European Union terrorism situation and trend report 2022.
Date: 2022-07-14
Institutions: Europol
Subjects: EU situation, European security, Europol, activity report, terrorism

 
 
CONTENTS 

– TE-SAT 2022 

3 
Foreword 

7 

Terrorism in 
Europe in 2021: 
an overview 

58 

Left-wing  
and anarchist 
terrorism 

4 
Key points 

21 

Jihadist  
terrorism 

6 
Introduction 

44 

Right-wing 
terrorism 

71 

Ethno-nationalist 
and separatist 
terrorism 

76 

Outlook on 
potential 
developments 

78 

Annexes 

| 2 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
Catherine De Bolle 
Executive Director  
of Europol 

FOREWORD 

– TE-SAT 2022 

I am pleased to present the 2022 edition of the EU Terrorism Situation and Trend 
Report (TE-SAT). This report is produced by Europol on an annual basis. The TE-SAT is 
the most comprehensive report on the situation and trends observed in terrorism in 
Member States. It informs policymakers, law enforcement staff and the wider public of 
developments related to terrorism, as well as forms of extremism that may influence 
or be connected to terrorism. This edition of the TE-SAT outlines the situational 
overview of the terrorist landscape that we must take note of and react to as a law 
enforcement community, while also informing other practitioners in order to address 
the challenges as part of a multi-disciplinary response. 

The findings of the TE-SAT 2022 confirm that lone actors associated with jihadist and 
right-wing violent extremism remain the biggest threat associated with potential 
terrorist and violent extremist attacks in the EU. The online environment plays a key 
role in this as it facilitates (self-) radicalisation and the spread of terrorist propaganda. 
Europol has significantly scaled up its capabilities in identifying terrorist and violent 
extremist content, and is working with online providers to remove it. The EU Internet 
Referral Unit (EU IRU), based at Europol’s European Counter Terrorism Centre (ECTC), 
plays a key role in this domain and is promoting new and innovative approaches to 
technological challenges. 

The impact of the COVID-19 pandemic on terrorism was particularly visible in terms of 
shaping extremist narratives. This has made some individuals more vulnerable to 
radicalisation and recruitment into terrorism and extremism. Social isolation and more 
time spent online have exacerbated the risks posed by violent extremist propaganda 
and terrorist content, particularly among younger people and minors. The societal 
impact of the COVID-19 pandemic will stay with us for some time and we must remain 
vigilant about some of the long-term challenges that follow on from this 
unprecedented crisis. 

Undoubtedly, the geopolitical shifts and the fallout from Russia’s war of aggression 
against Ukraine will have a lasting impact on the EU’s security for years to come.  
This war has already attracted several radicalised individuals from Member States who 
have joined the fight on both sides. Moreover, the ongoing war is likely to spark violent 
extremist reactions and mobilisation, particularly in the online domain. We must 
continue to closely monitor these developments while taking heed of the lessons 
learnt in the past in dealing with foreign fighters returning from battlefields in the 
Middle East. 

Europol will continue to work closely with Member States, partners from outside the 
EU, EU Agencies and other international bodies in order to understand and mitigate 
terrorist threats to EU communities. The TE-SAT 2022 provides us with the current 
situational picture of terrorism in the EU, but also highlights some of the challenges 
ahead of us. However, I am convinced that by working together and investing in 
cooperation we can meet these challenges head on. 

| 3 

 
 
KEY POINTS 

– TE-SAT 2022 

EU law enforcement authorities arrested 388 
suspects for terrorism-related offences in 2021 

Of these, more than two thirds (260) were 
carried out following investigations into jihadist 
terrorism offences in Austria, France and Spain. 
The number of arrests for terrorism decreased 
slightly in 2021 compared to the previous year. 

Terrorism remains a key threat to the EU’s 
internal security. 15 completed, foiled and 
failed terrorist attacks were recorded in the EU 
in 2021. The four completed attacks included 
three jihadist terrorist attacks and one left-
wing terrorist attack 

Two of the three completed jihadist attacks in 
France and Spain caused a total of two deaths. 
The 2021 total of completed, foiled and failed 
attacks is considerably lower than in the 
previous year (57), due to a significant decrease 
in the number of attacks reported as left-wing 
terrorism. 

Court proceedings concluded in 2021 resulted 
in 423 convictions for terrorist offences 

The conviction rate for terrorism remained high. 
All right-wing and left-wing prosecutions 
resulted in convictions, while for jihadist and 
separatist charges the conviction rate was 84 % 
and 82 % respectively. 

Lone actors remain the primary perpetrators of 
terrorist and violent extremist attacks in 
Europe. However, attack plots involving several 
actors were also disrupted in 2021 

Individuals carrying out attacks alone have been 
associated mainly with jihadist terrorism and 
right-wing terrorism and violent extremism. This 
does not necessarily mean that these individuals 
act in complete isolation. Online community 
building often plays a key role, as it connects 
peers virtually on a global scale. This drives 
radicalisation and provides access to terrorist 
propaganda, instructional material and 
opportunities for procurement of weapons and 
explosives precursors. 

| 4 

 
 
 
 
 
 
 
– TE-SAT 2022 

In 2021, weaponry was used in the completed 
terrorist attacks that is relatively easy to source 
and does not require extensive skills for 
assemblage or use 

Weapons used in attacks in the EU in 2021 
included bladed weapons, vehicles (in ramming 
attacks) and improvised incendiary devices 
(IIDs). Disrupted plots showed the intent and 
efforts to produce improvised explosive devices 
(IEDs).   

Terrorist propaganda disseminated online in 
2021 has continued to reflect themes related to 
COVID-19. The increased amount of time spent 
online due to COVID-19 restrictions, amongst 
other reasons, constitutes a risk factor in 
vulnerable individuals’ potential pathway  
to extremism 

The combination of social isolation and more 
time spent online during the pandemic has 
exacerbated the risks posed by violent extremist 
propaganda and terrorist content online, 
particularly among younger people and minors. 
Gaming platforms and services are increasingly 
used by right-wing terrorists to channel terrorist 
propaganda targeting a younger generation of 
users. Pandemic-linked restrictions also have the 
potential to exacerbate pre-existing mental 
health issues potentially prompting violent acts 
that resemble terrorist or violent extremist 
attacks. 

Violent anti-COVID-19 and anti-government 
extremism, which is not affiliated with 
traditional violent extremist and terrorist 
activities, emerged in some Member States and 
non-EU countries 

Such forms of violent extremism materialised in 
open threats, hateful messages spread online 
and, in some cases, the use of violence. Targets 
included politicians, government 
representatives, police, health authorities 
involved in the management of the crisis, or 
personnel from test and vaccination centres. 

Geopolitical developments in key regions 
outside of the EU influence terrorist narratives 
and propaganda spread in Member States 

The current terrorist threat for Member States 
appears not to have been directly affected by 
the Taliban’s takeover of power in Afghanistan. 
However, it increased global attention on 
religiously motivated insurgencies and, thereby, 
provided jihadists affiliated with both al-Qaeda 
and the self-proclaimed Islamic State (IS) 
terrorist group opportunities to promote their 
own narratives.  

| 5 

 
 
 
 
 
 
 
 
 
 
 
INTRODUCTION  

– TE-SAT 2022 

The European Union (EU) Terrorism Situation and Trend Report (TE-SAT) 2022 provides 
a situational overview of the terrorism landscape in 2021. 

The TE-SAT 2022 presents figures, major developments and trends pertaining to the 
terrorism situation in the EU, based on verified qualitative and quantitative data 
provided by Member States on terrorist attacks, arrests and court decisions issued for 
terrorist offences. Europol’s partners also provided valuable qualitative information 
and assessments that enrich the findings of the report, in order to reflect on 
developments beyond the EU that affect the security of the EU and its citizens. The 
report also includes information on convictions and acquittals for terrorist offences 
provided by Eurojust and based on data shared by Member States. 

According to the EU Directive 2017/541 on combatting terrorism1, a legal framework 
which all Member States were obliged to transpose into their national legislation by 8 
September 2018, terrorist attacks are criminal offences carried out with the purpose of 
intimidating a population or trying to coerce a government or international 
organisation, seriously destabilising or destroying the fundamental political, 
constitutional, economic or social structures of a country or an international 
organisation. The TE-SAT distinguishes between and elaborates in-depth on the 
following types of terrorism, based on ideological preferences: jihadist terrorism, 
right-wing terrorism, left-wing and anarchist terrorism, ethno-nationalist and 
separatist terrorism and other types of terrorism2.  

Despite varying legislation at national level, the EU Directive 2017/541 sets out a legal 
framework common to all Member States, and in particular, a harmonised definition of 
terrorist offences. On this basis, the TE-SAT provides statistical data on terrorist 
attacks, arrests and convictions in Member States. On a national level, terrorism 
legislation varies within the limits set by this Directive, as Member States retain 
flexibility when legislating. The quantitative analysis presented in the TE-SAT therefore 
reflects Member States’ definitions of terrorist offences according to national 
legislation, which may be broader (but not narrower) than the definitions set by EU 
Directive 2017/541.  

While the primary scope of the TE-SAT is terrorism, where relevant and available, the 
report presents specific violent extremist incidents, acts and activities where relevant 
and available, as reported by Member States. Extremist incidents are thus not 
reflected in the quantitative overview of terrorist attacks and are included in the 
report for contextualisation and to provide a more comprehensive picture of the 
terrorism situation in the EU. For the same purposes, Member States are also 
requested to report qualitative information on extremism and hateful narratives that 
have been observed to play a role in (inciting) terrorist violence.  

1 Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on 
combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending 
Council Decision 2005/671/JHA, accessible at https://eur-lex.europa.eu/legal-
content/EN/TXT/?uri=CELEX%3A32017L0541. 
2 Also referred to in past issues of the TE-SAT as ‘single issue terrorism’. 

| 6 

 
 
– TE-SAT 2022 

TERRORISM IN EUROPE  
IN 2021: AN OVERVIEW  

Terrorist attacks and arrests3  

15 
completed, 
foiled and 
failed 
attacks  
in 2021 in 
the EU  
This is a decrease 
from 2020  
(57 attacks)  
and 2019  
(55 attacks) 

France experienced the highest number of attacks (5), followed by Germany (3) and 
Sweden (2). Austria, Denmark, Hungary, Belgium and Spain reported one attack each. 
Of the 15 attacks, four were completed. Most reported terrorist attacks were 
categorised as jihadist terrorism (11), of which three were completed attacks carried 
out in France, Spain and Germany, and eight were foiled respectively in France (4), 
Sweden (1), Hungary (1), Denmark (1) and Germany (1). Jihadist attacks decreased 
compared to 2020 (14) and 2019 (18). The two fatalities recorded in 2021 were the 
result of the jihadist attacks carried out in Spain and France.  

There continues to be low numbers of completed, foiled and failed right-wing terrorist 
attacks. The total of three attacks in 2021 was comparable to the attacks reported in 
2020 (4) and in 2019 (2). In 2021, Member States did not report any completed right-
wing attacks, while two attacks were thwarted in Sweden and Austria, and one attack 
failed in Belgium.   

Left-wing and anarchist terrorist attacks in the EU sharply decreased in 2021. Only one 
completed attack was reported by Germany (no foiled or failed left-wing attacks were 
reported in 2021) compared to the 25 attacks in 2020 and the 26 attacks in 2019 
reported by Member States. The difference in numbers across the last three years can 
be attributed to a change in classification of incidents by some Member States from 
terrorist to extremist attacks4. In 2021, no completed, foiled or failed ethno-nationalist 
and separatist attacks were reported by Member States, while one such attack was 
confirmed in 2019 and 14 attacks were confirmed in 2020.  

3 Following the withdrawal of the United Kingdom of Great Britain and Northern Ireland (UK) 
from the European Union (Brexit), the statistics on terrorist attacks and terrorism-related arrests 
reported by the UK have not been included in the data collected since 2020. For consistency 
reasons, the statistics reported by the UK for 2019 have not been included in this report.   
4 See section on left-wing and anarchist attacks and arrests. 

| 7 

 
 
 
 
 
– TE-SAT 2022 

| 8 

 
– TE-SAT 2022 

388 individuals have been arrested in Member States in 2021 for terrorism-related 
offences. The number of arrested suspects has decreased from the 449 arrested in 
2020. Most of the arrests in 2021 (260) were carried out following investigations on 
jihadist terrorism in France, Spain and Austria (respectively 96, 39 and 23 individuals 
arrested). Arrests for jihadist terrorism remain in line with the numbers reported in 
2020. The number of arrests for right-wing offences increased in 2021, while the 
arrests for left-wing and anarchist terrorism decreased for the second consecutive 
year. Additionally, five arrests were carried out for other types of terrorism in Italy, the 
Netherlands, Croatia and Belgium. The majority of the arrested suspects were charged 
with membership of a terrorist organisation (74) and for planning or preparing an 
attack (31). Other suspects were charged with financing terrorism (14), recruitment 
(12) and incitement to terrorism (8)5.  

5 The offence leading to arrest was specified for 198 of the 388 arrests reported to Europol.  

| 9 

 
 
 
 
 
– TE-SAT 2022 

| 10 

 
– TE-SAT 2022 

Convictions and penalties  

Convictions and acquittals in 2021  

12 Member States reported information on court proceedings for terrorist offences 
that were concluded in 20216. Once concluded, these court proceedings resulted in 
423 convictions and acquittals for terrorist offences7. 

8

The Member States that reported the highest number of convictions and acquittals9 
for terrorist offences in 2021 are Belgium, France and Germany (107, 107 and 55, 
respectively). Aside from natural persons, four legal persons were charged with 
terrorist offences in Spain. Female defendants appeared before courts in the Member 
States on charges related to jihadist, right-wing and separatist terrorism in 2021. 
Courts in several Member States heard cases against women repatriated from, or 
believed to be still held, in camps in North Syria.  

6 Eurojust received contributions containing information on terrorism-related convictions and 
acquittals in 2021 from the following Member States: Austria, Belgium, Bulgaria, Denmark, 
France, Germany, Greece, Hungary, Italy, Latvia, Netherlands and Spain. 
7 Please refer to Annex I for further statistical information. 
8 The data for the previous years correspond to the data reported in the respective TE-SAT 
reports. 
9 Due to the specifics of reporting, some Member States submit information on final decisions 
only, while other Member States report also on decisions that are not yet final and that are 
pending judicial remedy. 

| 11 

 
 
 
All  concluded  terrorism-related  proceedings  heard  in  courts  in  Bulgaria,  Denmark, 
Germany,  Greece,  Hungary  and  Latvia  in  2021  resulted  in  convictions.  Also,  a  large 
majority of the concluded proceedings in Belgium and France led to guilty verdicts10. 

– TE-SAT 2022 

Types of offences in court proceedings  

The concluded court proceedings for terrorist offences in Member States in 2021 
concerned various types of acts. The most common offences on trial in 2021 included 
participation in (the activities of), support to or collaboration with a terrorist group, 
financing of terrorism, (self-) indoctrination, providing or receiving training for terrorist 
purposes, terrorist attacks, incitement to commit terrorist acts, and recruitment or 
glorification of terrorism. In some cases, the charges concerned the threat, 
preparation, attempt, aiding and abetting or complicity to commit such offences. As 
well as charges for terrorist offences, defendants were also charged with firearms or 
explosives-related offences, core international crimes, document forgery, theft, 
violation of financial legislation, etc.  

In some cases, the charges concerned threats, preparation, attempt, aiding and 
abetting or complicity to commit such offences. Further to terrorist offences, 
defendants were also charged with firearms or explosives-related offences, core 
international crimes, document forgery, theft, violation of financial legislation, etc.  

(Preparation of) Terrorist attacks 

In 2021, several proceedings related to recent attacks or preparation of attacks in 
Member States were concluded. 

In February 2021, the Court of First Instance of Antwerp in Belgium convicted three 
men and a woman of participation in the activities of a terrorist organisation and 
attempted murder by an attempted terrorist attack. Through these acts they 
intended to kill participants, with terrorist intent, at a rally organised by the exiled 
Mujahedin-e-Khalq (MEK/National Council of Resistance of Iran, CNRI) in the 
French town of Villepinte in June 2018.  

Financing of terrorism and providing logistical and other support 

Proceedings concluded in 2021 also concerned financing of terrorism and/or providing 
logistical and other support to terrorist organisations or their members. Those 
proceedings were related to different types of terrorism. In some cases of alleged 
financing of terrorism, financial services companies and money transfer providers, as 
well as hawala were used. Links to other types of crime, such as money laundering, 
were also investigated. 

In February 2021, the Regional Criminal Court of Vienna in Austria convicted one 
defendant charged with the financing of terrorism and membership of a terrorist 
and criminal organisation, and sentenced him to two years of imprisonment. He 
collected donations via Facebook for an IS member in Syria, spread IS propaganda 
in social media and encouraged individuals to join the terrorist organisation.  

10 Eurojust considers it one verdict if a person is convicted of more than one terrorist offence 
within the same proceeding, or convicted of a terrorist offence and acquitted of another 
offence. If a person is acquitted of a terrorist offence and convicted of another offence, the 
verdict is included in the overview as acquittal of terrorism. 

| 12 

 
 
– TE-SAT 2022 

Cumulative prosecutions for terrorism and core international crimes 

Charges for both terrorism and core international crimes were also brought in 
concluded court proceedings in 2021. Several cases concluded in 2021 concerned, 
among others, offences committed against the Yazidi community.  

In June 2021, the Higher Regional Court of Düsseldorf in Germany convicted a 
woman of German-Algerian nationality of two counts of participation in a terrorist 
organisation abroad. One offence was committed in concurrence with the crime 
against humanity of enslavement, resulting in death, the crime against humanity of 
persecution, aiding and abetting the crime against humanity of rape, deprivation of 
liberty for over a week, as well as deprivation of liberty, resulting in death and 
bodily harm. The defendant travelled to Syria in 2013, at the age of 15, and was 
incorporated into IS through her marriage with an IS fighter, in which position she 
dealt with the recruitment and accommodation of new arrivals and the 
enslavement of seven women and girls of Yazidi origin.  

Dissemination of terrorist content, recruitment, (self-) indoctrination, 
training, incitement and glorification of terrorism 

The dissemination of terrorist propaganda and other terrorist content, the glorification 
of terrorism and public incitement to commit terrorist acts were dealt with in cases 
concluded in various Member States in 2021. Similar to activities related to 
recruitment, (self-) indoctrination, receiving and providing training for terrorist 
purposes, these offences were often committed online. 

In August 2021, the Court of First Instance of Brussels in Belgium (French-speaking 
court) convicted a Belgian national to four years of imprisonment and a fine for 
participation in the activities of a terrorist group, for self-training and for 
attempting to receive training. The court heard that the defendant endorsed IS 
ideology and was in contact with numerous IS supporters and terrorist convicts. He 
also spread IS propaganda material on social media and provided support, including 
financial, to the terrorist organisation. According to the investigations, the 
defendant was preparing a bomb attack against a Belgian prison where a relative 
was detained. He made online searches on the production of a bomb, remote 
control systems and unmanned aerial vehicle (UAV or drones). In this case, the 
instructions on the fabrication of a bomb were provided by IS members, leaving no 
doubt as to the terrorist motivation of the defendant when consulting the material.  

Penalties11  

The average prison sentence for terrorist offences in the reported proceedings in the 
Member States in 2021 was six years, which was lower than in 2020 (eight years)12. 
The lowest prison sentence ordered by courts in the Member States in 2021 was five 
months and the highest was life imprisonment given to defendants found guilty in 
Austria, Belgium, Germany and Hungary. Similarly to 2020, in 2021 prison terms of up 

11 The severity of the penalty in each case depends on the respective offence and specific 
circumstances, and therefore cannot serve any comparative purposes. Also, in some Member 
States the average sentence is calculated on the basis of one conviction, while in others it is 
based on a considerably larger number of convictions 
12 For the purpose of the calculation of the average prison sentence, penalties exceeding 40 
years of imprisonment and life sentences were counted as 40 years, unless the court has 
indicated a specific number of years to be served. In the cases where the court ordered a 
possibility of parole after a certain number of years have been served, those years are included 
in the overview. 

| 13 

 
 
to five years were the most common penalty handed down in guilty verdicts for 
terrorist offences (65 %), while penalties of 10 or more years of imprisonment were 
handed down in 17 % of the guilty verdicts (25 % in 2020).  

– TE-SAT 2022 

| 14 

– TE-SAT 2022 

Cross cutting issues  

The impact of the COVID-19 pandemic on terrorism and extremism  
in the EU  

During the COVID-19 pandemic, the combination of increased online presence and 
social isolation have deepened individuals’ susceptibility to radicalisation. For those 
advocating extremist ideologies, the crisis has emerged as an opportunity to advance 
their narrative.  

From the onset of the pandemic, jihadist, but more notably right-wing, 
left-wing and anarchist terrorist and extremist groups, have framed 
COVID-19 themes in line with their respective ideology.  

New topics of propaganda have been taken up by both right-wing and left-wing 
extremists during the pandemic, including conspiracy theories on the origin of the 
COVID-19 pandemic, disinformation on the vaccination roll-out and allegations of mass 
surveillance by authorities. Websites, blogs, social media and various encrypted 
messaging applications have played a major role in the dissemination of propaganda 
material during the crisis. 

The restrictions related to COVID-19 have hampered physical activities such as 
networking, training, recruitment and weapons procurement. Traditional terrorism 
financing activities and physical flows for circulating money were also disrupted. 
Online financial services and virtual assets have become more prominent in terrorism 
financing, especially in the jihadist terrorist and right-wing extremist scene13.  

Nonetheless, (preparation of) attacks and incidents continued despite the COVID-19 
restrictions and, in some cases, the latter were motivated by it. While some Member 
States reported decreased levels of activity within the left-wing and anarchist 
extremist scene during the pandemic, others witnessed intensified activity during anti-
COVID-19 demonstrations where left-wing and anarchist extremists attacked 
demonstrators or caused property damage.  

Extremist views and behaviours linked to anti-COVID-19 measures and anti-
government sentiments, but not associated with established terrorist and violent 
extremist ideologies, emerged in some Member States. They were mostly noted in 
relation to groups formed loosely online, and materialised in threats made against 
politicians, government representatives, and health authorities. They also threatened 
to harm the police at protests as well as vandalise COVID-19 vaccination and test 
locations. 

Croatia reported the arrest of two suspects who committed the criminal offence of 
public incitement to terrorism through online channels and social networks. By doing 
so, they encouraged others to attack individuals during COVID-19 protests, and 
members of the government and the parliament. They also encouraged others to 
occupy public facilities and infrastructure by means of violence. In Italy and the 
Netherlands, suspects were arrested for bomb and arson attacks on vaccination 
centres.  

13 See section on financing of terrorism.  

| 15 

 
 
Weaponry and explosives 

– TE-SAT 2022 

Out of the total of 15 completed, foiled and failed terrorist attacks reported by 
Member States in 2021, weapons of choice included bladed weapons, vehicles (in 
ramming attacks) and IID. The four completed terrorist attacks were perpetrated by 
stabbing (2), ramming a vehicle into a crowd (1) and arson using inflammable liquids 
(1). Similarly, suspects in the failed and foiled attacks were planning to use knives, 
IEDs, and a vehicle.  

IEDs and IIDs were used in all types of terrorism, while bladed weapons such as knives 
were mainly used in a jihadist or right-wing context. 3D-printed weapons, as well as 
conventional and homemade weapons and materials, have been found during 
investigations in Member States, particularly those concerning right-wing extremists 
and terrorists. 

Explosives 

Evidence from right-wing and jihadist foiled attacks confirmed the intent and 
capabilities of terrorists to conduct attacks employing explosives and IEDs. In February 
2021, law enforcement authorities in Denmark and Germany detained 14 individuals 
on suspicion of planning a jihadist bomb attack in Europe and seized chemical 
substances, ten kilograms of black powder and fuses. In order to carry out their plan, 
the suspects had purchased several kilograms of explosives precursors, bomb 
components, firearms and ammunition. Of the 14 suspects, five were charged with 
terrorist offences in Denmark while the others were released without charges. During 
the investigation linked to a foiled right-wing attack in November 2021, the Swedish 
police arrested a man for planning to build an IED using stolen fertiliser.  

Home-made explosives (HME) remain the preferred weapon for jihadist terrorists. 
While the use of TATP14 has continued to decrease, a continuing increasing trend of 
manufacturing homemade low explosives15 mixed from acquired explosives precursors 
(e.g. potassium nitrate, aluminium powder, sulphur, ammonium nitrate) has been 
noted in 2021. Instructions published and shared via encrypted communication 
platforms mostly incited and suggested the use of HME, readily available pyrotechnics 
and rudimentary ‘pipe bomb’ types of IEDs.   

Left-wing, right-wing and ethno-nationalist and separatist violent extremist groups also 
employed IIDs and fire accelerators to commit arson attacks. The majority of IIDs used 
and recovered in 2021 were filled with flammable liquids and equipped with simple 
time-delayed activation systems. Some activation systems were more sophisticated, 
with programmable time-delayed relay modules. These devices are available as low-
cost, self-built electronic kits or pre-assembled boards, and they do not require 
extensive funding or specialised expertise for the set-up.  

