INTELBRIEF
September 9, 2026
25 Years After 9/11: Europe’s Convergent Terrorist Threat Matrix
Bottom Line Up Front
- Twenty-five years after the 9/11 attacks, the terrorist threat in Europe has evolved, with tactics, structures, and narratives that continue to change.
- Today’s threat is defined by digital exploitation, decentralized initiative, and violent extremists’ ability to learn and adapt quickly, complicating both detection and prevention.
- Large-scale terrorist operations are unlikely as Europe faces a fragmented terrorist ecosystem in which jihadist propaganda, encrypted communication, converging ideologies, youth subcultures, and low-threshold, single-actor attack methods converge.
- In 2026, jihadism remains the most consequential terrorist threat in the European Union and the United Kingdom, yet far-right, far-left, anarchist, separatist, nihilistic, and conspiracy-driven extremism has gained ground.
The attacks of September 11, 2001, marked the apex of hierarchical, centrally directed transnational terrorism. Al-Qaeda’s model relied on deep-rooted ideological allegiance, hierarchical command structures, and complex transnational logistics. The successive wave of Islamic State (IS)-directed attacks in Europe from 2015 onward preserved some of these 9/11-era strategies, but the barrier to conducting attacks by inspired sympathizers with minimal direct guidance from the central organization was already lowered. The subsequent collapse of Islamic State’s territorial “caliphate” in Iraq and Syria left its overarching project intact and accelerated a shift toward decentralized franchising, online mobilization, and autonomous action.
Today, only a small circle of specialists can confidently name the current leaders of key terrorist organizations and their main affiliates — a far cry from the immediate post-9/11 era. The personal charisma of militant figures like Islamic State founder and first caliph Abu Bakr al-Baghdadi, who consciously echoed Osama bin Laden’s leadership style, matters far less now. Repeated targeted killings of senior leaders have pushed the most relevant terrorist organizations toward more horizontal, networked, or digital forms of command. In effect, terrorist leadership has become largely depersonalized, with individual commanders increasingly less relevant.
Today, much of terrorist groups’ infrastructure is virtual, maintaining and inspiring a vast digital ecosystem. While Islamic State continues to hold territory in key conflict hot spots, it now also thrives on a sprawling digital ecosystem. Short videos consumed by supporters on social media platforms such as TikTok, Instagram, and Twitch give radical narratives visibility and serve as emotional entry points for susceptible audiences, and continue to proliferate. Encrypted channels enable secure interaction and the sharing of explicit content, while peer-to-peer applications reinforce ideological commitment and operational skills. In this digital environment, a terrorist organization can inspire violence without knowing who its supporters are, and self-radicalized individuals can act without receiving formal orders. This is the logic of “mutant jihadism”: the ideological brand survives even as hierarchical structures dissolve.
The Islamic State Khorasan Province (ISK) has exploited this model with particular effectiveness, well beyond their operational core in Central Asia and into Europe. Its external operations show that planners located far from Europe can still connect with supporters in cities like Paris, Brussels, or Berlin. Cases since 2023 suggest that ISK’s Central Asian diaspora networks, cross-border logistics, and use of encrypted communications can sustain structured plotting. The group’s messaging explicitly targets young, socially isolated individuals it can mobilize online.
The August 2024 plot against Taylor Swift concerts in Vienna symptomatically illustrates digitally-mediated radicalization and plotting by young extremists. The principal perpetrator, Beran A., a young adult, consumed Salafi influencer-preacher content on TikTok alongside explicit Islamic State propaganda. He moved beyond passive consumption to practical preparation: researching targets, studying bomb-making, and maintaining intensive contact with like-minded individuals both online and offline. Based on Beran A.’s plans, the plotted operation combined a vehicle attack, explosives, and a machete assault. The early detection of the plot underscores the value of transatlantic intelligence cooperation, domestic surveillance, and timely information sharing. It also highlighted the difficulty of categorization: although initially described as a lone-actor plot, the attacker and his accomplices operated within a supportive micro-network, exemplifying a “lone perpetrator plus” pattern.
