Recent security arrests in Lebanon suggest that the Islamic State has rebuilt its presence in the country through clandestine networks and cells.
The latest arrest involved a Syrian national who Lebanon’s Internal Security Forces said served as the “general security emir” for the ISIS’s so-called “Southern Province” and “Central Province” in Syria. He was responsible for overseeing security activities and operations in coordination with other ISIS commanders in Syria.
According to a Lebanese official, the suspect was arrested by security services in the northern city of Tripoli following a surveillance operation. Investigators are still examining electronic devices seized during the arrest and tracing his communications network.
The arrest does not appear to be an isolated case. In December 2024, the Lebanese army announced the capture of Abu Saeed al-Shami, identified as the ISIS “emir,” or regional leader, for its so-called Lebanon Province. In June 2025, authorities said they arrested his successor, known by the pseudonym “Qaswara.”
Badih Qarhani, a researcher specializing in security and political affairs, said the movement of ISIS leaders and operatives between Syria and Lebanon is “a serious security indicator,” particularly given the porous Lebanon-Syria border and its numerous illegal crossings, which facilitate the movement of smugglers and wanted individuals.
A Long History of ISIS Activity in Lebanon
The recent arrest has drawn attention to ISIS’s history in Lebanon.
In 2014, the group carried out a series of bombings targeting Beirut’s southern suburbs before reaching the height of its presence during the Arsal offensive in August of that year — a cross-border battle near the Syrian border — when ISIS and the Al Qaeda-affiliated al-Nusra Front kidnapped several Lebanese soldiers.
In 2015, Lebanon witnessed additional attacks, including twin suicide bombings in the Beirut suburb of Burj al-Barajneh. Two years later, the Lebanese army launched Operation Dawn of the Outskirts, driving ISIS fighters out of the mountainous border areas of Qaa and Ras Baalbek. Around the same time, Hezbollah reached an agreement with ISIS in the Arsal outskirts that allowed more than 600 of the group’s fighters to withdraw from Lebanese territory.
In 2021, several young men disappeared from the northern city of Tripoli; it later emerged that some had joined ISIS in Iraq. In June 2024, a gunman carrying ISIS insignia opened fire near the U.S. Embassy in Awkar.
Issam al-Absi, a security and strategic affairs expert, said the so-called Lebanon Province hasn’t existed within ISIS’s administrative structure since the collapse of the so-called caliphate in 2019.
Speaking to MBN, he said ISIS members in Lebanon now operate under the group’s Syria Province, with the leadership in Syria responsible for planning while Lebanese cells carry out local operations in coordination.
Does ISIS Still Pose a Threat?
Today, ISIS recruits new members by exploiting “social marginalization, feelings of exclusion, family ties, closed networks, prisons and encrypted digital platforms,” al-Absi said.
He added that the group continues to rely primarily on direct personal relationships as heightened security measures have made open recruitment increasingly difficult.
Platforms such as Telegram and Facebook remain tools for attracting young recruits, particularly those between the ages of 18 and 20, by exploiting their vulnerability to extremist ideology or financial incentives.
Nonetheless, Qarhani argued that ISIS has lost most of its experienced operatives responsible for recruitment efforts.
“The group never succeeded, even at the height of its power, in establishing a supportive environment inside Lebanon, particularly within the Sunni community,” he said, adding that its current activity is largely confined to a handful of remaining cells, primarily in Syria.
Although its capabilities have diminished, experts caution against underestimating the group. They say ISIS no longer requires territorial control or broad local support to sustain its presence. Instead, it needs only a limited number of operatives capable of remaining hidden, maintaining communications and carrying out logistical or security tasks when needed.
Retired Brig. Gen. George Nader said the sustained security pressure ISIS has faced across the region and the world has significantly weakened the organization.
“However, it still retains the ability to carry out limited attacks through small cells or self-directed individuals,” he said. “That does not pose a broader threat to Lebanon’s overall stability, given the absence of a supportive environment and the rejection of the group by the country’s political and religious forces.”
The significance of the latest arrest is significant not only for removing a senior ISIS figure from the field, but also for what it may reveal about the networks that remain active in Lebanon, the routes used by ISIS leaders to move across borders and the communications methods the organization has adopted since the collapse of its self-declared caliphate.
The key question investigators are now seeking to answer is whether the commander’s presence in Lebanon was merely a temporary visit dictated by the demands of clandestine operations, or whether it points to a broader role Lebanese presence for remaining ISIS cells and networks.
Adapted and translated from the original Arabic.
