ISIS Killed Three Americans in Syria: Inside the Islamic State's Dangerous Resurgence

Watch the Episode

Video originally published on December 17, 2025.

On December 13th, a lone gunman acting on behalf of the Islamic State opened fire at a Syrian military base in Palmyra, killing three Americans and wounding six others. The attacker, who had infiltrated local security forces just two months prior, was a suspected ISIS affiliate under surveillance—and was scheduled to be removed just one day after he carried out his deadly assault. The victims included two National Guard soldiers from Iowa and a civilian interpreter, marking the first US combat deaths in Syria since President Trump's second term began. But this attack was far from an isolated incident. It was part of a coordinated weekend of violence that saw ISIS operatives kill four Syrian security personnel in Idlib and inspire a mass shooting at Australia's Bondi Beach that left sixteen dead. For close observers of the Middle East, these attacks represent something far more alarming than a single tragedy: they signal that the Islamic State, after years of lying low and learning from its defeats, is in the midst of a calculated and dangerous comeback across Syria.

Key Takeaways

The Islamic State is actively reconstituting itself across Syria, adding new recruits, expanding into new territories, and infiltrating Syrian state institutions.

Over the past year, ISIS has evolved into a more decentralized, operationally sophisticated organization that has learned from its earlier defeats.

Hundreds of ISIS loyalists may have infiltrated Syria's military and security services through rushed recruitment and insufficient vetting processes.

The group is planning prison breaks targeting camps holding roughly 25,000 refugees and over 8,000 ISIS fighters, with multiple jailbreak attempts already thwarted in 2025 alone.

Syria's post-civil war chaos—characterized by a weak central government, disorganized security forces, and reduced international presence—has created ideal conditions for ISIS to thrive.

The December 13th attack in Palmyra demonstrates how a single infiltrator can achieve multiple strategic objectives: accelerating US withdrawal, eroding trust in Syrian forces, and forcing governments to expend massive resources on counterterrorism.

The Attack in Palmyra: A Security Failure with Deadly Consequences

The ancient city of Palmyra carries deep significance for the Islamic State. Before Syria's civil war, it stood as a major historical site, but from 2015 to 2017, ISIS controlled the city for nearly two years. During that occupation, Islamic State fighters systematically destroyed major historical monuments and well-preserved structures, claiming the destruction was necessary to eliminate Syria's cultural heritage while simultaneously pillaging valuables to fund their war effort. Though the city was eventually recaptured by the Assad regime, partially restored, and later passed into the hands of Syria's new transitional government, Palmyra remains located in an area where ISIS cells are known to maintain active operations.

On December 13th, US forces and their Syrian security partners were operating from a base in Palmyra when the attack occurred. Among the personnel on that base was a man who had joined Syria's Interior Ministry approximately two months earlier. He initially worked as a base security guard before being reassigned to a local security unit just days before the shooting. This reassignment was not routine—Syrian officials had identified him as a suspected Islamic State affiliate because an unidentified infiltrator had been leaking information to ISIS contacts.

Rather than detaining the suspect immediately, Syrian forces made a calculated decision to keep him under observation. Their goal was to identify his contacts, track his meetings, and discover what information he was accessing. As part of this surveillance operation, they reassigned him to what they believed was a safer position on guard duty, where he would be sufficiently distant from US personnel. According to Syria's interior ministry spokesman, the man was scheduled to be removed from his position just one day after he carried out his attack.

During a lunchtime meeting between US officers and their Syrian partners, the ISIS infiltrator arrived at the location and immediately opened fire. The attack happened so quickly that there was no time to respond. He killed three Americans before anyone could react, and managed to wound three additional Americans along with three Syrian security personnel who attempted to confront him. Within moments, armed responders at the scene were able to neutralize the threat, shooting and killing the gunman. As of the time of the source material, the attacker had not been publicly identified. The two deceased US soldiers were both members of the National Guard from Iowa, while the civilian interpreter's identity was not publicly released. This marked the first attack to kill US troops in Syria since the fall of Bashar al-Assad in December 2024, and represented America's deadliest day in Syria since January 2019.