In 2021, targets of attacks employing IIDs included political parties’ headquarters, 
police vehicles, financial institutions, railway infrastructure and telecommunication 
towers, as well as vaccination and health centres. Arson has been the preferred 
method of attack, carried out with simple IIDs thrown at the targets, and by setting 
vehicles on fire. However, bombing attacks have also been recorded, committed with 
time-delayed IEDs made with explosive materials sourced from pyrotechnics. 

Member States did not report terrorist attacks using chemical, biological, radiological 
or nuclear (CBRN) materials. However, media highlighted an arrest in France. After 

14 Triacetone triperoxide (TATP). 
15 A low explosive is usually a simple mixture of a combustible substance and an oxidant that 
decomposes rapidly (deflagrate, rather than detonate). Examples of low explosives include: 
black powder, flash powder, smokeless powder. 

| 16 

 
 
– TE-SAT 2022 

publicly announcing at a school the alleged manufacturing of pipe bombs loaded with 
radioactive material, a suspect with far-right ideologies was detained, and CBRN and 
EOD teams were called in16. The investigation of the case highlighted the risks 
associated with the availability of such materials, since the suspect acquired them on 
an online commercial platform.  

Only a few CBRN references were observed in online propaganda in 2021 and they 
largely involved the circulation of posters from previous years on online forums and 
websites, which had indirect CBRN content, such as pictures of terrorists wearing gas 
masks. Although the COVID-19 pandemic has placed bioterrorism under a spotlight, in 
the second year of the pandemic online propaganda and discussions in closed online 
forums on the possibility of weaponising a virus decreased.   

The financing of terrorism  

In 2021, out of the 388 arrests for terrorism-related offences reported by Member 
States, 14 arrests concerned terrorism financing. All of the cases concerned the 
funding of terrorist organisations’ support activities by individuals, rather than direct 
funding of a specific terrorist attack or plot.  

Legal sources 

Across the EU, individual donations remain one of the primary means of funding for 
terrorist and violent extremist organisations across the whole ideological spectrum. In 
January 2021, for instance, three individuals were arrested in Germany, with charges 
of terrorism financing. The suspects were part of an international network promoting 
the activities of Hay’at Tahrir al-Sham (HTS) by obtaining donations in the EU and 
sending them to Syria. For the other types of terrorism, money is collected at 
fundraising events among members and sympathisers, or via bank transfers. In 2021, 
Germany convicted a member of the Partiya Karkerên Kurdistanê (PKK, ‘Kurdistan 
Workers’ Party’) responsible for the overall activities of the group in one German 
region. The suspect was heavily involved in financial operations for the PKK, including 
the annual fundraising campaign.   

There are instances of terrorist groups using non-profit organisations to collect 
donations under the guise of charitable collections. In Spain, three suspects were 
arrested for terrorism financing by using these means. The money was raised by a 
religious organisation under the pretence of humanitarian aid for Syrian orphans, but it 
was diverted to fund al-Qaeda fighters in Syria by using a non-profit organisation. 
Some foundations openly collect funds for FTFs and their families in conflict zones and 
prison camps in Syria. In addition, family and friends also financially contribute to 
jihadists outside of the EU.  

The increased availability of crowdfunding websites, providing opportunities to reach a 
large number of donors and quickly raise considerable amounts of money, makes this 
otherwise legitimate way of fundraising attractive to terrorist and extremist 
organisations. Spain reported that most of the funds channelled from the country to 
jihadist groups was raised through online crowdfunding campaigns. Moreover, 
separatist movements in Spain are also relying on crowdfunding to pay for propaganda 
activities and, increasingly, to raise the money needed to cover the legal expenses of 
arrested and prosecuted members. Some right-wing groups known to raise funds 
through physical events also shifted to online methods for funding, including 
crowdfunding. Right-wing extremists raise money through campaigns posted on 

16 Europol information.   

| 17 

 
 
– TE-SAT 2022 

platforms such as YouTube, Patreon and GoFundMe, while online payment systems 
like PayPal or Amazon Pay are used for transfers.  

Terrorist and extremist organisations actively finance themselves through commercial 
activities. Although organising concerts has been hampered in the EU due to       
COVID-19, some right-wing, left-wing and ethno-nationalist and separatist extremist 
groups have still been able to generate funds the traditional way. The groups capitalise 
on entrance tickets, merchandise and donation campaigns, but generally, the funds 
collected remain modest. Left-wing extremists traditionally sell books and dedicated 
magazines to collect funds, which in parallel also promote the groups’ extremist 
ideologies among a wider public.  

Other ways of generating income include the online sale of merchandise on e-
commerce platforms (band t-shirts, CDs and World War II Nazi equipment in a right-
wing context), membership fees, and publications and tickets for events organised by 
affiliated NGOs for ethno-nationalist and separatist groups.  

Illegal sources 

Individual members of right-wing and jihadist extremist and terrorist groups have been 
linked to criminal activity, ranging from the distribution and sale of drugs to robberies, 
thefts and extortions. Dissident Republican (DR) groups in Ireland utilise extortion, 
often in the form of taxation, for financial gain as much as for increasing their influence 
and presence in the communities. Extortion has also been investigated in cases 
involving right-wing extremists along with trafficking in human beings for sexual 
exploitation.  

Terrorist and extremist actors engage in a variety of frauds to raise funds, including tax 
fraud and tax evasion, social benefit fraud, and insurance and loan fraud.  

Modi operandi  

The traditional banking system remains one of the first choices for transferring money 
abroad. Terrorist organisations use national and transnational banks for transfers to 
accounts in and outside the EU. In order not to be flagged, the amounts of money 
transferred remains low, mostly under EUR 1 000. Smurfing17 remains a practice that is 
highly exploited. Terrorist and extremist actors that raise funds through donations and 
events are more inclined to use the formal banking system to collect and transfer 
money, as these activities are considered legal. Platforms such as Wise and PayPal are 
also among the ways that terrorist and extremist groups transfer funds.  

Jihadist actors commonly use money transfer services, such as MoneyGram and 
Western Union, or informal value transfer systems (IVTS), such as hawala. IVTS rely on 
a network of collaborators outside the formal banking infrastructure. Money mules are 
key figures in such networks, as they act as intermediaries and collectors of cash on 
behalf of the end receiver. Intermediaries have also been noted to withdraw cash from 
money transfer services in locations outside the EU and close to conflict zones, where 
the money is then delivered.  

Cash intensive businesses may be used to facilitate funding and money laundering 
operations by members or sympathisers of extremist groups. Similarly, legal business 
structures – ranging from small traders to large structures of international companies – 

17 In the context of money laundering, smurfing is a technique whereby large amounts of cash are 
transferred  into  multiple  small  transactions,  often  over  several  accounts,  to  remain  within 
regulatory reporting limits.  

| 18 

 
 
– TE-SAT 2022 

are used to hide the collection and transfer of money. FinTech companies18 have been 
increasingly investigated by EU authorities in cases of terrorism financing.  

The use of digital currency, cryptocurrency and virtual assets service providers (VASPs) 
enables terrorist and extremist groups to increasingly misuse crowdfunding activities, 
while maintaining a higher level of anonymity for donors and recipients. With regard to 
jihadist terrorism, there have been cases of financial support or requests for support 
from IS and al-Qaeda involving cryptocurrencies. Spain, for instance, has reported a 
shift from money business services to crypto-assets and virtual platforms since 2020, 
which further increased in 2021. Right-wing extremists also use funding platforms 
operating with cryptocurrencies. Moreover, prepaid cryptocurrency coupons or 
premium tickets that can be bought legally in Member States for values comprising 
between EUR 50 to 250 have been used for transferring money abroad. 

The nexus between terrorism and serious and organised crime  

Connections between terrorism and extremism on one side, and 
serious and organised crime on the other, do not follow a set pattern. 

Links between terrorism and extremism and serious and organised crime are 
characterised by the joint use of criminal services, a common pool for recruitment, as 
well as by overlaps in extremist and terrorist suspects’ backgrounds in crime or 
conversely criminals’ history with extremism or terrorism. Terrorists and violent 
extremists are also involved in serious and organised crime activities to expand profits 
and finance terrorist operations. 

Criminal services: a jointly used resource in terrorism and serious and 
organised crime 

Suspects linked to terrorism were detected travelling to and through the EU, using the 
services of migrant smuggling criminal networks. Relevant routes included the Eastern 
Mediterranean route, entering Greece from Turkey, and onward journeys via the 
Western Balkan routes into the EU. Terrorist or violent extremist suspects, including 
returning FTFs, also make use of fraudulent documents acquired from criminal services 
to travel to or through the EU.   

Traffickers and criminal networks smuggling firearms and explosives also cater to 
terrorist/violent extremist actors. Suspects connected to the right-wing scene, and 
occasionally to jihadism, were seeking to procure or buy weaponry and explosives 
from criminal networks, while some engaged in firearms trafficking themselves. During 
investigations, law enforcement authorities found 3D printing equipment used to 
fabricate weapons, as well as right-wing propaganda material and instructions.   

Common pool for recruitment and overlapping background of suspects  

Skills and experience in crime, connections in the criminal world, or access to illicit 
goods and services such as weapons and fraudulent documents, make criminals 
attractive potential recruits for terrorist and violent extremist organisations. 

18 Financial Technology (FinTech) companies use technology to offer financial services, for 
instance online banking and mobile payment apps.  

| 19 

 
 
– TE-SAT 2022 

Moreover, prisons remain a fertile ground for radicalisation, often facilitated by the 
bonds created between inmates. 

A number of suspects affiliated with terrorism and violent extremism in the EU have a 
criminal background or maintain contacts in the criminal environment. Migrant 
smugglers operating in the EU were in several cases suspects in terrorism 
investigations or had connections with terrorists and violent extremists. Similarly, 
members of drug trafficking networks in the EU were found to be affiliated with right-
wing extremism or jihadism. Furthermore, some members of outlaw motorcycle gangs 
(OMCGs) adhere to right-wing ideology; occasionally, members of such gangs were 
found cooperating in serious and organised crime with right-wing extremists. 

Serious and organised crime: a source for funding terrorism  

Profits represent a core element of the nexus between serious and organised crime 
and terrorism. Some terrorist groups based outside the EU have engaged in profitable 
criminal activities on EU territory, such as money laundering or drugs trafficking.  

Hezbollah19 - drug trafficking and money laundering in the EU20 
The organisation based in Lebanon has been using the EU as a base for fundraising, 
recruitment and criminal activities from which they obtain significant profits. The 
network of collaborators built by Hezbollah in the EU is suspected of managing the 
transportation and distribution of illegal drugs into the EU, dealing with firearms 
trafficking and running professional money laundering operations that include the 
provision of money laundering services for other criminal organisations.   

While it may not affect the EU directly, outside of the EU, terrorist organisations 
constantly fight to gain control over infrastructure or criminal activities that may 
ultimately finance terrorist operations or expand their overall profits and capabilities21.  

Environmental crime is a lucrative business. Much of the wildlife trafficked by criminal 
organisations into the EU originates from territories on other continents that are under 
control of terrorist groups. Moreover, mineral resources are also exploited by terrorist 
organisations and their local branches. One such example is in the Northern Province 
of Cabo Delgado in Mozambique, where terrorist groups have a foothold on 
exportation routes for timber, gold, gas and precious minerals and metals22.  

Trafficking in cultural goods stolen from conflict areas has been associated with 
criminal groups in the EU and may be another instrument in the hands of terrorist 
groups active in such regions to expand their influence and build on their capabilities23.  

19 The military branch of Hezbollah is designated as a terrorist organisation by the EU. 
20 Europol information.  
21 CT MORSE, Counter-Terrorism Monitoring, Reporting and Support Mechanism, 2017, 
‘Examining the Nexus between Organised Crime and Terrorism and its implications for EU 
Programming’, accessible at https://ct-morse.eu/resource/examining-the-nexus-between-
organised-crime-and-terrorism-and-its-implications-for-eu-programming/  
22 Operational information from Europol’s European Counter Terrorism Centre. 
23 Europol, 2021, ‘EU Serious and Organised Crime Threat Assessment (SOCTA) 2021’, accessible 
at https://www.europol.europa.eu/publications-events/main-reports/serious-and-organised-
crime-threat-assessment.  

| 20 

 
 
– TE-SAT 2022 

JIHADIST TERRORISM  

KEY FINDINGS  

►  Three completed jihadist terrorist attacks were reported in the EU in 2021, 
in France, Spain and Germany. Eight jihadist attacks were foiled in six 
Member States, whereas no failed attacks were reported.  

►  260 suspects were arrested in 2021. The most common charges were 

membership of a terrorist organisation, often combined with dissemination 
of propaganda, or planning and preparing an attack.   

►  All completed jihadist terrorist attacks were carried out by individuals acting 

alone. In addition, Member States conducted a significant number of 
investigations into individuals suspected of planning jihadist terrorist attacks. 
A number of groups of suspects involved in planning and preparing attacks 
were dismantled in 2021. 

►  The perpetrators of the three jihadist attacks carried out in 2021 employed 
simple means, including bladed weapons and a vehicle. However, some 
foiled attacks involved modi operandi requiring longer and more complex 
planning, such as the manufacture of IEDs. 

►  Decentralised technologies and newly developed online spaces remained 

attractive for IS supporters. 

►  IS and al-Qaeda propaganda’s narratives did not experience any notable 
shifts. However, both exploited the Taliban takeover in Afghanistan to 
promote their own narratives. Both organisations remained eager to 
conduct attacks in the West, despite their affiliates focusing on local issues. 

►  Several violent incidents not labelled as terrorist but using terrorist modi 
operandi, that occurred in 2021 were exploited by IS and al-Qaeda 
propagandists to promote the groups’ narratives. 

| 21 

 
– TE-SAT 2022 

JIHADIST TERRORISM – defined  

The TE-SAT uses a narrow definition of jihadism. Jihadism is defined as a violent sub-
current of Salafism, a revivalist Sunni Muslim movement that rejects democracy and 
elected parliaments, arguing that human legislation is at variance with God’s status as the 
sole lawgiver. Jihadists aim to create an Islamic state governed exclusively by Islamic law 
(shari’a), as interpreted by them. Major representatives of jihadist groups are the al-
Qaeda network and the self-proclaimed Islamic State (IS) terrorist group. 

Contrary to other Salafist currents, which are mostly quietist, jihadists legitimise the use 
of violence with a reference to the classical Islamic doctrines on jihad, a term which 
literally means ‘striving’ or ‘exertion’, but which jihadists treat as religiously sanctioned 
warfare.  

All those opposing jihadist interpretations of Islamic law are perceived as ‘enemies of 
Islam’ and therefore considered legitimate targets. Some jihadists include Shi’a, Sufis and 
other Muslims in their spectrum of perceived enemies. 

Jihadist terrorist attacks and arrests24  

Attacks  

11  
completed and 
foiled attacks in 
six Member 
States 

In 2021, a total of 11 completed and foiled jihadist attacks were reported by Denmark, 
France, Germany, Hungary, Spain and Sweden. No failed attacks were reported. This 
was a lower number than in previous years (with 14 in 2020 and 18 in 2019). Three 
attacks were completed in Germany, France and Spain compared to 10 in 2020. Two 
victims died as a result of the attacks in France and Spain, while in 2020 jihadist attacks 
led to 12 deaths.  

The completed jihadist terrorist attack in France occurred on 23 April 2021 in 
Rambouillet, when a Tunisian national stabbed and killed an administrative officer with 
a knife in a police station. Police killed the perpetrator within minutes of the attack.  

The second attack occurred in Roldán near Torre Pacheco in Murcia, Spain,  
on 17 September 2021. A Moroccan national rammed a vehicle into the terrace of a 
restaurant mainly frequented by foreign tourists. The incident killed one person and 
injured five others. The attacker also died during the attack. At the time of writing, a 
decision on the classification of this attack as terrorist is pending at the National Court.  

The third was a knife attack that occurred on 6 November 2021 on a train from Passau 
to Nuremberg in the district of Neumarkt (Bavaria), Germany, when a Syrian national 
left five persons injured. The perpetrator was motivated by radical jihadist ideology. 
He was arrested at the next train station.  

As in previous years, all completed jihadist attacks were carried out by individuals 
acting alone. The three attackers were male and were non-native of the countries of 
the attacks, while being legal residents in the countries of the attacks. The attacker in 
France was a 36-year-old Tunisian national who arrived illegally in France in 2009 and 

24 Following the withdrawal of the UK from the European Union (Brexit), the statistics on 
terrorist attacks and terrorism-related arrests reported by the UK have not been included in the 
data collected since 2020. For consistency reasons, the statistics reported by the UK for 2019 
have not been included in this report.   

| 22 

 
 
  
obtained a residence permit in 2019. The attacker in Spain was a 27-year-old 
Moroccan legally residing in Spain, where he arrived at the age of 13. The attacker in 
Germany was a 27-year-old Syrian national who arrived in Germany in 201425. 

– TE-SAT 2022 

25 Polizeipräsidium Oberpfalz, 7.11.2021, Attack with a knife in an ICE train - 2nd supplementary 
report/‘Angriff mit einem Messer in einem ICE-Zug – 2. Nachtragsmeldung’, accessible at 
https://www.polizei.bayern.de/aktuelles/pressemitteilungen/019187/index.html.  

| 23 

 
 
 
– TE-SAT 2022 

Member States foiled eight attacks in 2021 (compared to four in 2020 and 12 in 
2019)26.  

As in 2020, Member States did not report failed jihadist attacks in 2021.  

26 UK numbers are not included in the 2019 and 2020 statistics.  

| 24 

 
 
 
 
– TE-SAT 2022 

| 25 

 
Arrests  

– TE-SAT 2022 

EU law enforcement authorities made 260 arrests for suspected jihadist terrorist 
offences in 2021. This number was in line with the 254 arrests in 2020 but decreased 
compared to the 436 arrests in 2019. The most common offences leading to an arrest 
for jihadist terrorism were membership of a terrorist organisation, often combined 
with dissemination of propaganda, and planning and preparing an attack.   

The majority of jihadists that came under the attention of law enforcement in the EU 
are young or middle-aged men, often – but not exclusively – of a Muslim background. 
Jihadist suspects arrested in 2021 were predominantly male (80 %) with an average 
age of 33 years. The vast majority of the suspects were either citizens of a non-EU 
country or EU citizens born outside the EU. The majority of arrested non-EU citizens 
were Moroccan (19), Algerian (13) and Pakistani (7). Among EU citizens’ arrestees born 
outside the EU, the two most represented countries of birth were Syria (5) and the 
Kosovo region27 (3). Austrian (15), German (13) and Dutch (11) were the three most 
reported nationalities of EU citizens born in the EU28.   

Arrests for planning attacks 

Member States reported 19 cases where the offence leading to arrest was planning 
and preparing terrorist attacks.   

Lone actors remain a source of great concern. In Germany, a 20-year-old German 
national was arrested in Hamburg in August 2021 while trying to purchase weapons. 
He was part of the radical jihadist scene in Hamburg and investigations have shown 
that he was likely planning an attack.  

Terrorist and extremist groups continue to be dismantled in the EU. In a joint Danish-
German operation, 14 suspects were initially arrested, 13 in Denmark and one in 
Germany. The group was planning to carry out a terrorist attack in Europe using IEDs 
and firearms. Among the suspects, three were Syrian brothers aged 33, 36 and 40 (two 
arrested in Denmark and one in Germany)29. Of the 13 people arrested in Denmark, 
five were charged with terrorist offences, while the suspect arrested in Germany was 
released without charges.  

The planning and preparation of attacks were frequently accompanied by auxiliary 
offences such as self-training, including the exchange of tactical information online.  

The woman arrested in April 2021 in Béziers, France30, was a member of a chat group 
on Telegram where instructions on how to make explosives and suicide bomb vests 
were shared. Occasionally, suspects were found to connect online with terrorist groups 
and networks, or with foreign fighters located in Syria and Iraq.  

Minors have been involved in terrorist-related actions. In Germany, a 16-year old 
Syrian national was arrested in September 2021 on charges of planning and preparing 
an attack against a synagogue in Hagen31, while another 16-year old German national 
was arrested for incitement and threats inspired by IS ideology.  

27 The designation of Kosovo is without prejudice to positions on status, and is in line with 
UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence. 
28 Age was reported for 135 arrestees, gender for 139, citizenship for 137 and country of birth 
for 127.  
29 Europol information.  
30 See section on foiled attack.  
31 Europol information.   

| 26 

 
 
 
– TE-SAT 2022 

| 27 

 
– TE-SAT 2022 

Violent incidents using terrorist modi operandi 

As in previous years, violent incidents not labelled as terrorist but using terrorist modi 
operandi occurred in 2021. While sometimes showing signs of religious radicalisation, the 
perpetrators of these incidents displayed other driving factors, in particular mental health 
issues. Upon closer inspection, these incidents were judged to have been triggered by factors 
other than political or ideological persuasions. However, exposure to jihadist propaganda 
online can be a factor precipitating vulnerable individuals’ passage to violent action. 

One of the most notable of these incidents was an assault in Würzburg, Germany, where a 
Somalian citizen killed three people, all women, and injured seven others with a knife on 25 
June 2021. The perpetrator was arrested but expert reports concluded that he was not legally 
responsible at the time of the incident because of mental health issues. No indications of an 
extremist background or the existence of associates who knew about the plot or took part in it 
emerged during the investigation32. 

Several of these violent incidents were initially framed as terrorism in media reporting and 
public commentary and were regularly exploited by jihadist propagandists, both in support  
of al-Qaeda and IS, and by right-wing extremists, each in an effort to promote their own 
radical narratives. 

Convictions and penalties 

Similar to previous years, the vast majority (340) of the convictions and acquittals 
handed down by courts in Member States in 2021 for all terrorist offences concerned 
jihadist terrorism. The majority of them were rendered in Belgium and France (100 and 
83, respectively). A large share of the offences related to jihadist terrorism continued 
to be linked to terrorist groups that are, or used to be, active in Syria, such as IS, Hay’at 
Tahrir al-Sham (former Jabhat al-Nusra and Jabhat Fath al-Sham), the Ahrar al-Sham 
Islamic Movement, and Junud al-Sham. Concluded court proceedings concerning 
offences related to jihadist terrorism led to convictions in 84 % of the cases 
(decreasing from 93 % in 2020). 

In February 2021, the Higher Regional Court of Celle in Germany convicted four 
persons of various offences related to IS, including participation in or support for a 
terrorist organisation abroad, aiding and abetting the preparation of a serious act 
of violence endangering the state, financing of terrorism and incitement to commit 
fraud. Among the four arrested in 2016 was an imam from the German Salafist-
scene who was in direct contact with IS decision makers and encouraged his 
followers to travel to IS-controlled territory or to act in support of IS in Germany, 
for instance by committing attacks. A man, who acted as his logistician, engaged in 
fraudulent acts to finance the travels of some who decided to join IS-controlled 
territory. A third person organised indoctrination events in a residence, with the 
aim of getting others to join IS, and also supported travels to territories controlled 
by IS. The fourth man organised information and indoctrination events in a travel 
agency he operated and supported the travels of others as well. Based on the role 
of the defendants, the court ordered prison terms of between four years and two 
weeks and ten years and six months.  

32 Bavaria State Criminal Police Office press release, 22.10.2021, Knife attack in Würzburg on 
June 25, 2021 - expert report and investigation status/‘Messerangriff in Würzburg am 25. Juni 
2021 – Sachverständigengutachten und Ermittlungsstand’, accessible at 
https://www.polizei.bayern.de/aktuelles/pressemitteilungen/018252/index.html. 

| 28 

 
 
– TE-SAT 2022 

Groups and structures  

Jihadist milieu 

Over the years, the jihadist environment in the EU has remained largely stable in 
regard to the activities, geographical distribution and actors involved. Geographically, 
members of jihadist networks in the EU remained concentrated in and around major 
urban areas. However, jihadist communities are characterised by hybrid online-offline 
interactions that influence their dynamics, notably reaching a global audience. 

The jihadist environment in Member States often consists of individuals or fragmented 
groups without clear hierarchies or division of roles. Jihadist cells can be formed by 
close friends and acquaintances, but often expand beyond such relationships, strongly 
enabled by the online environment and community connections.  

In 2021, four groups of different sizes were dismantled. Two 23-year-old men were 
arrested in France as they were planning to conduct knife attacks in crowded areas 
over the Christmas period. Similarly, in Sweden a couple in their 30s with Afghan 
citizenship was arrested on suspicion of plotting a terrorist attack in Stockholm County. 
14 suspects, 13 in Denmark and one in Germany, were initially arrested as they were 
planning to carry out a terrorist attack in Europe using IEDs and firearms. Five people 
were charged with terrorist offences in Denmark and the suspect arrested in Germany 
was released without charge. In the Netherlands, nine suspects were arrested for 
preparing a crime with terrorist intent. The suspects discussed planning a terrorist 
attack but were arrested before the start of concrete preparations. The suspects were 
sympathetic to IS, without being formally affiliated to the group. At the time of writing, 
the case is still under investigation. 

Given the lack of formal hierarchies, some individuals can claim greater authority over 
others, especially based on perceived knowledge of Islam, willingness to commit to the 
jihadist cause, and age. Individuals who spent time in conflict zones and, interestingly, 
those who attempted to travel there but were prevented from doing so by law 
enforcement activity, have also been observed to be influential actors in the 
dissemination of jihadist ideology and in attracting new recruits.  

