top of page

Analysis: The threat of sleeper cells continues after ISIS territorial defeat in Syria

• By Wladimir Van Wilgenburg •  March 23, 2019 

With the liberation of the last ISIS pocket in Baghouz (Baghuz) in the Deir Ezzor (Deir ar Zour) province of Syria, the threat of sleeper cells of the Islamic state continues, especially in Arab majority areas recently liberated from the ISIS. Local officials therefore ask for continued coalition support to prevent the resurgence of ISIS.

Based on exclusive interviews in eastern Syria, this article looks at challenges emerging in 2019. 


Raqqa's Internal Security Forces (Wladimir Van Wilgenburg)

The sleeper cell threat by ISIS and the use of assassins by regional states could also threaten coalition troops after the territorial defeat of ISIS in Baghouz which was announced on March 23, 2019.

The sleeper cell attacks increased, after US president Donald Trump’s announcement that the US would withdraw its troops in December. “The sleeper cells became more active in Manbij, Shadadi, and Raqqa,” Layla Mohammed, the co-head of the Raqqa Civil Council said in an interview.

On Jan. 16, a suicide attack in Manbij left 19 people dead, including four Americans. Two Syrian Democratic Forces (SDF) fighters were also killed in the explosion. “We are seeing an increase in attacks, including assassination attempts, kidnapping, and ransom activities in some areas of Iraq and Syria,” Colonel Sean Ryan, the spokesman of the US-led coalition fighting the Islamic State (IS) group, confirmed. “It is difficult to say if they are coming from actual ISIS sleeper cells or just other individuals filling the void left by ISIS, to create havoc and extort money, so no exact number, but there has been an increase since December,” he confirmed.

A Pentagon report released in February this year warned that, “ISIS may conduct opportunistic attacks on US personnel as they withdraw but will leverage the event as a 'victory' in its media.” Manbij’s fragile security On 15 March, five ISIS members that were planning to carry out attacks in the city of Manbij were arrested. Moreover, on 19 March, suspects that were involved in 16 January attack in Manbij targeting US soldiers were also arrested after an investigation. Assassinations have especially targeted senior officials of the SDF, local Arab fighters of the SDF, tribal leaders working with the SDF, and administration officials that played a role in improving relations between the Kurds, and Arabs in northeastern Syria. The goal of these attacks is to undermine the stability in the northeast of Syria, and to force the US forces to leave.

“ISIS is still dangerous, even after Baghouz,” says Sharvan Darwish, the spokesperson of the Manbij Military Council (MMC) during an interview on 26 February, who himself survived an assassination attempt in February 2018.

“ISIS stayed for years in Manbij, Raqqa, and other areas, and created a base.”

Darwish's driver was targeted on 9 March, 2019 by an IED blast that killed one civilian and wounded six others. Another IED blast exploded on the road on 13 March. “ISIS has still capabilities, and are hidden among civilians. You cannot see them, but this is the most difficult. On the ground you can fight them, but when they are hidden, it’s a difficult mission.”

“Off course, stability is not in the favour of the regime, Daesh [the Arabic acronym for ISIS], and Turkey, they don’t want stability here,” Darwish said in a recent interview.

The security of Manbij is especially threatened by the nearby presence of areas under the control of Turkey. Idlib, which has Turkish army observation points, is under control of the Al Qaida affiliate Hay'at Tahrir al-Sham (HTS). The former US envoy against ISIS in 2017 called Idlib the biggest safe haven for Al Qaida since 9/11.

However, the presence of the Turkish army prevents a Syrian or Russian operation to clear out the province from Al Qaida. So far, Turkey nor Turkish-backed rebels have done much to clear out the province from Jihadists. Also ISIS is present in Idlib as well. Several ISIS members were reportedly evacuated to Idlib by the Syrian regime, and have carried out attacks in Idlib against HTS targets. Moreover, the territories from Afrin to Jarabulus and Bab are under direct control of Turkey, or de-facto annexed by Turkey. Among the Turkish-backed forces are also extremist Salafist groups such as Ahrar al-Sharqiya, which claimed an attack on an SDF Humvee on 9 January 2019. In addition ISIS members have joined Turkish-backed groups. The leader of the Hamza Brigade, Saif Abu Bakr, who wants to fight the SDF in the east of Euphrates on behalf of Turkey, is a former ISIS member from Al-Bab according to a Foreign Policy piece.