A Weekend of Coordinated Violence

The hours following the Palmyra attack saw Syrian military and internal security forces launch a string of raids and arrests across the wider Badiya region where the attack occurred. These operations targeted several alleged Islamic State cells that were already known to the Syrian government but had been under observation—a strategy similar to the surveillance of the Palmyra gunman. Five individuals were arrested inside the ancient city itself.

But the violence did not end with the Palmyra attack. Islamic State operatives carried out multiple small attacks across Syria throughout the following day. The most notable incident occurred on Sunday, December 14th, when four members of Syria's internal security forces were killed and another wounded in an ambush in Idlib province.

The weekend's violence extended far beyond Syria's borders. Also on Sunday, at Australia's Bondi Beach, a father and son who had each pledged loyalty to the Islamic State killed sixteen people and injured forty-three during a Hanukkah celebration. The attack became Australia's deadliest mass shooting since the Port Arthur massacre in 1996. While investigators had not yet determined whether higher-level Islamic State operatives had advance knowledge of the attack, they discovered a pair of Islamic State flags in the vehicle the gunmen brought to the scene.

Another planned attack was disrupted in Germany's Lower Bavaria, where authorities prevented a terror cell from attacking a Christmas market. However, German authorities indicated this plot did not appear to be linked to the Islamic State movement.

Taken together, that weekend represented one of the bloodiest two-day periods for Islamic State-related violence around the globe since the late 2010s. More significantly, the coordinated nature of these attacks pointed to a larger and more troubling reality that Syria analysts and radicalization experts had been warning about for some time: the Islamic State was not merely surviving—it was actively reconstituting itself, and Syria was at the heart of this resurgence.

Syria's Perfect Storm: Why ISIS is Thriving in Post-Assad Chaos

Syria represents the ideal environment for the Islamic State's resurgence, not because the country's current leadership supports ISIS—quite the opposite—but because the nation has only just emerged from a devastating civil war that left it with a weak central government and nationwide chaos. Syria was the home of ISIS's attempt to build a caliphate in the mid-2010s, with territory stretching between Syria and Iraq for multiple years. Now, it hosts a rapidly rebuilding network of ISIS cells that have graduated from relatively low-level activities like extortion, fuel tanker ambushes, and roadside bombings to more direct confrontations with Syrian forces.

It is crucial to understand that Syria's current leadership, following the fall of the Assad regime, is not supporting the Islamic State. Syrian transitional leader Ahmed al-Sharaa and his inner circle have been exceptionally bitter enemies of ISIS for the last decade. While Syria's state security forces have proven inadequate in dealing with the ISIS threat—as evidenced by the recent attacks—they appear to be making genuine efforts to suppress the movement, even as they make frequent and fatal miscalculations and perpetrate unrelated atrocities against several of Syria's minority groups.

In November, Damascus took the significant step of officially joining the global coalition to defeat ISIS, reversing over a decade of Assad-era policy during which Syria refused to work with that coalition despite also wanting to eliminate the Islamic State. Meanwhile, Kurdish-led forces in Syria's autonomous northeast have attempted to maintain pressure on ISIS, and US-led multinational forces continue to maintain a ground presence, though America's troop deployment has shrunk over the past year.

The Islamic State is not receiving overt assistance from any of Syria's rival internal governments or partner forces, but it has learned to exploit the chaos of post-war Syria with devastating effectiveness. Large portions of the country—from minority Druze and Alawites to Assad regime loyalists—remain deeply distrustful of the new Syrian government. Syria's security forces are disorganized and undertrained for counterterrorism roles, while attempting to work alongside extremist paramilitaries that bear responsibility for some of the country's worst recent massacres.