While many jihadist groups are active locally, some have established links on a regional 
level and a few on a transnational level. Transnational networks can be based on the 
members’ common origin and language. Belgium reported that transnational 
connections are driven by language preferences, with Flemish jihadists reaching out to 
the Netherlands or French-speaking individuals to peers in France. Jihadists in Estonia, 
many with origins in the Caucasus, were observed to consume propaganda in Russian, 
in addition to Arabic and English.  

| 29 

– TE-SAT 2022 

Lone actors   

The threat from jihadist terrorism in the EU is most likely to materialise 
in attacks by individuals acting alone.  

As in previous years, the three completed attacks in the EU in 2021 
were perpetrated by lone actors. Small, ad hoc groups also pose a risk, 
given the ease of formation and the challenges in identifying and 
monitoring them. Terrorist groups are more likely to be detected in 
the planning phase of an attack, given the greater extent of 
organisation needed to coordinate a more complex attack. 

FTFs returning from conflict areas remain a concern for Member States, as they may 
engage in violence, propaganda and training, and may be willing to orchestrate 
terrorist attacks upon return to Member States. Although in 2021, returnees or FTFs in 
Member States did not perpetrate any terrorist attacks, several EU and non-EU FTFs 
were arrested upon their return to, or arrival on, EU soil under charges including 
planning and preparing attacks, war crimes and membership of a terrorist 
organisation33. 

Prisoners and released convicts 

Radicalisation and recruitment trends within prisons continued to be monitored by 
Member States.  

Individuals under observation in prisons for their membership of a terrorist 
organisation or for violent extremist views include both prisoners convicted of terrorist 
or violent extremist offences and prisoners convicted of criminal offences who became 
radicalised while in prison. Member States reported investigations targeting, among 
others, imprisoned individuals promoting IS and al-Qaeda propaganda with other 
prisoners or suspected of being members of IS in contact with other subjects of 
interest for terrorist offences, both outside and within prisons.   

In addition to the threats emerging from potential radicalisation of other inmates, such 
individuals also pose risks of violence or orchestrating attacks upon release. 

Propaganda, radicalisation and recruitment  

Propaganda 

The dissemination of propaganda, online and offline, remained one of the most 
frequent offences mentioned in law enforcement investigations into jihadist terrorism 
conducted by Member States in 2021.  

33 See section on terrorism-related travel.  

| 30 

 
 
– TE-SAT 2022 

Social and political events outside the EU have a strong influence on 
jihadist narratives circulating among radicalised audiences. 

In one case in Spain, five men – all of Algerian nationality – were arrested in 
October 2021 for disseminating propaganda and on suspicion of constituting a cell 
of the IS affiliate Islamic State Algeria Province (ISAP)34.  

Conflicts and instability in the Middle East, Africa and Asia played an important role in 
propaganda narratives, whereas the fate of prisoners linked to IS in Iraq and Syria 
strongly resonated with jihadists and their supporters. Contacts with IS-linked women 
detained in the camps in Syria were noted, and support and funding for these 
detainees took place through networks present in Turkey and Syria.  

Despite the restrictions imposed by the COVID-19 pandemic, in-person events and 
contact between extremists remain an important factor in the overall process of 
radicalisation. Throughout the EU, in-person propaganda pursued by jihadist terrorist 
and extremist groups has been observed taking place in informal religious buildings 
and prisons.  

Although it was less prominent in jihadist propaganda in 2021, the COVID-19 pandemic 
was exploited in several instances. Harakat al-Shabab al-Mujahidin advised Muslims in 
Somalia not to take the AstraZeneca vaccine, citing safety reasons, and encouraged 
residents of Mogadishu to stay away from ‘the Western crusaders’ living in military 
complexes described as the source of COVID-19 transmission in the country. In its 
continued condemnation of the West’s interventions in West Africa, Jama’at Nusrat al-
Islam wal-Muslimin (JNIM, ‘Group in support of Islam and Muslims’) framed the virus 
as a divine punishment for France and the United States of America (USA). Finally, pro-
al-Qaeda propaganda also suggested infiltrating anti-COVID-19 protests to target the 
‘enemies of God’, including law enforcement personnel. 

IS narratives  

IS discourse did not experience any notable shifts in 2021. IS official propaganda and 
supportive media outlets continued to emphasise the importance of ‘media jihad’ to 
be pursued by both men and women, called for the freeing of imprisoned IS 
members35, and urged Muslims to carry out attacks in the West. 

IS sustained its online ‘war of attrition’ in 2021. The group’s supporting media outlets 
continued to dominate the production and distribution of pro-IS propaganda. Their 
releases included original creations, repurposed content and translations. The group’s 
official propaganda reflected its reliance on local jihadist insurgencies to display force 
and remain relevant. An otherwise invisible leadership applauded regional 
achievements. In particular, IS’s spokesperson, Abu Hamza al-Qurashi, praised the 

34 Previously known as Jund al Khalifa (‘Soldiers of the Caliphate’). 
35 In January 2021, al-Naba’ issue 269 featured an infographic titled ‘We have not forgotten you - 
Prisons whose walls were destroyed by the soldiers of the Islamic State in Iraq’, listing prison 
breaks carried out by IS militants in Iraq over the last few years. In response, supporting media 
outlets launched an online campaign under the hashtag #We_have_not_forgotten_you. 
Similarly, an all-female online campaign in support of imprisoned women ran from mid-April to 
the beginning of May with the hashtag #Muslim_female_prisoners_be_patient.    

| 31 

 
 
 
– TE-SAT 2022 

group’s contingents worldwide in his only speech in 2021, while its leader Abu Ibrahim 
al-Hashimi al-Qurashi remained reclusive36.  

Claims by IS’s regional affiliates aimed to suggest soaring violence against Christians, 
predominantly in sub-Saharan Africa but also in Indonesia and Egypt. IS propaganda 
weaved the attacks into a broader anti-Christian narrative, further reinforced after 
Rwanda’s military intervention in Mozambique in August 202137. As a response, IS 
supporters launched a multilingual media campaign38 denouncing the ‘the crimes of 
the Christians of Rwanda’ and inciting violence against Christians in the Democratic 
Republic of the Congo (DRC) and Mozambique. IS’s supporting media outlets amplified 
the campaign’s reach and called for attacks against Christian churches in the EU.  

IS supporters continued to experiment with decentralised technologies 
and to expand their activities to new online spaces. 

Based on a P2P network rather than centralised infrastructure, the 
additional anonymity and data control layers offered by decentralised 
technologies are likely to hamper investigative efforts39. 

Among others, IS supporters experimented with the Coffespot.com instance on the 
encrypted messaging app Element (previously known as Riot). Propaganda items were 
also shared as Skylinks (i.e. links to files uploaded on a Skynet portal40) as well as Inter-
Planetary File System (IPFS) links, which rely on a distributed storage protocol. 
Moreover, IS supporters experimented with sharing IS links on Ignite, a decentralised 
microblogging service allowing users to exchange text and media files that can be 
distributed among the nodes via Skynet. Several IS videos were detected on the 
decentralised video platform DTube (Decentralised Tube), which emerged as an 
alternative to YouTube and self-advertised as ‘the first crypto-decentralised video 
platform’.  

In addition, IS sympathisers shared propaganda material on platforms more commonly 
exploited by right-wing extremists, such as Gab and Odysee, and tried to establish a 
presence on the pro-former USA President Donald Trump GETTR platform, which 
marketed itself as a free speech substitute to mainstream social media.  

Among instant messaging platforms, Telegram remained a firm favourite in 2021, 
although other encrypted communication apps were used, such as RocketChat, Signal, 
Tam Tam, and Hoop messenger. IS supporters also attempted to strengthen their 
presence on more mainstream platforms, including Instagram and Facebook, which 
witnessed a surge of pro-IS accounts in 2021. To do so, IS continued its efforts to 

36 In March 2022, IS released an audio recording confirming the death of its leader Abu Ibrahim 
al-Hashimi al-Qurashi, as well as of its spokesperson Abu Hamza al-Qurashi. 
37 In August 2020 the city of Mocímboa da Praia was occupied by IS and was retaken by the 
Mozambican army on 8 august 2021 with the help of the Rwandan military. 
38 Under the hashtag #Rwanda_Christians_Crimes. 
39 Peter King, 2019, ‘Islamic State group’s experiments with the decentralised web’, conference 
paper, ECTC, European Counter Terrorism Centre, ECTC Advisory Network Conference, 
accessible at https://www.europol.europa.eu/publications-events/publications/islamic-state-
group%E2%80%99s-experiments-decentralised-web. 
40 Skynet is a decentralised content delivery network (CDN) and file sharing platform for 
developers. It is powered by the Sia network, which is a decentralised cloud storage platform 
secured by blockchain technology. 

| 32 

 
 
 
– TE-SAT 2022 

circumvent content-moderation tools, for instance by using ‘emojis’ to replace certain 
words or by toning down English language material as opposed to Arabic versions41. 

Al-Qaeda narratives  

Al-Qaeda’s central leadership and its affiliates continued to denounce French foreign 
policy in North Africa and the Sahel region and criticised French President Macron for 
justifying the 2020 reprinting of cartoons depicting the Prophet Muhammad. The 
group also justified terrorist attacks in the EU and the targeting of EU interests as 
retaliation for the publication of the cartoons.  

Al-Qaeda’s narrative remained largely unchanged in 2021. 

The group’s strategic coherence and brand homogeneity was 
maintained by broadcasting a unified discourse from its various 
subsidiaries, and balancing local priorities with international ones. 

As in the past, each of the group’s videos began with credits displaying the logos of the 
official media outlets42 pertaining to the four main affiliates43 as well as that of al-
Sahab, the official media wing of al-Qaeda’s core leadership. The al-Qaeda linked 
unofficial Thabat News Agency, which appeared in 2018 and reports on the activities of 
al-Qaeda’s affiliates, continued to play a role as a news aggregator for the group in 
2021. Its activity declined in the second half of 2021.   

Speculations on al-Zawahiri’s health and possible death continued in 2021 and were 
exacerbated in March 2021 when a newly relased video featuring him utilised old 
footage. However, he was proven to be alive until at least January 2021, as he 
appeared in a video released on the 20th anniversary of the 11 September 2001 
attacks, where he alluded to the attack carried out by al-Qaeda’s affiliate in Syria 
Tanzim Hurras al-Din (THD, ‘Guardians of the Religion Organisation’) on 1 January 2021 
against Russian forces in Tal al-Saman, Syria.  

Al-Qaeda’s willingness to conduct attacks in western countries persisted in 2021, and 
was made obvious in al-Qaeda in the Arabian Peninsula’s (AQAP) issue of its Inspire 
Guide magazine in June 2021. The issue, dedicated to the supermarket shooting in 
Colorado (USA) in March 202144, was produced in English and Arabic and urged 
Muslims in the United States and other western countries to carry out terrorist attacks 
in order to ‘win the pleasure’ of God and to ‘gain paradise’. The magazine also 
contained instructions on how to carry out a lone terrorist attack, stressing among 
other points the importance of choosing a location from which it would be difficult for 
the targets to flee or hide. In a similar vein, in April 2021, the pro-al-Qaeda media 
outlet Jaysh al-Malahim al-Elektroni published the second issue of the Wolves of 
Manhattan magazine. The publication provided guidance on how to infiltrate protests 
in western countries for the purpose of targeting police officers and promised a 

41 Politico, 11.5.2022, ‘Islamic State evolves ‘emoji’ tactics to peddle propaganda online’, 
accessible at https://www.politico.eu/article/islamic-state-disinformation-social-media/.  
42 Al-Kata’ib Media (HSM), al-Zallaqa Media (JNIM), al-Malahim Media (AQAP), al-Andalus Media 
(AQIM) and al-Sahab Media (al-Qaeda central). 
43 Harakat al-Shabaab al-Mujahidin (HSM), Jama’at Nusrat al-Islam wal-Muslimin (JNIM), al-
Qaeda in the Arabian Peninsula (AQAP), al-Qaeda in the Islamic Maghreb (AQIM). 
44 The shooting was not categorised by authorities as a terrorist attack. 

| 33 

 
 
 
– TE-SAT 2022 

cryptocurrency reward to the first individual who would send photos documenting the 
killing of a police officer.  

In terms of dissemination platforms, al-Qaeda continued to rely on RocketChat. While 
the group and its affiliates are present on Telegram, WhatsApp, Element and Minds, 
the number of subscribers on these platforms is considerably less than that of 
RocketChat’s users. 

Taliban takeover in Afghanistan  

Member States did not report immediate repercussions on the jihadist scene following 
the leadership takeover in Afghanistan in August 2021. However, it sparked increased 
interest and propaganda from both al-Qaeda and IS.  

While al-Qaeda outlets praised the Taliban takeover and tried to exploit it to portray 
the idea of endurance and long-term victory, IS criticised it.  

Events in Afghanistan gave a boost to pro-IS propaganda. IS’s weekly newsletter Al-
Naba’ gave considerable space to ISKP operations against the Taliban and condemned 
them for betraying the jihadist cause and siding with western powers. In addition, old 
propaganda material produced by IS against the Taliban was shared on various 
platforms by IS sympathisers, who argued that rather than winnig a military victory, 
the Taliban regained the leadership in Afghanistan because the United States left the 
country for financial reasons.  

IS supporters also condemned the Taliban overtures to the USA, Iran, and China. In 
particular, IS propaganda pointed to the Taliban’s relations with China to discredit and 
accuse them of betraying China’s Muslims. IS’s Amaq News Agency identified the 
perpetrator of the attack against a Shi’i mosque in Kunduz province (Afghanistan) on 8 
October 2021 as an ethnic Uyghur, saying the assault targeted both Shi’is and the 
Taliban government for its supposed willingness to deport Uyghurs from Afghanistan 
in response to requests from China in return for the country’s financial support. The 
arguments and IS’s attempts to portray itself as a protector of the Uyghurs are likely to 
find fertile soil in Central and South Asia given China’s historical ties to peoples across 
Asia and the Uyghurs’ historical migration to the region.  

Three pro-IS publications focus on the South Asian region: Sawt-al-Hind (Voice of 
India), which has held an anti-Taliban stance since its release in February 2020; the 
Urdu online magazine Yalghar launched in April 2021; and an IS-KP magazine Voice of 
Khurasan in February 2022.  

Recruitment  

As in previous years, in 2021, recruitment for jihadist terrorism in the EU took place 
through personal contacts, either in physical settings or online.  

In the physical sphere, recruitment and radicalisation were observed to take place 
within unofficial prayer rooms, Salafist associations, as well as prisons and reception 
centres.   

In a trend confirmed in 2021, both recruiters and targets of recruitment have become 
increasingly younger and have included minors. This trend may be linked to the 
increased accessibility of digital platforms among youths.  

| 34 

Terrorism-related travel  

– TE-SAT 2022 

A significant number of FTFs (including men, women and minors), who are citizens of 
the EU, remain in Syria. Following IS’s military defeat, many are now located in the 
Syrian Democratic Forces (SDF) camps.  

In 2021, women and minors were increasingly repatriated from Syria the Member 
States of which they are citizens and represented the majority of returnees travelling 
back to the EU throughout 2021. Women were repatriated either because they were 
on trial or were the recipients of court orders for terrorism-related offences, or 
because minors evacuated from Syria could not be separated from their mothers. 
Although in the majority of cases returnees were repatriated directly from Syria, in two 
cases women returnees reported themselves and their children to Dutch diplomatic 
posts in Turkey and were then repatriated to the Netherlands.   

Some of the returnees were arrested upon their arrival in the EU: 

►  14 FTFs retuned to France, of which 12 were arrested. Returnees were 

accompanied by 26 minors under the age of 13 and four minors aged 
between 13 and 17; 

►  9 FTFs, one man and eight women, travelled back to Sweden, mostly by plane, 

and were accompanied by approximately 20 minors; 

►  9 FTFs returned to Germany. Eight IS women were repatriated from northern 
Syria accompanied by 23 minors, while one male returnee, originally from 
Kosovo and member of al-Qaeda, was arrested for planning and preparing an 
attack and financing of terrorism. Two of the female returnees, in their early 
40s, were arrested for their membership of IS and for war crimes allegedly 
committed while in Syria; 

►  7 FTFs, six women and one men, accompanied by 10 minors, returned to 

Belgium; 

►  6 FTFs, two men and four women, returned to the Netherlands, with one 

having dual Dutch-Portuguese nationality; 

►  3 women FTFs returned to Finland accompanied by approximately 10 minors;  
►  1 woman FTF travelled back to Austria by plane and was arrested at the 

airport; 

►  1 FTF was repatriated to Italy. 

In 2021, Member States reported several arrests of non-EU FTFs and terrorists on EU 
territory.  

In Greece, a 33-year-old Syrian citizen accused of being a member of Jabhat al-Nusra 
was arrested in January 2021 in Thessaloniki under a European Arrest Warrant issued 
by the Netherlands. A 28-year-old Moroccan IS FTF was also arrested in Thessaloniki in 
July 2021 as a result of an international arrest warrant issued by Morocco.   

In September 2021, Portugal arrested two Iraqi nationals in their 30s at their residence 
in the outskirts of Lisbon on suspicion of membership of and support for IS and crimes 
against humanity. They both arrived in Portugal in March 2017 from Greece and been 
granted refugee status.  

In the Netherlands, several Syrian asylum seekers were arrested for membership or 
leadership of a terrorist organisation.  

In January 2021 in Spain, three Algerian nationals in Barcelona were arrested on 
charges of membership to ISAP. One was an FTF from the Iraqi-Syrian theatre, who 

| 35 

 
– TE-SAT 2022 

travelled from Iraq to Turkey and Senegal. Upon his return to Algeria, he joined ISAP 
and departed in a boat from Algeria to Spain. He was detected living in Barcelona in a 
run-down property45. In October 2021, five Algerian nationals were arrested in 
Barcelona and Madrid believed to be members of an IS cell and preparing an attack. 
The alleged leader of the group was a man who had been arrested in Turkey in 2016 
when he tried to join IS and, once released, travelled to several countries, including 
Malaysia, Tanzania and Algeria, before entering Spain in March 202146.   

In July 2021, a Moroccan FTF was arrested in Salerno, Italy, and had reportedly 
travelled to Syria in 2012 first with Jabhat al-Nusra and later with IS. After leaving Syria 
in 2017, he was detained in Turkey for two years and then returned to Morocco, 
where he helped Moroccan fighters travelling to conflict areas. In November 2021, a 
25-year-old Tunisian was detained in Gorizia, Italy under an international arrest 
warrant for extradition purposes issued by Tunisia for participation in terrorist 
association and acts of terrorism. The suspect arrived in Italy by boat and is believed to 
be a member of an IS cell active in Tunisia and intending to reach other EU countries.  

A Moroccan FTF was arrested by Bulgarian authorities in November 2021 upon 
entering the country from Turkey. The man was convicted for terrorism-related 
offences in 2015 in Belgium and lost his Belgian nationality in 2020.  

Only France reported attempts to travel to conflict areas. Three suspects tried to reach 
Mali and Afghanistan, but were intercepted before reaching their destinations and, in 
one case, the individual was arrested upon arrival in Afghanistan.  

Terrorist situation outside the EU 

While global terrorist organisations mainly operate outside the EU, they pose a threat 
to the EU insofar as they may also orchestrate attacks against EU targets and calls for 
action may inspire sympathisers in the EU to commit acts of violence. Member States 
remain targets for jihadist terrorist propaganda and attacks, especially from groups 
active in the Middle East and North Africa (MENA), in the Sahel region, the Horn of 
Africa and in Central Asia.  

Western Balkans  

In 2021, only one violent incident potentially related to jihadism in the Western 
Balkans47 was reported to Europol. On 19 April 2021, a 34-year-old Albanian citizen 
was arrested on charges of terrorism, after having stabbed five people in a mosque in 
Tirana. During the trial, the perpetrator was assessed to be legally not responsible and 
assigned to a psychiatric hospital. 

The methods used to radicalise or recruit followers in the region reflect the complex 
political scenario in the Western Balkan countries, where issues pertaining to ethnic 

45 Europol press release, 12.1.2021, ‘Returning foreign fighter arrested in Spain’, accessible at 
https://www.europol.europa.eu/media-press/newsroom/news/returning-foreign-fighter-
arrested-in-spain.  
46 Europol press release, 14.10.2021, ‘Spanish Police arrests 5 jihadists on suspicion of preparing 
a terrorist attack’, accessible at https://www.europol.europa.eu/media-
press/newsroom/news/spanish-police-arrests-5-jihadists-suspicion-of-preparing-terrorist-attack.  
47 Albania, Bosnia and Herzegovina, Kosovo, Montenegro, Republic of North Macedonia and 
Serbia. The designation of Kosovo is without prejudice to positions on status, and is in line with 
UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence. 

| 36 

 
 
– TE-SAT 2022 

and religious identity are combined with economic and social difficulties. In addition, 
‘reciprocal radicalisation’ plays an important role, as right-wing, ethno-nationalist and 
jihadist ideologies reinforce each other as a factor of individuals’ and communities’ 
radicalisation48.   

Radicalised and extremist groups in the region are usually small, loosely organised and 
led by individuals accepted by the group’s members as religious authorities.  

According to the assessment of Western Balkan countries, Salafist groups and 
individuals advocating for ultraconservative and extremist interpretations of Islam 
remained the main drivers of radicalisation in the region. Within Salafist communities, 
preachers active in ‘parallel mosques’49 and in informal gatherings were observed to 
promote violence, while returnees from Syria and other conflict areas continued to 
spread jihadist ideologies.  

Several Western Balkan countries confirmed the trend seen in previous years whereby 
some extremist groups portray themselves as non-governmental organisations (NGOs) 
working for humanitarian aims. In this position, they collect donations which are then 
channelled to supporters or sympathisers of radical Islamist ideologies. In some cases, 
these groups established links with migrant communities originating from the Western 
Balkans in EU countries.  

In 2021, several suspects returned from conflict areas to Western Balkan countries. 
Albania repatriated five women together with fourteen minors from Syria, while North 
Macedonia repatriated four men, five women and fourteen minors from Syria and Iraq. 
The four men were all FTFs convicted by North Macedonian courts in absentia 
between 2015 and 2020, and were imprisoned upon arrival. 

Middle East and North Africa (MENA) 

Syria 

The Syrian regime controls about two thirds of the country. The Turkish-backed Syrian 
National Army controls part of the north and northeast regions, while most of the 
northeast and east regions are under the control of the USA-backed Kurdish-led SDF50. 

Hay’at Tahrir al-Sham (HTS, ‘Levant liberation committee’) remained the dominant 
militant group in the Idlib enclave and neighbouring governorates held by the Syrian 
armed opposition. HTS’s efforts to change its profile from that of a terrorist group to a 

48 British Council, 2018, ‘Western Balkans Extremism Research Forum: Bosnia and Herzegovina 
Report’, accessible at https://www.rcc.int/swp/docs/176/western-balkans-extremism-research-
forum--bosnia-and-herzegovina-report-2018; Amra Sabic-El-Rayess, November 2021, ‘How do 
people radicalize?’, International Journal of Educational development, Vol. 87, article 102499, 
accessible at https://doi.org/10.1016/j.ijedudev.2021.102499.  
49 Concept used by an Albanian-Macedonian expert to describe mosques which are outside the 
authority of the official Islamic Religious Community (IRC) and which are more likely to 
propagate Salafi-Wahhabi influence. Arber Fetiu, Diana Mishkova, Edina Becirevic, Evlogi 
Stanchev, Leonie Vrugtman, Predrag Petrovic, Simeon Evstatiev, Stoyan Doklev, 2021, ‘D5.1 
Policy brief summarising the EU and other stakeholder’s prevention strategy towards violent 
extremisms in the region, the Balkans’, PREVEX (Preventing Violent Extremism in the Balkans 
and the MENA: Strengthening Resilience in Enabling Environments) project, accessible at 
https://www.prevex-balkan-mena.eu/wp-content/uploads/2021/01/D5.1-Policy-brief-the-
Balkans-1.pdf.   
50 The SDF is an alliance of Arab and Kurdish militias supported by the USA and other Western 
countries. It is dominated by the Yekîneyên Parastina Gel (YPG, ‘People’s Protection Units’), 
which Turkey considers to be an extension of the Partiya Karkerên Kurdistanê (PKK, ‘Kurdistan 
Workers’ Party’). 

| 37 

 
 
– TE-SAT 2022 

local Islamist group fighting for Syrians’ liberation from an autocratic regime continued 
in 2021. The group tried to secure regional and international recognition of its 
authority over northwest Syria, expelled hard-line elements from its ranks and 
restrained groups opposing negotiated ceasefires and not members of the Fath al-
Mubin (‘Clear Conquest’) Operations Room51. As a result, it clashed with foreign 
fighters’ groups active in the area, the primarily Chechen Junud al-Sham (‘Soldiers of 
the Levant’) and the Jund Allah (‘God’s Soldiers), composed of Azerbaijani and Turkish 
nationals. Both Junud al-Sham and Jund Allah evacuated their military positions in the 
Latakia mountains. HTS came under pressure from extremists dissatisfied with the 
leadership’s pragmatism, as well as with locals dissatisfied with the group’s 
management of social and economic affairs. HTS’s security services also targeted IS 
remnants in Idlib and military subjugated Tanzim Hurras al-Din (THD, ‘Guardians of the 
Religion Organisation’), al-Qaeda’s local affiliate.  

