A resurgent and diversifying threat: Islamist extremist violence in Germany in the wake of October 7

28 November 2024

Special thanks to Leonie Oehmig for her research support for this article.

Since Hamas’ attacks on Israel on 7 October 2023, there have been two deadly Islamist extremist attacks in Germany (Mannheim and Solingen) and a spate of foiled plots. This Dispatch analyses four key aspects behind the rise in Islamist extremist planning targeting Germany:

The resurgence of the so-called Islamic State (IS);
Plots related to Hamas and the Islamic Republic of Iran;
The radicalisation of minors and young adults;
Blasphemy-related attacks and plots.

It concludes with a series of recommendations on how to reduce the violent threat from Islamist extremism in a proportionate and targeted manner while upholding Germany’s commitment to liberal democracy and human rights.

Background: Ebb and flow in threat perception

Over the past year, Germany has suffered two deadly Islamist attacks – the first targeting an anti-Islam rally in Mannheim in March 2024 in which a police officer was killed, and the second on a festival in Solingen in August 2024 which killed three people. German authorities have also reportedly foiled a range of other Islamist extremist attacks. This trend has been galvanised by the 7 October attack by Hamas on Israel and the subsequent Israeli bombardment of Gaza that has killed over 43,000 people.[i]

These incidents have put Islamist extremism under renewed scrutiny. During the height of IS in the mid-2010s, Islamist extremism was widely considered the key security challenge for Germany with over 1,000 Salafi-jihadists from Germany joining armed groups in Syria and Iraq. 12 people were killed in an attack at a Berlin Christmas market in December 2016, Germany’s single most lethal Islamist extremist incident. 18 plots were foiled by authorities between 2010 and 2023, according to the German Federal Crime Agency.

With the demise of Islamic State’s (IS) territorial ‘Caliphate’, authorities pivoted to focusing on right-wing extremism as the main threat to German democracy. This was supported by the rise and radicalisation of the far-right Alternative für Deutschland (AfD), large-scale anti-migrant riots in Chemnitz in 2018, the assassination of the conservative politician Walter Lübcke by a Neo-Nazi in 2019, and deadly extreme-right terrorist attacks in Halle in 2019 (killing two) and Hanau in 2020 (killing 12).

Islamist extremist terrorist attacks and plots since October 7

The current violent threat from Islamist extremism in Germany is driven by factors including grievances related to the Israel-Hamas conflict, the increasing prevalence of online extremist propaganda and controversies related to blasphemy.

Actors including IS, the group’s Afghan affiliate Islamic State Khorasan Province (ISKP), Hamas, and the Iranian regime have been accused of trying to inspire or direct terrorist attacks against targets in Germany since 7 October (see following sections). While IS continues to play a central role, this reflects the diversity of Islamist extremist threat actors.

Targets included:

Public gatherings or concerts;
Israeli, pro-Israeli or Jewish targets;
Commentators and activists deemed to have violated religious norms (either through blasphemy or Quran burnings);
Members of the German military were the target of one alleged plot.

The following sections analyse four key aspects that shape the current threat picture in Germany:

The resurgence of Islamic State
Plots related to Hamas and the Iranian Regime
The radicalisation of minors and young adults
Blasphemy-related attacks and plots

The resurgence of Islamic State

Following 7 October, Salafi-jihadist groups called for followers to commit attacks across Europe, especially in France and Germany. ISD assesses that since 7 October, there have been at least 10 attacks or plots linked to IS supporters in Germany (based on an assessment of cases collated by Peter Neumann and subsequent media reporting).

ISKP has grown into a significant international security challenge, carrying out two high-profile terrorist attacks in 2024: a bombing in January in Kerman, Iran which killed 84 people attending a memorial service for Islamic Revolutionary Guards Corps commander Qasem Soleimani; and the attack on Crocus City Hall in Moscow which killed 144 people in March.

Some of the attacks and plots appear to have used IS ideology merely as an inspiration without any formal connection to the group.

On the 2024 anniversary of the 1972 Munich Olympics attacks which killed 11 members of the Israeli team, another fatal attack was narrowly avoided when an 18-year-old Austrian of Bosnian heritage[ii] shot at the Israeli consulate in Munich before being killed by police. He was found to have consumed IS and Hayat Tahrir al-Sham propaganda online. Likewise, police arrested a 27-year-old Syrian IS-supporter in Bavaria in October 2024 who had allegedly planned to attack a German army station with a machete. Two minors arrested for allegedly planning to attack a Christmas market two months later had planned to travel to Afghanistan together and join ISKP following the attack, according to investigators.

