ISIS’s Transition and the Interplay of Online and Face-to-Face Recruitment 

Abstract

The article explores how ISIS sustained its operational presence through a strategic blend of face-to-face and online recruitment, including prison radicalization, social media outreach, and the exploitation of local grievances.  It highlights how ISIS adapted to territorial losses, with a focus on its expansion into new regions, particularly in Africa, through affiliates such as Islamic State West Africa Province (ISWAP), Islamic State-Central Africa Province (ISCAP), ISIS-Mozambique, and ISIS in the Greater Sahara.  

Introduction

Islamic State in Iraq and Syria (ISIS), also known as Islamic State in Iraq and Levant (ISIL), represents a unique case study of how a terrorist organization can emerge, rapidly expand, suffers a territorial defeat, yet successfully reconstitute itself as a global extremist franchise. While ISIS built on the know-how and ideological foundation of al-Qaeda, it has proved far more successful in building a diverse recruitment and propaganda machine.  

To understand the group’s trajectory, three main periods should be analyzed: its emergence, expansion, and enduring insurgency. In short, ISIS “emerged from the convulsions of the war in Iraq (2003-2011), the Arab revolutions (2010-present) and the civil war in Syria (2011-present)”.  

ISIS’ global network of affiliates across various regions has contributed to the group’s resilience and solidified its status as the preeminent force in global jihadist terrorism. This article explores how ISIS strategically leveraged both offline and online recruitment methods to broaden its reach.  It also investigates the emergence and recruitment activities of ISIS’ regional affiliates in Africa, with a focus on the Islamic State West Africa Province (ISWAP), the Islamic State Central Africa Province (ISCAP), ISIS-Mozambique, and ISIS in the Greater Sahara.

Overview of the Rise and Fall of ISIS

ISIS initially emerged after the second US invasion of Iraq and rebranded itself multiple times. The institutional collapse in Iraq in the aftermath of the 2003 invasion, along with widespread discrimination against Sunni Arabs, and sectarian politics that further marginalized them, created the social-psychosocial and political conditions conducive to the emergence and empowerment of ISIS in Iraq.   

The civil war in Syria offered a strategic opportunity for ISIS. After securing major territorial gains in both Syria and Iraq, the group declared itself as the Islamic State – and so-called Caliphate – in 2014, which triggered US military intervention   

A defining feature of the group is its adaptability even after losing territorial control in Syria and Iraq in 2019. Despite substantial setbacks resulting from the US-led military campaign, including Operation Inherent Resolve, ISIS has proven to be remarkably resilient.  

This resilience is evident in the group’s ability to adapt its tactics and strategically expand its influence and territorial control during its peak. Its rapid and unprecedented expansion in Syria and Iraq is partly attributable to an exceptionally efficient propaganda machine, which produced three major outcomes.  

First, the group managed to recruit thousands of foreign fighters from more than 90 countries, becoming a critical source of resilience for the group. Second, its propaganda methods, content, and platforms inspired individuals to carry out attacks in their home countries. While many of these actors had no formal ties to ISIS, their actions—motivated by the group’s ideology—fueled the perception of a global presence. Third, as seen in other groups like al Qaeda, ISIS’s success led other like-minded groups from Afghanistan to Madagascar to establish alliances with ISIS.

ISIS Recruitment in the Physical Space

While cyberspace is a critical platform for ISIS recruitment, face-to-face interaction is still the prominent model of recruitment. ISIS has relied on a wide array of recruitment channels, namely established networks of friends and family and tribal affiliations. In locations that become hotbeds for ISIS recruitment, “social media becomes less important than via direct human contact, as clusters of friends and neighbors persuade each other to travel separately or together to join the Islamic State”. 

ISIS has conducted recruitment activities in a wide range of physical spaces, including mosques, cafes, bookstores, front organizations disguised as humanitarian aid agencies, makeshift madrasas, religious festivals and gatherings, prisons, and other locations where marginalized or vulnerable individuals commonly congregate. This complex and well-organized recruitment infrastructure has enabled ISIS to survive and sustain its presence across multiple countries.  

Although precise figures on ISIS membership remain unavailable, estimates range from 30,000 to over 100,000 members. Two critical enablers of ISIS’ recruitment efforts have been foreign terrorist fighters (FTFs) and networks of family and friends, both of which played a key role in facilitating the group’s global outreach. 