IS sought to rebuild its combat capabilities in Syria, particularly in rural areas. The 
group operated in the Badia region (the expansive central desert) and the northeast 
area controlled by the SDF, carrying out hit-and-run operations against security 
checkpoints. Most of the attacks were clustered near the eastern side of the Euphrates 
River Valley. IS attempted to exploit HTS clashes with foreign fighters and called on the 
latter in Syria to join its ranks.  

The humanitarian and security situation in the detention camps controlled by the SDF 
in northeast Syria continued to deteriorate. In early 2021, the al-Hawl camp reportedly 
accommodated approximately 65 000 residents52, with the separate section reserved 
for non-Syrian detainees, including women and children. According to UN and Kurdish 
officials, children received no education and some minors were reportedly trained to 
become future IS operatives. Moreover, multiple killings of those suspected of 
abandoning IS ideology, working as informants or defying IS rules were reported in the 
camp.  

Iraq 

IS maintained its military pressure in central Iraq and in the region northeast of 
Baghdad. Additionally, it demonstrated its ability to conduct attacks in Iraq specifically 
targeting Shi’i Muslims. On 21 January, a double suicide bombing in a crowded market 
in Baghdad left at least 32 dead and wounded more than 100 people53. This was the 
first suicide attack in Baghdad since 2017. Other attacks were carried out on 15 April 
and 19 July in the Shi’i neighbourhood of Sadr City, Baghdad, causing at least 39 deaths 
and wounding 80 people54.  

Operations by the Shi’i-led Popular Mobilization Forces (PMF) continued to heighten 
sectarian tensions and are likely to serve as a recruiting tool for IS to replenish its ranks 
with disenchanted Sunni Arabs.  

51 Al-Fath al-Mubin is an operations room of Syrian rebel and jihadist factions participating in the 
Syrian civil war. 
52 UN Security Council (S/2021/68), 3.2.2021, Twenty-seventh report of the Analytical Support 
and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL 
(Da’esh), Al-Qaida and associated individuals and entities. 
53 BBC, 22.1.2021, ‘Iraq bombing: IS says it was behind deadly suicide attacks in Baghdad’, 
accessible at https://www.bbc.com/news/world-middle-east-55760822.  
54 Reuters, 15.4.2021, ‘Car bomb blast kills four in Baghdad’s Sadr City’, accessible at 
https://www.reuters.com/world/middle-east/car-bomb-kills-four-baghdads-sadr-city-police-
2021-04-15/; Reuters, 20.7.2021, ‘Suicide attack in Iraq's Sadr City kills at least 35, wounds 
dozens’, accessible at https://www.reuters.com/world/middle-east/two-killed-13-wounded-
explosion-iraqs-sadr-city-sources-2021-07-19/. 

| 38 

 
 
– TE-SAT 2022 

Libya 

Despite being debilitated, IS and al-Qaeda in the Islamic Maghreb (AQIM) are present 
in Libya, largely confined to the remote south-western desert region of Fezzan with 
some IS cells active in the Tripoli area. AQIM’s Libya branch has reportedly become a 
logistics platform and transit zone for al-Qaeda affiliates in Mali. 

IS claimed two bomb attacks in the Fezzan region on 6 and 14 June 2021 both targeting 
Libyan National Army (LNA)55 checkpoints. The group had last claimed an attack in 
Libya in May 2020. IS in Libya could also focus on logistical support to IS affiliate in 
West Africa. 200 IS fighters reportedly travelled to the Sahel region from Libya in April 
202156.  

Africa 

Sahel and West Africa 

In 2021, no known plots were devised by terrorist groups in the Sahel region to target 
European territory. Their declared focus is to drive western, especially French, security 
and economic presence out of the region.  

The military activities of Jama’at Nusrat al-Islam wal-Muslimin (JNIM, ‘Group in 
support of Islam and Muslims’, a coalition of al-Qaeda’s groups)57 increased 
exponentially58. The dismantling in January of a cell recruiting for the Macina 
Liberation Front (MLF, part of JNIM) in Senegal, along with increasing attacks in Côte 
d’Ivoire, highlighted the group’s push toward the Gulf of Guinea countries. In 
December 2021, JNIM claimed its first attack in Benin59.    

Both JNIM and AQIM have incited Muslims to attack Western countries, in particular 
France, which was repeatedly condemned for its ‘interference’ in the Sahel region. 
France has been the leading force in the foreign military efforts in the Sahel with 
Operation Barkhane60 and the Takuba Task Force61. Following the announcement in 
June 2021 to transform the French military presence in the Sahel62, the French 
government has further declared in February 2022 that it and its Canadian and 

55 The Libyan National Army is a group of militias opposing the internationally recognised  
Libyan government.  
56 United Nations S/2021/655, 21.7.2021, Letter dated 15 July 2021 from the Chair of the 
Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) 
concerning Islamic State in Iraq and the Levant (Da’esh), Al-Qaida and associated individuals, 
groups, undertakings and Entities addressed to the President of the Security Council.  
57 JNIM include the MLF, Ansar al-Din, Al-Mourabitoun and the Sahel branch of AQIM.  
58 Jared Thompson, 15.7.2021, ‘Examining Extremism: Jama’at Nasr al-Islam wal Muslimin’, 
Center for Strategic & International Studies, accessible at 
https://www.csis.org/blogs/examining-extremism/examining-extremism-jamaat-nasr-al-islam-
wal-muslimin.  
59 On 1.12.2021, JNIM militants attacked a border security post in the town of Porga, Northern 
Benin. Two soldiers were killed and several wounded. 
60 Operation Barkhane is an ongoing counterterrorism operation which started on 1 August 2014 
led by French military against jihadist groups in the Sahel region.  
61 Takuba Task Force is an EU military task force under French command advising and assisting 
Malian armed forces in coordination with Burkina Faso, Chad, Niger, Mauritania and Mali (the 
so-called G5 Sahel).  
62 Élysée, 10.6.2021, Press conference ahead of the G7 and NATO summits/‘Conférence de 
presse en amont des sommets du G7 et de l'OTAN’, accessible at 
https://www.elysee.fr/emmanuel-macron/2021/06/10/conference-de-presse-en-amont-des-
sommets-du-g7-et-de-lotan.  

| 39 

 
 
– TE-SAT 2022 

European allies would withdraw their troops from Mali63. Remaining French troops 
would be merged with the Takuba Task Force. In 2021, JNIM claimed several attacks 
targeting Operation Barkhane forces, the Joint European forces involved in the Takuba 
Task Force and the United Nations Multidimensional Integrated Stabilization Mission 
(MINUSMA). Although no official claim has been made so far, it is possible that JNIM is 
behind the kidnapping of French journalist Olivier Dubois in Gao on 8 April 2021.  

In Mali, the transitional government installed after the coup in August 2020 was 
overthrown by a second military coup in May 2021. Being in a military impasse, Malian 
transitional authorities have expressed interest in opening a dialogue with JNIM, and 
the new Prime Minister Choguel Kokalla Maïga acknowledged widespread public 
support for talks with jihadists. In August 2021, JNIM’s leader Iyad Ag Ghaly 
commended the Taliban on their victory. It is possible that JNIM sees events in 
Afghanistan as an example to emulate, especially as it had already shown itself open to 
talks with the Malian government in 2020 on the condition that French and 
international forces leave the country. JNIM pointed out in January 2021 that it had 
never perpetrated an attack on French soil. 

IS has two branches in West Africa: the Islamic State West Africa Province (ISWAP) and 
the Islamic State in the Greater Sahara (ISGS), the latter officially being a subunit of the 
former. While ISWAP operates around the Lake Chad Basin and in north-eastern 
Nigeria, ISGS is primarily active in the triangle border region of Mali, Niger and Burkina 
Faso (the so-called Liptako-Gourma region). ISWAP in Nigeria focused its attacks 
against government military forces, Boko Haram militias and international presence. 
Notable attacks included the capture of a Nigerian military base in February 2021, and 
an attack on a UN base in Borno State in late February 2021 that trapped 25 aid 
workers. ISGS conducted large-scale attacks in Burkina Faso, Mali and Niger, including 
an ambush on a Malian military post in Gao on 15 March 2021, which killed 33 Malian 
soldiers and wounded 14 others.  

ISWAP’s position in Nigeria was likely strengthened by the killing of Boko Haram’s 
leader in May 2021, following which ISWAP appeared to have expanded in the 
historical stronghold of Boko Haram. Despite its gains, IS has faced problems in the 
Sahel and West Africa. Apart from factionalism, ISWAP’s initially successful exploitation 
of local grievances towards the governments in Niger, Mali, and Burkina Faso has 
entrenched it in local conflicts. In addition, both ISWAP’s and ISGS’s leaders, 
respectively Abu Musab al-Barnawi and Adnan Abu Walid al-Sahrawi, died in 2021.   

The Horn of Africa and East Africa 

Al-Qaeda’s affiliate Harakat al-Shabab al-Mujahidin (HSM, ‘mujahidin youth 
movement’) is the dominant jihadist group in East Africa and maintained control over 
large parts of southern Somalia.  

Following the completed USA military withdrawal in January 2021, the reduction of the 
Africa Union Mission in Somalia (AMISOM), and the focus of the Somalian security 
forces on pre-election violence, the Somalian army struggled to contain the violent 
activity from HSM. The high number of attacks claimed by the group against the 
Western-backed Somalian government and AMISOM forces identified it as one of al-
Qaeda’s most powerful and dynamic affiliates.  

HSM is vocal about its intent to attack Western and USA interests and continued to 
plot international attacks. On 27 March 2021, HSM leader Ahmad Umar Abu Ubayda 

63 Ministère de l’Europe et des Affaires Étrangères, France Diplomacy, 2022, ‘The International 
Coalition for the Sahel’, accessible at https://www.diplomatie.gouv.fr/en/country-
files/africa/the-international-coalition-for-the-sahel/.  

| 40 

 
 
 
– TE-SAT 2022 

urged Djiboutians to carry out attacks against French and USA interests in Djibouti. 
Abu Ubayda also called for ‘individual martyrdom operations’ and praised the 
perpetrators of the 7 January 2015 and 16 October 2020 terrorist attacks in Paris. In 
addition, HSM criticised Turkey’s membership of the North Atlantic Treaty 
Organization (NATO) and its military and economic engagement in Somalia and, on 15 
June 2021, carried out a suicide attack at a military training camp run by Turkish and 
Somalian forces in Mogadishu. 

HSM encouraged Muslims in Africa and elsewhere to travel to Somalia to join its ranks. 
A video, released on 13 May and featuring a training course for foreign fighters, 
showed HSM fighters from a variety of countries, including Kenya, Tanzania, Burundi, 
Egypt, Morocco, Sudan, but also the United Kingdom of Great Britain and Northern 
Ireland (UK) and USA. The video urged those Muslims who were unable to travel, to 
instead carry out attacks in their countries of residence.  

The Taliban takeover may act as a source of inspiration for HSM, as in the case of 
Afghanistan, Somalia is led by a government with a low level of local legitimacy which 
is sustained by external security assistance. The group’s propaganda avoided 
mentioning the Taliban-USA negotiations and framed the takeover as a Taliban victory 
amid the USA withdrawal. However, HSM has a vague position with regard to talks 
with the government and it is unclear whether it will combine diplomacy with military 
force.  

HSM will likely benefit from the eroding security situation in East Africa. The civil war in 
northern Ethiopia between the Ethiopian government and the Tigray People's 
Liberation Front has weakened counter–HSM efforts in Somalia, which include 
Ethiopian forces, and could create opportunities for HSM to gain a foothold in Ethiopia.  

Despite its low profile, IS affiliates in Somalia continued operating in Puntland, from 
where it also supported the Islamic State Central Africa Province (ISCAP). ISCAP 
operated mainly in the DRC and Mozambique, connecting with existing insurgencies, 
the Allied Democratic Forces (ADF) in the DRC and Ahlu‑Sunna wal-Jama’a (ASwJ, 
‘Adherents to the Sunnah and the community’) in Mozambique. 

Since 2017, ASwJ’s tactics evolved from cautious guerrilla attacks targeting villages at 
night to attacks increasingly focusing on larger urban centres in 2020-2021. The 
lethality and brutality of attacks also increased. Notably, on 24 March 2021 ASwJ 
attacked the city of Palma, Cabo Delgado province, close to a major multinational gas 
project. ASwJ coordinated a local and transnational attack as the following day, on 25 
March, 100 to 120 insurgents crossed the border from Tanzania to support the 
ongoing attack in Palma64.  While four days later IS claimed control of the city, the 
Mozambican army recaptured Palma on 5 April.  

ASwJ insurgents are mainly Mozambican from Cabo Delgado, mobilised by local 
political and socio‑economic issues, however, the group also attracts individuals from 
East African countries, in particular Tanzania, the DRC, Kenya, Somalia, and South 
Africa. The insurgency is also supported by funds from across East, Southern and 
Central Africa through mobile money transfer platforms65.  

64 Rhula Intelligence Solutions, 16.4.2021, ‘Mozambique Palma Attack – March 2021’, referenced 
in Brenda Mugeci Githing’u, Tore Refslund Hamming, 2021, ‘The Arc of Jihad’: The Ecosystem of 
Militancy in East, Central and Southern Africa, International Centre for the Study of 
Radicalisation, King’s College London, note 168, accessible at https://icsr.info/2021/11/01/the-
arc-of-jihad-the-ecosystem-of-militancy-in-east-central-and-southern-africa/.   
65 News24, 28.4.2021, ‘South Africans among funders of Mozambique insurgents – SADC report’, 
accessible at https://www.news24.com/news24/southafrica/news/south-africans-among-
funders-of-mozambique-insurgents-sadc-report-20210428; Brenda Mugeci Githing’u and Tore 

| 41 

 
 
– TE-SAT 2022 

Over 2021, the activity and geographical scope of the ADF evolved considerably. The 
ADF is present predominantly in the provinces of North Kivu and Ituri but also 
appeared in the provinces of South Kivu and Tanganyika, attacking military and civilian 
targets. A number of signs may indicate that the ADF is moving towards territorial 
consolidation (tamkin), as in August 2021 the group issued a statement via IS’s A’maq 
News featuring a fighter trying to promote the group’s ideology to a Christian village in 
Ituri.  

ADF propaganda also showed a new disturbing approach, as for the first it released 
time two beheading videos in June 2021. Although it had committed beheadings for 
years, the ADF did not previously use brutality as a propaganda tool. Similarly, the 
group carried out its first targeted murders of religious leaders in the DRC in May. The 
beheading videos and assassination of religious leaders are examples of how the ADF’s 
ties with IS have influenced the group’s ideology and communication style.  

ADF’s increased lethality and evolving propaganda appears to have coincided with an 
influx of foreign recruits, mostly from neighbouring countries. For instance, the 
perpetrators in some of the ADF videos reportedly speak Swahili with Kenyan accents. 
Furthermore, in September 2021, the DRC army arrested a Jordanian reportedly in 
charge of the ADF’s UAV program66. The use of foreign recruits in propaganda is likely 
to attract more fighters from surrounding countries, boosting the ADF’s military 
capability and morale. 

On 8 October 2021, IS claimed its first attack in Uganda after detonating an IED inside a 
police station in Kampala. This was followed by a series of attacks. On 23 October, IS 
claimed an IED attack that targeted ‘members of the crusader Ugandan government’ in 
a pub in Kampala, killing one person and injuring several others. On 25 October, a 
bomb exploded on a bus, killing the alleged suicide bomber and wounding others. On 
16 November, suicide bombers detonated devices in Kampala city centre near the 
central police station and parliament building. At least four people were killed and 
over 30 others were injured in the double attack. In claiming the 16 November attack, 
IS declared Uganda and ISCAP at war.  

Arabian Peninsula  

Yemen 

Al-Qaeda in the Arabian Peninsula (AQAP) has become significantly weaker over the 
past five years. However, AQAP continued its operations against Security Belt Forces 
and other groups affiliated with the United Arab Emirates and Saudi Arabia in the 
Shabwa and Abyan governorates. It also clashed with Houthi forces in the Bayda’ 
governorate.   

AQAP continued to be led by Khalid bin Umar Batarfi (aka Abu Miqdad al-Kindi), 
despite claims by the United Nations (UN) in February 2021 that he had been arrested 
in October 2020.  

In comparison to al-Qaeda, the Islamic State Yemen is weak, having suffered heavy 
losses in fighting against both the Houthis and AQAP.  

Refslund Hamming, 2021, ‘The Arc of Jihad’: The Ecosystem of Militancy in East, Central and 
Southern Africa, International Centre for the Study of Radicalisation, King’s College London. 
66 HumAngle, 22.9.2021, ‘Jordanian ADF Trainer Arrested in Beni, DR Congo’, accessible at 
https://humanglemedia.com/jordanian-adf-trainer-arrested-in-beni-dr-
congo/#:~:text=A%20man%20believed%20to%20be,the%20country%2C%20military%20authorit
ies%20said.  

| 42 

 
 
Central Asia 

Afghanistan 

– TE-SAT 2022 

On 15 August 2021, the Taliban took control of the Afghan capital of Kabul. On 7 
September, the Taliban appointed an interim government consisting exclusively of 
Taliban members. Among others, Mullah Ya’qub, the son of Taliban founder Mullah 
Omar, was appointed defence minister, former Guantánamo prisoner and alleged al-
Qaeda associate Mullah Abdulqayyum Zakir was appointed deputy defence minister, 
and the leader of the Haqqani Network67 Sirajuddin Haqqani was appointed interior 
minister. 

Following the leadership takeover, al-Qaeda issued a statement congratulating the 
Taliban leadership on ‘its great victory against the crusader alliance’. It is likely that al-
Qaeda will try to strengthen its capabilities in Afghanistan, capitalising on the former 
relationship with the Taliban and especially with the Haqqani Network. According to 
the UN, al-Qaeda in the Indian Subcontinent (AQIS) already operates under Taliban 
protection from the provinces of Kandahar, Helmand and Nimruz68.  

In a series of attacks during and following the Taliban takeover, Islamic State Khorasan 
Province (ISKP) attempted to demonstrate that the Taliban were unable to provide 
security in the country. Among others, ISKP claimed responsibility for the suicide attack 
on 26 August 2021 targeting the Western evacuation efforts at Kabul airport which 
killed over 170 civilians and 13 USA troops. Possibly to magnify ISKP’s operational 
strength, the group also started claiming attacks in Pakistan, despite the existence of a 
separate IS Pakistan Province announced in May 2019.  

ISKP continued to attack the Shi’i Muslim Hazara ethnic minority, which has long been 
one of its targets. The group claimed responsibility for a suicide bomb attack on a Shi’i 
mosque in Kunduz on 8 October that left over 70 people dead and injured over 140. 
On 15 October, another Shi’i mosque in Kandahar was targeted by an IS suicide attack 
during Friday prayers, killing more than 40 people. 

Contrary to the Taliban, whose main support base is rural ethnic Pashtun communities, 
ISKP has been able to recruit men and women from middle-class families, including a 
substantial number of non-Pashtun university students69. 

The takeover of the Taliban movement has raised concerns that other militant Islamist 
groups worldwide could be encouraged to follow its strategy. While some militants, 
namely IS supporters, criticised the willingness of the Taliban to negotiate directly with 
the USA, others – including several of al-Qaeda’s affiliates and HTS – appeared to 
demonstrate interest in replicating this example.  

67 The Haqqani Networok is a Sunni militant organisation linked to al-Qaeda.  
68 UN Security Council (S/2021/68), 3.2.2021, Twenty-seventh report of the Analytical Support 
and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL 
(Da’esh), Al-Qaida and associated individuals and entities. 
69 United States Institute of Peace, 1.6.2020, ‘Bourgeois Jihad: Why Young, Middle-Class Afghans 
Join the Islamic State’, accessible at https://www.usip.org/publications/2020/06/bourgeois-
jihad-why-young-middle-class-afghans-join-islamic-state.  

| 43 

 
 
RIGHT-WING TERRORISM  

– TE-SAT 2022 

KEY FINDINGS  

►  No right-wing terrorist attacks were completed in the EU in 2021. Two 

attacks were foiled, one in Sweden and one in Austria. There was one failed 
right-wing terrorist attack reported in Belgium. 

►  In 2021, 64 arrests were made in nine Member States following charges for 

right-wing terrorist offences. 

►  The ages of the suspects involved in law enforcement investigations and of 

those participating in right-wing online communities continued to 
decrease, potentially influenced by more time generally spent online during 
the COVID-19 pandemic. Gaming platforms and gaming communication 
services popular among young people and children are used for spreading 
right-wing terrorist and extremist propaganda. 

►  Whereas historically, the right-wing scene concentrated mostly on the 

hierarchically organised neo-Nazi spectrum, loose international networks 
have emerged online, consisting of mostly very young men with the 
potential for lone actor attacks. 

►  Mental health issues are of growing concern to law enforcement agencies, 
as they may make individuals more susceptible to right-wing extremist 
ideas. This has been enforced by the COVID-19 pandemic measures, such 
as school closures and prolonged social isolation. 

►  SIEGE and Accelerationism, both with significant potential for inciting 

violence, were the most prominent ideologies in 2021, especially attracting 
young people radicalised online. International online connections and 
networks, especially the ones with USA contacts, play a strong role in 
spreading propaganda in the EU. 

| 44 

 
– TE-SAT 2022 

RIGHT-WING TERRORISM – defined  

Right-wing terrorism refers to the use of terrorist violence by right-wing extremists. 
Violent right-wing extremist individuals and groups use, incite, threaten, legitimise or 
support violence and hatred to further their political or ideological goals. They seek to 
change the entire political, social and economic system on an authoritarian model and, in 
doing so, reject the democratic order and values as well as fundamental rights. Violent 
right-wing extremist ideologies are centred on exclusionary nationalism, racism, 
xenophobia and/or related intolerance. Examples are neo-Nazism and neo-fascism. In 
addition, violent right-wing extremist ideologies feed on a variety of hateful sub-cultures, 
commonly fighting back against diversity in society and equal rights of minorities. For 
example, misogyny and hostility to lesbian, gay, bisexual, transgender and queer 
(LGBTQ+) communities and immigration are common attitudes among right-wing 
extremists. A core concept in right-wing extremism is supremacism or the idea that a 
certain group of people sharing a common element (nation, race, culture, etc.) is superior 
to all other peoples.  Seeing themselves in a supreme position, the particular group 
considers it to be their natural right to dominate the rest of the population. 

Right-wing terrorist attacks and arrests 

Attacks 

No 
completed 
right-wing 
inspired 
attack was 
carried out 
in the EU  
in 2021  

Two attacks were foiled (one in both Austria and Sweden) and one attack failed 
(Belgium). Homemade explosives were the weapons of choice in both foiled attacks. 

In July 2021, one right-wing attack was foiled in Austria, when a suspect attempted to 
use homemade explosives at a left-wing event. The suspect seemingly acted alone and 
had previously donated to a right-wing group, the Identitäre Bewegung Österreichs 
(IBÖ, ‘Identitarian Movement Austria’).  

In November 2021, the police in Sweden arrested a 25-year-old man for planning to 
build an IED using stolen fertiliser. During the search, several objects and substances 
were found that could have been used to produce one or more bombs, as well as a 
firearm. The man had links to Nordiska Motståndsrörelsen (NMR, ‘The Nordic 
Resistance Movement’), a neo-Nazi organisation active in all Nordic countries. 

In May 2021, a 46-year-old member of the military expressed intentions to commit an 
attack on a well-known virologist in Belgium. The suspect was known to the 
intelligence service for his right-wing extremist ideas and links to persons involved in 
right-wing extremist groups. With the intention to carry out the attack, he had stolen 
military equipment, including firearms, from a Belgian military base. The suspect 
committed suicide and his body was found in a forest, after a month-long search by 
authorities from Belgium, Germany and the Netherlands. 

| 45 

 
 
– TE-SAT 2022 

| 46 

 
– TE-SAT 2022 

Arrests 

64 individuals were arrested in nine Member States on suspicion of involvement in 
right-wing terrorist activities. This is an increase compared to the 34 arrests in 2020 
and the 21 arrests in 2019. One of the most significant increases in the number of 
arrests was in France (29 arrests in 2021, compared to five in 2020 and seven in 2019), 
possibly linked to intensified propaganda from transnational accelerationist groups 
targeting French right-wing extremist groups, and the impact of successful law 
enforcement investigations that took place in 2020 and 2021. The suspects arrested 

| 47 

 
– TE-SAT 2022 

were predominately male, nationals of the countries where they were arrested, and 
between 23 and 62 years old70.  

The most frequent offence leading to arrest was membership of a terrorist group (13), 
which was often associated with terrorist propaganda activities71.  

In June 2021, a right-wing extremist group was dismantled in Italy, after 
investigations had been ongoing since 2019, for membership of a right-wing 
terrorist organisation and dissemination of terrorist propaganda. Photographs of 
Hitler, swastikas and a book listing Jewish surnames were seized during house 
searches of 12 alleged members of the Ordine Ario Romano (‘Roman Aryan Order’), 
a white supremacist group. One of the suspects, who called herself Miss Eva Braun, 
was voted the winner of an online Miss Hitler beauty pageant in 2019. The group 
was publishing racist, discriminatory, Nazi-inspired, anti-Semitic and Holocaust-
denying content, videos and images on social media72. The group was in very early 
stages of plotting to attack a NATO base with homemade explosives73. 