Additionally, Syria and its major backer Turkey are placing pressure on Kurdish-led forces in the northeast, forcing those Kurdish forces to redirect soldiers away from anti-Islamic State operations. This comes at a time when a shrinking foreign troop presence and weak government control in the sparsely populated southeast have already allowed ISIS to operate with relative freedom. The combination of these factors has created the perfect conditions for the Islamic State to rebuild, and the organization has been doing exactly that, continuously, for more than a year.

The Evolution of ISIS: Smarter, More Decentralized, and More Dangerous

Even before the Assad regime collapsed, Middle East experts were sounding alarms that the Islamic State was mounting a comeback. More importantly, they emphasized that ISIS had fundamentally changed—becoming more decentralized, more cunning, and more operationally aware. This was no longer the same group of young, hotheaded ultra-radicals that had attempted to establish a caliphate, believing they could withstand global air power and a concerted worldwide elimination effort. This was an organization that had learned from its initial defeat and undergone a complete rethinking of its tactics and strategy to ensure survival.

Today's ISIS organization—the Islamic State of Iraq and Syria—functions as just one node in a far larger global Islamic State network. Using the Internet, major Islamic State outfits in the Sahel, West Africa, Somalia, Mozambique, Afghanistan, the Philippines, and elsewhere can collaborate with global financiers, recruiters, and operational planners. They support each other through systems that leverage digital stealth, money laundering, secretive finance networks, and even artificial intelligence to great effect.

On the ground in Syria, ISIS has learned to decentralize itself across the country, spreading into cities, towns, and villages throughout the nation. The organization stays low to the ground and uses encrypted communications to avoid detection. They have learned to operate like organized criminals as well as jihadists, funding themselves through armed robbery, extortion, kidnapping, drugs, weapons trafficking, human trafficking, and whatever other illicit enterprises generate revenue.

Crucially, ISIS has been able to let go of its aspirations to establish a caliphate, at least in the near future. The organization has recognized that in practice, their attempted caliphate only succeeded in gathering their fighters in full view of coalition bombers. They have established cross-border transnational networks in Iraq, worked out mutually beneficial arrangements with other extremist groups they once might have fought, and—though it is practically impossible to know recruitment numbers with certainty—appear to have swelled their ranks with thousands of new fighters over the past few years.

This problem has not gone unnoticed by international leaders. In July 2024, US Central Command openly warned that ISIS was working to reconstitute itself. Under the Biden administration, US troop deployments surged into the thousands to address the problem. However, since the start of the Trump administration, those deployments have shrunk again, and Washington has made clear it might withdraw entirely. While the US has engaged in high-profile precision airstrikes and ground raids in 2025, these actions have mostly targeted senior-level ISIS operatives who, while important to the movement, are easily replaced in an operation built to be decentralized—ISIS knows most high-ranking operatives will eventually be killed.

Syria's new security forces have worked to constrain ISIS as much as possible, carrying out regular raids and mass arrests while breaking up hidden cells. But they have often found themselves on the receiving end of Islamic State ambushes, and their preference to monitor cells under surveillance—hoping those cells will reveal others—has a tendency to backfire. Kurdish-led forces continue dealing with ISIS where and when they can, but they have had to shift into a far less proactive posture while beginning to release and repatriate ISIS fighters and supporters held in massive camps in the northeast. Even though security forces are still trying to address the ISIS threat, it has not been enough.

Infiltration, Prison Breaks, and Expanding Ambitions

Based on their recent actions, ISIS appears to fully understand that the current situation in Syria presents an opportunity not just to pursue objectives more quickly or openly, but to broaden its ambitions in this permissive environment. The presence of an ISIS infiltrator within Syria's security forces was far from a one-off occurrence. According to Damascus insiders, hundreds of ISIS loyalists may have infiltrated the Syrian military or interior security services, taking advantage of rushed recruitment processes and insufficient vetting.

The organization has also taken the opportunity to move deeper into Syrian cities, with larger, better-armed cells now able to hide inside major population centers. Perhaps most troubling, their long-time focus on Syria's ISIS prison camps appears to be shifting from observation toward active operations in the near term.