In addition, prisons in particular have offered fertile ground for recruitment. Recruiters have been known to “take advantage of the psychological characteristics of inmates and their deprivation of liberty to inculcate them with jihadist values.” Notably, the network of detention centers—often referred to as prisons—in Syria and Iraq has held large numbers of ISIS members and their families. According to the US Central Command (CENTCOM), as of July 2024, there were “more than 9,000 ISIS detainees in detention facilities in Syria, and … more than 43,000 individuals and families from the Al Hol and Al Roj camps”. Poor conditions in these camps enable male or female ISIS detainees to enforce their own rules and exert pressure on families, including children, to replicate the group’s pre-defeat governance structure. In short, ISIS continues to exploit prisons and detention camps as spaces to maintain influence and recruit new members.

ISIS’s Influence & Propaganda in Cyberspace

ISIS has demonstrated a highly sophisticated media and communications strategy, particularly in its use of social media and other digital platforms to advance propaganda and recruitment efforts.  Despite its territorial defeat in 2019, ISIS core and global affiliates have continued to increase their online presence by sustaining its networks, driving radicalization, and facilitating the planning and execution of attacks.     

Virtual spaces continue to serve as platforms for ISIS-linked activities. For example, a study examined over 90 unofficial media outlets affiliated with ISIS across different platforms—some fully active, others partially inactive. They found many of them recycled existing content and relied on low-quality visuals or narratives. Despite this, outlets attracted large followings with individual channels. Another study examines how TikTok enables the persistence of terrorist content, particularly audio recordings of ISIS and al-Qaeda leaders. Research based on a dataset of over 55 videos found that, despite the removal of original content, extremist speeches often resurface in new user-generated videos, sometimes stripped of context or mislabeled, and attract millions of views. While these videos clearly violate TikTok’s community guidelines, most videos remained accessible, with the platform’s algorithm even recommending additional extremist content.  

The informal online ecosystem that supports ISIS is composed of a complex and decentralized international network of individuals—including writers, editors, and graphic designers—who operate across mainstream social media platforms such as Facebook, Instagram, YouTube, TikTok, and X (formerly Twitter) as well as encrypted messaging applications such as WhatsApp and Telegram. These actors frequently adopt similar messaging strategies and self-organize into small, autonomous groups centered around key influencers or individual social media accounts. Their primary objective is to generate and disseminate content that promotes ISIS ideology, supports its leadership, and circulates ISIS-related news through rebranded channels. These groups translate content into multiple languages, employ tactics to avoid detection, and share secure communication tools.     

These accounts used deeply embedded evasion tactics to avoid detection and moderation systems. The tactics they used include disguising content with altered branding, sharing links through comment sections, organizing coordinated raids on adversarial social media pages, and using “broken text” formats to bypass automated content moderation. For example, the unofficial ISIS-linked outlet Global Events operates across multiple platforms, such as Facebook (22,000+ followers), Telegram (30,000+ subscribers), using coded language and backup accounts to sustain viability. It has played a key role in promoting migration (hijrah) to sub-Saharan Africa and spread propaganda via more than 80 video reels—some viewed over 230,000 times—while relying on emoji code systems to circumvent content moderation.  

ISIS’s media operations also include news agencies such as Amaq News Agency and Al Hayat Media Center, which allow the group to broadcast a range of propaganda including claims of attacks.  An emerging subculture driven by young supporters further amplified the influence of ISIS. Termed the “Alt-Jihad,” this movement merges visual aesthetics of far-right online communities with jihadist content, using platforms like TikTok, Instagram, Facebook, and Telegram to disseminate its messages.   

These networks – often driven by tech-savvy youth – form decentralized and multi-platform communities that use modern aesthetics and language to spread propaganda, recruit followers, and sustain online influence.

Key Hotspots of ISIS-Linked Groups Across Africa

While ISIS continues to exploit the digital realm to maintain global influence, its offline footprint remains equally concerning—particularly across Africa, where several affiliated groups have become key actors in regional conflicts. This analysis draws on incident-level data from the Global Terrorism Trends and Analysis Center’s (GTTAC)’s GRID database, an open-source database sponsored by the US Department of State’s Bureau of Counterterrorism for the Country Reports on Terrorism and its Statistical Annex.  

Figure 1 illustrates the geographic distribution of violent activities linked to ISIS-affiliated groups across Africa between 2018 and 2024. The data reveal that IS-DRC (formerly Allied Democratic Forces) was the most active affiliate, responsible for over 1,500 incidents primarily in the Democratic Republic of Congo. IS-DRC’s operations overwhelmingly dominate the conflict landscape in central Africa. Following this, ISIS-Mozambique (ISIS-M) and ISIS-West Africa (ISIS-WA) emerge as the second and third most active affiliates, centered in Mozambique and Nigeria, respectively. The data also illustrate significant operational presence by ISIS-Greater Sahara (ISIS-GS) in the Sahel region and ISIS-Sinai Province (ISIS-SP) in Egypt.