Arrests for planning attacks 

Seven individuals were arrested for the planning or preparation of a terrorist attack. A 
cell of five right-wing men aged between 23 and 26 years suspected of preparing a 
terrorist attack were arrested in Finland in December 202174, although the 
preparations had already been made in 2019. Back then, the police had seized firearms 
and material from the suspects which could be used to build explosives. Members of 
the group have committed numerous other crimes before the terrorist investigation. 
The suspects followed a right-wing ideology influenced by accelerationist and 
apocalyptical Satanist ideas and wanted to foment chaos in society in order to 
accelerate the collapse of western societies, using extreme violence to pursue their 
aims. 

One individual who distributed accelerationist materials and spoke about planning 
and executing a terrorist attack in a Telegram group was arrested in the 
Netherlands in August 2021, and another individual was arrested in Sweden in 
December 2021 suspected of having planned an attack with one or more explosive 
devices.  

70 Gender was reported for 24 arrestees, citizenship for 23, country of birth for 24, and  
age for 23.   
71 For 41 cases, no additional data were reported.  
72 Carabinieri, 2021, Contrasting the subversive and terrorist phenomenon/‘Contrasto al 
fenomeno eversivo e terroristico’, accessible at https://www.carabinieri.it/chi-
siamo/oggi/reparti/organizzazione-mobile-e-speciale/raggruppamento-operativo-
speciale/risultati-operativi/contrasto-al-fenomeno-eversivo-e-terroristico.  
73 European Eye on Radicalisation (EER), 30.7.2021, ‘Italy Sees Spike in Far-Right Activity During 
Pandemic’, accessible at https://eeradicalization.com/italy-sees-spike-in-far-right-activity-
during-pandemic/.   
74 Europol press release, 8.12.2021, ‘Five arrested in Finnish investigation targeting right-wing 
extremism’, accessible at https://www.europol.europa.eu/media-press/newsroom/news/five-
arrests-in-finnish-investigation-targeting-right-wing-extremism. 

| 48 

 
 
– TE-SAT 2022 

| 49 

 
– TE-SAT 2022 

Other arrests 

In addition to arrests confirmed as related to terrorist offences, several other arrests in 
Member States concerned suspects and activities in the right-wing violent extremist 
spectrum. In some of these cases, the suspects were arrested in the very early stages 
of preparing violent actions. 

In one case in Italy, a 22-year-old male was arrested in January 2021 on suspicion of 
being a member of Nuovo Ordine Sociale (‘New Social Order’), a neo-Nazi militant 
organisation inspired by the Atomwaffen Division (AWD, ‘Nuclear Weapons 
Division’, today known as National Socialist Order, NSO). He allegedly spread 
propaganda on Telegram and expressed intentions to commit violence in online 
communications, such as school shootings, while encouraging others to do the 
same. He also intended to attack a feminist demonstration and held deep hatred 
for women, particularly those of Jewish origin and those sharing communist 
worldviews. He described himself as an incel75.  

In December 2021, Italian police arrested the leader and four other members of a 
neo-Nazi group (called Unione Forze Identitarie, ‘Union of Indentity Forces’) which 
was closely aligned with the extremist groups Feuerkrieg Division (FKD, ‘Fire War 
Division’) and AWD (known today as the NSO). Nazi propaganda and weapons were 
seized during the house searches. The arrested leaders are suspected of 
distributing information on explosives. The investigations showed how the 
recruiters aimed at radicalising young people, often minors in difficult situations. 
The indoctrination also took place through the glorification of terrorist acts, 
described as the White Jihad, committed by lone actors76. 

INCEL 

Incel is an online subculture, in which men blame women for their involuntary celibacy, i.e. their lack 
of sexual relations with women. Many incels have a history of problems socialising and finding a 
female partner, and have experienced rejection in the past. In incel online communities, this 
experience is transmuted into hatred against women. They reject women’s sexual emancipation and 
label women as shallow, cruel creatures who will choose only the most attractive men if given the 
choice. While the incel movement is not a right-wing extremist narrative in particular, incel-
motivated persons can develop explanations for their lack of sexual relations that feed into right-
wing extremist ideas (TE-SAT 2021). Whereas the majority of incels are non-violent and do not 
approve violence, some members consider themselves to be staunch misogynists and are likely to 
endorse violence77.  

75 European Eye on Radicalisation (EER), 30.7.2021, ‘Italy Sees Spike in Far-Right Activity During 
Pandemic’, accessible at https://eeradicalization.com/italy-sees-spike-in-far-right-activity-
during-pandemic/.  
76 Europol information.   
77 Anne Speckhard, Molly Ellenberg, Jesse Morton and Alexander Ash, 2021, ‘Involuntary 
Celibates’ Experiences of and Grievance over Sexual Exclusion and the Potential Threat of 
Violence Among Those Active in an Online Incel Forum’, Journal of Strategic Security, Volume 14, 
Number 2, p. 89-121, accessible at https://digitalcommons.usf.edu/jss/vol14/iss2/5/.   

| 50 

 
 
 
 
Convictions and penalties for right-wing terrorism offences 

– TE-SAT 2022 

The number of convictions for right-wing terrorism-related offences (15) continued to 
increase in 2021 compared to previous years (6 in 2019 and 11 in 2020). The 
convictions in 2021 were pronounced by courts in France, Germany, Italy and the 
Netherlands. All relevant cases concluded in Member States in 2021 resulted in 
convictions.  

In France, for example, the Criminal Court of Paris heard the case of six French 
nationals accused of participation in a criminal conspiracy with the purpose of 
preparing an act of terrorism and, for two of them, theft in the context of a 
terrorist offence. The main defendant was also charged with public glorification of 
an act of terrorism using an online communication service. Between September 
2016 and October 2017, the defendants set up a right-wing terrorist organisation 
called Organisation des Armées Sociales (OAS, ‘Social Armies Organisation’) or 
Nouvelle OAS, which declaratively fought against what the group called the 
‘islamisation of France’78. The organisation planned violent actions targeting 
individuals and groups of people based on ethnical and religious criteria, as well as 
well-known figures such as politicians, or busy locations such as restaurants and 
places of worship. The court established that some defendants acquired weapons 
and firearms, as well as instructions on the fabrication of explosives, and were 
ready to perpetrate attacks with the aim of destabilising the institutions and the 
democratic order. The court found all six defendants guilty. Three members of the 
organisation were minors at the time of the facts and will be brought to a juvenile 
court. 

Groups and structures  

The right-wing extremist scene was historically dominated by 
hierarchical neo-Nazi groups, but a transnational scene, consisting of 
loose online networks of mostly very young men with great potential 
for lone actor attacks, adhering to SIEGE and accelerationist ideologies, 
has emerged and progressively expanded in the last few years. 

The members of groups associated with the hierarchical neo-Nazi spectrum and its 
subcultures are often connected to the music and mixed martial arts (MMA) scenes, or 
to football hooliganism, and are generally more likely to be known by law enforcement 
authorities. Traditionally these groups attract people of all ages from marginalised 
factions of society with a lower education and low economic status. Members of such 
groups are overwhelmingly male and can often be recognised by their attire and 
tattoos. They usually have great distrust for new members and respect has to be 

78 Regarding the legal qualification of the OAS as a terrorist organisation, the court underlined 
the clear historical reference to the French far-right paramilitary organisation set up during the 
Algerian War, the Organisation Armée Secrète (OAS, ‘Secret Armed Organisation’), which had 
been held accountable for assassinations, bombings and terrorist attacks. In addition to its 
ideological proximity, the organisation founded by the defendants adopted structural elements 
of the OAS set up in 1961, functioning as a military-like and clandestine structure. 

| 51 

 
 
 
 
– TE-SAT 2022 

earned over time. Their activities focus mostly on gatherings, stickering, fly-postering, 
the organisation of and attendance to music concerts, marches, demonstrations and 
sport events. Most of these events are held in a peaceful manner, though hate speech 
is omnipresent. Some of the members have connections to organised crime. The 
collection of memorabilia is still very popular within this scene. They purchase and sell 
flags, uniforms and other right-wing paraphernalia. These groups are more likely to be 
involved in spontaneous violence, rather than in premeditated attack planning.  

But the formation of small cells from within this spectrum that could go underground 
and plan attacks cannot be excluded. One recently banned group falling under this 
category is the German neo-Nazi association Nationale Sozialisten Rostock (NSR, 
‘National Socialists’)79, also known under the name Aktionsblog, and its sports division, 
Baltik Korps. Since 2019, the organisation has established a broad network within the 
right-wing extremist scene. In the context of the ban, among others, Nazi memorabilia 
and sound carriers containing right-wing extremist music were seized.  

In 2021, connections between individuals as well as between groups were largely 
established and held online. Nonetheless, given the gradual lifting of COVID-19 
restrictions, physical gatherings attended by supporters from several countries were 
organised again towards the end of 2021. Contacts between EU extremists and groups 
in Europe and Russia were also noted, for instance the Russian Imperial Movement has 
supported white supremacist extremist activity beyond Russia and Ukraine. The group 
provided paramilitary training to Swedish members of NRM. 

Another category of right-wing actors concerns international networks of individuals 
on the Internet, mostly adhering to SIEGE and accelerationist ideas. This concerns 
predominantly very young males, aged as young as 12. This scene is closely connected 
with like-minded subjects all over the world in loose virtual networks, lacking clear 
leadership and hierarchical structures. This global online movement intersects with a 
large number of ideologies and narratives that feed into each other, such as the ‘Great 
replacement’80 theory and occultism. Some individuals within SIEGE communities have 
also been linked to apocalyptic Satanism, such as that promoted by the Order of Nine 
Angles (ONA or O9A) and affiliates. ONA promotes violence and sexual assault against 
perceived enemies with the aim to undermine and destroy civilisation and replace it 
with a new imperial age. Network-building and common support for the greater cause, 
often connected to the salvation of the white race on a global level, are elements of 

79 Mecklenburg-Vorpommern Ministerium für Inneres, Bau und Digitalisierung, 24.6.2021, 
Interior Minister bans “National Socialists Rostock” including its sub-organization “Baltik Korps”. 
Renz: Right-wing extremism has no place in our society/ ‘Innenminister verbietet „Nationale 
Sozialisten Rostock“ einschließlich seiner Teilorganisation „Baltik Korps“. Renz: 
Rechtsextremismus hat in unserer Gesellschaft keinen Platz’, accessible at 
https://www.regierung-
mv.de/Landesregierung/im/Aktuell/?id=171301&processor=processor.sa.pressemitteilung; 
Federal Gazette, 17.5.2021, State of Mecklenburg-Western Pomerania, Announcement of a ban 
on associations against the associations “National Socialists Rostock” and “Baltik Korps”/ ‘Land 
Mecklenburg-Vorpommern, Bekanntmachungeines Vereinsverbots gegen die Vereine „Nationale 
Sozialisten Rostock“ und „Baltik Korps“’, accessible at 
https://www.bundesanzeiger.de/pub/en/search-result?9. 
80 In recent years, many strands of right-wing extremism have been incorporated into the 
broader framework of the so-called ‘Great Replacement’ conspiracy theory, which originates 
from the 2011 book Le Grand Replacement by French author Renaud Camus. Violent actors 
motivated by different right-wing extremist motivations have justified their attacks with a 
reference to this theory. The ‘Great Replacement’ promotes the idea that a global elite, often 
perceived to be led or dominated by Jews, tries to replace ‘white’ populations with ‘non-white’ 
people through massive immigration. In the aftermath of the Christchurch attacks, an 
exponential increase of references to the ‘Great Replacement’ on social media propelled the 
term into mainstream attention, Europol Terrorist Threat Assessment (TE-SAT) 2020.   

| 52 

 
 
– TE-SAT 2022 

key importance for this movement. SIEGE also criticises white populations for being 
deeply corrupt and complacent81.  

SIEGE 

SIEGE has become the manifesto for right-wing extremists, such as Atomwaffen Division 
(‘Nuclear Weapons Division’, known today as Nationalist Social Order, NSO), Sonnenkrieg 
Division (‘Sun War Division’) and FKD.  The ideology is inspired by a book comprising a 563-
page collection of newsletters produced by USA neo-Nazi James Mason during the 1980s. 
SIEGE promotes ‘leaderless, cell-structured terrorism and white revolution’, and calls on 
‘true’ neo-Nazis to go underground and begin a guerrilla war against ‘the system’. James 
Mason’s SIEGE refers back to Charles Manson, Adolf Hitler and prominent USA neo-Nazi 
William Pierce, author of The Turner Diaries, a novel depicting an imaginary breakdown of 
the political system in the USA and an allegedly ensuing ‘race war’. Charles Manson’s 
‘Helter Skelter’, which describes a race war between ‘blacks’ and ‘whites’, seems to 
particularly resonate with right-wing extremists.  

SIEGE culture encompasses the concept of accelerationism, the use of violence, including 
acts of terrorism, to bring about a ‘race war’ and the fall of existing social and political 
systems. Accelerationism is based on the idea that Western governments are irreparably 
corrupt. Therefore, white supremacists must accelerate their collapse by sowing chaos and 
creating political tension. The preferred tactic for achieving this is violence in the form of 
attacks on minorities, including ‘non-whites’ and Jews, as a way to bring society closer to a 
‘race war’. The ultimate goal is to bring down the ‘system’, so as to pave the way for a 
future dominated by ‘whites’. Accelerationist ideas have been cited in the case of the 
Christchurch attack in New Zealand in 2019 and are frequently referenced in white 
supremacist web forums and chat rooms.  While the concept of accelerationism in the 
extremist right-wing scene has developed significantly over recent years, it has existed for 
much longer. Some of the earliest examples can be found in the Marxist idea that the 
intensification of an unhinged force, such as capitalism, will inevitably result in that force’s 
own self-destruction (TE-SAT 2021). 

Supporters connect through various social media and online forums, including some on 
the dark web. Members of such networks hide behind the anonymity of encrypted 
chat groups and are generally less likely to join traditional offline right-wing extremist 
organisations.  

Some however, form small cells and groups, loosely connecting to international 
organisations such as the AWD (now also known under ‘National Socialist Order’) 
which was founded in the USA and also adheres to SIEGE and accelerationist ideas, but 
has since expanded significantly to Europe. For example, in mid-September 2021, AWD 
Finland was founded. The branch bears the name Atomwaffen Division Finland Siitoin82  
Squadron (AWDSS). In its announcement, the group stated that its aim is to overthrow 
the Finnish government by any means necessary83.  

Currently, right-wing extremist networks from English-speaking countries, particularly 
from the USA, appear to exert the strongest impact on groups and individuals active in 
the EU. USA organisations such as The Base, Hammerskin Nation, NSO (formerly AWD) 
and Nationalist Social Club (NSC) are among the actors heavily influencing right-wing 

81 J.M. Berger, April 2021, ‘A Paler Shade of White: Identity & In-group Critique in James Mason’s 
Siege’, Resolve Network, accessible at https://doi.org/10.37805/remve2021.1. 
82 Pekka Siitoin was a well-known Finnish neo-Nazi who died in 2003. 
83 Europol information. 

| 53 

 
 
– TE-SAT 2022 

groups and individuals in Europe. They do not seek to enforce their white supremacist 
worldview by engaging in politics, and are rather likely to strike out of their cover in 
small cells or as lone actors, making them especially dangerous as they are mostly 
unknown to law enforcement authorities. Such a fluid and changing environment 
currently poses the main threat for terrorist attacks in a violent right-wing extremism 
context. Many of the members of these communities have psychological and/or socio-
economic problems. These circumstances make them unpredictable and more 
vulnerable to the message of online communities and to the sense of belonging 
offered there. The elevation of perpetrators of right-wing extremist attacks to saints in 
global digital right-wing extremist communities, as seen for instance with the attacker 
from the Christchurch attack in New Zealand in 2019, is especially worrisome given 
their potential to inspire more followers and copycats across the globe84.  

In addition to the above, another category is the New Right movement. While it is not 
extremist or violent in itself, the New Right has the potential to incite hate and 
violence. The New Right movement includes groups such as the Identitarian 
movement operating throughout Europe. France for example banned the right-wing 
group Génération Identitaire for incitement to discrimination, hatred and violence in 
March 2021.  

This movement attracts both male and female supporters, mostly between 18 and 40 
years, who present themselves as intellectuals, and have average or higher economic 
and social status. They try to influence public opinion in order to mainstream right-
wing extremist ideas. They are active on social media and often organise public 
actions.  

Similar to other ideologies, New Right communities seek connections with like-minded 
people in Europe and abroad. The Portuguese members of Escudo Identitário 
(‘Identitarian Shield’) with ties to the international Identitarian movement, for 
example, published in February 2021 several messages on social media, expressing 
support for the members of the proscribed French organisation Génération Identitaire 
(‘Identitarian Generation’).  

Paramilitary training and activities 

Physical, tactical, survival, and weapons trainings are important areas of focus for most 
right-wing extremist groups and individuals. Right-wing supporters take part in training 
camps in remote rural areas, inside and outside the EU, where they attend lectures, 
self-defence classes, MMA and boxing trainings, as well as courses on the use of 
weapons. Within the EU, trainings were held in eastern European countries, while 
outside the EU trainings were held in Ukraine and Russia. The acquisition of firearms 
continues to gain right-wing extremists’ attention. 

In Ireland, a 40-year old male with British nationality was arrested for firearms 
offences in June 2021.  Allegedly, he imported component parts with the intention 
of manufacturing firearms using a 3D printer. The suspect is charged and in custody 
awaiting trial. Specific details of his motive and intentions are unknown, but it is 
clear that he sympathised with right-wing extremism and had an interest in 

84 The attack on a supermarket in Buffalo (USA) on 14 May 2022 appears to be partially inspired 
by the 2019 Christchurch attack as references to it were included in the attacker’s manifesto – 
Tahir Abbas, Inés Bolaños Somoano, Joana Cook, Isabelle Frens,  Graig R. Klein, G.R., Richard 
McNeil-Willson, 18.5.2021, ‘The Buffalo attack – An analysis of the manifesto’, Perspective, The 
International Centre for Counter-Terrorism, accessible at https://icct.nl/publication/the-buffalo-
attack-an-analysis-of-the-manifesto/.  

| 54 

 
 
previous atrocities committed by right-wing extremists. The suspect has not been 
linked to any particular group. 

– TE-SAT 2022 

Financing 

Traditional ways for the right-wing extremist scene to raise funds are donations, legal 
private businesses, fund raising campaigns, music concerts and sports events, and 
sales of right-wing extremist merchandise such as clothing with right-wing symbols. 
However, criminal activities are also used as a source for financing. Limitations in 
concerts and events in the COVID-19 era have driven right-wing extremist groups to 
seek alternative methods of funding for their activities. An increased number of online 
campaigns on social media, forums, gaming chat rooms and other internet platforms, 
have been organised in support of the right-wing extremist scene.  

These activities not only provide funds, but also help promote their ideology, create 
opportunities for future recruitment and build relationships between different right-
wing extremist adherents. The monetising of online profiles through the right-wing 
extremist scene has also been observed. Right-wing extremists also show an interest in 
cryptocurrencies. 

Propaganda, radicalisation and recruitment 

While the online environment appears to host the most significant share of right-wing 
propaganda, some also exists offline and often materialises in stickers, banners and 
leaflets. Radicalisation and recruitment in an offline setting often takes place in sports 
clubs and gyms, e.g. MMA and boxing clubs, but also during right-wing extremist music 
concerts, football games and demonstrations. There can also be an overlap between 
radicalisation which is initiated online and then moves on to meetings in real life, after 
trust is earned. Such meetings can happen during demonstrations or other gatherings.  

Similarly to previous years, a large part of all radicalisation and indoctrination took 
place online in 2021. Given the accessibility and fluidity of the virtual environment, this 
development has made the traditional groups’ organisational structures less relevant 
compared to the past.  

A major part of online propaganda can be attributed to SIEGE and accelerationist 
ideas. In mid-June 2021, a group of right-wing extremists collectively produced ‘A 
Terrorgram Publication’ and disseminated a 136-page guide online with the title 
‘Militant Accelerationism: A Collective Handbook’, consisting of detailed incitements 
for attacks on critical infrastructure and violence against minorities, police, public 
figures, journalists and other perceived enemies. In December 2021, the Terrorgram 
collective published a second document called ‘Do It for the ‘Gram’’. The 268-page, 
multi-author document contains ideological sections that stem from accelerationism, 
white supremacy, and eco-fascism together with practical instructions on how to 
facilitate the collapse of Western society. 

Right-wing extremists are active on almost all social networks, content 
sharing platforms as well as a large number of websites and forums. 

The purpose of right-wing propaganda efforts is to strengthen the movement and 
number of supporters, especially since they are, according to their beliefs, preparing 
for a societal collapse. Such an event would require resources to plan and eventually 
fill a future power vacuum and to raise a white ethno-state from the ashes, as 

| 55 

– TE-SAT 2022 

according to the extremists forming an army of like-minded people is of utmost 
importance. 

Some groups employ the media in an almost professional way.  Switzerland reports 
that the new right-wing extremist group Junge Tat pursues a public communication 
strategy on social media that has so far been unprecedented in its respective right-
wing extremist scene. The group regularly publishs videos produced in relatively high 
quality. In these clips, emphasis is put on the importance of education, physical 
training, tradition, community, the defence of the homeland and nature, and 
conventional media and excessive capitalism are rejected. The group also organises 
hikes to recruit new members. In mid-September 2021, the group distributed leaflets 
and campaigned against compulsory vaccination.  

Decreasing ages of those exposed to right-wing propaganda 

The radicalisation of very young males, often still minors, is of great 
concern. In some cases, a less aggressive form of propaganda is 
distributed first and when the person shows interest, more extremist 
content is introduced. 

The conversation is often then moved to closed chat groups and forums. Fashwave and 
Tacticool are two popular trends that contribute to the popularisation of right-wing 
content. Fashwave melds Vaporwave85 and Synthwave86 visual aesthetics with Nazi or 
Fascist iconography. It materialises online as visual art (e.g. memes or images), 
sometimes mixed with music. Tacticool is the utilisation of military style clothing and 
gear for the purpose of looking cool and showing a readiness to fight. This form of 
targeted propaganda mostly stems from SIEGE and accelerationist ideas spread 
through loose online networks. 

The online environment and the multitude of groups and networks active online make 
it difficult to define who the main players are in terms of propaganda dissemination, as 
anyone can spread their own propaganda. This can also lead to an escalation of 
rhetoric, as individuals try to outdo each other. The aggressive communication style 
observed online in connection with SIEGE and accelerationism can lead to a lower 
threshold for tolerance or acceptance of violent discourse. In the worst case scenario, 
an individual, after a phase of radicalising on the internet, may decide to carry out an 
attack as part of a common goal shared virtually by other right-wing extremists.  

The very young males observed in right-wing online communities do not match the 
classic profile of a right-wing extremist and come from a diversified background. Many 
still live with their parents and attend school. Some common features have been 
repeatedly observed, such as psychological issues and issues in engaging socially with 
peers. In that sense, right-wing extremist online networks may offer a sense of 
community and belonging. Certain individuals join this scene because of their 
fascination with weapons, military training, self-defence, and/or survival techniques. 

85 A subgenre of electronic music and visual art style where 1980s and 1990s imagery and music 
are slowed down, cut and spliced together. 
86 A subgenre of electronic music based on music associated with 1980s action, horror and 
science-fiction film soundtracks. 

| 56 

 
 
– TE-SAT 2022 

Regarding the increase in the number of radicalised minors, the exploitation of the 
gaming landscape by extremists is an unsettling trend. Not only do right-wing 
extremists use gaming apps, gaming platforms and video games for communication, 
but they are also used for the gamification of propaganda, for example through the 
creation of fascist utopias where racist role-play is facilitated in video games. 

Right-wing propaganda topics 

Right-wing extremist organisations have been seeking to integrate current social issues 
into their narratives, in order to appear more relevant and reach a wider audience, as 
well as to improve their public image.  

In particular cases, right-wing groups have even posed as saviours in crisis situations. 
Right-wing extremists used the heavy floods in parts of Belgium in 2021 to present 
themselves as the rescuers, carrying out activities such as the collection of groceries to 
help the affected citizens in the area. The aim of those actions was to generate new 
supporters and at the same time to highlight the shortcomings and delays in 
governmental assistance.  

COVID-19 was the most important propaganda topic for right-wing extremists in 2021. 
There was a clear consensus throughout all forms of right-wing extremism, to oppose 
the measures put in place by Member States in connection with COVID-19, such as 
lockdowns and social distancing measures. There was also strong opposition to the 
introduction of vaccine passports to participate in society, mandatory mask wearing 
and vaccinations or tracking apps were perceived as a government attempt to monitor 
citizens’ lives. The right-wing extremist scene also tried to exploit the crisis and the 
subsequent discontent of large sections of the population, for example by trying to 
influence or recruit those demonstrating peacefully against COVID-19 measures. 
However, their efforts were largely assessed as unsuccessful. Despite right-wing 
extremists generally positioning themselves against COVID-19 measures, some right-
wing extremists blamed minorities and immigrants for the spread of the virus through 
non-compliance with anti-pandemic measures or refusal to vaccinate themselves. In 
the background of deepening social polarisation driven by COVID-19 measures and its 
economic impact, right-wing extremists also targeted people affected socially and 
economically by the COVID-19 measures, e.g. people that lost their jobs. Conspiracy 
theories have been disseminated online. Some right-wing extremists have also spread 
the idea that globalisation and the current political systems are to blame for the 
spread of the virus.  