According to Manbij official Shervan Derwish, the person who carried out the attack on US soldiers came from al-Bab.

“We don’t have definitive proof, but our expectation is that he came from Bab. In general, ISIS members that want to run away go to Idlib,” he said, referring to ISIS fighters that in January asked the SDF safe passage from Baghouz to Turkey or Idlib through smugglers. A demand which was refused by the SDF.

“Other members that want to come and join ISIS come from Idlib and the Euphrates Shield area,” he added.

As a result of these developments, the area under Turkish is an incubator for extremists, and poses a major threat to the security of Manbij, and coalition forces present there. This will continue unless Turkey deals with Jihadist and Salafist groups such as HTS, the extremist Ahrar al-Sham group, ISIS remnants and Ahrar al-Sharqiya in Idlib and northern Aleppo.

Plausible deniability

Turkey, Iran and the Syrian government have an interest in destabilizing the northeast of Syria, and oppose a presence of the US-led coalition in the areas under control of the Kurdish-led Syrian Democratic Forces (SDF).

It would be easy for states to hire locals or former ISIS members, which would give them plausible deniability, especially since most attacks are claimed by ISIS. Turkey and the regime could have also infiltrated some sleeper cells that could direct attacks against SDF forces.

Shiyar Mohammed, the co-president of Tabqa’s executive council, said in an interview that, “some regional powers use the sleeper cells of ISIS for political gains. There is a real Turkish threat, the Russian, Iranians and Assad are still working on some areas.”

Both Turkey and Damascus have been blamed for certain assassinations. Some of the assassinations have also not been claimed by ISIS.

On 15 March, a ceremony was held for Omar Alloush, a senior official who was killed one year ago on 15 March 2018, with the presence of officials of the US-led coalition.

Local officials suspect Turkey killed him since he played a major role in setting up local administrations and bringing Kurds and Arabs together. He was the main force behind the Raqqa Civil Council. Nevertheless, no definitive proof has been presented for this claim. However, the Turkish-backed group Qiyam group attempted to assassinate Raqqa official Ibrahim Hassan in his home on January 11, 2018, in a similar style to the killing of Alloush. In June, 2018, the SDF carried out operations against Qiyam in Raqqa.

The Syrian Observatory for Human Rights (SOHR), said last year that the SDF arrested 6 suspects in Raqqa, that were found in the possession of $100,000, that was reportedly the money paid for carrying out the assassination. Alloush was not the only one killed. On 2 November 2018, Raqqa tribal leader Bashir Faisal al-Huwaidi was assassinated in his vehicle in Raqqa. According to SOHR he was killed by the person riding with him in his car. Although ISIS claimed the attack, one senior official told me in December last year that the regime could have been behind it.

Local sources say the regime blames him for handing over regime forces in Raqqa to the FSA, who were later executed. The regime and Turkey have also their own proxy groups that were allegedly involved in attacks. Turkey has supported an FSA group called Harakat al-Qiyam, reportedly created in August 2017, has carried out several assassinations against SDF fighters and local administrators. However, its social media presence has decreased since last year.

Syrian regime ‘resistance’ threat

Apart from Turkey, the Syrian government and Iran support the so-called tribal ‘Popular Resistance in the Eastern region’ created on 26 February 2018, that has claimed attacks against the US-backed SDF in the Raqqa province in February 2019. On 14 March, the group claimed to have used an IED targeting a US military convoy.

“We support these resistance forces based on our national role as a government,” the Syrian president Bashar Assad said on June 13, 2018.

Moreover, on 6 April 2018 the Iranian-backed Baqir militia said it would launch Jihadist attacks against US forces in northeastern Syria. The Syrian government is also unhappy with the Trump administration decision in February to keep a residual number of troops in Syria, despite of the US withdrawal.

Syria’s defense minister Gen. Ali Ayoub on 18 March slammed what he called the “illegitimate” US military presence, and vowed the right of self-defense. The use of insurgent cells to target US forces might be the only option that the Syrian government and Iran has to pressure the US and the SDF forces, since it's not able to militarily challenge the SDF and the US-backed forces on the ground. The Syrian government was not able to stop the Syrian Kurds from cementing their control, and lost clashes in Qamishli in April 2016 and Hasakah in August 2016.