Figure 1. Geographic Distribution of Attacks by ISIS-Affiliated Groups, 2018-2024  

The Democratic Republic of the Congo experienced the highest number of ISIS-linked incidents, followed by Mozambique and Nigeria. These three countries represent the primary zones of ISIS expansion and sustained operations in Africa during this period. Meanwhile, Libya, Egypt, Somalia, and a handful of Sahelian and North African states reported relatively fewer incidents, suggesting more localized or less active insurgencies. 

Figure 2 presents trends, tactics, and victims of ISIS-affiliated attacks between 2018 and 2024, based on the GTTAC GRID database. The trend graph illustrates a sharp rise in both incidents and fatalities beginning in 2020, with ISIS-DRC (formerly ADF) emerging as the most lethal and active affiliate. The group escalated attacks consistently culminating in over 300 incidents and nearly 1,800 fatalities in 2024 alone. ISIS-M and ISIS-WA follow in scale, with episodic surges, notably in 2021 and 2022. These trends underscore a geographical pivot toward Central and Southeastern Africa, now the primary theaters of ISIS-linked violence.

Figure 2. Trends, Tactics and Victims of ISIS-affiliated Attacks, 2018-2024  

The bar chart on tactics in Figure 2 shows that attacks involving firearms account for the majority of incidents. This is followed by extortion, kidnappings, executions, and ambushes—reflecting a hybrid insurgency strategy blending guerrilla warfare, coercion, and terrorism aimed at controlling territory and intimidating local populations. The high frequency of incidents labeled with “unclear tactics” also points to gaps in intelligence and challenges in data collection, particularly in remote or unstable regions.  

The bar chart on victim types emphasizes the heavy toll on civilians: the general population is the primary target, far surpassing attacks on security forces or state actors. Civilian targeting is a hallmark of ISIS’s African affiliates, which rely on mass intimidation and population control. Notably, Christian communities are frequently targets, especially in the DRC, Nigeria, and Mozambique.  In 2024 alone, 106 such incidents were recorded— 88 of them in the DRC.  

In sum, Figure 2 reveals a disturbing trajectory in ISIS’s African operations: rapid escalation, operational sophistication, lethal efficiency, and a civilian-centric strategy of violence and intimidation. The prominence of ISIS-DRC and sustained attacks in Mozambique and Nigeria illustrate a geographic pivot toward regions with weak governance, porous borders, and exploitable local grievances.  

Our analysis ultimately highlights the geographic diversification and regional entrenchment of ISIS-affiliated violence in Africa. Central, Southeastern, and West Africa (Sub-Saharan) have emerged as epicenters, with soft-target-strategies reinforcing ISIS’s influence. ISIS’s presence in Africa is manifested through regionally distinct affiliates, each shaped by local grievances, historical dynamics, and leadership structures. The following sections explore key regional ISIS affiliates and their recruitment strategies—both offline and online—beginning with Central Africa, followed by Southeastern Africa, and concluding with West Africa (Lake Chad region and Greater Sahara). 

Central Africa Epicenter: ADF   

One major ISIS-affiliated hotspot in Africa is the Democratic Republic of the Congo (DRC) where the Allied Democratic Forces (ADF) operate. The group emerged in Uganda in the mid-1990s under the leadership of Jamil Mukulu, following the state’s crackdown on violent factions within the Salafi Muslim Youth Movement. Although the ADF initially struggled to recruit from Salafi mosques due to government alliances with quietist Salafi clerics and the Uganda Muslim Supreme Council (UMSC), it later received support from Sudan and the DRC and evolved into a transnational jihadist group, drawing recruits mainly from outside Uganda, including Burundi, Tanzania, Mozambique, and the Ugandan diaspora in the United Kingdom.   

Since 2015, the ADF transitioned from a reclusive insurgent group to a multinational network focused on propaganda and recruitment. The group’s media efforts evolved significantly under Musa Baluku’s leadership, shifting from low-quality audio sermons shared on memory cards to highly produced videos and coordinated social media campaigns aligned with the Islamic State’s global messaging. After rebranding and being recognized as the Islamic State’s Central Africa Province (ISCAP), the group has maintained its localized propaganda apparatus and began releasing videos glorifying violence, urging jihadist migration to Central Africa, and coordinating with the Islamic State’s central media units. This resulted in a dual-track propaganda strategy targeting both local and global audiences. Through videos distributed via Telegram and branded platforms like Mujahideen TV, the ADF glorifies martyrdom, reinforces loyalty to the Caliphate, and emphasizes that it is no longer the ADF, but rather the Islamic State’s Central Africa Province, fully integrated into the global jihadist movement. 