Right-wing extremist propaganda has heavily touched upon immigration, attributing 
increases in crime to migrant populations or blaming them for burdening societies in 
the EU and criticising EU migration policies. In that context, the Great Replacement 
theory is propagated regularly. 

Anti-Semitism is a recurring theme within the right-wing extremist scene and is 
integrated in almost all of its ideologies and sub-currents. An increase in anti-Semitic 
propaganda was observed in 2021. Judaism is viewed as a root of evil and cause for 
societal inequality. In Italy, precautionary measures were issued against 12 members 
of the neo-Nazi group Ordine Ario Romano, who were investigated for having formed 
an association aimed at disseminating anti-Semitic propaganda and inciting the 
commission of crimes on grounds of racial, ethnic and religious discrimination. 

The loss of traditional values and societal structures, such as the classic family, is  
also regularly featured in right-wing extremist propaganda, along with xenophobia, 
homophobia and anti-feminism. Some Member States pointed out that green 
nationalist and eco-fascist ideas are increasingly promoted in the EU, fuelled by  
the intensifying climate crisis and the continuing rise of populist and right-wing 
extremists’ movements. 

| 57 

– TE-SAT 2022 

LEFT-WING AND ANARCHIST 
TERRORISM 

KEY FINDINGS  

►  One left-wing terrorist attack was completed in the EU in 2021, which was 

carried out in Germany. 

►  There is growing concern about an increased propensity for violence within 

the left-wing and anarchist extremist scene.  

►  The number of arrests related to left-wing and anarchist terrorism in 2021 
(19) decreased from 2020 (52). The three countries that had the highest 
number of arrests in 2020 (Italy, Greece and France) a reported significant 
drop in arrests in 2021. 

►  Doxxing incidents are constantly increasing, whereby private addresses and 
other personal or sensitive data of political opponents or public servants 
get published on the internet, constituting a considerable threat to the 
victims and their families. 

►  Left-wing and anarchist violent extremist activity largely focused on 5G 
antennas, power grids and the housing situation in major urban areas. 

►  Left-wing and anarchist violent extremists continued to pose a threat to 

public order in the EU. They did so by engaging in confrontational violence 
with their political opponents or the police during demonstrations. 
Moreover, they caused significant material damage to public and private 
property, estimated to amount to millions of euro. 

| 58 

– TE-SAT 2022 

LEFT-WING AND ANARCHIST TERRORISM – defined  

Left-wing terrorist groups seek to trigger a violent revolution against the political, social 
and economic system of a state, in order to introduce socialism and eventually establish 
a communist and a classless society. Their ideology is often Marxist-Leninist. Examples 
of left-wing terrorist groups are the Italian Brigate Rosse (BR, ‘Red Brigades’) and the 
Greek Revolutionary Organisation 17 November. 

Anarchist terrorism is a term used to describe violent acts committed by groups, and to 
a lesser extent individuals, promoting the absence of authority as a societal model. 
Anarchists pursue a revolutionary, anti-capitalist and anti-authoritarian agenda. 
Examples of anarchist terrorist groups are the Italian Federazione Anarchica 
Informale/Fronte Rivoluzionario Internazionale (FAI/FRI, ‘Informal Anarchist 
Federation/International Revolutionary Front’) and the Greek Synomosia Pyrinon tis 
Fotias (‘Conspiracy of Cells of Fire’). 

Left-wing and anarchist attacks and arrests 

Attacks 

The main decrease in the number of terrorist attacks in 2021 concerned left-wing 
attacks. Member States have nonetheless reported numerous other left-wing violent 
incidents that were not labelled as terrorist attacks according to their national 
legislation.   

On the night of 26 May 2021, flammable liquids were used to set fire to a number 
energy cables which supplied the construction site of a new USA electric vehicle 
factory near Berlin, Germany87. A nearby village was also affected. The damage 
amounted to EUR 200 000. A left-wing extremist group called Vulkangruppe (‘Volcano 
group’) claimed responsibility on the German Indymedia88 website, stating that the 
USA electric vehicle company ‘is neither green, ecological nor social’.  

One 
completed 
attack 
carried out 
by left-wing 
terrorists in 
the EU in 
2021  

87 Polizei Brandenburg, 26.5.2021, LKA takes over investigations after fire/‘LKA übernimmt 
Ermittlungen nach Brand’, accessible at https://polizei.brandenburg.de/pressemeldung/lka-
uebernimmt-ermittlungen-nach-brand/2588143.  
88 Indymedia is short for Independence Media Center, which is a loose network for left-wing 
news websites. Since its beginnings in 1999, several countries around the globe have taken legal 
action against affiliated websites for promoting violence. 

| 59 

 
 
 
– TE-SAT 2022 

| 60 

 
– TE-SAT 2022 

Arrests  

In total, there have been 19 arrests in connection with left-wing and anarchist 
terrorism in the EU. 

The number of arrests related to left-wing and anarchist terrorism in 2021 (19) 
decreased from 2020 (52). The three countries that had the highest number of arrests 
in 2020 reported significant drops in arrests in 2021: Italy reported 24 arrests in 2020 
and six arrests in 2021, Greece reported 14 arrests in 2020 and one in 2021, France 
reported 11 arrests in 2020 and three in 2021. On the other hand, Belgium reported six 
arrests in 2021 and none in 2020.  

2021 is the second consecutive year showing a fall in the number of arrests.  

| 61 

 
– TE-SAT 2022 

The individuals arrested for left-wing offences were predominately male, had an 
average age of 39 years, and were mostly nationals of Member States89. 

89 Age was reported for eight arrestees, gender for eight arrestees, citizenship for eight arrestees 
and the country of birth for 10.    

| 62 

 
 
 
– TE-SAT 2022 

Counter-terrorism officers in Greece arrested a suspected member of the now 
defunct Revolutionary Self-Defense urban guerrilla group90 in Thessaloniki. The 49-
year-old suspect was arrested during the attempted armed robbery of a bank 
branch in Thessaloniki. Revolutionary Self-Defense, a militant organisation active in 
the metropolitan area of Athens since May 2014, became known when it attacked 
the headquarters of the Panhellenic Socialist Movement (PASOK) party in 2014 and 
2017, as well as the Mexican Embassy in Athens in 2016. The group also claimed 
responsibility for a hand grenade attack on the French Embassy in November 2016, 
which injured a police officer91. 

The Spanish police detained a member of the Peruvian terrorist organisation 
Sendero Luminoso (‘Shining Path’) at the Madrid Barajas airport, wanted by the 
authorities of Peru and on whom search and arrest warrants were issued, in order 
to be extradited92. Sendero Luminoso has killed thousands of people in Peru since 
the 1980s.  

In addition to the arrests confirmed as terrorism related, ten Italian left-wing terrorists 
who were hiding in France for decades were detained in France in 2021. The terrorists 
were escaping terrorism convictions in Italy and were convicted on terrorism charges 
linked to bombings, kidnappings and assassinations perpetrated between the late 
1960s and early 1980s. Five of them belonged to the left-wing terrorist group Brigate 
Rosse. The arrests came after high-level government meetings.   

 Convictions and penalties for left-wing terrorism offences 

While in 2020 the convictions and acquittals for left-wing terrorism related offences 
were the second largest in the EU, in 2021 such convictions were reported only by 
Germany and Greece. They concerned activities related to Devrimci Halk Kurtulus 
Partisi-Cephesi (DHKP-C, ‘Revolutionary People’s Liberation Party-Front’), the Organosi 
Epanastatikís Aftoámynas (OEA, ‘Organisation for Revolutionary Self-Defense’) and 
Epanastatikos Agonas (‘Revolutionary Struggle’). All defendants appearing before the 
courts were convicted. 

Left-wing and anarchist extremist incidents and activities  

Incidents and activities 

In 2021 there have been numerous violent left-wing and anarchist extremist incidents, 
which were not classified as terrorist attacks. The modus operandi used to execute the 
attacks and incidents reported in 2021 is similar to that observed in previous years, 
including incendiary attacks on infrastructure or on private companies. France noted 
an increase in incendiary attacks over the last years, with 30 attacks on communication 
infrastructure and 16 attacks on private companies in 2021. In Spain, Greece and Italy, 

90 The group has been dismantled in 2019 following a law enforcement counter-terrorism 
operation. 
91 Europol information.  
92 Ministerio del Interior, 11.10.2021, The National Police detains a member of the Shining Path 
terrorist organisation in Madrid/ ‘La Policía Nacional detiene en Madrid a un miembro de la 
organización terrorista Sendero Luminoso’, accessible at 
https://www.interior.gob.es/opencms/eu/detalle/articulo/La-Policia-Nacional-detiene-en-
Madrid-a-un-miembro-de-la-organizacion-terrorista-Sendero-Luminoso/.    

| 63 

 
 
 
– TE-SAT 2022 

numerous cases of material damage caused by left-wing and anarchist extremists were 
registered in 2021. Attacks on communication infrastructures are particularly 
motivated by the fact that they are perceived as a symbol of a digital economy, in 
which the state can monitor everything. 

In most cases, arson was the means used in the attacks and fires usually started with 
flammable liquids, IEDs and IIDs, such as Molotov cocktails. In addition, considerable 
property damages and bodily injuries were regularly caused at demonstrations and 
marches in several Member States.  

Criminal activities linked to the violent left-wing and anarchist extremist environment 
are generally assessed as not particularly costly, given their weapons of choice in 
attacks. Some financial resources originate from fundraising, donations, musical 
concerts, affiliated associations and the selling of books, magazines and merchandise.  

Very often, violent left-wing and anarchist extremist activity was connected to a 
specific campaign or was initiated to demonstrate solidarity with domestic and 
international like-minded prisoners. In some cases, left-wing and anarchist extremists 
claimed responsibility for their actions, which sometimes happened on the spot, 
especially using spray painting (graffiti). Nonetheless, in most cases left-wing attacks 
were claimed online, on dedicated websites or through other social media platforms. 
The multiple national Indymedia affiliated websites are widely used for that purpose, 
next to a range of other platforms. 

The violent left-wing and anarchist extremist scene displays a high level of security 
awareness. For example, instructions on how to avoid leaving traces of organic 
material during criminal activities and other precautionary measures to take in order 
not to be arrested are being disseminated on left-wing and anarchist extremist 
websites. It was also observed that despite having a good level of technological and IT 
expertise, left-wing and anarchist extremists limit their use of technological tools to 
the utmost degree to avoid detection and infiltration by law enforcement agencies.  

| 64 

 
– TE-SAT 2022 

Main targets of left-wing and anarchist terrorist attacks and 
extremist incidents in the EU are currently 

►  Critical infrastructures, such as 5G antennas and cell towers  

►  Individuals from the right-wing extremist scene, their private properties 

and places of gathering  

►  Government agencies and their personnel 

►  Diplomatic premises 

►  Political parties premises and politicians (especially from the conservative 

and right-wing sphere), including their private properties  

►  Journalists and media offices  

►  Bank offices and ATMs 

►  Construction sites  

►  Employers’ associations  

►  Companies  

o 

Involved in technology, housing and real estate, energy, 
construction, automobile, logistics 
o  Part of the prison system supply chain 
o 
o  Associated with countries considered responsible for  

Involved in the repatriation of migrants  

perceived injustices 

o  Believed to profit from military conflicts 

One important area of activism for the anarchist scene in some Member States is the 
creation of ‘free autonomous spaces’ (in French speaking areas ‘zone à défendre’, ZAD) 
in the hope of establishing communities where they can live ‘free’ of state repression 
and of the influx from capitalism. At the same time, these spaces can serve violence-
oriented left-wing and anarchist extremists as a base for their criminal activities and as 
a hideout. As anarchists do not acknowledge the authority of the state, public order 
and ownership of property, they sometimes occupy houses or other premises. This 
takes place especially when rental agreements expire, when property is sold to new 
owners or when neighbourhoods undergo restructuring. When measures are taken by 
private owners or the government to vacate these claimed premises, this often 
provokes an extremely aggressive response from violence-oriented anarchist 
extremists. Arson attacks, damages to vehicles and the machinery of real estate and 
construction companies, and personal threats to those deemed responsible for 
vacating the properties have been observed. This has been intended to influence 
political or commercial decision making. The mere presence of police or journalists 
near those occupied areas has the potential to provoke violent attacks by the 
anarchists. 

Doxxing (also doxing), while not purely a left-wing phenomenon, is an increasingly 
common way for left-wing and anarchist extremists to out right-wing extremists, 
conservative and right-wing politicians, journalists, and government personnel such as 
police officers. Doxxing refers to the collection of private and sensitive information, 
such as names, addresses and other personal data, and the publication of this 
information usually on the Internet and without consent. The publication of such 
sensitive data constitutes a great risk to the personal safety of the victims and their 
relatives, as it might inspire left-wing and anarchist extremists to physically attack or 

| 65 

– TE-SAT 2022 

threaten the concerned individuals or damage their property. For that purpose, left-
wing and anarchist extremists use websites, blogs, and other social media platforms. 

In July 2021, the Greek anarchist group ‘Organisation Anarchist Action’ published 
the names and home addresses of 21 police officers serving in various Police 
Departments in Thessaloniki, Greece on an anarchist website93.  

Increasing use of violence within the left-wing and anarchist extremist 
scene in some Member States 

There is growing concern within some Member States about an 
increased propensity towards violence within the left-wing and 
anarchist extremist scene. 

This was particularly visible in cases of unprovoked violence against right-wing 
extremists, as well as police forces, during otherwise peaceful demonstrations, such as 
those against government measures to contain COVID-19. The surveillance and 
targeting of victims by small clandestine groups is an exemple of how violence can take 
a more organised form and may be integrated in the strategies of left-wing extremists 
and terrorists.  

In one case in May 2021, the German Federal-Prosecutor General indicted four 
German citizens on charges that included membership in a terrorist group adhering 
to a militant left-wing ideology. This ideology revolved around concepts such as the 
rejection of the democratic state of law, the fundamental right to freedom of 
expression and the opposition to the state’s monopoly of the use of force. Between 
late 2018 and February 2020, members of the group carried out attacks causing 
property damage and considerable injuries to individuals identified as belonging to 
the right-wing scene. These attacks were usually preceded by intensive 
preparations, including the surveillance of the targets94. According to open sources, 
in September 2021, approximately 3 500 people from the left-wing and anarchist 
extremist scene in Leipzig demonstrated in solidarity with the female head of the 
terrorist group. During the demonstration, bank offices, a police station and police 
personnel were attacked with brick stones, bottles and pyrotechnics. Several 
protesters were carrying a large-scale banner, exposing the name of the head of 
the Saxony police centre for counter-terrorism and threatening his life in a 
reference to the prominent 1977 murder of the head of the German Employers 

93 Policenet, 16.7.2021, Anarchists have declared and are threatening 21 police 
officers/‘Αναρχικοί επικήρυξαν και απειλούν 21 αστυνομικούς’, accessible at 
https://www.policenet.gr/article /αναρχικοί-επικήρυξαν-και-απειλούν-21-αστυνομικούς. 
94 German Federal Prosecutor-General’s Office press release, 28.5.2021, Charges brought against 
four suspected members of a left-wing extremist criminal organization/‘Anklage gegen vier 
mutmaßliche Mitglieder einer linksextremistischen kriminellen Vereinigung erhoben’, accessible 
at 
https://www.generalbundesanwalt.de/SharedDocs/Pressemitteilungen/DE/aktuelle/Pressemitt
eilung-vom-28-05-2021.html; ibid., 9.8.2021, Further charges brought against Lina E./‘Weitere 
Anklage gegen Lina E. erhoben’, accessible at 
https://www.generalbundesanwalt.de/SharedDocs/Pressemitteilungen/DE/aktuelle/Pressemitt
eilung-vom-09-08-2021.html. 

| 66 

 
 
– TE-SAT 2022 

Association by the left-wing terrorist group Rote Armee Fraktion (RAF, ‘Red Army 
Faction’)95. 

In October 2021, two German nationals aged 22 and 26 were sentenced to prison 
for public order offences and serious bodily harm perpetrated with dangerous 
means. The two have been charged with having seriously injured members of an 
employees’ representative body in Stuttgart, Germany, who were on their way to a 
demonstration against the government measures to tackle COVID-19 in 2020.   

Groups and structures  

Most left-wing and anarchist affiliated attacks and incidents were perpetrated by 
groups of people. In general, the relationship between the members of left-wing 
groups is based on bonds of close affinity, which is crucial for minimising the risk of 
discovery by the police when carrying out attacks. While the majority of actors 
involved in violence are young and generally male, their profile varies in terms of 
nationality, ethnicity and social background. Most of the left-wing and anarchist 
extremist activities in the EU are concentrated in the large urban centres and their 
surrounding metropolitan areas. Much less activity is being detected in rural areas. 

Albeit adhering to various ideologies, violent left-wing and anarchist extremist groups 
often work closely together and overlap in personnel. 

The majority of left-wing violent extremists in Member States adhere to the Marxist-
Leninist ideology. They want to achieve a revolutionary change in the current political 
and economic system and establish a socialist alternative to capitalism, eventually 
leading to communism. The left-wing extremist scene relies on structured groups, 
often with prominent leaders.  

The anarchist extremist scene, also referred to as autonomous or insurrectionary, 
advocates for a life free from rules and rejects authority, the existing political order 
and societal norms. Its objective is to carry out violent actions and to destabilise the 
social order. They are characterised by a strong tendency towards violence and 
destruction. Especially during demonstrations, anarchists, often loosely falling under 
the umbrella term of the anti-fascist movement (Antifa), actively start and engage in 
violent confrontations with perceived opponents and police forces, sometimes making 
use of dangerous weapons. The common choice of clothing for the anarchist scene is 
completely black, very often covering their faces to prevent prosecution. The scene has 
no prominent leader figures, consists of unstructured groups and it is an informal and 
rather loose movement with flexible membership. This entails greater difficulty for law 
enforcement in identifying groups and individuals.  

95 Welt, 19.9.2021, Death threat against Soko boss at left demo – videos are supposed to convict 
perpetrators/‘Morddrohung gegen Soko-Chef bei linker Demo – Videos sollen Täter überführen’, 
accessible at https://www.welt.de/politik/article233883050/Leipzig-Morddrohung-gegen-Soko-
Chef-Videos-sollen-Taeter-ueberfuehren.html. 

| 67 

 
 
 
– TE-SAT 2022 

International networking 

International networking and collaboration is an important feature 
within the left-wing and anarchist extremist scene. There are 
worldwide connections and contacts, and left-wing extremists and 
anarchists pay close attention to developments regarding their causes 
in other countries. 

This is highlighted when campaigns are being propagated and attacks are being carried 
out in solidarity with fellow left-wing extremist groups or individuals abroad. Such 
campaigns often appear to be instigated online, whereas one group issues a call for 
action, inviting like-minded people to perpetrate actions in support of their cause. 
While physical travel was limited by the COVID-19 restrictions, it did occur that 
individuals in the violent left-wing extremist movement travelled to other EU countries 
to take part in demonstrations, concerts and opinion-building activities together with 
like-minded actors and organisations.  

Within Europe, cross-border connections appear to have either a regional or a 
common language dimension. The left-wing and anarchist extremist circles of Italy, 
Greece, France and Spain foster close connections as well. Close collaboration was 
observed between Nordic left-wing extremist groups in Sweden, Norway and 
Denmark. Likewise, left-wing supporters in Germany and German-speaking countries 
such as Austria and Switzerland seem to have closer contacts.  

Outside the EU, strong ties exist with groups in Latin America, such as Chile, Argentina 
and Mexico. In this sense, the developments in extremist groups abroad often 
constitute a driving force behind the launch of solidarity campaigns and subsequent 
extremist actions within the EU. More violence-prone left-wing and anarchist extremist 
groups from other countries could exert a negative influence on their EU counterparts.  

Support for the Kurdish cause and paramilitary activities 

Left-wing extremists from Member States have travelled to the Kurdish-populated 
regions in north-east Syria and northern Iraq where they received military training 
(weapons and explosives) within the Yekîneyên Parastina Gel (YPG, ‘People’s 
Protection Units’) militia and some even took part in the fighting. Given the training 
and the battle experience acquired there, it is assessed that upon their return to the 
EU, such individuals have the potential to carry out violent attacks. Transnational 
training activities have been nonetheless hampered in the last two years by the COVID-
19 restrictions on movements. Support for the Kurdish cause continues to be a main 
source of interest for EU left-wing and anarchist extremists, and various connections 
have been observed with the PKK and YPG. 

Propaganda, radicalisation and recruitment 

Online propaganda is mostly circulated on left-wing and anarchist extremist websites 
and blogs, but also through other social media platforms and web forums. Moreover, 
the extreme left-wing circles form restricted groups in social media and use these 
groups to discuss their ongoing and planned activity. It has also been noted that in 
recent years manuals have been disseminated via the Internet containing detailed 

| 68 

– TE-SAT 2022 

instructions on explosives. Youth centres, universities and student clubs, offices of 
workers’ unions, football stadiums, sport clubs, cafes, restaurants, concerts, 
demonstrations and dance clubs are among the locations where offline propaganda is 
disseminated. Posters, brochures, magazines and stickers are still being used to spread 
left-wing and anarchist narratives as well as spray paintings on public and private 
property.  

Topics on the left-wing propaganda agenda 

In 2021, next to longstanding narratives such as anti-fascism, anti-
racism, anti-capitalism, state repression and workers’ rights, newer 
themes were tackled by left-wing propaganda, many of which with a 
greater potential to attract new followers. Among these themes were 
scientific and technological advancements, such as 5G antennas, social 
injustice, the growing economic gap within society, living costs and 
shortages in housing, especially in bigger European cities and 
metropolitan areas, gentrification, patriarchy, LGBTQ+, women’s rights 
and Black Lives Matter (BLM). 

The shortage of available housing and the drastically increased prices triggered 
protests in the Netherlands.  Left-wing extremist groups did not organise them, but 
used them to propagate their own agenda or to provoke and use violence against the 
police. Discontent with authorities was reflected in narratives linked to the judicial 
system, incarceration or support for prisoners worldwide, as well as perceived police 
brutality.  

Other important topics included environmental issues. While lately eco-extremism was 
also adopted by some right-wing extremists, generally connections to this issue were 
more apparent with left-wing extremism. Common topics in this context are climate 
change, the use of traditional energy sources, such as coal mining and nuclear power, 
the consumption of land through single-family houses, food waste, construction of 
road networks and high-speed rail lines, the use of cars and air pollution. In this 
context, the left-wing and anarchist extremist scene attributes any deterioration of 
climatic conditions and natural disasters to the system of capitalist exploitation of 
natural resources and in particular to companies in the energy sector.   

Animal rights have also been a topic of importance. Violent acts were carried out 
against butcher shops, hunter associations and companies that were perceived to 
exploit animals. In September 2021, the French anti-speciesist96 and anarchist group 
269 Libération Animale occupied a slaughterhouse in Apeldoorn, the Netherlands with 
over 80 extremists, halting production.  

Left-wing propaganda also highlighted current geopolitical crises, such as those in 
Belarus, Ukraine, Israel and Palestine. Criticism against Israel and anti-Israeli rhetoric is 
a looming topic within the left-wing extremist scene and is being highlighted in 
situations where the Israeli-Palestinian conflict flares up on the world stage, as was the 

96 Speciesism refers to the different treatment of individuals of different species. Anti-speciesism 
activists advocates for equal animal rights, ethical treatment, and encourage debates on animal 
liberation.  

| 69 

 
 
– TE-SAT 2022 

case in 2021. The conflict is considered an example of resistance to imperialism. The 
role played by Israel at the international level and, in particular, its perceived 
discriminatory policy against Palestine, pursued with the support of Western 
governments, is often harshly criticised by the left-wing scene.  

Even though the online environment plays an ever-increasing role in the left-wing 
extremist activity, personal contacts and physical meetings remain an important factor 
in the violent left-wing extremist milieu, given their generally high level of security 
awareness and desire to act anonymously. Violent left-wing extremists mainly target 
young individuals perceived as sharing the same ideology as them and often those who 
are associated with actors already active in this environment.  

The impact of the COVID-19 pandemic on left-wing propaganda  
and activities 

COVID-19 and especially the measures implemented by governments in the EU had a 
visible effect on the left-wing and anarchist violent extremist scene. The most obvious 
of these effects was probably the reduced potential to travel and hence to participate 
in demonstrations, rallies or attacks. Fundraising and meeting activities, such as 
concerts, were also dampened by the measures.  

Traditionally, the left-wing and anarchist extremist scene opposes the State and its 
policies, especially when they are of a restrictive nature. However, with the COVID-19 
measures, some factions of the left-wing and anarchist extremist scene appeared to 
have had trouble finding a common point of view: 

►  Some groups and individuals starkly opposed the rights-limiting measures 

such as lockdowns, social distancing, tracking apps and the so-called ‘green 
passes’ proving vaccination status. 

►  Other groups and individuals paradoxically sided with the state and supported 
the measures. One possible explanation for this difference is the positioning 
of right-wing extremist groups and individuals, as well as of conservative 
circles against the restrictive government measures. Left-wing and anarchist 
circles organised counter-protests to the large-scale protests against     
COVID-19 measures in 2021, attended by citizens all over Europe.  