The European terrorism threat landscape has also been shaped by the Hamas attack of October 7, 2023, and the subsequent war in Gaza. This has led to a propaganda shockwave that reshaped Islamist mobilization across Europe. The conflict provided extremists with a powerful narrative reservoir. Images of civilian suffering, often stripped of context and repackaged with emotionally charged slogans, became tools of political and psychological mobilization.
Jihadist propaganda framed the war as proof of a global assault on Islam and as justification for retaliatory violence in Europe. This “victim–revenge” narrative is especially potent in environments where emotional arousal triggers a process towards violence. Radicalization frequently begins with anger, humiliation, grief, and a sense of complicity, well before any coherent doctrinal worldview takes shape. Digital platforms algorithmically amplify this process by rewarding highly emotional content, allowing users to move quickly from mainstream material to explicit extremist propaganda.
European cases documented since October 7 reveal an increasingly youth-centric threat. Adolescents do more than consume extremist material. Some produce propaganda, run chat groups, discuss objectives, and seek validation from older or more experienced actors. This peer-driven dynamic accelerates radicalization and lowers the threshold for action.
Statistically, jihadism remains the primary security concern, but Europe’s terrorist threat landscape extends well beyond a single ideology. In 2025, Europol recorded 45 terrorist attacks across 10 EU member states, comprising 22 completed attacks, 20 foiled plots, and three failed attempts. Arrest figures, foiled plots, and the low cost of many attacks reflect intensive prevention efforts, but they also reveal a persistent environment of mobilization.
The prevailing modus operandi now involves knives, vehicles, improvised weapons, and other readily available means — methods that offer little warning and require minimal funding. Drones or 3D-printed weapons may, in the near future, become a preferred means of executing low-level attacks, particularly among young, digitally-savvy users.
Right- and left-wing extremism, nihilist and anarchist violence, separatist activities, anti-government extremism, and conspiracy-driven mobilization remain highly relevant. Ideological boundaries are also blurring. We increasingly face eclectic, “salad bar” ideologies that combine a variety of narrative elements, even from opposing belief systems. Extremists borrow narratives from one another, particularly those concerning alleged state oppression, demographic replacement, anti-globalism, antisemitism, and civilizational conflict.
Digital environments facilitate the circulation of shared emotional codes (anger, resentment, humiliation, nihilism) across otherwise disparate social groups in Europe. Relatedly, the crime-terror nexus is a trend that is here to stay when it comes to counterterrorism trends in Europe: criminal experience can support terrorist activities, while also blurring lines of accountability. Prisons remain a Pandora’s box, serving as environments for recruitment and reinforcement. Mental health problems are more common and may coexist with extremist commitments without fully explaining them. A key European issue, migration from conflict zones, creates additional vulnerabilities. Intelligence analysis must therefore distinguish structural risk factors from concrete evidence of mobilization and intent.
A quarter-century after 9/11, terrorism in Europe rests more on networked potential than on organizational mass. The key shift is from the terrorist group as a bounded entity to the terrorist ecosystem as an enabling environment. In that space, propaganda is personalized, radicalization accelerates, operational know-how is widely circulated, and attacks are improvised at low cost. Europe’s response therefore needs to combine intelligence-led disruption with long-term prevention, digital resilience, and efforts to strengthen social cohesion. The goal is to shrink the converging virtual and social spaces where grievance, ideology, technology, and opportunity fuse into extremist violence. For the next 25 years, this will very likely remain the core task of European counterterrorism institutions.
Dr. Nicolas Stockhammer is a Senior Research Fellow at The Soufan Center and leads the ‘Counter-Terrorism, CVE (Countering Violent Extremism) and Intelligence’ cluster at Danube University Krems in Austria.