Southeastern Africa: ISIS-Mozambique 

ISIS-Mozambique (ISIS-M), also known as Ansar al-Sunna Wa Jamma (ASWJ), gained global attention following its March 2021 assault on Palma and has since been elevated to the status of a formal ISIS province, Wilayat Mozambique. Locally, ISIS-M conducts guerrilla warfare, relies on brutal violence against civilians, and uses these acts to both coerce communities and fuel recruitment. 

ISIS-Mozambique’s recruitment and propaganda are deeply rooted in local conditions rather than directed primarily by the Islamic State’s central leadership. The group capitalizes on local grievances—especially inequality, state neglect, and resource exploitation in Cabo Delgado—to attract recruits.     

Regionally and globally, the group employs its ISIS affiliation through a layered propaganda strategy. While it produces localized media content aimed at inspiring recruits and glorifying martyrdom (e.g., through Mujahideen TV), its attacks are also featured in the ISIS’ central propaganda, including its Al-Naba newsletter and social media channels, with over 50 attack claims made by ISIS-Central between 2019 and 2022. This dual-media approach allows ISIS-M to maintain local relevance and international visibility, portraying itself as part of the broader ISIS movement while remaining strategically autonomous in its operations and recruitment strategies.  

West Africa – Lake Chad Region: ISIS in West Africa Province (ISWAP) 

The Islamic State in West Africa Province (ISWAP) has been a prominently active ISIS-affiliated group in West Africa and emerged in 2016 after breaking away from Boko Haram. Unlike its predecessor, ISWAP has prioritized cultivating legitimacy by presenting itself as a more disciplined and community-oriented force.   

ISWAP’s recruitment is primarily driven by local dynamics. It takes advantage of widespread poverty, insecurity, and weak government presence in northeastern Nigeria and surrounding areas to draw in new members. The group appeals to local populations by providing essential services such as basic healthcare, water access, religious education, and local dispute resolution mechanisms. It also attracts recruits by offering protection from rival group Boko Haram , shielding communities from harsh counter-terrorism operations, and promising economic opportunities.   

The group actively avoids harming Muslim civilians and focuses its attacks on government forces and collaborators—a tactic designed to gain trust and cooperation from local communities. By imposing structured taxation and enforcing its version of Islamic law with relative restraint, ISWAP has built a governance framework that attracts new recruits and strengthens its territorial control.   

West Africa – Tri-Border Region ISIS in the Greater Sahara (ISGS) 

The Tri-border region of Mali, Niger, and Burkina Faso is another hot-spot for ISIS affiliated groups in West Africa. The Islamic State in the Greater Sahara (ISGS) has operated primarily in this region. Originally a splinter from al-Qaeda, ISGS was formally acknowledged as an ISIS affiliate in 2019. Its online and media presence has grown since then. ISIS’s core media, including the Amaq News Agency, has claimed ISGS attacks and promoted its role in regional jihadist conflicts—particularly highlighting its clashes with rival groups like JNIM and encouraging defections to ISGS.   On the ground, ISGS actively co-opts fighters from groups like Ansaroul Islam and appeals to marginalized communities, especially through grievances stemming from abuses by local militias and state forces. ISGS propaganda frames itself as a defender of aggrieved populations. Additionally, ISGS has implemented limited governance and welfare services in rural areas, offering food, medicine, and protection to gain local support and incentivize participation in its campaigns. 

Conclusion  

The ISIS’ trajectory from a regional insurgency to a global extremist franchise illustrates the evolving nature of contemporary Salafi-jihadist terrorism. Its ability to leverage both face-to-face and online networks, mobilize foreign fighters, recruit within prisons and utilize digital platforms, has enabled the group to persist even after its territorial defeat, expanding its reach far beyond Iraq and Syria.  

The emergence and expansion of regional affiliates across Africa, each adapted to local grievances and governance vacuums, reflect a troubling transformation and decentralization of the jihadist threat. This trend poses an alarming risk for further expansion, particularly in regions afflicted by weak state institutions, social polarization, and collective grievances. 

To counter the evolving ISIS threat, a multi-faceted approach is essential. This strategy must integrate efforts to disrupt the group’s digital presence, such as by collaborating with tech companies on advanced content moderation, and on-the-ground initiatives that address the root causes of recruitment described above. These initiatives include strengthening local governance and security forces, providing essential services to communities, and implementing effective de-radicalization programs in prisons, thereby directly tackling the vulnerabilities that ISIS exploits for its expansion, particularly across Africa.

The post ISIS’s Transition and the Interplay of Online and Face-to-Face Recruitment  appeared first on Small Wars Journal by Arizona State University.