Generally, left-wing and anarchist extremist groups managed to draw some 
momentum from the COVID-19 crisis. Their causes were more visible due to the social 
and economic consequences of lockdowns and other measures. Some propaganda 
attributed the pandemic to capitalism and to climate change, while others claimed that 
the government’s measures to contain COVID-19 are part of a strategy aimed to 
reduce individual freedom and to increase militarisation. Propaganda also pointed out 
how media attention on the phenomenon will overshadow the serious consequences 
on health caused by the technological progress, biotechnology, genetically modified 
organisms, nuclear power and vaccinations. Left-wing and anarchist extremist groups 
also tried to highlight the economic crisis caused by government measures to attract 
people who lost their jobs and livelihoods during the pandemic. 

| 70 

– TE-SAT 2022 

ETHNO-NATIONALIST AND 
SEPARATIST TERRORISM  

ETHNO-NATIONALIST AND SEPARATIST TERRORISM – defined  

Ethno-nationalist and separatist terrorist groups are motivated by nationalism, ethnicity 
and/or religion. Separatist groups seek to carve out a state for themselves from a larger 
country or annex territory from one country to that of another. Left-wing or right-wing 
ideological elements are not uncommon in these types of groups. 

Ethno-nationalist and separatist attacks and arrests 

Attacks and arrests 

26 individuals were arrested in four EU countries (12 in France, 7 in the Republic of 
Ireland, 5 in Germany and 2 in Spain), for involvement in ethno-nationalist and 
separatist activities. The arrests in Spain concerned two Euskadi ta Askatasuna (ETA, 
‘Basque Fatherland and Liberty’) members arrested under suspicion of committing an 
act of sabotage against a bank’s office in 2020 to mark the hunger strike of an ETA 
prisoner. Of the seven suspects arrested in the Republic of Ireland, four were 
associated with the Continuity Irish Republican Army (for the other three suspects, the 
IRA was generally mentioned). All of the suspects arrested in Germany were members 
of the PKK.  No additional data were reported on the suspects arrested in France.  

Most suspects arrested were male (only one female was arrested), between 20 and 62 
years of age, and they were mostly citizens of the countries where they have been 
arrested, with the exception of the five Turkish nationals arrested in Germany97. The 
main offence leading to an arrest was membership of a terrorist group (6), possession 
of facilitating items (3) and other facilitation activity (3)98.  

No 
completed, 
failed or 
folied attack 
carried out 
by ethno-
nationalist 
and 
separatist 
terrorist in 
the EU in 
2021  

97 Age and gender were reported for 14 arrestees, citizenship was reported for 13 and the 
country of birth for nine.   
98 For 12 out 27 arrests, no additional information was provided.  

| 71 

 
 
 
– TE-SAT 2022 

Convictions and penalties for separatist terrorism offences 

Convictions and acquittals for separatist terrorism-related offences were the second 
highest figure in the Member States (40 in total), after convictions and acquittals for 
offences related to jihadist terrorism. Cases of alleged separatist terrorism-related 
offences were concluded by courts in Austria, Belgium, France, Germany, Hungary and 
Spain and concerned ETA and the Partiya Karkerên Kurdistanê (PKK, ‘Kurdistan 
Workers’ Party’). Defendants that appeared before courts on charges related to 

| 72 

 
– TE-SAT 2022 

separatist terrorism were convicted in 82 % of the cases in 2021 (increasing from a    
68 % conviction rate in 2020). 

All PKK-related cases in Belgium resulted in acquittals based on a ruling of the Court of 
Cassation from January 2020 referring to the non-applicability of provisions on 
terrorist offences to acts of armed forces in an armed conflict that is subject to 
international humanitarian law. In contrast, cases in other Member States concluded 
with convictions for terrorist offences.  

In January 2021 in Hungary, for example, two defendants were found guilty of 
financing terrorism and sentenced to two years imprisonment by the Regional 
Court of Appeal of Szeged. The court held that they contributed to PKK’s activity by 
providing logistical and other support. The two were also expelled from the 
territory of Hungary for a period of eight years.  

In another case in Germany, in February 2021 the Higher Regional Court of Koblenz 
convicted a Turkish national of participation in a terrorist organisation abroad and 
sentenced him to two years and three months of imprisonment. He was part of the 
PKK leadership in Europe and was responsible for various PKK areas and regions 
within Germany. 

Germany also reported numerous arrests and convictions for membership or support 
of a foreign terrorist organisation (PKK) in 2021 and trials of leading PKK figures and 
members are still pending. On 30 April 2021, the Higher Regional Court in Stuttgart, 
Baden-Württemberg, sentenced five Turkish nationals to several years in prison for 
membership and/or support of the PKK coinciding with causing bodily harm by 
dangerous means, false imprisonment, attempted coercion and attempted extortion 
with use of force or threat of force. The defendants had kidnapped another PKK 
member in 2018 and, using weapons, had subsequently threatened, beaten and 
interrogated him. The case revolved around missing donated funds. 

In March 2021 in Spain, the National Court handed a 50-year sentence to an ETA 
member found guilty of committing a deadly terrorist attack and a failed 
assassination. The defendant was a leading member of the terrorist organisation. 
The court heard that she provided weapons, money and manuals with instructions 
about handling weapons and explosives to members of an ETA command, who 
following the objectives set by the defendant, decided to commit an attack against 
police officers in Bilbao. The attack took place in January 1995. One of the victims 
of the attack was killed on the spot, while the other victim was severely injured and 
passed away a few years later as a result of his injuries. The defendant was arrested 
in France in 2004. She was also convicted of terrorist offences by a French court in 
November 2010 and sentenced to serve 20 years in prison. 

Ethno-nationalist and separatist groups and structures  

Euskadi ta Askatasuna (ETA)  

In 2021, ETA remained operationally inactive. Despite the announcement of its 
dissolution and disarmament in 2018, one warehouse with explosives and 
ammunitions was discovered in Spain in 2021. 

| 73 

 
Partiya Karkerên Kurdistanê (PKK) 

– TE-SAT 2022 

In the EU, national PKK organisations are coordinated by the Kurdish umbrella 
organisation in Europe, the European Kurdish Democratic Societies Congress (KCDK-E), 
which is based in Belgium.  

In 2021, the PKK remained active in the EU through fundraising events used to finance 
the activities of their members in Europe, Turkey and the Middle East. This was mainly 
achieved through membership fees, sales of publications, income generated from 
events and the annual fundraising campaign (‘Kampanya’). Despite COVID-19 
restrictions limiting physical gatherings to an extent, the PKK continued to participate 
in traditional events (such as the Kurdish New Year and the annual Kurdish festival) 
albeit on a smaller scale. In addition, PKK members were also allegedly involved in 
organised crime activities such as money laundering, racketeering, extortion and drug 
trafficking.   

No PKK terrorist attacks have been reported by Member States during 2021. However, 
numerous violent activities and arrests were reported by Turkey during 2021.  

Although violence appears to be integral to PKK ideology, regular PKK demonstrations 
throughout the EU are typically carried out in a non-violent manner and have not, to 
date, posed a significant terrorist threat to the EU. Nonetheless, one demonstration 
reported by the Netherlands is noteworthy. On 3 December 2021, 44 people who 
travelled from overseas were arrested after trying to enter the offices of the 
Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague, with 
several demonstrators using force. The majority of the demonstrators were of Turkish-
Kurdish background, who were accusing Turkey of using chemical weapons against 
Kurds, particularly in northern Iraq. The protest was organised by the umbrella 
organisation of PKK associations in the Netherlands, based in The Hague, with some 
protestors carrying banners calling for the release of the PKK leader, Abdullah Öcalan.  

Abdullah Öcalan has been detained in a Turkish prison since 1999. Any deterioration in 
his situation, particularly in his health, could trigger reactions from PKK supporters in 
the EU holding Turkey responsible. Such reactions could materialise in attacks or 
damage to the property of Turkish institutions in Europe or large-scale demonstrations 
and confrontations between Turkish and Kurdish nationalists. 

Northern Ireland - Dissident Republican (DR) groups 

In Northern Ireland, the main terrorist threat emanates from two groups: the new Irish 
Republican Army (nIRA) and Continuity Irish Republican Army (CIRA). The nIRA 
continued to be the dominant group and remained engaged in attack planning, while 
the threat from CIRA was largely localised to small geographic areas of Northern 
Ireland. Both groups rely on a support network of members active in Northern Ireland 
(UK) and the Republic of Ireland. No terrorist attacks were perpetrated by DR groups in 
the Member States.  

Disruption by law enforcement and the COVID-19 restrictions has had a suppressive 
effect and the number of attacks in Northern Ireland continued to drop, with two 
failed attacks on national security targets reported in 2021. In mid-March 2021, a 
shooting was directed at Enniskillen police station using a homemade firearm. No 
casualties were reported and the CIRA was allegedly involved in this incident. In April 
2021, an IED was deployed targeting an off duty police officer in Dungiven, however 

| 74 

– TE-SAT 2022 

the device failed to function. The attack was believed to have been conducted by the 
nIRA99.  

Both the nIRA and CIRA maintained the intent and capabilities to conduct attacks, with 
police, military and prison officers as the preferred targets. The weapons generally 
used by DR groups included firearms or small IEDs (such as pipe bombs), but they have 
also deployed larger and potentially more destructive devices such as vehicle borne 
IEDs and explosive projectiles. In 2021, pipe bombs were found during investigations 
into terrorism-related offences, but also in other cases where a link to terrorism could 
not be confirmed. 

DRs and other paramilitary groups (both republicans, supporting Ireland’s unity and 
independence as a republic, and loyalists, opposing Irish independence from the UK) 
continued to engage in violence and intimidation against their own communities. Their 
activities included minor and serious criminality, such as drug trafficking, extortion, 
fuel laundering100 and murder.  

Loyalist paramilitary groups remain concerned by the repercussions of the UK’s exit 
from the EU. There is a growing perception in the loyalist community that their identity 
and culture is under threat. Following serious public disorder across Northern Ireland 
in late March and early April 2021, which resulted in injuries to over 100 police 
officers, protests have reduced significantly. However, localised incidents continued to 
take place at times of increased tension, and the Loyalist Communities Council (LCC) 
and the Ulster Volunteer Force’s political wing, the Progressive Unionist Party (PUP), 
have withdrawn support for the 1998 Good Friday Agreement. 

99 Contribution from non-EU Partner country.  
100 Fuel laundering is a type of excise fraud, in which subsidised agricultural-grade diesel is 
filtered through chemicals to remove identification markers and the resulting product is sold on 
as regular fuel.  

| 75 

 
 
– TE-SAT 2022 

OUTLOOK ON POTENTIAL 
DEVELOPMENTS IN 
TERRORISM AND VIOLENT 
EXTREMISM IN THE EU 

Forecasting developments in the terrorism situation in the EU is not within the scope 
of the TE-SAT. Nevertheless, awareness of societal factors that may impact the 
terrorism landscape in the EU is important to highlight potentially significant changes. 
This edition of the TE-SAT is the first to include a look into the broader external 
environment and the effects that it may have on terrorism and (violent) extremism in 
the EU.  

(Geo-) political instability 

Political shifts in Member States may be used by violent extremist groups and 
individuals to fuel terrorist and extremist narratives, and could instigate followers to 
use violent means to pursue their political objectives. 

Political instability outside the EU could exacerbate the terrorist threat from within 
the EU, materialising in a surge in the activity of terrorist groups, an increase in online 
propaganda and the strengthening of recruitment efforts that may spread to Member 
States. This is particularly the case for jihadist terrorism. Potential developments in key 
regions where jihadist terrorist groups are active represent sources of concern for the 
future.  

Foreign fighters returning from conflict areas may engage in violence, spreading 
terrorist propaganda and recruiting followers in Member States, and may attempt to 
orchestrate attacks in the EU.  

Disinformation campaigns associated with the Russian war of aggression against 
Ukraine may mobilise consumers of the Russian propaganda, while online (social) 
media can be used by different groups and individuals to discuss joining the fight and 
financing violent activities.  

The uncertain socio-economic situation in the EU 

Although social, political and economic inequalities are neither necessary nor sufficient 
to fuel radicalisation process among individuals, violent extremist groups may use 
(perceived) inequalities to promote divisive messages, and exacerbate polarisation and 
further violent extremism in societies.  

Inflation within the Eurozone, and especially the increasing cost of living, combined 
with the new challenges to the EU’s economy posed by the Russian war of aggression 

| 76 

against Ukraine101, may be used as leverage in terrorist and violent extremist groups’ 
propaganda to promote their narratives and undermine societal shared values.  

– TE-SAT 2022 

Digital society and advanced technologies 

The online environment is used by violent extremists and terrorists of all ideologies, to 
connect, share instructions, issue propaganda and recruit new followers. This is likely 
to become a more frequent occurrence, as new platforms emerge and more users are 
attracted and exposed to extremist narratives. Encrypted communication platforms 
will further diversify. The opportunities made available by the online environment may 
also influence the types of activities in the extremist and terrorist scene. Terrorist and 
violent extremist groups may resort to new violent tactics and techniques of 
intimidation, including virtual mobilisation campaigns, ransomware attacks or new 
forms of online sabotage.  

New types of weapons may be used in complementarity with more traditional 
instruments observed so far in terrorist and violent extremist attacks. The popularity of 
3D printed weapons may grow amongst adherents of various ideologies. The COVID-19 
pandemic may have refocused attention on biological weapons such as viruses102. 
Increased use autonomous vehicles may increase security vulnerabilities, for instance 
as they can target locations for attacks based on remote commands. Despite its 
potentiality in counter-terrorism, augmented reality may also be exploited by terrorists 
and violent extremists to facilitate remote training activities103. 

Technological and scientific advancements are often opposed in particular by left-
wing and anarchist extremist circles. Further developments, including the introduction 
of 5G technology, the use of gene-technology for food production or the research and 
developments in artificial intelligence, are likely to be even more recurrently included 
and opposed in these groups’ propaganda.  

The lasting impact of COVID-19 

The medium to long-term effects of the COVID-19 pandemic are challenging to assess 
due to the multitude of factors at play and the persistent uncertainty with regard to 
their evolution. Strains associated with pandemic-linked restrictions may act as a 
stressor and create pressure for corrective measures, and developing extreme views 
and potentially engage in violent actions of extremist nature may be one possible 
response.   

Similarly, extremists may exploit the societal effects of the COVID-19 pandemic to 
further incentivise disillusionment towards the society. This may be particularly utilised 

101 European Commission, 16.5.2022, ‘Spring 2022 Economic Forecast: Russian invasion tests EU 
economic resilience’ accessible at https://ec.europa.eu/info/business-economy-euro/economic-
performance-and-forecasts/economic-forecasts/spring-2022-economic-forecast_en.   
102 NATO Parliamentary Assembly, 10.10.2021, Sub-Committee on Technological Trends and 
Security (STCTTS),  BIOLOGICAL THREATS: TECHNOLOGICAL PROGRESS AND THE SPECTRE OF 
BIOTERRORISM IN THE POST-COVID-19 ERA’, accessible at https://www.nato-pa.int/download-
file?filename=/sites/default/files/2021-10/024%20STCTTS%2021%20E%20rev.%201%20fin%20-
%20%20BIOLOGICAL%20THREATS%20-%20ALLESLEV.pdf.  
103 Office of the Director of National Intelligence, March 2021, ‘Global Trends 2040, The future of 
terrorism: Diverse actors, fraying international efforts’, accessible at 
https://www.dni.gov/index.php/gt2040-home/emerging-dynamics/international-dynamics/the-
future-of-terrorism.   

| 77 

 
 
by right-wing extremists that seek societal collapse, or left-wing extremists that 
disagree with government policies.  

– TE-SAT 2022 

Climate change 

Environmental developments might have an influence on the, albeit small, faction of 
eco-fascists within the right-wing extremist spectrum. Climate change may deepen 
dystopic views that some right-wing extremists are emphasising, such as the collapse 
of current societal systems, social-Darwinist ideas of the survival of the fittest, and the 
preservation of humankind. 

| 78 

– TE-SAT 2022 

ANNEXES 

Amendments to national legislation on terrorism in 2021 

Austria 

Finland 

France 

As part of the Federal Law on Counter Terrorism (Federal Law Gazette I No. 159/2021), 
several provisions of the Austrian Criminal Code were amended with the aim of 
improving the prevention and combating of terrorism. The amendments entered into 
force on 1 September 2021.  

The amendments concern the provisions on extended forfeiture (§ 20b para 2a), 
adding an aggravating circumstance when committing a crime based on religiously 
motivated extremism (§ 33 para 1 fig 5a), adding an aggravating circumstance when 
committing money laundering (§ 33 para 3), amending the provision on money 
laundering (§ 165) and implementing a new provision focusing on religiously motivated 
extremist groups (§ 247b). 

The Finnish legislation on terrorist offences was complemented with a new provision 
regarding the financing of an individual terrorist (Criminal Code, Chapter 34a, 
paragraph 5a). At the same time, the provision regarding the financing of a terrorist 
group became paragraph 5b of Chapter 34a of the Criminal Code, and minor changes 
in the wording of that paragraph were made. The purpose of the changes is to clarify 
the requirement that a financer has to have an intention to finance or is aware of the 
fact that the assets given or gathered by him are used to finance a terrorist group. The 
sentencing scale regarding the financing of a terrorist group was also amended to be 
uniform with the sentencing scales of other terrorist offences. Lastly, technical 
revisions to Chapter 34a were made due to the implementation of the new provision 
regarding the financing of an individual terrorist. 

A recent reform was introduced by the law of 30 July 2021 with the creation of a 
judicial measure for the prevention of terrorist recidivism and of social reintegration. 
This new measure relies on a multidisciplinary approach and can be autonomously 
ordered, irrespective of the sentence imposed or the part of the sentence already 
served. It is applicable to terrorist convicts sentenced to a custodial sentence higher 
than or equal to 5 years and requires demonstrating, at the end of the detention 
period, that the convicted person presents a particular dangerousness characterised 
by a very high probability of recidivism and by a persistent adherence to an ideology or 
to theses inciting the commission of acts of terrorism. It also requires proof that the 
convicted person was, during the execution of his sentence, in a position to benefit 
from measures likely to promote his social reintegration. This measure, which includes 
a list of social, psychological and educational obligations, can be imposed for a 
duration of one year, and is renewable for five years. Among the priorities set in this 
multidisciplinary approach, the speaker highlighted the individualised work and follow-
up done by a variety of judicial and social actors in relation to the long-term terrorist 
convicted on identity discourses and anti-hatred narratives, sharing of knowledge on 

| 79 

– TE-SAT 2022 

religion and reflection on citizenship and role in the society. This new legislation results 
in a change of focus in the judicial treatment of prison leavers, with a greater 
prioritisation of the social reintegration of long-term terrorist convicts upon their 
release with the objective of preventing recidivism. 

Hungary 

Section 182 (3) of Act CXXXIV of 2021 on the amendment of certain acts regulating 
criminal matters and on other acts relating thereto, introduced an additional 
subsection to Section 298 of Act XC of 2017 on Criminal Proceedings. A subsection (4) 
was added, with the following wording: ‘(4) The maximum term of pre-trial detention 
specified by Subsection (1) e) is lengthened with another one year period if, […] c) an 
indictment has been filed for the felony of act of terrorism.’ 

Malta 

Act No. L of 2021, the Criminal Laws (Combating Terrorism) (Amendment) Act, 2021, 
passed by the House of Representatives on 14 July 2021, introduced various 
amendments to the Criminal Code and to the Victims of Crime Act.  

In Chapter 9 of the Criminal Code, sub-article (2) of article 328A, which lists the acts of 
terrorism, the word ‘radiological’ was added after the word ‘biological’ in paragraph 
(f), concerning the manufacture, possession, etc., of weapons. In paragraph (g), 
concerning research into and development of weapons, the words ‘radiological, 
nuclear’, were added immediately after the words ‘of biological’. 

Article 328C of the Criminal Code was amended as follows:  

(a) in paragraph (c) of sub-article (2), immediately after the words ‘another person’ the 
words ‘or self-studies’ were added. Immediately after sub-article (6) of article 328C, 
two new sub-articles (7) and (8) were introduced: ‘(7) For the purpose of ensuring the 
removal of online content hosted outside the territory of Malta, which online content 
constitutes a public provocation to commit terrorist activities as defined in sub-article 
(2)(a), the Police may request internet service providers hosting such online content to 
remove such online content. The request communicated to the internet service 
provider shall contain reasoned grounds for which such a request was made. (8) Any 
decision taken by the Police in accordance with sub-article (7) may be challenged in 
terms of article 469A of the Code of Organisation and Civil Procedure.’ Some technical 
revisions were made to articles 328D and 328F. 

In Chapter 539 of the Victims of Crime Act, amendments were made to articles 2, 10, 
12 and 13. In article 2, paragraph (a) on the definition of ‘victim’, immediately after the 
words ‘directly caused by a criminal offence’, the words ‘including harm from terrorist 
activities’ were added. In the proviso to article 10, the words ‘reference to the victim.’ 
were substituted by the words ‘reference to the victim:’ after which a new proviso was 
added: ‘Provided further that the severity and circumstances of the offence shall be 
taken into consideration when granting legal aid to the victim.’. Article 12, paragraph 
(c) was amended by the following: (a) the words ‘victim support services’ were 
substituted by the words ‘for victim support services, as long as necessary,’; and (b) in 
sub-paragraph (vi), immediately before the words ‘medical treatment’ the word 
‘immediate’ was added. Article 13 was amended as follows: (a) in the proviso to sub-
article (1), immediately after the words ‘access to victim support services’, the words 
‘as provided in article 12’ were added; and (b) in sub-article (3), immediately after the 
words ‘free of charge’ the words ‘, easily accessible’ were added. 

| 80 

– TE-SAT 2022 

Portugal 

Law 52/2003 of 22 August on combatting terrorism was amended to include, in Article 
4 (2), the crime of aggravated theft, robbery, extortion, computer and communication 
fraud, abuse of a guarantee card or a debit card, payment device or data, computer 
fraud, counterfeiting of cards or other payment devices, use of counterfeit cards or 
other payment devices, acquisition of counterfeit cards or other payment devices, 
preparatory acts for counterfeiting or forgery of a document to commit the facts set 
out in Article 2(1) concerning terrorist organisations. The amendments were 
introduced in transposition of Directive (EU) 2019/713 of the European Parliament and 
of the Council of 17 April 2019 on combating fraud and counterfeiting of non-cash 
means of payment and replacing Council Framework Decision 2001/413/JHA. 

Slovenia 

Amendments to Articles 109 (Financing of terrorist activities) and 111 (Conscripting 
and training for terrorist activities) of the Criminal Code of the Republic of Slovenia 
(hereinafter KZ-1) were introduced in 2021 (Official Gazette of the Republic of 
Slovenia, No. 186/21 of 30 November 2021). Concerning the amendment to Article 109 
of the KZ-1, since the previous wording of the first paragraph of Article 109 of the KZ-1 
only defined as a criminal offence the provision or collection of funds with the 
intention that they will be used for financing the commission of criminal offences 
specified therein, the description of the criminal offence is supplemented, in line with 
the requirements of the International Convention, with the provision or collection of 
funds with the knowledge that they will be used for such offences. With regard to the 
proposed amendments to Article 111 of the KZ-1, a change is introduced in Article 
111(1) of the KZ-1, which, inter alia, criminalises incitement or recruitment to commit 
the offences referred to in Article 108 (Terrorism) of the KZ-1. In addition, some 
terminological changes to Article 111(2) and (3) of the KZ-1 have been proposed, 
resulting from the partly inadequate translations of international documents. 

| 81 

 
– TE-SAT 2022 

Completed, failed and foiled attacks in 2021 per Member 
State and per affiliation 

This annex contains statistical information on terrorist attacks in 2021 in the EU as 
reported to Europol by Member States.  

MEMBER 
STATES 

JIHADIST 
TERRORISM 

RIGHT-
WING 
TERRORISM 

LEFT-WING AND 
ANARCHIST 
TERRORISM 

ETHNO-NATIONALIST 
AND SEPARATIST 
TERRORISM 

OTHER 

TOTAL 

Austria 

Belgium 

Denmark 

France 

Germany 

Hungary 

Spain 

Sweden 

1 

5 

2 

1 

1 

1 

TOTAL 

11 

1 

1 

1 

3 

1 

1 

1 

1 

1 

5 

3 

1 

1 

2 

15 

MEMBER 
STATES 

JIHADIST  
TERRORISM 

RIGHT-WING TERRORISM 

Completed 

Foiled 

Failed 

Completed 

Foiled 

Failed 

LEFT-WING AND 
ANARCHIST TERRORISM 
Failed 
Completed 

Foiled 

TOTAL 

Austria 

Belgium 

Denmark 

France 

Germany 

Hungary 

Spain 

Sweden 

1 

1 

1 

TOTAL 

3 

1 

4 

1 

1 

1 

8 

1 

1 

2 

1 

1 

1 

1 

1 

5 

3 

1 

1 

2 

1 

1 

15 

| 82 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
– TE-SAT 2022 

Arrests in 2021 per Member State and per affiliation 

This annex contains statistical information on terrorist arrests in 2021 in the EU as 
reported to Europol by Member States.  

