Weekly Global Explosives Incident Brief: 2026/03/30- 2026/04/05

edwin.a.bundy@gmail.com -
April 6, 2026
Weekly Explosive Incident Brief

Period: Monday 30 March 2026 – Sunday 5 April 2026

Classification: UNCLASSIFIED // OSINT

Prepared for: International Guild of Master Bomb Technicians

Prepared: 6 April 2026

NOTE ON CONVENTIONAL CONFLICTS: This reporting period coincides with active, large-scale conventional military operations in multiple theaters: the ongoing Israel-Iran war (commenced late February 2026), resumed Israeli military operations in Lebanon (since 2 March 2026), Houthi ballistic missile and drone strikes on Israel (resumed 28 March 2026), and the Russia-Ukraine conflict. Conventional munitions employment – airstrikes, ballistic missiles, artillery, and drone strikes in these theaters – is excluded from the incident cards below. Only IED, improvised explosive device, criminal explosive, and ERW incidents are carded. Conventional conflict context with IED/asymmetric implications is addressed in the Appendix.

Audio Summary

EXECUTIVE SNAPSHOT

  • Lebanon: UNIFIL peacekeepers killed by roadside IED – Two Indonesian peacekeepers were killed and two others wounded by a roadside IED near Bani Hayyan in southern Lebanon on 30 March. A third Indonesian soldier died overnight from a separate projectile strike on a UNIFIL position. Israel blamed Hezbollah; the UN opened a formal investigation. This is the deadliest single IED attack on peacekeepers in Lebanon in years and carries potential war crime implications under international humanitarian law.
  • Hezbollah IED targeting IDF, Lebanon – Hezbollah claimed detonating an IED against Israeli forces near al-Biyyadah, Tyre District, during the 2-3 April reporting window. The attack was part of a 15-attack series Hezbollah conducted against IDF positions in southern Lebanon during that period, signaling continued asymmetric tactics alongside conventional fire.
  • Boko Haram IEDs ambush displaced civilians, Nigeria – As thousands of civilians attempted to return home to Ngoshe, Borno State from temporary shelter in Pulka, Boko Haram planted IEDs and launched ambushes along the route. Four civilians were killed and 24 wounded. One device was rendered safe during clearance operations at the Bokko area on 31 March.
  • JNIM IED strikes Burkina Faso army vehicle, Yatenga province – JNIM militants targeted a Burkinabe Armed Forces vehicle with an IED in the Barga area of Yatenga province on 30 March. Casualties not confirmed in open sources. Yatenga province sits astride critical northern supply corridors that JNIM has increasingly targeted.
  • Northern Ireland: First significant CBIED attack of 2026 – A delivery driver was hijacked at gunpoint in Lurgan on 31 March, forced to drive a vehicle containing a viable IED to the town’s police station. The driver escaped; roughly 100 homes were evacuated. ATO conducted a controlled explosion. Police assessed the device as crude but viable and attributed the attack with high confidence to dissident Republican groups.
  • Al-Shabaab chief bombmaker killed, Somalia – A precision airstrike in the Middle Juba region of Somalia on or around 5 April killed Ibrahim al-Sudani, identified as al-Shabaab’s lead explosives specialist. The target was linked to dozens of deadly IED attacks, including VBIED and pressure-plate devices. At least nine fighters and six bomb-manufacturing engines were destroyed in the operation.
  • Paris: Pro-Iran cell charged in Bank of America bomb plot – Four suspects, including three minors, were charged by French anti-terrorism prosecutors on 1-2 April for an attempted bomb attack outside Bank of America’s Paris headquarters on 28 March. The device contained 650 grams of explosives and five liters of fuel – a quantity French investigators described as unprecedented for a domestically constructed device.
  • USA: Multiple device incidents within reporting window – A 25-pipe-bomb cache was discovered in a White Plains, NY apartment (30 March); a Palm Springs airport item prompted a controlled detonation (30 March); a suspicious device with energetic materials was disassembled by bomb squad near a Norwalk, Iowa bike trail (31 March); and a suspicious device was recovered during a search warrant in Spokane, WA (1 April). These are unrelated but reflect an elevated domestic device tempo.
  • Sweden gang explosive rate remains at record pace – Swedish National Council for Crime Prevention reported 621 explosion offenses in 2025 (the highest in the period reviewed), and police data confirm detonations remained at elevated levels in early 2026. No single confirmed incident with a pinned date within the 30 Mar – 5 Apr window was available in open sources, but the structural trend is operationally significant for the EU C-IED community.
  • Somalia/al-Shabaab EOD intelligence note – The killing of Ibrahim al-Sudani degrades al-Shabaab’s near-term VBIED and pressure-plate IED production, though the group has shown historical resilience in replacing bomb-making specialists and retains significant institutional knowledge.


