top of page
  • Writer's pictureMECRA

Analysis: The threat of sleeper cells continues after ISIS territorial defeat in Syria

Updated: Mar 26, 2019


Raqqa's Internal Security Forces. (Wladimir Van Wilgenburg)

By WLADIMIR VAN WILGENBURG

March 23, 2019*


With the liberation of the last ISIS pocket in Baghouz (Baghuz) in the Deir Ezzor (Deir ar Zour) province of Syria, the threat of sleeper cells of the Islamic state continues, especially in Arab majority areas recently liberated from the ISIS. Local officials therefore ask for continued coalition support to prevent the resurgence of ISIS.

The sleeper cell threat by ISIS and the use of assassins by regional states could also threaten coalition troops after the territorial defeat of ISIS in Baghouz which was announced on March 23, 2019.

The sleeper cell attacks increased, after US president Donald Trump’s announcement that the US would withdraw its troops in December. “The sleeper cells became more active in Manbij, Shadadi, and Raqqa,” Layla Mohammed, the co-head of the Raqqa Civil Council said in an interview.


On Jan. 16, a suicide attack in Manbij left 19 people dead, including four Americans. Two Syrian Democratic Forces (SDF) fighters were also killed in the explosion. “We are seeing an increase in attacks, including assassination attempts, kidnapping, and ransom activities in some areas of Iraq and Syria,” Colonel Sean Ryan, the spokesman of the US-led coalition fighting the Islamic State (IS) group, confirmed. “It is difficult to say if they are coming from actual ISIS sleeper cells or just other individuals filling the void left by ISIS, to create havoc and extort money, so no exact number, but there has been an increase since December,” he confirmed.

A Pentagon report released in February this year warned that, “ISIS may conduct opportunistic attacks on US personnel as they withdraw but will leverage the event as a 'victory' in its media.” Manbij’s fragile security On 15 March, five ISIS members that were planning to carry out attacks in the city of Manbij were arrested. Moreover, on 19 March, suspects that were involved in 16 January attack in Manbij targeting US soldiers were also arrested after an investigation. Assassinations have especially targeted senior officials of the SDF, local Arab fighters of the SDF, tribal leaders working with the SDF, and administration officials that played a role in improving relations between the Kurds, and Arabs in northeastern Syria. The goal of these attacks is to undermine the stability in the northeast of Syria, and to force the US forces to leave.

“ISIS is still dangerous, even after Baghouz,” says Sharvan Darwish, the spokesperson of the Manbij Military Council (MMC) during an interview on 26 February, who himself survived an assassination attempt in February 2018.

“ISIS stayed for years in Manbij, Raqqa, and other areas, and created a base.”

Darwish's driver was targeted on 9 March, 2019 by an IED blast that killed one civilian and wounded six others. Another IED blast exploded on the road on 13 March. “ISIS has still capabilities, and are hidden among civilians. You cannot see them, but this is the most difficult. On the ground you can fight them, but when they are hidden, it’s a difficult mission.”

“Off course, stability is not in the favour of the regime, Daesh [the Arabic acronym for ISIS], and Turkey, they don’t want stability here,” Darwish said in a recent interview.

The security of Manbij is especially threatened by the nearby presence of areas under the control of Turkey. Idlib, which has Turkish army observation points, is under control of the Al Qaida affiliate Hay'at Tahrir al-Sham (HTS). The former US envoy against ISIS in 2017 called Idlib the biggest safe haven for Al Qaida since 9/11.

However, the presence of the Turkish army prevents a Syrian or Russian operation to clear out the province from Al Qaida. So far, Turkey nor Turkish-backed rebels have done much to clear out the province from Jihadists. Also ISIS is present in Idlib as well. Several ISIS members were reportedly evacuated to Idlib by the Syrian regime, and have carried out attacks in Idlib against HTS targets. Moreover, the territories from Afrin to Jarabulus and Bab are under direct control of Turkey, or de-facto annexed by Turkey. Among the Turkish-backed forces are also extremist Salafist groups such as Ahrar al-Sharqiya, which claimed an attack on an SDF Humvee on 9 January 2019. In addition ISIS members have joined Turkish-backed groups. The leader of the Hamza Brigade, Saif Abu Bakr, who wants to fight the SDF in the east of Euphrates on behalf of Turkey, is a former ISIS member from Al-Bab according to a Foreign Policy piece.