In other cases, plotters established direct contact with or received orders from IS to commit violence.

In August 2024, a Syrian man fatally stabbed three people at a “festival of diversity”[iii] in Solingen, celebrating the 650th anniversary of the city’s founding. IS later took credit for the attack and published a video allegedly showing the attacker pledging allegiance to the group. IS stated that the attack had targeted Christians to avenge Muslims killed in Palestine, Syria, Bosnia and Iraq by or with the support of Zionists.

A German national previously convicted for membership in IS was arrested in October 2023 for allegedly plotting to attack a pro-Israel demonstration in Duisburg. The man had joined IS in Syria and featured in the group’s propaganda videos before returning to Germany in 2016, where he was arrested upon arrival. An Iraqi national, who allegedly fought for IS in his home country and specifically entered Germany in 2022 to prepare himself for an attack, was arrested in June 2024. Lastly, a 28-year-old Libyan man with connections to IS was arrested in Bernau (near Berlin) in early November 2024 after a foreign intelligence service indicated that he had been in contact with IS and planned to attack the Israeli Embassy with firearms.

Plots related to Hamas and the Iranian Regime

IS has been the most important ideological inspiration for Islamist extremist attacks and plots since 7 October. However, Hamas and the Iranian regime have also been accused of directing terrorist attacks against Germany. This includes an alleged Hamas plot to attack the Israeli embassy in Berlin and a US military base in Rhineland-Palatine which would mark the first time the Palestinian group is known to have attempted attacks in Europe. In April and May 2024, French and German police also arrested criminals who were allegedly recruited by Iranian intelligence services. Their alleged victims included Jewish and Israeli targets in Germany, as well as Iranian opposition activists. While the recruitment of criminals would be novel, it echoes previous Iranian-directed terrorist attacks in the US, UK, France and the Netherlands.

Radicalisation of minors

At least seven minors have been arrested in connection with terrorist offences, an increasing challenge for authorities.[iv] In late November 2023, a 15-year-old German-Afghan and 16-year-old Russian were arrested for allegedly planning to perpetrate a van attack on a Christmas market. In April 2024, four teenagers were arrested for allegedly plotting an IS-inspired attack on churches and police stations with knives and Molotov cocktails. Lastly, police in Wuppertal arrested a 15-year-old in October 2024 who previously expressed support for IS online and was communicating with extremists abroad who suggested he should attack public gatherings or Jewish communities.

These teenagers were born at the height of the Global War on Terror, were children when IS declared its “Caliphate”, entered puberty when the Taliban took over Afghanistan and are now witnessing the war in Gaza through livestreams. In all of these cases, digital media, platforms and messaging apps were crucial in their radicalisation and/ or attack preparation.

These radicalisation journeys are further facilitated by the ease with which minors can access graphic or terrorist content online. ISD research found more than 300 posts or videos portraying extremely graphic, distressing or violent imagery related to the Israel-Hamas conflict which 13-year-olds could access on Instagram, TikTok and Snapchat. Our research also showed basic English search terms referencing well-known IS-associated individuals can uncover terrorist content.

Blasphemy-related attacks and plots

As noted by terrorism scholar Peter Nesser, Islamist extremist terrorist attacks in Europe are typically justified through foreign policy grievances, or blasphemous publications and activities perceived as hostile/insulting to Islam.[v] Although foreign policy grievances – especially related to Gaza – have been central to most attacks and plots since 7 October, two cases were seemingly motivated by the second rationale.

Over the past two years, the Quran burnings by anti-Islam activists in Sweden have proven particularly consequential. In March 2024, two Afghan nationals affiliated with ISKP were arrested in Thuringia. The men are accused of plotting to attack the Swedish parliament over the Quran burnings.

In the May 2024 Mannheim attack, an Afghan man similarly attacked and injured the prominent anti-Islam activist Michal Stürzenberger with a knife and killed the police officer Rouven Laur who had intervened to protect Stürzenberger. The attacker had come to Germany in 2013 as an underage refugee and had not been individually monitored by the security agencies. However, he had uploaded Taliban content on his YouTube channel and frequented a mosque that has been identified as extremist by the State Office for the Protection of the Constitution in Hesse.