Roughly 25,000 refugees, mostly women and children, currently live in Syria's al-Hol camp, where a well-organized faction of women loyal to ISIS are known to carry out internal repression and indoctrination. As one camp administrator told the New York Times just weeks before the source material was created: "All of the women here are radical. They all stayed with the Islamic State until the end. But the bigger problem is that the mothers are educating their kids according to the Islamic State ideology."

Not far from al-Hol, over 8,000 ISIS fighters are confined in massive prisons, technically watched over by Syria's autonomous Kurdish-led faction. In practice, however, the number of guards and available resources for these facilities continues to shrink. For a high-level ISIS operative operating freely in the countryside with dozens or hundreds of armed fighters, the objective is clear: orchestrate a jailbreak as soon as possible.

Syrian and international officials confirm that multiple jailbreak attempts and prison attack plots have been thwarted in 2025 alone. While this demonstrates that Syrian and partner forces can currently stay ahead of these attempts, it also reveals that the prisons remain a critical priority for ISIS. In January 2022, a major Islamic State attack at the al-Sina'a prison led to the escape of hundreds of prisoners, with 346 ISIS fighters and 159 Kurdish paramilitary troops killed during the battle.

Today, if ISIS were to attempt something similar, Kurdish forces would not be able to mount the same level of defense, primarily because they have fewer resources and personnel available. With the US disengaging from Syria and from Kurdish forces specifically, it remains unclear whether they would receive much external assistance. ISIS, by contrast, appears to have learned a lesson from that 2022 battle: if they attempt a jailbreak on that scale again, they must ensure it succeeds, and they must leverage maximum firepower to make that happen.

Even if the Islamic State successfully freed all those prisoners, it is highly unlikely they would immediately attempt to restart the caliphate of the 2010s. This is primarily because ISIS now has a much better understanding of when and how it can cause maximum damage. While the Islamic State's eventual goal remains building an Islamic state, the organization has learned it can advance much further by creating chaos than by attempting to capture territory prematurely.

The Asymmetric Advantage: How One Attack Can Achieve Multiple Strategic Goals

When examining insurgency and counterinsurgency dynamics, the numbers in Syria increasingly favor the Islamic State in ways that should alarm observers across the globe. Consider the impact of one single jihadist who infiltrated one single camp and carried out one single attack on December 13th. The leader of the United States vowed "very serious retaliation," the attack dominated the global news cycle alongside another Islamic State-inspired attack in Australia, and while the group might absorb some short-term pain, its attacks are likely to benefit ISIS in several ways simultaneously.

Through a handful of attacks over one weekend—primarily the work of just three men in Syria and Australia—the Islamic State may be able to accelerate America's withdrawal from Syria, erode international trust in Syria's security forces, intensify disagreements between the Syrian government and the Kurdish-led northeast, spread panic and terror in Australia, and force world governments to expend significant resources on domestic counterterrorism and surveillance.

Now multiply that impact tens of thousands of times to account for all the ISIS fighters spread across Syria and all the fighters who may soon be broken out of prison camps. The danger becomes clear: once the Islamic State shifts from a rebuilding phase to an all-out operational phase, the damage could be truly massive.

As counterintuitive as it may sound, when ISIS first emerged in the 2010s, the world benefited from the tactical missteps the organization made. ISIS did not choose to fight to its fullest asymmetric potential. Instead, they concentrated their forces openly in a bid to occupy land and were forced to pay the price for that strategic error. But the ISIS of the 2020s is fundamentally different—it is smarter, more cunning, and willing to delay its high ambitions for as long as necessary to cause maximum damage in the present.

The world has been far too slow in countering this resurgent threat. Although the global community may now be in the process of waking up to the danger, it is waking up too late. The Islamic State attacks in Palmyra, Idlib, and Australia during that December weekend were tragedies, but they were not isolated incidents. Treating them as such will only put more lives at risk and allow ISIS to continue its calculated resurgence across Syria and beyond.