According to Manbij official Shervan Derwish, the person who carried out the attack on US soldiers came from al-Bab.

“We don’t have definitive proof, but our expectation is that he came from Bab. In general, ISIS members that want to run away go to Idlib,” he said, referring to ISIS fighters that in January asked the SDF safe passage from Baghouz to Turkey or Idlib through smugglers. A demand which was refused by the SDF.

“Other members that want to come and join ISIS come from Idlib and the Euphrates Shield area,” he added.

As a result of these developments, the area under Turkish is an incubator for extremists, and poses a major threat to the security of Manbij, and coalition forces present there. This will continue unless Turkey deals with Jihadist and Salafist groups such as HTS, the extremist Ahrar al-Sham group, ISIS remnants and Ahrar al-Sharqiya in Idlib and northern Aleppo.



The car of Sherva Darwish which was hit by an IED (screenshot)


Plausible deniability

Turkey, Iran and the Syrian government have an interest in destabilizing the northeast of Syria, and oppose a presence of the US-led coalition in the areas under control of the Kurdish-led Syrian Democratic Forces (SDF).

It would be easy for states to hire locals or former ISIS members, which would give them plausible deniability, especially since most attacks are claimed by ISIS. Turkey and the regime could have also infiltrated some sleeper cells that could direct attacks against SDF forces.


"Some regional powers use the sleeper cells of ISIS for political gains."

Shiyar Mohammed, the co-president of Tabqa’s executive council, said in an interview that, “some regional powers use the sleeper cells of ISIS for political gains. There is a real Turkish threat, the Russian, Iranians and Assad are still working on some areas.”

Both Turkey and Damascus have been blamed for certain assassinations. Some of the assassinations have also not been claimed by ISIS.

On 15 March, a ceremony was held for Omar Alloush, a senior official who was killed one year ago on 15 March 2018, with the presence of officials of the US-led coalition.

Local officials suspect Turkey killed him since he played a major role in setting up local administrations and bringing Kurds and Arabs together. He was the main force behind the Raqqa Civil Council. Nevertheless, no definitive proof has been presented for this claim. However, the Turkish-backed group Qiyam group attempted to assassinate Raqqa official Ibrahim Hassan in his home on January 11, 2018, in a similar style to the killing of Alloush. In June, 2018, the SDF carried out operations against Qiyam in Raqqa.

The Syrian Observatory for Human Rights (SOHR), said last year that the SDF arrested 6 suspects in Raqqa, that were found in the possession of $100,000, that was reportedly the money paid for carrying out the assassination. Alloush was not the only one killed. On 2 November 2018, Raqqa tribal leader Bashir Faisal al-Huwaidi was assassinated in his vehicle in Raqqa. According to SOHR he was killed by the person riding with him in his car. Although ISIS claimed the attack, one senior official told me in December last year that the regime could have been behind it.

Local sources say the regime blames him for handing over regime forces in Raqqa to the FSA, who were later executed. The regime and Turkey have also their own proxy groups that were allegedly involved in attacks. Turkey has supported an FSA group called Harakat al-Qiyam, reportedly created in August 2017, has carried out several assassinations against SDF fighters and local administrators. However, its social media presence has decreased since last year.


A cemetery in Hazime countryside of Raqqa. (Wladimir Van Wilgenburg)

Syrian regime ‘resistance’ threat

Apart from Turkey, the Syrian government and Iran support the so-called tribal ‘Popular Resistance in the Eastern region’ created on 26 February 2018, that has claimed attacks against the US-backed SDF in the Raqqa province in February 2019. On 14 March, the group claimed to have used an IED targeting a US military convoy.

