ByGIORGIA VALENTE/THE MEDIA LINE

AUGUST 5, 2026 10:09

Updated: AUGUST 5, 2026 10:12

The fatal incident close to Berlin Pride events in late July raised a tough issue for European officials: how security bodies should evaluate people whose online support for extremist violence is clear yet has not turned into a specific, identifiable attack scheme.

On July 25, a man steered a van into a gathering near the final activities of Berlin Christopher Street Day, one of the continent largest LGBTQ+ Pride events. Probes indicate the suspected perpetrator then proceeded on foot and was later discovered carrying a machete.

A Polish woman lost her life, and no fewer than 29 others suffered injuries. The 21-year-old suspect, Abdul Ballout, was killed the next day in a clash with police.

German federal prosecutors later verified that investigators had found a video in which a masked person thought to be Ballout declared his plan to stage an attack and swore loyalty to the Islamic State (ISIS).

The assault was not ordered or run operationally by ISIS, according to details released publicly so far. Still, it shows a pattern of violence that has grown central to the jihadist danger in Europe: a person radicalized via propaganda, using readily available weapons and seemingly without needing ongoing ties to the group central command.

Direct danger from people and small cells radicalized and planning online

This difference counts because Europe is not necessarily seeing a return to the organized, high-casualty operations linked to the Islamic State territorial growth from 2014 to 2017. The nearer risk is spread among individuals and small cells whose ideological growth, talks and at times operational prep happen mostly online.

What we are seeing in Europe is not so much a revival of jihadist terrorism in the shape we saw between 2014 and 2017, but instead its evolution. This is likely the key point to note, Daniele Garofalo, a specialist on extremist groups and jihadism, told The Media Line.

Europol latest terrorism review backs that view. Per the EU Terrorism Situation and Trend Report 2026 issued in July, European Union states noted 45 terrorist attacks in 2025 and 486 terrorism-linked arrests. Jihadist terrorism made up 24 of the attacks and 347 arrests. Most attacks and plots featured lone actors or small, self-started cells using basic tactics.

The gap between arrests and carried-out attacks does not always show the threat is growing at the same pace as detentions. It may also show that intelligence and police forces are stopping suspects during early stages, such as while gathering items, watching targets, spreading propaganda or trying to reach foreign groups.

This may seem odd, but it actually shows that European officials are stopping a large share of the danger before it happens, Garofalo said. The rise in arrests does not always mean terrorism has suddenly increased, but that there is an active base of radicalization that security forces are tracking more successfully.

The Berlin case, though, shows the limits of prevention when warning signs do not lead to a clear enough judgment of immediate intent.

German prosecutors noted Ballout had posted banned Islamic State material on Instagram twice in June 2024. In 2025, he went to Lebanon while reportedly aiming to reach Syria and join the group. He was held in Lebanon before returning to Germany, where he was detained and kept in pretrial custody.

In May 2026, a juvenile court found him guilty and gave a term of one year and 10 months for preparing a serious act of violence endangering the state and for crimes involving banned ISIS material. The court delayed a final call for six months on whether the term would be suspended, freed him under a probation officer watch, and ended the prior arrest order. It considered his time in custody, his admission, his claimed break from ISIS, and the lack of a real threat from the crimes. Prosecutors appealed, asking for a longer term that could not be suspended and for continued detention.

For Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, the case shows how online actions may be downplayed when viewed apart from the full radicalization path.

Lasting risk of ISIS-inspired attacks

The Berlin Pride attack highlights the lasting risk of ISIS-inspired violence, where propaganda viewed and shared online keeps ideological drive separate from any operational command tie to ISIS leaders, Webber told The Media Line.

He added, The attacker had been convicted of posting Islamic State propaganda online, yet received a suspended term because judges balanced his admission and apparent break from the group against the fact that no real threat had occurred, a call his later actions have now changed.

Ballout exact legal term was more involved than a suspended sentence that was set right away, because the court had delayed that choice for six months. The main point raised by Webber still stands: how much proof weight should courts and security services give to repeated creation, viewing or sharing of extremist propaganda when no clear target or operational plan has been found yet?

