north in the Wadi Azeeb area left one civilian wounded and two dea on March 17 and March 22, respectively. On March 23 another significant attack took place near Marina, east of Ithriyah, when five truffle pickers from the Haddadin tribe were killed in an attack. (Pro-opposition outlets claimed 15 were killed, but these reports all came more than 24 hours after the incident was first reported by local Haddadin tribal pages and could not be corroborated by more accurate sources.) On March 24, two soldiers were killed by a mine on the northern side of Jabal Bala’as, on the Hama-Homs border near Uqayribat. Lastly, on April 3 the bodies of four locals were found, reportedly with gunshot wounds to their heads, near Duwayzin. Local Facebook pages claimed that had previously gone missing during an unreported attack on March 17 or March 18.

Concurrent with the northward shift in ISIS activity, militants also carried out the first two attacks on the year in southern Aleppo. On March 10, at least 30 civilians from nearby Safira were kidnapped and three killed while truffle picking east of Khanasir. Two days later, a soldier from the regime’s 25th Division was killed near Andarin, close to the Aleppo-Hama border. It is worth noting that this region between Ithriyah and Khanasir has become a center of 25th Division training and patrols over the past year.

Map of locatable ISIS attacks in Hama and Aleppo in February 2023 alongside attacks in 2022.

Looking Ahead

This author has been consistently warning against any over-interpretation of ISIS’s increased activity since August. Yet nearly every month since then, ISIS has generally increased or maintained a higher tempo of attacks. In many ways the past seven months are reminiscent of the late 2019 and early 2020 period leading up to the large ISIS surge across central Syria. It is difficult to draw accurate comparisons across such long periods of time due to the ever-changing dynamics on the ground. However, as this author has repeatedly indicated since late 2022, there are increasingly many similarities between attacks over the past months and the period of initial ISIS expansion in late 2019 and early 2020. If we look at the location and number of attacks ISIS conducted in that period leading up to its massive 2020 surge, and the period since August 2022, it could be argued that the past two months have mirrored the April and May 2020 pattern of attacks: Focused activity around Jabal Bishri and western Deir Ez Zor and an expansion into northeast Hama. In 2020, these two months of heightened activity were followed by one month of significantly reduced ISIS attacks, after which militant cells spent seven months consistently pressuring regime forces and civilians across all fronts.

However, unlike in recent months, ISIS attacks in early 2020 were much more focused on hitting security forces. We have yet to see the same level of consistent, high-level attacks on regime forces. There have been many more attacks targeting the more vulnerable civilians in central Syria. This may simply reflect ISIS’s emphasis on financial operations, combined with the practical approach of targeting weaker targets if they are available, but it should also add some nuance to comparisons between early 2020 and today.

One complicating factor is the apparent reduction in regime airpower in central Syria this year, which may open the door for ISIS cells to return to their security forces-centered attacks. Airpower has been the key to forcing ISIS into a more cautious and defensive posture, but several attacks over the past two months against hardened regime positions hint at a new, more aggressive ISIS posture in the Badia. The renewed presence of trucks in ISIS attacks is also cause for concern, as it should be remembered that by the end of 2021, regime intelligence believed they had destroyed nearly all of ISIS’s truck fleet and no trucks were reportedly sighted during ISIS attacks in 2022. Technicals serve as a force multiplier for ISIS cells, enabling attackers to utilize heavy weapons and carry away captured equipment. Reduced regime airpower reduces security forces’ ability to monitor and strike these vehicles. The question going forward, then, is whether ISIS cells will shift from targeting civilians to consistently and successfully hitting regime positions in the coming months.

Map of locatable ISIS attacks (highlighted) in March 2023 alongside January and February 2023 (green, not highlighted) and attacks in 2022. Note that not included is one attack conducted somewhere in the southern Deir Ez Zor countryside. To view an interactive version of this map, please click here.

---

*High quality attacks are defined as attacks behind frontlines, those that result in seized positions, target regime officers, involve coordinated attacks on multiple positions, fake checkpoints, ambushes on military convoys, or attacks on checkpoints that kill at least three soldiers or lead to POWs.