Related Coverage

FAQ

What happened in the December 13th attack in Palmyra?

A lone gunman who had infiltrated Syria's Interior Ministry approximately two months earlier opened fire during a lunchtime meeting between US officers and their Syrian partners. He killed three Americans—two National Guard soldiers from Iowa and a civilian interpreter—and wounded three additional Americans and three Syrian security personnel before being shot and killed by armed responders. The attacker was a suspected ISIS affiliate who had been under surveillance and was scheduled to be removed from his position just one day after the attack.

Why was the attacker not detained before the shooting if he was already suspected of being an ISIS affiliate?

Syrian forces made a calculated decision to keep the suspect under observation rather than detaining him immediately. Their goal was to identify his contacts, track his meetings, and discover what information he was accessing. He was reassigned to a guard duty position believed to be sufficiently far from US personnel. However, this surveillance strategy ultimately backfired when the attacker found his moment to strike.

Were there other ISIS attacks that same weekend?

Yes. Islamic State operatives carried out multiple small attacks across Syria the following day, including an ambush in Idlib province that killed four members of Syria's internal security forces. Additionally, at Australia's Bondi Beach on Sunday December 14th, a father and son who had pledged loyalty to ISIS killed sixteen people and injured forty-three during a Hanukkah celebration. A separate planned attack on a Christmas market in Germany's Lower Bavaria was disrupted but did not appear linked to ISIS.

Does Syria's current government support ISIS?

No. Syrian transitional leader Ahmed al-Sharaa and his inner circle have been exceptionally bitter enemies of ISIS for the last decade. In November, Damascus officially joined the global coalition to defeat ISIS, reversing over a decade of Assad-era policy. While Syria's security forces have proven inadequate in fully dealing with the ISIS threat, they appear to be making genuine efforts to suppress the movement through raids, arrests, and breaking up hidden cells.

How has ISIS changed since its defeat in the mid-2010s?

ISIS has become more decentralized, cunning, and operationally aware. Rather than concentrating forces to hold territory, the organization now operates like organized criminals, funding itself through armed robbery, extortion, kidnapping, drug and human trafficking, and other illicit enterprises. It uses encrypted communications, digital stealth, money laundering networks, and even artificial intelligence. It has also established cross-border transnational networks and works with other extremist groups, functioning as one node in a larger global Islamic State network.

Why is Syria particularly vulnerable to ISIS resurgence?

Syria has just emerged from a devastating civil war, leaving it with a weak central government and nationwide chaos. Large portions of the population distrust the new government. Security forces are disorganized and undertrained for counterterrorism. Pressure on Kurdish-led forces from Syria and Turkey is redirecting soldiers away from anti-ISIS operations. A shrinking foreign troop presence and weak government control in the sparsely populated southeast have allowed ISIS to operate with relative freedom.

What is the threat regarding ISIS prison camps?

Roughly 25,000 refugees live in Syria's al-Hol camp where ISIS-loyal women carry out internal repression and indoctrination. Over 8,000 ISIS fighters are confined in massive prisons watched over by Kurdish-led forces with shrinking resources. Multiple jailbreak attempts have been thwarted in 2025 alone. A 2022 attack at al-Sina'a prison led to hundreds of prisoner escapes, and ISIS appears to have learned from that battle, planning to leverage maximum firepower in any future attempt.

What is the current US military posture in Syria regarding ISIS?

Under the Biden administration, US troop deployments surged into the thousands to address the ISIS reconstitution. Since the start of the Trump administration, those deployments have shrunk, and Washington has signaled it might withdraw entirely. While the US has conducted high-profile precision airstrikes and ground raids in 2025, these have mostly targeted senior-level ISIS operatives who are easily replaced in the group's decentralized structure.

Sources

About the Author

Jackson Reed

Jackson Reed creates and presents analysis focused on military doctrine, strategic competition, and conflict dynamics.

About the Team →