INCIDENT LEDGER

#CountryCity/AreaCategoryTypeDeviceTargetCasualtiesConfidence
1LebanonBani Hayyan, TyreConflict-relatedDetonationRoadside IEDUNIFIL peacekeeper convoy2 KIA, 2 WIAConfirmed
2Lebanonal-Biyyadah, TyreConflict-relatedDetonationIED (type unspecified)IDF ground forcesUnknownConfirmed
3NigeriaBokko/Ngoshe corridor, BornoTerror/ InsurgentDetonation + Cache findIED/roadside + ambushCivilian returnees4 KIA, 24 WIAConfirmed
4Burkina FasoBarga, Yatenga provinceTerror/ InsurgentDetonationVehicle-targeted IEDMilitary vehicleUnknownProbable
5UK (N. Ireland)Lurgan, Co. ArmaghTerror/ InsurgentAttempted (disrupted)CBIED (vehicle-borne hijack)Police station0 (prevented)Confirmed
6SomaliaMiddle Juba regionTerror/ InsurgentDisruption (strike)Bomb-making facilityal-Shabaab HVT/EOD capability9+ KIA (militants)Probable
7FranceParis (8th arrondissement)Terror/ InsurgentAttempted (disrupted)IED (improvised incendiary/explosive)Bank of America branch0 (prevented)Confirmed
8USAWhite Plains, NYCriminalCache find/ ArrestPipe bombs (25+)Not applicable0Confirmed
9USAPalm Springs, CAUnknownDisruptionUnknown deviceAirport0Confirmed
10USANorwalk, IAUnknownDisruptionImprovised device with energetic materialsPublic trail0Confirmed
11USASpokane, WAUnknownDisruptionSuspicious deviceResidential0Probable

INCIDENT CARDS

CARD 1: UNIFIL Peacekeepers Killed by Roadside IED, Southern Lebanon

Location/Time: Bani Hayyan village, Tyre District, southern Lebanon | Late afternoon to evening local time | 30 March 2026

Category / Context: Conflict-related – ongoing Israel-Lebanon military operations in context of resumed 2026 Lebanon War (active since 2 March 2026)

Incident Type: Detonation

Incident Summary (TTP-focused): A roadside explosive device detonated as a UNIFIL convoy from the Indonesian contingent passed through the Bani Hayyan area south of the Litani River. Two Indonesian peacekeepers were killed outright and two others were wounded. A third Indonesian soldier was killed separately overnight when a projectile struck a UNIFIL position. The UN Secretary-General’s Office confirmed “initial findings” pointed to a roadside IED as the cause of the Bani Hayyan casualties. A separate UNIFIL investigation was opened.

  • Device Type: Roadside IED (probable pressure-plate or command-detonated; initiation method unspecified in open sources)
  • Delivery & Placement: Emplaced on road surface or roadside; triggered as convoy passed
  • Initiation Method: Unknown; probable victim-operated or command-detonated
  • Target Type: UN peacekeeping convoy (Indonesian Armed Forces personnel in UNIFIL)
  • Effects: 2 peacekeepers KIA, 2 peacekeepers WIA (Bani Hayyan event); 1 peacekeeper KIA (separate overnight projectile event)
  • Suspected Perpetrator: Israel Defense Forces stated Israeli troops did not place the device and were not present in the area; IDF attributed the IED to Hezbollah. Hezbollah did not claim the attack. Attribution remains unresolved in open sources.
  • Confidence: Confirmed (UN OSSG initial findings, Al Jazeera, Times of Israel, AP/Reuters wire services)
  • Source Reliability: High – multiple independent wire services, UN official statement, IDF statement

Sources:

Analyst Note: This is the most strategically significant IED incident in the reporting window. The attack on a clearly marked UN convoy in a designated UNIFIL operational area carries serious implications under IHL, and the UN Secretary-General characterized it as a potential war crime. EOD professionals supporting UNIFIL should treat Bani Hayyan and surrounding Tyre District roads as active IED threat corridors. The device placement pattern – targeting vehicle corridors below the Litani River during periods of active IDF ground operations – mirrors Hezbollah’s historical TTPs from the 2006-era conflict. Attribution remains diplomatically contested. Expect route clearance requirements and vehicle hardening protocols to intensify for all UNIFIL contingents in the south in coming weeks.

