Assessing the Trends in Islamic State Mozambique's Activities in 2026

The Islamic State has maintained a growing footprint across Africa through affiliated networks operating in different regions. Research and analysis often focus on Islamic State in West Africa Province (ISWAP) in the Lake Chad Basin, Islamic State Sahel Province (ISSP) in the Sahel, and Islamic State Somalia.

By comparison, Islamic State Mozambique has received less attention, despite the growing threat it poses to Mozambique and neighbouring countries. Since beginning its operations in Mozambique, the group has undergone several phases of change. Its territorial expansion peaked in 2021, when it briefly captured the port town of Palma, before counterterrorism operations by Rwandan forces and the Southern African Development Community (SADC) Mission in Mozambique disrupted its operations and reduced its territorial reach. However, the group appears to have regained some operational momentum since late 2025. Changes in its supply networks, revenue-generating activities and recruitment approaches may have contributed to a resurgence in attacks and an expansion into previously less affected areas.

These developments raise questions about the factors shaping the group's operational behaviour in 2026 and whether its recent gains point to a more sustainable recovery. Drawing on conflict data and analysis from ACLED, this article identifies three trends shaping the group's activities: rebuilding operational supplies, restoring its offensive capabilities, and expanding into new areas while diversifying its sources of funding. Together, these developments suggest that the group's recovery has progressed from replenishing essential supplies to renewed tactical offensives and incursions into previously less affected territories.

Rebuilding Operational Supplies

The early part of 2026 was marked by intense fighting in central Cabo Delgado, including operations around strategic forested areas in Macomia District and reported losses among Mozambican security forces. Alongside these confrontations, however, the group also appeared to be rebuilding the supplies needed to sustain its operations and potentially prepare for further advances.

In February, Islamic State Mozambique attacked a commercial convoy and looted sacks of grain and other provisions, reportedly transporting the stolen goods eastwards towards its outposts in Catupa Forest. Open-source reporting suggests that the primary objective was to replenish the group's logistical supplies. Such attacks can help the group maintain access to food and other necessities without relying entirely on established supply networks. They also place commercial transport at risk and disrupt the movement of goods along important regional corridors.

The group has also reportedly obtained supplies through less confrontational means. In Palma and Mocímboa da Praia districts, fighters approached villages to purchase provisions, sometimes using local youths to buy goods in Mocímboa da Praia. This suggests that the group's supply system relies on a combination of coercion and transactions with local communities. While attacks allow it to seize large quantities of supplies, purchases may offer a lower-risk way to obtain necessities without attracting the same level of military attention. These activities present two broader security concerns.

First, attacks on commercial convoys can disrupt transport networks, raise risks for traders and communities, and increase the costs of moving essential goods. Second, the government's response to suspected civilian collaboration can create additional tensions. Heavy-handed treatment of young people suspected of assisting insurgents may deepen local grievances, discourage cooperation with security forces, and undermine state legitimacy. This is particularly concerning where civilians purchase supplies for fighters without necessarily sharing their ideological objectives or participating directly in insurgent activities.

Tactical Rearming and Southward Offensives

The second quarter of 2026 marked a further shift in the group's activities, characterised by attacks on security positions, operations targeting mining sites and a gradual expansion into southern parts of Cabo Delgado. These developments suggest that the group was seeking to improve its access to weapons and revenue while extending its operational reach beyond established strongholds. In late April, Islamic State Mozambique attacked a security outpost in Mitope, Mocímboa da Praia District.

The group's propaganda material reportedly highlighted military equipment seized during the assault, including rifles, machine guns and ammunition. If the reported seizures are accurate, the captured weapons could strengthen the group's ability to sustain further attacks and reduce its immediate dependence on other supply sources.

During the same period, the group reportedly began a campaign targeting artisanal gold-mining operations. In Meluco District, it occupied a gold-mining site for six days before moving further south into Ancuabe District, where it reportedly captured around 80 miners and extorted them for ransom and access to gold extraction activities. These incidents point to a possible effort to exploit local economic activity as a source of revenue and leverage over communities.

In early May, the group advanced further into Ancuabe and Chiúre districts, attacking civilian communities, burning churches and schools, and killing non-Muslim residents. The violence reportedly displaced more than 13,000 people. ACLED monitoring suggests that the group's movement into these areas was linked, in part, to the presence of gold-mining operations and communities that were predominantly non-Muslim. The relationship between these factors remains very crucial. The movement towards mining areas may reflect an attempt to access revenue, extort miners and establish a presence near valuable economic activity. Attacks against non-Muslim communities also demonstrate the continued role of religious targeting in the group's violence.

The reported expansion is significant because it exposes communities that may have experienced less sustained insurgent activity to new risks. It also creates additional demands on security forces, which must protect vulnerable settlements while responding to threats against military positions and economic sites. If the group can maintain access to mining areas while continuing attacks against civilians, it may be able to combine revenue generation with territorial pressure, making its operations more difficult to contain.