The regime and Iranian-backed elements also failed in attempts to take oil fields from the US-backed SDF in February 2018. Up to 200-300 pro-Syrian regime fighters, including Russian mercenaries, and members of the pro-Iranian-backed Baqir Brigade were killed in February 2018, when they tried to take oil fields from the US-backed SDF. Also in September 2018, 11 regime fighters were killed at a checkpoint in the city of Qamishli, which led to anger among Alawite supporters of the regime, since most of those killed were from Alawite areas.

The MERV sleeper cell threat

A bigger threat to the SDF and US coalition forces, are active ISIS cells in the countryside of Deir Ezzor in the Middle Euphrates River Valley (MERV), an area which will be difficult to control even after the defeat of ISIS in Baghouz.

In February, an ISIS attack left 14 dead near a Syrian oil field, a few kilometers away from SDF bases where US soldiers are also present amidst ongoing operations in Baghouz.

“Hopefully, they will be finished. There we couple of them here, they were arrested,” one civilian near the town of al-Suwar told the author in Deir Ezzor’s countryside.

“There were a few explosions by sleeper cells. Tunisians, other nationalities, and people from the area too. When Baghouz is finished, they [SDF] will have more time to take care of the cells.”

One SDF official said the area around Margada in the countryside east of Deir Ezzor is not finished being cleared of ISIS threats, and he warned me not to interview civilians in this area. “Don’t stop your car there, even not at a speed bump.”

He expected that after the defeat of ISIS in Baghouz is completed, the SDF and internal security forces will focus on cleaning sleeper cells in the area. “This area is not cleared yet.” According to Riyad Derrar, the co-chair of the Syrian Democratic Council (SDC), the area in the countryside of Deir Ezzor was like a ‘storage of Salafi [movements]’ in the past. Another SDF member from Deir Ezzor said that the Islamist Muslim Brotherhood also had a presence in Deir Ezzor in the past.

“There is a need for more services so that the local population will trust the new rules,” Derrar said.

Moreover, before the Syrian crisis in 2011, the Syrian government also allowed Jihadist cells to cross the Syrian border in Deir Ezzor to infiltrate Iraq from where they attacked US troops. Those same cells in Syria, later joined ISIS, and could become active again.

With the defeat of ISIS in Baghouz the group still controls a pocket in the Homs and Deir Ezzor desert, although the areas is cordoned off by regime forces. According to a timely op-ed in the New York Times by Hassan Hassan, a resident fellow at the Tahrir Institute for Middle East Policy and an author of “ISIS: Inside the Army of Terror”, ISIS could retreat to the desert after military defeats, and prepare for a comeback, just as they did between 2007 and 2013.

Currently, ISIS is still carrying out attacks from the desert against the Syrian government. This pocket could also pose a threat of infiltration to SDF-held areas in the future.

Raqqa’s ongoing instability

Even the Raqqa, that used to be the capital of the Islamic State, and was liberated in October 2017, is still facing security incidents from Islamic state remnants in Raqqa.

When visiting Raqqa in August 2018, there was still an ISIS flag in one destroyed building. Members of Raqqa Civil Council's Emergency Intervention Units that are responsible for digging up bodies in mass graves, said the flag kept on coming back, despite the fact they removed it several times.

There were also several attacks in Raqqa, even recently. On 3 March, ISIS launched an attack targeting tribal leaders and the SDF in the Jadeedat al-Khabur village, in the countryside of Raqqa, killing four. Moreover, on 4 March, the SDF arrested an ISIS attacker riding a motorcycle with a suicide belt.

Zakaria, a member of the Raqqa’s Internal Security Forces, therefore last Monday, that 15 days ago motor cycles were banned in Raqqa by the local authorities. According to Abu Mohammed (52) a local civilian in Raqqa city, the ISIS sleeper cells are locals. “They found a lot of wigs, and fake beards. The SDF are arresting them from their houses.”

ISIS was not only using the motorcycles for killings, but also stealing. “They knocked on a door, pretending to be electricity generator owner, they opened the door, they put a gun in his face, tied up all his relatives, and took all the money, and a cell phone charger.” However, a SDF patrol saw the perpetrators, their faces covered. He was carrying a firearm. “They shot at them, and three of them were killed.”

Another civilian Abu Tawfiq (62) in Raqqa said despite the ban affected the people, it's more secure. He said ISIS sleeper cells use motors “to shoot at some one, and then they flee.”

bottom of page