“We support these resistance forces based on our national role as a government,” the Syrian president Bashar Assad said on June 13, 2018.

Moreover, on 6 April 2018 the Iranian-backed Baqir militia said it would launch Jihadist attacks against US forces in northeastern Syria. The Syrian government is also unhappy with the Trump administration decision in February to keep a residual number of troops in Syria, despite of the US withdrawal.

Syria’s defense minister Gen. Ali Ayoub on 18 March slammed what he called the “illegitimate” US military presence, and vowed the right of self-defense. The use of insurgent cells to target US forces might be the only option that the Syrian government and Iran has to pressure the US and the SDF forces, since it's not able to militarily challenge the SDF and the US-backed forces on the ground. The Syrian government was not able to stop the Syrian Kurds from cementing their control, and lost clashes in Qamishli in April 2016 and Hasakah in August 2016.


The regime and Iranian-backed elements also failed in attempts to take oil fields from the US-backed SDF in February 2018. Up to 200-300 pro-Syrian regime fighters, including Russian mercenaries, and members of the pro-Iranian-backed Baqir Brigade were killed in February 2018, when they tried to take oil fields from the US-backed SDF. Also in September 2018, 11 regime fighters were killed at a checkpoint in the city of Qamishli, which led to anger among Alawite supporters of the regime, since most of those killed were from Alawite areas.


ISIS members surrender at Baghouz. (Wladimir Van Wilgenburg)


The MERV sleeper cell threat

A bigger threat to the SDF and US coalition forces, are active ISIS cells in the countryside of Deir Ezzor in the Middle Euphrates River Valley (MERV), an area which will be difficult to control even after the defeat of ISIS in Baghouz.

In February, an ISIS attack left 14 dead near a Syrian oil field, a few kilometers away from SDF bases where US soldiers are also present amidst ongoing operations in Baghouz.

“Hopefully, they will be finished. There we couple of them here, they were arrested,” one civilian near the town of al-Suwar told the author in Deir Ezzor’s countryside.

“There were a few explosions by sleeper cells. Tunisians, other nationalities, and people from the area too. When Baghouz is finished, they [SDF] will have more time to take care of the cells.”

One SDF official said the area around Margada in the countryside east of Deir Ezzor is not finished being cleared of ISIS threats, and he warned me not to interview civilians in this area. “Don’t stop your car there, even not at a speed bump.”

He expected that after the defeat of ISIS in Baghouz is completed, the SDF and internal security forces will focus on cleaning sleeper cells in the area. “This area is not cleared yet.” According to Riyad Derrar, the co-chair of the Syrian Democratic Council (SDC), the area in the countryside of Deir Ezzor was like a ‘storage of Salafi [movements]’ in the past. Another SDF member from Deir Ezzor said that the Islamist Muslim Brotherhood also had a presence in Deir Ezzor in the past.

“There is a need for more services so that the local population will trust the new rules,” Derrar said.

Moreover, before the Syrian crisis in 2011, the Syrian government also allowed Jihadist cells to cross the Syrian border in Deir Ezzor to infiltrate Iraq from where they attacked US troops. Those same cells in Syria, later joined ISIS, and could become active again.

With the defeat of ISIS in Baghouz the group still controls a pocket in the Homs and Deir Ezzor desert, although the areas is cordoned off by regime forces. According to a timely op-ed in the New York Times by Hassan Hassan, a resident fellow at the Tahrir Institute for Middle East Policy and an author of “ISIS: Inside the Army of Terror”, ISIS could retreat to the desert after military defeats, and prepare for a comeback, just as they did between 2007 and 2013.

Currently, ISIS is still carrying out attacks from the desert against the Syrian government. This pocket could also pose a threat of infiltration to SDF-held areas in the future.


An ISIS member gestures after she surrendered in Baghouz (Wladimir Van Wilgenburg)

Raqqa’s ongoing instability

Even the Raqqa, that used to be the capital of the Islamic State, and was liberated in October 2017, is still facing security incidents from Islamic state remnants in Raqqa.

