Fragmented Threats: The Damascus Church Attack and the New Face of IS

Executive Summary

On the evening of 22 June 2025, in the Al-Dwaila district of Damascus, an armed individual carrying an AK-47-type rifle infiltrated St. Eliagia Church during evening services. The attacker fatally shot multiple worshippers before detonating an explosive device, which killed 26 people (including the attacker) and injured 62 others.

Two Syrian Internal Security (SIS) members guarded the church. They attempted to engage the attacker but quickly became overpowered. Eyewitnesses confirmed to Damas Security that the attacker reached the main hall without facing effective resistance.

Security forces responded promptly and secured the area. Emergency medical teams performed on-site triage and evacuated the wounded.

Attack path at St. Eliagia Church: Attacker entered through perimeter fence (1), proceeded to main door (2), and detonated device in hall (3). Path reconstructed from CCTV footage.

On 24 June, the previously elusive group Saraya Ansar al-Sunnah (SAS) claimed responsibility, identifying the bomber as Muhammad Zain al-Abidin and framing the attack as retaliation for the government’s ban on unapproved dawa (proselytization) in the neighborhood. Notably, the ban had been imposed after Salafists attempted to proselytize outside St. Eliagia Church in late March. This incident highlights a possible motive for the targeting of St. Eliagia Church

The 22 June attack is the first confirmed person-borne improvised explosive device (PBIED) attack in Syria since the fall of the Assad regime. The target selection, timing, and tactics indicate premeditated planning with a strong ideological component. The attack aligns with warnings outlined in Damas Security’s June 2025 report, “Syria’s Security Vacuum and the Reawakening of the Islamic State,” which predicted a resurgence of IS-linked activities in government-held areas where institutional oversight has deteriorated.

Security Lapses

A preliminary analysis was conducted by Damas Security based on CCTV footage and eyewitness testimonies, revealing critical vulnerabilities in the church’s protective measures. Security had been limited to two SIS personnel, who appeared inadequately trained and poorly equipped to counter an armed assault. SIS personnel failed to immediately challenge the attacker, who was openly carrying a weapon.

This lapse occurred despite prior intelligence alerts, including warnings reportedly issued by foreign stakeholders concerning the resurgence of extremist elements within Syria. Additionally, the escalation in attacks against Christian communities across the country since December 2024 should have been met with the implementation of heightened protective measures.

Targeted Attacks on Christian Sites (Post-December 2024)

Since 8 December 2024, the country witnessed a pattern of targeted violence against Christian sites, which caused some damages but did not appear to have led to any casualties, including:

• 11 December 2024: Hagia Sophia Greek Orthodox Church in Al-Sqibliya (northwest Hama) was vandalized, with religious symbols defaced and property damaged.

• 18 December 2024: Saint George Greek Orthodox Church in Hama City was struck by gunfire from a passing vehicle. The following day, a second church in the city was attacked, with assailants attempting to remove icons and firing multiple rounds before fleeing.

• 10 April 2025: St. George Church in Bloudan was targeted by masked individuals who poured gasoline through a broken window and threw two grenades inside. The fire was contained, and the grenades failed to detonate. General Security Services launched an investigation.

• 8 June 2025: Um al-Zennar Church in Homs, one of the oldest Christian churches globally, was fired at, as captured by surveillance footage. No injuries were reported.

These incidents demonstrate an escalating threat environment, necessitating a nationwide reassessment of security protocols—particularly for prominent sites such as St. Eliagia Church.

Operational Response and Arrests

On 23 June 2025, within 24 hours of the attack, the Ministry of Interior (MoI) conducted counterterrorism raids in Harasta and Kafar Batna (rural Damascus), resulting in five arrests and two fatalities during an exchange of fire. According to MoI statements, the cell was composed of eight operatives, including the attacker.

Map displaying the locations of Kafr Batna and Harasta

Image released by MoI showing seized explosive device from counter-IS operation. Device appears to be a modified landmine with visible wiring, indicating improvised conversion to command-detonated IED.