MEMBER 
STATES 

JIHADIST 
TERRORISM 

RIGHT-
WING 
TERRORISM 

LEFT-WING 
AND 
ANARCHIST 
TERRORISM 

ETHNO-
NATIONALIST 
AND SEPARATIST 
TERRORISM 

OTHER 

NOT 
SPECIFIED 

TOTAL 

Austria 

Belgium 

Croatia 

Cyprus 

Denmark 

Finland 

France 

Germany 

Greece 

Hungary 

Ireland 

Italy 

Netherlands 

Poland  

Portugal 

Romania 

Spain 

Sweden 

23 

18 

6 

9 

96 

24 

4 

2 

4 

14 

15 

2 

2 

39 

2 

3 

6 

5 

29 

3 

1 

18 

1 

3 

1 

12 

5 

7 

3 

1 

6 

3 

2 

1 

5 

2 

1 

2 

3 

2 

2 

1 

24 

32 

2 

6 

9 

5 

140 

34 

6 

2 

14 

40 

17 

3 

2 

2 

3 

3 

TOTAL 

260 

64 

19 

26 

5 

14 

388 

| 83 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
– TE-SAT 2022 

Convictions and penalties 

This annex contains statistical information on concluded court proceedings for terrorist 
offences in 2020, as reported to Eurojust. It highlights some key figures and, where 
relevant, compares those with the figures for previous years. 

Number of convictions and acquittals for terrorist offences per Member State in 
2019, 2020104 and 2021105, as reported to Eurojust 

MEMBER STATE 

2019 

2020 

Austria 

Belgium 

Bulgaria 

Czechia 

Denmark 

Finland  

France 

Germany 

Greece 

Hungary 

Italy 

Latvia 

Lithuania 

Malta 

Netherlands 

Portugal 

Romania 

Spain 

Sweden 

40 

91 

- 

- 

4 

- 

105 

53 

45 

6 

17 

- 

- 

- 

56 

1 

- 

97 

5 

20 

52 

2 

2 

4 

2 

155 

67 

12 

4 

42 

- 

1 

1 

20 

2 

3 

32 

1 

TOTAL 

520 

422 

2021 

37 

107 

1 

- 

5 

- 

107 

55 

4 

10 

10 

1 

- 

- 

35 

- 

- 

51 

- 

423 

104 The data for the previous years corresponds to the data reported in the respective  
TE-SAT reports. 
105 Eurojust received contributions containing information on terrorism-related convictions and 
acquittals in 2021 from the following Member States: Austria, Belgium, Bulgaria, Denmark, 
France, Germany, Greece, Hungary, Italy, Latvia, Netherlands and Spain. The statistics for France 
is based on first instance judgments only. 

| 84 

 
 
 
 
 
Number of convictions and acquittals in 2021 per Member State and per type of 
terrorism, as reported to Eurojust 

MEMBER STATES 

JIHADIST 

SEPARATIST 

RIGHT-WING 

LEFT-WING  NOT SPECIFIED 

TOTAL 

– TE-SAT 2022 

Austria 

Belgium 

Bulgaria 

Denmark 

France 

Germany 

Greece 

Hungary 

Italy 

Latvia 

Netherlands 

Spain 

35 

100 

5 

83 

38 

1 

9 

33 

36 

TOTAL 

340 

1 

3 

6 

13 

2 

2 

15 

40 

1 

4 

9 

3 

1 

1 

4 

1 

9 

7 

1 

37 

107 

1 

5 

107 

55 

4 

10 

10 

1 

35 

51 

15 

5 

23 

423 

| 85 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Number of convictions and acquittals per Member State in 2021,  
as reported to Eurojust 

MEMBER STATES 

CONVICTIONS 

ACQUITTALS 

TOTAL 

ACQUITTALS IN % 

– TE-SAT 2022 

Austria 

Belgium 

Bulgaria 

Denmark 

France 

Germany 

Greece 

Hungary 

Italy 

Latvia 

Netherlands 

Spain 

24 

95 

1 

5 

99 

55 

4 

10 

8 

1 

26 

34 

TOTAL 

362 

Europol CT activities 

13 

12 

- 

- 

8 

- 

- 

- 

2 

- 

9 

17 

61 

37 

107 

1 

5 

107 

55 

4 

10 

10 

1 

35 

51 

423 

35 % 

11 % 

0 % 

0 % 

7 % 

0 % 

0 % 

20 % 

20 % 

0 % 

26 % 

33 % 

14 % 

First-line investigative support: the European Counter Terrorism Centre  

In support of Member States’ fight against terrorism, the European Counter Terrorism 
Centre (ECTC) was established at Europol in early 2016, ensuring a coherent and 
comprehensive response to the constantly changing terrorism threat in the EU. To 
enhance the capabilities of the EU counter terrorism (CT) authorities, the ECTC builds 
on already existing tools at Europol and also develops new ones to address the 
emerging needs of its stakeholders. The ECTC’s established counter terrorism networks 
also facilitate the exchange of knowledge and best practices, aiding competent 
authorities in their fight against terrorism. 

Providing effective support to Member States’ CT authorities is the main task of ECTC. 
In order to do so, the ECTC has developed a four-pillar approach: 

►  Facilitation of information exchange between the ECTC and competent 

authorities from Member States as well as Third Parties, by means of secure 
intelligence sharing platform; 

| 86 

– TE-SAT 2022 

►  Facilitation of cross-border cooperation and provision of coordination, in-

house expertise as well as operational and analytical support to investigations 
in Member States; 

►  Addressing the dissemination of terrorist and violent extremist propaganda 

and the use of social media for radicalisation purposes; 

►  Central strategic support capability to identify European-wide counter 

terrorism implications and promote outreach with relevant (international) 
partners. 

Facilitation of information exchange between the ECTC and competent 
authorities from Member States as well as Third Parties, by means of a 
secure intelligence sharing platform 

The main task of the ECTC is to facilitate counter terrorism information exchange 
among law enforcement authorities from all Member States as well as Third Parties. 
This information exchange is facilitated via Europol’s intelligence sharing platform 
which ensures secure transmission of information among the parties connected106. 

Facilitation of cross-border cooperation and provision of coordination, in-
house expertise as well as operational and analytical support to 
investigations in Member States 

The ECTC has developed and offers custom-made support to Member States’ 
investigations with a diverse set of services and products. 

The dedicated teams of CT specialists and analysts within ECTC deliver operational 
analysis in support of the investigations conducted by the competent authorities of the 
Member States and Third Party countries, harnessing facial recognition technology and 
specific data analysis techniques, such as link analysis, social network analysis, 
geospatial analysis and timeline analysis. The ECTC also utilises the Terrorist Finance 
Tracking Programme (TFTP)107 for the broader purposes of detecting terrorism 
financing, tracking terrorist money flows and assisting in efforts to uncover terrorist 
cells. 

Upon request from competent authorities in Member States, the ECTC can deploy a 
multi-disciplinary team to provide on-the-spot operational support in terrorism 
investigations. The deployed team of CT experts delivers tailor-made services, 
including criminal analysis, on-the-spot technical support (e.g. digital forensics and face 
recognition exploitation), chemical, biological, radiological, nuclear (CBRN) and 
explosives expertise, financial or open source intelligence and expertise on 
propaganda. ECTC experts can also be deployed during action days or in the course of 
major international events. 

106 Member States, Europol and Third Parties with an operational agreement with Europol. 
107 The Terrorist Finance Tracking Programme (TFTP) is a tool used by the ECTC since 2010. It is 
based on the Agreement between the European Union and the United States of America on the 
Processing and Transfer of Financial Messaging Data from the EU to the USA. 

| 87 

 
 
– TE-SAT 2022 

The ECTC also provides support to Member States’ online investigations, in order to 
trigger new leads based on the intelligence retrieved from the online communications 
of suspects and open sources. 

THE SIRIUS PROJECT  

The SIRIUS project aims to address the complexity of cross-border access to electronic 
evidence, both from a legal and an operational point of view. With online service providers 
(OSPs) frequently based in non-EU jurisdictions, their fragmented policies as well as lengthy 
and cumbersome legal procedures to access data owned by such providers, make it harder 
for competent authorities in the EU to make progress in criminal investigations. To best 
respond to this situation, the judicial component of the project was strengthened by signing 
a new contribution agreement between Europol, Eurojust and the European Commission at 
the end of 2020, making funding available until mid-2024.  

The restricted SIRIUS platform on the Europol Platform for Experts (EPE) boasts over 6 200 
members from all Member States and over 15 Third Parties with operational agreements 
for Europol-related activities, such as the SIRIUS Programme for OSPs, which aims to assist, 
on a voluntary basis, small and medium OSPs that do not have a law enforcement response 
policy in place. Moreover, a dedicated Open SIRIUS platform was set up on the EPE to share 
general and practical resources on e-evidence with OSPs. The ambition is to further solidify 
SIRIUS’ position as an internationally acknowledged platform for knowledge and expertise 
sharing on digital cross-border investigations, and in particular on formal processes (i.e. 
MLA Treaties between the EU and Third Parties), voluntary cooperation (requests 
originating from the EU directly submitted to foreign-based OSPs) and legislative 
developments (i.e. EU e-evidence legislation). 

In order to assist Member States in developing their capacity to prevent and respond 
to the threats posed by CBRN and explosives incidents, the ECTC works together with 
national competent authorities from Member States and Third Parties, and jointly 
promotes activities, including training with the European Commission and other 
relevant international organisations108. The ECTC CBRN & Explosives Team conducts 
technical analysis on bomb-making processes and illicit use of explosives precursors. 
CBRN & Explosives experts also provide timely and relevant information to Member 
States and Third Parties on potential new threats using CBRN materials.  

The Counter Terrorism Joint Liaison Team (CT JLT), created in 2016, comprises CT 
experts from Member States and Third Party countries with operational agreements 
and convenes at the Europol premises on a weekly basis. The CT JLT facilitates 
engagement and cooperation on CT related matters and reinforces the links between 
ECTC and the CT units in Member States and Third Parties with operational 
agreements. The CT JLT provides a trusted environment, in which information can be 
shared swiftly, securely and efficiently.  

Europol deploys short-term seconded national experts (‘guest officers’) to specific 
hotspots, in order to support the detection of returning FTFs or the infiltration of 
foreign members of terrorist organisations and other criminals into the EU. 

108 With the support of the European Commission and the Member States, Europol have created 
the European EOD Network (EEODN). The EEODN is a network of bomb technicians and CBRN 
specialists from competent authorities of the Member States. The main objectives are to 
facilitate cooperation, share information as well as organise international conferences and  
joint trainings.   

| 88 

 
 
Through the ECTC, CT units in Member States and Third Party countries can access the 
expertise of the European Cyber Crime Centre (EC3) and receive support for their 
investigations in cases where cybercrime and terrorism converge109.  

– TE-SAT 2022 

Addressing the dissemination of terrorist and violent extremist 
propaganda and the use of social media for radicalisation purposes  

The EU Internet Referral Unit (EU IRU), as an integral part of the ECTC, coordinates EU 
efforts to address the dissemination of online terrorist propaganda, including through 
the organisation of joint Referral Action Days (RAD). The unit delivers operational 
support to CT cases with an online component and develops tools and techniques to 
identify and counter terrorist abuse of the internet. The EU IRU strategy in the field of 
prevention continues to focus on the close engagement with Member States and OSPs 
to exchange best practices and expertise, and enhance the streamlining of the referral 
processes. In addition, the EU IRU makes use of specialised linguistic and subject 
matter expertise to detect threats and claims of responsibility for attacks targeting EU 
and non-EU countries. The unit also collects new propaganda content for referral to 
OSPs with a request for voluntary review against their terms of reference. Terrorist 
propaganda releases are also exploited for the purpose of strategic analysis. 
Furthermore, the EU IRU works in close cooperation with Member States and the 
European Commission for the development of PERCI, the proposed technical solution 
to facilitate the implementation of (EU) 2021/784 regulation addressing the 
dissemination of terrorist content online. PERCI will coordinate the issuing of referrals 
and the transmission of removal orders to hosting service providers while safeguarding 
fundamental rights and freedoms. 

Central strategic support capabilities to identify European-wide counter 
terrorism implications and promote outreach with relevant (international) 
partners  

In cooperation with Europol’s strategic analysis capabilities, the ECTC experts produce 
strategic analysis reports on all terrorism phenomena with the aim of providing an 
insight and a better understanding of current and emerging terrorist threats. This 
enables decision-making at strategic and policy level and sets the direction for tactical 
and operational actions.  

The ECTC has established a wide network of partners to discuss new developments in 
terrorism and to exchange best practices in countering terrorist threats, assuring the 
provision of the best policy recommendations.  

The ECTC also recognises that academic research on issues relevant for CT can provide 
important benefits for law enforcement strategies and practices. For this purpose, the 
ECTC maintains the ECTC Advisory Network on terrorism and propaganda, whose 
annual conference serves as a platform to enable direct contact and exchange 
between the two areas.  

109 Launched in January 2013, the European Cybercrime Centre (EC3) delivers state of the art 
technical, analytical and digital forensic expertise. 

| 89 

 
 
Methodology 

– TE-SAT 2022 

The TE-SAT is a situational strategic report that describes the terrorism situation in the 
EU. It is, however, not a threat assessment that aims at mapping and ranking current 
and future threats. The TE-SAT does not seek to analyse the root causes of terrorism, 
neither does it attempt to assess the impact or effectiveness of CT policies and law 
enforcement measures taken, although it can serve to illustrate such elements. 

While the primary scope of the TE-SAT focuses on terrorism, the report presents 
specific violent extremist acts and activities, where relevant and available and as 
reported by Member States, for contextualisation and to provide a more 
comprehensive picture of the terrorism situation. For the same purposes, Member 
States are also asked to report qualitative information on hateful narratives that have 
been observed to play a role in (inciting) terrorist violence. By means of horizontal 
scanning, where information available allows for such an assessment, the report also 
reflects on wider developments that have affected the EU terrorism landscape, or may 
affect it in the future.  

The TE-SAT is based on quantitative and qualitative contributions provided by Member 
States, which are complemented by in-house data and expertise on terrorism, as well 
as by open source information. Third Party countries similarly contribute to the report, 
providing qualitative input to complete the situational overview of the terrorism 
landscape in the EU. Based on quantitative contributions provided by Member States, 
the TE-SAT presents a comprehensive overview of figures related to terrorist attacks 
and arrests as recorded in the reporting period, which is 1 January to 31 December of 
the year preceding its production and dissemination. Furthermore, Eurojust 
complements the situational picture with additional data on convictions and penalties 
for terrorism and terrorism-related offences. 

The TE-SAT is presented every year in the Committee on Civil Liberties, Justice and 
Home Affairs (LIBE) of the European Parliament. The report is also published on 
Europol’s website to inform the wider public110. The TE-SAT only exists as public 
version; no restricted version of the document is produced. 

Types of terrorism 

According to EU Directive 2017/541, terrorist attacks are criminal offences carried out 
with the purpose of intimidating a population or trying to coerce a government or 
international organisation. 

The TE-SAT distinguishes between the following types of terrorism, based on 
ideological preferences: 

►  jihadist terrorism; 

►  right-wing terrorism;  

110 Europol’s 2006 proposal for the TE-SAT, which was approved by the EU Council, states that 
the report is ‘intended to inform the European Parliament of the phenomenon of terrorism in 
the EU. It will also be forwarded to the Council and can be used to inform the public. ‘Europol's 
Proposal for the New TE-SAT’, 18.5.2006, EU Council 8196/06 EUROPOL 25 ENFOPOL 25 REV2; 
Europol, 7.12.2021, ‘EU Terrorism Situation & Trend Report (Te-Sat), Reviewing the terrorism 
phenomenon’, accessible at https://www.europol.europa.eu/activities-services/main-
reports/eu-terrorism-situation-and-trend-report. 

| 90 

 
 
– TE-SAT 2022 

►  left-wing and anarchist terrorism; 

►  ethno-nationalist and separatist terrorism; 

►  other forms of terrorism. 

While some groups operate off a mixture of motivating ideologies, usually one 
ideology or motivation dominates. Categories are not necessarily mutually exclusive. 

At times, it remains challenging to attribute some incidents and arrests to a particular 
type of terrorism, e.g. unclaimed incidents or arrests for support activities. Such 
classifications might become clearer in the judicial phase, but they are beyond the 
scope of the TE-SAT data collection. As a result, a share of attacks and arrests may 
remain unattributed to specific types of terrorism and are thus categorised in the 
statistics as ‘not specified’. 

Other types of terrorism 

The TE-SAT may also tackle other types of terrorism that encompass acts of terrorism 
motivated by ideologies that do not fall under the jihadist, right-wing, left-wing, ethno-
nationalist and separatist spectrums. 

Past issues of the TE-SAT referred to ‘single-issue terrorism’. Single-issue extremist and 
terrorist groups were described as using criminal means to change a specific policy or 
practice, as opposed to replacing the entire political, social and economic system in a 
society. The groups within this category were said to be concerned, for example, with 
animal rights, environmental protection or anti-abortion campaigns. Examples of 
groups in this category were the Earth Liberation Front (ELF) and the Animal Liberation 
Front (ALF). In recent years, however, Member States contributed limited data under 
this category and incidents classified as single-issue terrorism were not specific enough 
to justify a separate category. In addition, right-wing and left-wing extremists seem to 
try to co-opt violent animal rights and environment protection movements, which 
hitherto were linked to single issue extremism. Therefore, such incidents and arrests 
will be treated henceforth under ‘other types of terrorism’. 

Other types of terrorism might also include offences committed by groups like 
Hezbollah, which are inspired by ideologies making reference to Islam without falling 
under the narrow definition of jihadism used in the TE-SAT. 

Terrorism and extremism 

The TE-SAT primarily focuses on presenting the situation on terrorism in the EU, for 
which purpose Member States are contributing quantitative information solely on 
terrorist attacks and arrests, as per the legislative provisions of each contributing 
country.  

Nevertheless, in order to deliver a more comprehensive picture on terrorism in the EU, 
Member States and Third Party countries are also requested to contribute qualitative 
information not only on terrorist attacks and arrests, but also on violent extremist acts 
and activities, and on non-violent extremist acts/hateful narratives. 

Violent extremist acts refer to activities or incidents which are not categorised as 
terrorist under national legislation, if such acts aim to intimidate a population or 
compel a government, or have the potential to seriously destabilise or destroy the 
fundamental political, constitutional, economic or social structures of a country. 

Non-violent extremist acts, including hateful narratives, are relevant for the TE-SAT if 
they have the potential to incite acts of terrorism or violent extremism. 

| 91 

 
Acronyms 

– TE-SAT 2022 

5G 
ADF 
ALF  
AMISOM 
Antifa 
AQAP 
AQIM 
AQIS 
AswJ 

AWD 

AWDSS 
BLM 
BR 
CBRN 
CIRA 
CT 
CT JLT 
DHKP-C 

DR 
DRC 
EC3 
ECTC 
EEODN 
ELF 
EOD 
EPE 
ETA 

EU 
EU IRU 
EU PERCI 
FAI/FRI 

FinTech 
FKD 

FTF 
HME 
HSM 

HTS 

IBÖ 

ICJ 
IED 
IID 
incel 
IPFS 
IRC 

fifth generation mobile network standard 
Allied Democratic Forces 
Animal Liberation Front 
Africa Union Mission in Somalia 
anti-fascist movement  
al-Qaeda in the Arabian Peninsula 
al-Qaeda in the Islamic Maghreb 
al-Qaeda in the Indian Subcontinent 
Ahlu‑Sunna wal-Jama’a 
‘Adherents to the Sunnah and the community’ 
Atomwaffen Division  
‘Nuclear Weapons Division’ 
Atomwaffen Division Finland Siitoin Squadron  
Black Lives Matter  
Brigate Rosse ‘Red Brigades’ 
chemical, biological, radiological and nuclear 
Continuity Irish Republican Army 
counter terrorism 
Counter Terrorism Joint Liaison Team 
Devrimci Halk Kurtuluş Partisi-Cephesi 
‘Revolutionary People’s Liberation Party-Front’ 
Dissident Republican 
Democratic Republic of the Congo 
European Cybercrime Centre 
European Counter Terrorism Centre 
European Explosive Ordnance Disposal Network 
Earth Liberation Front  
Explosive Ordnance Disposal 
Europol Platform of Experts 
Euskadi ta Askatasuna 
‘Basque Fatherland and Liberty’ 
European Union 
EU Internet Referral Unit 
EU Platform to Combat Illicit Content Online 
Federazione Anarchica Informale/Fronte Rivoluzionario 
Internazionale 
‘Informal Anarchist Federation/International Revolutionary Front’ 
Financial Technology 
Feuerkrieg Division 
‘Fire War Division’ 
foreign terrorist fighter 
home-made explosives 
Harakat al-Shabab al-Mujahidin 
‘Mujahid Youth Movement’, also known as al-Shabaab 
Hay’at Tahrir al-Sham 
‘Levant Liberation Committee’ 
Identitäre Bewegung Österreichs 
‘Identitarian Movement of Austria’ 
International Court of Justice  
improvised explosive device 
improvised incendiary device 
involuntary celibate 
Inter-Planetary File System 
Islamic Religious Community 

| 92 

– TE-SAT 2022 

IS 

ISAP 
ISCAP 
ISGS 
ISKP 
ISWAP 
IVTS 
JNIM 

KCDK-E 
LCC 
LNA 
LGBTQ+ 
MLA 
MLF 
MMA 
MENA 
MINUSMA 

NATO 
nIRA 
NGO 
NMR 

NSC 
NSO 
NSR 

NSU 

OAS 

OEA 

OMCG 
ONA or O9A 
OPCW 
OSP 
P2P 
PASOK 
PKK 

PMF 
PUP 
RAD 
RAF 

SDF 
SEPA 
SIRIUS 
SWIFT 

self-proclaimed Islamic State terrorist group 
also referred to as Daesh, Da’ish, ISIS or ISIL (after the Arabic name 
al-dawla al-Islamiyya fi al-Iraq wal-Sham, ‘Islamic State in Iraq and 
the Levant’) 
Islamic State Algeria Province 
Islamic State Central Africa Province 
Islamic State in the Greater Sahara 
Islamic State Khorasan Province 
Islamic State West Africa Province 
informal value transfer systems 
Jama’at Nusrat al-Islam wal-Muslimin 
‘Group in support of Islam and Muslims’ 
European Kurdish Democratic Societies Congress  
Loyalist Communities Council 
Libyan National Army 
lesbian, gay, bisexual, transgender, queer 
mutual legal assistance  
Macina Liberation Front 
mixed martial arts 
Middle East and North Africa 
The United Nations Multidimensional Integrated Stabilization 
Mission in Mali 
North Atlantic Treaty Organization 
New Irish Republican Army 
Non-Governmental Organisation 
Nordiska Motståndsrörelsen (Swedish), Pohjoismainen vastarin-
taliike (Finnish) 
‘Nordic Resistance Movement’ 
Nationalist Social Club 
National Socialist Order 
Nationale Sozialisten Rostock  
‘National Socialists’ 
Nationalsozialistischer Untergrund  
‘National Socialist Underground’ 
Organisation des Armées Sociales or Nouvelle OAS 
‘Social Armies Organisation’  
Organisation Armée Secrète  
‘Secret Armed Organisation’ 
Organosi Epanastatikís Aftoámynas  
‘Organisation for Revolutionary Self-Defense’ 
outlaw motorcycle gangs 
Order of Nine Angles  
Organisation for the Prohibition of Chemical Weapons 
online service provider 
peer-to-peer 
Panhellenic Socialist Movement  
Partiya Karkerên Kurdistanê 
‘Kurdistan Workers’ Party’ 
Popular Mobilization Forces 
Progressive Unionist Party 
Referral Action Days 
Rote Armee Fraktion 
‘Red Army Faction’ 
Syrian Democratic Forces 
Single Euro Payments Area 
Shaping Internet Research Investigations Unified System 
Society for Worldwide Interbank Financial Telecommunications 

| 93 

– TE-SAT 2022 

TATP 
TE-SAT 
TFTP 
THD 

UAV 
UK 
UN 
USA 
UNSCR 
VASP 
YPG 

ZAD 

triacetone triperoxide 
EU Terrorism Situation and Trend Report 
Terrorist Finance Tracking Programme 
Tanzim Hurras al-Din 
‘Guardians of the Religion Organisation’ 
unmanned aerial vehicle (or ‘drone’) 
United Kingdom of Great Britain and Northern Ireland 
United Nations 
United States of America 
United Nations Security Council Resolution 
virtual assets service providers 
Yekineyên Parastina Gel 
‘People’s Protection Units’ 
zone à défendre 

| 94 

 
Your feedback matters.  

By clicking on the following link or scanning the embedded QR code you 
can fill in a short user survey on the received strategic report. 

Your input will help us further improve our products.

https://ec.europa.eu/eusurvey/runner/eus_strategic_reports

EUROPEAN UNION TERRORISM SITUATION AND TREND REPORT 2022 

PDF | ISBN 978-92-95220-44-7 | ISSN 2363-0876 | DOI: 10.2813/467703 | QL-AJ-22-001-EN-N

© European Union Agency for Law Enforcement Cooperation, 2022

Reproduction is authorised provided the source is acknowledged.

For any use or reproduction of photos or other material that is not under the copyright of the 

European Union Agency for Law Enforcement Cooperation, permission must be sought directly 

from the copyright holders. 

Photograph page 3 by Nicolas Peeters.

Cite this publication: Europol (2022), European Union Terrorism Situation and Trend Report, 

Publications Office of the European Union, Luxembourg.

This publication and more information on Europol are available on the Internet.

www.europol.europa.eu