That space between digital actions and seen risk is the main issue: online propaganda sharing is too often seen as a smaller crime, a sign to watch rather than a direct sign of intent, when in fact it is often the only clear marker of radicalization before a person turns to violence, Webber said.

Europol has pointed to the same digital space as a key part of modern terrorism. Its 2026 report notes that online platforms let extremist actors reach, recruit and move large groups while coordinating actions both online and offline. Algorithmic spread can boost extremist content, while first views on mainstream services may lead users to closed groups and encrypted platforms with more direct material. Young and at-risk people are seen as especially open to this.

Among jihadist suspects, Europol found that most detained people had been driven by ISIS propaganda, though direct organizational links were less usual. Radicalization often started with user-made jihadist content on social networks, youth-focused platforms or gaming spaces before shifting to more secure chats.

In recent years, the line between propaganda and operational planning has grown less clear, Garofalo said. Many people start by viewing extremist content, slowly connect with digital networks, build ties with online helpers and, in some cases, eventually start planning an attack. The radicalization path is much more personal than before and often does not go through hidden mosques or organized territorial groups.

This change also affects attack styles. Complex, coordinated operations need communications, funding, logistics and staff, which raise the chance of detection. Vehicles, knives, makeshift weapons and arson need fewer resources and can be used with less prep.

The fairly low number of successful attacks should not be read as a sign that the threat is small, Garofalo said. On the contrary, it also shows the strong results of the preventive work done by intelligence services, counterterrorism teams and international cooperation. Many plots are stopped in their early phases, when people are still gathering materials, doing checks or talking with other extremists.

The Berlin attack has not been tied to Iran, Hezbollah, Hamas or any Iranian state body. Mixing ISIS-inspired terrorism with Iranian or Iran-aligned operations would hide key ideological and operational differences.

Its link to the wider Iran-Israel-United States conflict lies instead in the added load on European security services, which must now watch several separate threat areas at the same time.

The war has increased propaganda, political divides and threats against Jewish, Israeli, Iranian opposition and Western targets. Europol has warned that groups tied to Iran regional network could try destabilizing moves in Europe, possibly including terrorism, threats, funding and cybercrime. The agency also warned that the fast spread of divisive material could speed short-term radicalization among people and diaspora communities.

Per the EU 2026 terrorism report, pressure on Iran and its proxy network could create more direct threats inside Europe. While Iran-aligned groups had mainly used European ground for fundraising and logistical work, Europol warned that some could increasingly consider attacks against Jewish, Israeli or other targets. The report also noted signs that Iranian actors and proxies had used criminal networks in incidents across several member states.

In February, the European Union formally placed Iran Islamic Revolutionary Guard Corps on its terrorism list, subjecting the group to asset freezes and limits on access to economic resources inside the bloc. Britain has separately sanctioned people and entities reportedly tied to an Iran-linked criminal network accused of planning attacks and aiding hostile activity. Tehran has repeatedly denied involvement in attacks and plots in Europe.

These moves represent a different security pattern from the largely self-directed ISIS supporter. Iran-linked activity may involve state intelligence bodies, proxy groups, financial networks, surveillance work, criminal go-betweens and deniable acts of violence. Yet both threat areas may use similar weak points: encrypted communications, decentralized online recruitment, informal financial paths and people who at first seem on the edge of organized terrorism.

The traditional jihadist threat has recently been joined by an added layer of risk tied to the growing tensions among Iran, Israel and the United States, Garofalo said.

European authorities have stepped up their monitoring of people linked to the Iranian apparatus, Hamas, Hezbollah and other affiliated groups, not only because of the risk of attacks but also because of intelligence work, surveillance, funding and logistical aid. This is a different threat from the one posed by the Islamic State or al-Qaeda, but it is potentially complementary.

The word complementary does not necessarily mean cooperation between ideologically opposed groups. ISIS has repeatedly shown Iran and Shiite groups such as Hezbollah as foes. Rather, it describes the added pressure on European institutions when several unrelated networks work within overlapping digital, financial and criminal systems.

International conflicts also give extremist movements a steady flow of images and grievances that can be reframed for recruitment. Europol found that conflicts in the Middle East continued to be used in 2025 by jihadist, far-right, left-wing and other violent extremist actors, sometimes leading to threats or attacks against Jewish and Muslim communities.