Moroccan and Spanish authorities on March 25 collaborated to arrest three suspected Islamic State group members: two in Tangier, one on Mallorca, Spain’s largest island.
The suspect in Spain is accused of planning a solo attack, while the suspects in Morocco allegedly provided funding and logistical support to fighters linked to the Islamic State group in Somalia (ISSOM) and other IS branches in the Sahel region, the Morocco World News newspaper reported.
Analysts say ISSOM, in particular, is keen to expand beyond its base in the country’s autonomous Puntland region through propaganda, online radicalization and recruitment efforts from its Al-Karrar base. Located in Puntland, Al-Karrar is a key logistical and financial hub for the IS globally.
According to security expert Lucas Webber, editor-in-chief of militantwire.com, ISSOM continues to “operate as a regional and transnational command, financial, and propaganda hub with a history of international recruitment, overseas facilitation, and plots,” which “underpins its emerging role as a concrete external operations threat, particularly to Europe and North America.” External operations refer to activities conducted outside the territory a group controls. IS has a history of hatching deadly overseas terror plots, including 2015 Paris attacks, bombings in Brussels the following year and a 2024 attack in Moscow.
These are reasons why the recent arrests in Morocco and Spain are a “warning sign” of how ISSOM’s international reach could translate into diverse, hard-to-predict attacks, said Webber, who is also a senior intelligence analyst at Tech Against Terrorism and a senior research fellow at the Soufan Center think tank.
Emerging ‘Cybercaliphate’
Terrorists are using technology to expand their influence. IS propaganda units often construct or alter historical narratives to suit the group’s motives, and its recruitment efforts, which often target diaspora communities and prisoners. This is done online via Facebook and YouTube, and through social media platforms such as Instagram, Telegram, Twitter and WhatsApp.
“This extensive use of cyber media to support jihadist ends has led to the coining of the term ‘cybercaliphate’ to refer to the network woven by [the IS] on the internet,” analyst Paula Las Heras wrote for the University of Navarra in Spain. “This network is professionally structured, with individual jihadists forming their own multilingual production agencies and digital magazines. On Twitter and Telegram there are accounts that are easy to identify and are dedicated to military training or to publishing jihadist material.”
IS video games are also known to highlight terror acts such as suicide bombings and are used to support violence against a state or political figures, Las Heras added.
According to Mohamed, an analyst with the Armed Conflict Location and Event Data (ACLED) project, ISSOM funds it operations mostly through extortion and illicit taxation of local businesses. In the strategic coastal town of Bosaso, for example, the group reportedly demanded up to $500,000 from local businesses in 2023. Bosaso’s location facilitates arms trafficking between Yemen and Somalia, while long-standing weapons smuggling outfits still operate across coastal regions in Somalia.
ISSOM also recruits defectors from al-Shabaab and “enjoys support from local communities, including the prominent sub-clans of the Majeerteen clan, especially the Ali Saleban sub-clan in the Bari region, which the group’s leader, Abdulkadir Mumin, is from,” Mohamed said in a September 2025 interview on ACLED’s website.
ISSOM Fighters Killed in Recent Battle
Puntland forces have scored recent victories against IS. On April 22, officials displayed the bodies of more than 10 suspected ISSOM fighters killed in the Calmiskaad Mountains. Military officials said the militants belonged to cells that had recently carried out attacks on Puntland security forces, adding that the group had killed one Puntland Soldier the previous night, Somali news website Hiiran Online reported.
Also on April 22, Puntland President Said Abdullahi Deni appointed Lt. Col. Mohamud Shire Mohamed as the new commander of security forces operating in the Calmiskaad Mountains, according to Puntland’s Horseed Media news organization.
According to the Somaliland Standard news organization, ISSOM resumed operations in the mountains recently after most Puntland troops withdrew from the front lines. Security sources said the group has reinstituted logistics and food supply networks, while units responsible for planting land mines have resurfaced. A recent land mine explosion in the mountains killed eight local Soldiers.