Proportionate and targeted responses to the rise in Islamist extremist violence

The threat from Islamist extremism in Germany has undeniably increased since the 7 October attacks. This requires a strong response from policymakers and civil society. However, public debate has primarily focused on tougher stances on migration.[vi] In a liberal democracy, the merits of different approaches to migration should be openly and rigorously scrutinised; conflating broader debates with an urgent conversation about how to tackle Islamist and other forms of extremism proportionately and effectively risks producing ineffective policy.

An ideologically agnostic counter-extremism strategy is necessary. First and foremost, Germany needs a nuanced threat assessment of Islamist extremism. The Federal Government should be more explicit and transparent in its communication on the security threat this poses. Though the potential for the normalisation or mainstreaming of Islamist extremism is more limited than that of the far right in Germany, it still presents a broader set of potential harms including social polarisation, undermining integration, belief in democracy, and the promotion of discriminatory and reactionary views.

Second, authorities should pay closer attention to emerging patterns and trends in radicalisation online, including where there is little connection to formal groups. This is particularly important on youth-focused platforms such as TikTok and Snapchat. The Federal government should better fund training courses to strengthen officials and practitioners’ understanding of youth radicalisation dynamics. Safeguarding approaches must recognise minors’ complex status as both potential perpetrator of violence and victims of grooming by extremist recruiters, rather than copying counter-terrorism policies and referral processes developed for adults.

Third, referral processes for potentially violent Islamist extremists should be aligned with local violence prevention initiatives which are already addressing many of the same underlying causes and correlates of violence, including mental health issues, grievances, social isolation, identity-formation and thrill-seeking behaviours. Such an approach could create synergies and effectively triage cases so only instances of suspected radicalisation are passed to counter-terrorism practitioners.

Any measures adopted to counter Islamist extremist violence should be proportionate to the threat. Targeted interventions are more likely to be effective than broad approaches that cast suspicion on entire communities. The aim should be to reduce the violent threat Islamist extremists pose to targeted communities and the broader public, while upholding Germany’s commitment to liberal democracy and human rights.

[i] Significant public debate has emerged on whether the figures produced by the Ministry of Health (which is an agency of the Hamas government in Gaza) are credible, as news organisations are not able to independently verify them due to the current conflict in Gaza and reporting restrictions. While some politicians and journalists have argued that Hamas has a clear propaganda incentive to inflate the death count, figures by the Ministry of Health have previously been used by the US State Department and were judged to be ‘generally reliable’ by human rights organisations in the past. https://www.theguardian.com/world/2023/oct/26/can-we-trust-casualty-figures-from-the-hamas-run-gaza-health-ministry

At the same time, it has been argued that the official figures may be an undercount, with United Nations agencies estimating in May 2024 that more than 10,000 people are likely buried under the rubble in Gaza. https://news.un.org/en/story/2024/05/1149256

[ii] It should be noted that the 2020 Vienna attacker and Austrian foreign fighters who joined IS frequently had family background in the Balkans, including Bosnia and Albania. Vienna’s role as hub for Salafi-jihadist activity is partially a legacy of the 1990’s conflicts in the Balkans, when Islamic charities based in Vienna raised money for Bosnian mujaheddin. https://ctc.westpoint.edu/the-network-of-the-november-2020-vienna-attacker-and-the-jihadi-threat-to-austria/

[iii] The choice by city authorities to celebrate “festival of diversity” in Solingen was no coincidence but should be understood in the context of the city’s painful history with violent extremism. In 1993, five members of a German family with Turkish roots were killed in a far-right arson attack. Additionally, Solingen was one the main hubs for German foreign fighters which joined IS. https://www1.wdr.de/nachrichten/rheinland/solinger-mahnmal-mutwillig-beschaedigt-100.html

[iv] Between 2001 and 2022, around one in five people involved in Islamist attacks and plots in Germany was under 18. The involvement of minors has become more common since 2016. https://ifsh.de/file/publication/Research_Report/011/Research_Report_011_DE_V4_web.pdf

[v] Nesser, Petter. Islamist terrorism in Europe. Oxford University Press, 2018.

[vi] The Solingen attack was carried out by a Syrian refugee days before elections in the East German states of Thuringia and Saxony in which the far-right Alternative für Deutschland made major gains. In response, the German government passed tougher migration policies designed to reduce the number of migrants coming the country and increase deportations.