Strategic Incursion and Expanded Funding Streams

In July, a joint operation by Mozambican and Rwandan forces targeted Islamic State Mozambique's operational core in Catupa Forest. The offensive reportedly dislodged the group from Namabo, Catupa and Cogolo, areas described as important insurgent staging grounds. The operation included aerial bombardment and reportedly resulted in casualties on both sides.

The military pressure appears to have forced the group to disperse its fighters and seek alternative operating areas. Reports indicated movement further west and south, including towards the R698 transport corridor connecting Montepuez and Mueda. In late August, an estimated 30 to 150 fighters reportedly advanced along the Lugenda River and crossed into Marrupa District in Niassa Province, near the Tanzanian border. If confirmed, this movement would represent an important development in the conflict. Pressure on established strongholds may be encouraging the group to seek alternative routes, resources and areas of operation. Its movement into Niassa could also extend the geographical reach of the threat and create new security challenges for authorities in a province less associated with the insurgency than Cabo Delgado.

Alongside these movements, the group has continued to rely on kidnapping for ransom and extortion. In July, it reportedly hijacked three commercial vehicles and extorted approximately US$6,000 from passengers. In September, it raided a luxury tourist camp, killing three hostages from South Africa, Zimbabwe and Mozambique. The remaining hostages were reportedly released after a ransom payment of US$53,000.

These incidents illustrate how the group may be broadening its methods of generating revenue. Attacks on transport routes provide opportunities for extortion, while kidnappings allow fighters to extract payments from individuals, businesses or their families. Such activities can generate income without requiring the group to hold territory permanently. They also create wider economic effects by increasing the perceived risks of travel, tourism and commercial activity in affected areas.

The relationship between military pressure and these funding methods is particularly important. When security operations disrupt established camps, supply routes or access to resources, the group may respond by dispersing its fighters and relying more heavily on mobile operations, extortion and kidnapping. These activities can help it maintain a degree of financial autonomy even when it loses access to established strongholds.

The reported movement towards Niassa and the group's continued activity around mining sites and transport corridors may therefore reflect an attempt to preserve its operational capacity under pressure. However, the scale of its financial recovery remains uncertain. Even so, the combination of supply seizures, access to mining economies, kidnapping and extortion suggests that the group's recovery is not dependent on a single source of support. A diversified funding base could make it more difficult for security forces to disrupt its operations through territorial offensives alone. It also means that efforts to contain the group will need to address the economic networks and civilian vulnerabilities that enable its activities.

Outlook

Islamic State Mozambique remains one of the less discussed Islamic State affiliates in Africa, but its reported activities in 2026 suggest that it has retained a capacity to adapt to changing battlefield conditions. Its ability to replenish supplies, capture weapons, exploit mining operations, and generate revenue through kidnapping and extortion may help it sustain its activities despite continued pressure from Mozambican and Rwandan forces.

In the coming months, the group may continue to probe areas beyond its established operating environment, including parts of Niassa Province near the Tanzanian border. The reported movement of fighters towards Marrupa raises concerns about possible cross-border implications. However, further expansion into Tanzania is not inevitable. Its likelihood will depend on whether the group can sustain movement beyond Cabo Delgado, establish local support or supply networks, and exploit gaps in border security. Cooperation between Mozambique and Tanzania, particularly in intelligence sharing and border monitoring, will be important in limiting the risk of cross-border expansion.

Mining areas are also likely to remain a focus of insurgent activity. Where the group can extort miners, seize gold, or impose demands on local economic actors, it may seek to maintain access to these resources despite military pressure. Further clashes could occur around strategically important mining sites as security forces attempt to deny the group access to revenue and prevent it from consolidating its presence. The extent to which mining activity contributes to the group's finances should remain an important indicator to monitor, alongside evidence of sustained extortion and control over local economic activity.

Attacks on commercial transport routes may also continue as the group seeks supplies and revenue. Renewed attacks against convoys, vehicle hijackings and extortion along key corridors would suggest that it retains the ability to disrupt movement beyond its principal strongholds. Such activity could increase the security burden on transport operators and communities while forcing authorities to divide resources between protecting economic infrastructure and conducting counterinsurgency operations.

The central question is whether the group's recent activity represents a temporary response to military pressure or a more durable recovery. Continued attacks alone will not answer this. More significant indicators include its ability to replace lost fighters and weapons, sustain access to revenue, return to areas after military operations, and maintain a presence beyond Cabo Delgado. If these capabilities strengthen, Islamic State Mozambique could remain a resilient threat even without recovering the territorial control it briefly achieved in 2021.

For security agencies, the priority should be to prevent the group from turning tactical mobility and diversified funding into a sustainable regional presence. This will require continued pressure on its operational strongholds, better protection of vulnerable communities and transport routes, and efforts to disrupt the economic activities that help finance its operations. Cross-border intelligence cooperation will also be important as the group's reported movements increasingly raise questions about the geographical limits of the conflict.