When visiting Raqqa in August 2018, there was still an ISIS flag in one destroyed building. Members of Raqqa Civil Council's Emergency Intervention Units that are responsible for digging up bodies in mass graves, said the flag kept on coming back, despite the fact they removed it several times.

There were also several attacks in Raqqa, even recently. On 3 March, ISIS launched an attack targeting tribal leaders and the SDF in the Jadeedat al-Khabur village, in the countryside of Raqqa, killing four. Moreover, on 4 March, the SDF arrested an ISIS attacker riding a motorcycle with a suicide belt.

Zakaria, a member of the Raqqa’s Internal Security Forces, therefore last Monday, that 15 days ago motor cycles were banned in Raqqa by the local authorities. According to Abu Mohammed (52) a local civilian in Raqqa city, the ISIS sleeper cells are locals. “They found a lot of wigs, and fake beards. The SDF are arresting them from their houses.”

ISIS was not only using the motorcycles for killings, but also stealing. “They knocked on a door, pretending to be electricity generator owner, they opened the door, they put a gun in his face, tied up all his relatives, and took all the money, and a cell phone charger.” However, a SDF patrol saw the perpetrators, their faces covered. He was carrying a firearm. “They shot at them, and three of them were killed.”

Another civilian Abu Tawfiq (62) in Raqqa said despite the ban affected the people, it's more secure. He said ISIS sleeper cells use motors “to shoot at some one, and then they flee.”


A flag with the logo of the Internal Security Forces. (Wladimir Val Wilgenburg)

Concluding remarks

The recent sleeper cell attacks show that even after the ISIS caliphate is defeated, the threat of cells will remain. This is especially true in the Arab majority areas liberated from ISIS. ISIS could also use desert areas in Deir Ezzor’s countryside to infiltrate and carry out attacks.

Turkey and the Iranian-backed Syrian regime could also use proxy groups or hired assassins to target the SDF, or even coalition troops, as shown by the January attack in Manbij that killed 4 US citizens. States opposed to the SDF and US role would not shy away from paying locals to carry out attacks. It is difficult to prove the involvement of states in such attacks. In general, such attacks will always be blamed on ISIS.

While the Syrian regime wants to regain all of the territory in the northeast Syria, Turkey wants the SDF to be eliminated, seeing it as an existential security threat linked to the Kurdistan Workers Party (PKK), although Syria’s Kurds deny that they are PKK.

Turkey fears any success of the Kurds in Syria could inspire or encourage Kurds in Turkey to demand more rights of their own. If relations between the SDF and Turkey are not improved, after Baghouz, Turkey will continue to have an interest to create instability in northeastern Syria.

Local officials from SDF-backed councils in Arab majority areas say there is a need for more support to prevent an ISIS resurgence. Thus, on 2 March, Layla Hassan, the co-head of the Deir Ezzor Civil Council, said although ISIS is almost defeated in Baghouz, there is the threat of sleeper cells. “Hopefully, we will work together and end the sleeper cells.”

Also in February, the SDF’s Military Council on 17 February said they will target the ISIS sleeper cells after Baghouz is finished through precise “military and security campaigns” with support from the US-led coalition.

There is also a need to support de-radicalization projects and aid for displaced people in the northeast, especially for the 68,000 hardline foreign, and local female ISIS supporters and their children. Most of them came from Al-Baghouz after they surrendered and the women and children are now in al-Hawl camp. They could possible pave the way for the next generation of ISIS 2.0, local officials fear. It would be wise for the US-led coalition therefore to continue their presence, and keep as many as troops as possible in the northeast of Syria to prevent an ISIS resurgence. Furthermore, although the US-led coalition is only focused on stabilization in eastern Syria, and not reconstruction, more aid should be provided to prevent possible grievances among residents that could be exploited by Jihadist groups, Turkey and the Syrian regime to recruit militant cells to target the SDF.


*This article, with an option to download a PDF can also be accessed on its own page here.


1,057 views0 comments
bottom of page