On 24 June, an MoI spokesperson revealed that two cell members were foreign nationals: one was the deceased PBIED attacker, while the other was allegedly preparing an attack on the Sayyida Zainab shrine near Damascus, a major Shiite pilgrimage site.

The rapid and precise operation raised questions about whether MoI possessed intelligence about the imminence of an attack. Analysts speculated that the cell may have been under partial surveillance, though the attack’s timing and location were not anticipated.

The Syrian government attributed the attack to IS, asserting that the two individuals—asserting that the two foreign nationals—had previously been detained in Al-Hol camp. They proceeded to infiltrate southern Syria following the collapse of the Assad regime and subsequent security vacuum.

However, this claim was contested by the Syrian Democratic Forces (SDF), which maintained that Al-Hol currently accommodates exclusively women and children and denied any record of the named attackers’ presence.

Subsequently, a leaked aid distribution list bearing the name of Blumont, an international aid organization operating in Al-Hol, circulated on social media. The document purportedly identified the attackers as recipients of humanitarian assistance.

These claims were accompanied by additional allegations that SDF forces had raided Blumont's headquarters in Hasakah, detaining 30 staff members in an attempt to force the organization to publicly disavow any connection between the attackers and the camp. Blumont subsequently issued a statement categorically denying these allegations, while Damas Security's independent field investigation conclusively determined that both the reported mass arrests and the leaked distribution list were complete fabrications.

While the attackers’ ideological alignment with IS appears plausible, it must be noted that the Islamic State now functions as a decentralized ideological brand. Unlike past operations requiring formal allegiance, modern militants may adopt IS tactics and messaging without direct affiliation—a likely scenario for Ansar al-Sunnah.

Broader Implications: Uncontrolled Groups and Security Decay

Following the collapse of the Assad regime, Syria has witnessed the emergence of “uncontrolled groups”—militias previously affiliated with opposition factions that have failed to integrate effectively under the Ministry of Defence (MoD). Operating outside formal command structures and defying government authority, these groups have been implicated in large-scale violence, including:

• March 2025 (Syrian Coast): Coordinated assaults on SIS units resulted in over 300 deaths. The government’s heavy-handed response—including summary executions—led to over 1,000 civilian deaths, predominantly from the Alawite community. A special investigative committee was later formed.

• May 2025 (Jaramana and Jdaidat Syhnaya): Similar violence erupted in these Druze-majority areas, with reports of extrajudicial killings and security failures. The government again blamed “uncontrolled groups” and pledged investigations.

Though not officially linked to IS, these incidents share operational similarities with IS-style attacks, suggesting ideological and tactical overlap among local actors.

Additionally, continued U.S led coalition strikes—such as the 10 June 2025 operation eliminating four Hurras al-Din members—underscore the persistence of extremist networks in Syria, capable of influencing domestic factions.

Strategic Forecast

The attack on St. Eliagia Church has underscored the accelerating deterioration of Syria’s security environment, in which complex attacks are increasingly being carried out by decentralized extremist groups and uncontrolled militias. A convergence has been observed among remnants of the Islamic State, local jihadist factions, and rogue armed elements—entities that continue to share tactics, ideological narratives, and access to extensive arms caches throughout Syria. As a result, coordinated operations targeting high-profile sites are likely to be pursued, with the intent of inflaming sectarian tensions.

It is anticipated that international actors—most notably the U.S.-led coalition—will escalate counterterrorism operations should the frequency or severity of attacks increase. However, the execution of unilateral strikes risks inflaming tensions with local partners and may unintentionally strengthen extremist narratives.

Over the medium term, the absence of a unified security architecture will continue to be exploited by extremist actors. Religious sites, minority communities, and symbolic infrastructure will remain high-value targets for groups seeking to provoke sectarian conflict and undermine national stabilization initiatives. While the adoption of preemptive security measures, improved cross-border intelligence coordination, and counter-radicalization programs will be essential in mitigating risk, durable improvements are unlikely to be achieved in the absence of meaningful political reconciliation and structural institutional reform. Syria’s security vacuum is therefore expected to persist as a critical enabler of renewed insurgent activity.