CARD 2: Hezbollah IED Targeting IDF, Tyre District, Lebanon

Location/Time: al-Biyyadah, Tyre District, southern Lebanon | 2-3 April 2026

Category / Context: Conflict-related – part of ongoing Hezbollah asymmetric campaign against IDF during resumed Lebanon War

Incident Type: Detonation

Incident Summary (TTP-focused): Hezbollah claimed responsibility for detonating an IED that targeted Israeli forces near the village of al-Biyyadah in the Tyre District. This single device was embedded within a broader campaign of 15 claimed Hezbollah attacks against IDF positions in southern Lebanon during the 2-3 April period, along with 29 additional attacks targeting IDF infrastructure and communities in northern Israel. Hezbollah’s use of IEDs alongside rockets, anti-tank missiles, and mortars reflects a layered asymmetric approach to force attrition.

  • Device Type: IED – type and construction not specified in open sources
  • Delivery & Placement: Likely road-emplaced or prepared position; exact placement method not specified
  • Initiation Method: Unknown – probable command-detonated given Hezbollah’s preference for electronic initiation
  • Target Type: Israeli ground forces in Tyre District
  • Effects: Casualties not reported in open sources
  • Suspected Perpetrator: Hezbollah – claimed directly via official Hezbollah media channels
  • Confidence: Confirmed (direct Hezbollah claim via reliable media, corroborated by Critical Threats/FDD Long War Journal tracking)
  • Source Reliability: High – Hezbollah official claim; corroborated by Critical Threats and Long War Journal analysis

Sources:

Analyst Note: Hezbollah’s continued IED use against IDF ground forces in the Tyre District is tactically significant even within a larger conventional conflict. It signals that the group has retained emplacement cells capable of forward positioning devices despite intense Israeli pressure. The geographic concentration of IED claims in Tyre District – the same corridor where the UNIFIL peacekeeper IED killed two soldiers on 30 March – raises the question of whether a single Hezbollah emplacement team is responsible for both incidents or whether device density in this corridor is coincidental to high IDF activity. C-IED analysts should flag this zone as an active pressure point with multiple unexplained device events within a five-day span.

CARD 3: Boko Haram IED Ambush on Displaced Civilian Returnees, Borno State, Nigeria

Location/Time: Bokko area, Ngoshe corridor, Borno State, northeastern Nigeria | Late March – 31 March 2026

Category / Context: Terror/Insurgent – Boko Haram (Jamā’at Ahl as-Sunnah lid-Da’wah wa’l-Jihād) exploitation of civilian displacement movement

Incident Type: Detonation (multiple) + Cache Find/Render-Safe

Incident Summary (TTP-focused): Following early March attacks in Borno State, thousands of displaced civilians who had sheltered in Pulka attempted to return home to Ngoshe during the last week of March. Boko Haram anticipated this movement and pre-emplaced IEDs along the return route while also mounting direct ambushes. The combination turned the corridor into a casualty-producing kill zone: 4 civilians were killed and 24 wounded. Nigerian security forces conducted route clearance and discovered and neutralized one device at the Bokko area along the main supply route on 31 March.

  • Device Type: IEDs (types not specified in open sources) – likely pressure-plate or victim-operated based on Boko Haram historical TTP
  • Delivery & Placement: Route-emplaced along civilian movement corridor from Pulka to Ngoshe
  • Initiation Method: Victim-operated (probable) based on historical Boko Haram TTP; command-detonation not reported
  • Target Type: Displaced civilian population in movement; secondary threat to military convoy/QRF
  • Effects: 4 KIA (civilian), 24 WIA (civilian); 1 device rendered safe
  • Suspected Perpetrator: Boko Haram (JASDJ) – assessed by Nigerian security analysts; no formal claim found in open sources
  • Confidence: Confirmed (Truth Nigeria reporting, ISWAP/Boko Haram open-source tracking)
  • Source Reliability: Medium-High – Truth Nigeria is a credible regional outlet; details corroborated by broader Borno security context

Sources:

Analyst Note: Boko Haram’s exploitation of civilian return movements is a documented TTP that has precedent across multiple conflict cycles in Borno State. The group routinely seeds routes with IEDs prior to anticipated civilian or military movement – effectively turning the predictable pattern of displacement and return into targeting intelligence. The humanitarian-security intersection here is direct: any route clearance or escort plan for future displacement returns in this corridor must treat the Pulka-Ngoshe axis as an active IED threat zone until confirmed clear. Nigerian EOD and UN Mine Action operators should prioritize this corridor. The render-safe of one device on 31 March confirms residual UXO risk persists on the route.

CARD 4: JNIM IED Strikes Burkinabe Army Vehicle, Yatenga Province

Location/Time: Barga area, Yatenga province, northern Burkina Faso | 30 March 2026

Category / Context: Terror/Insurgent – Jama’at Nusrat al-Islam wal-Muslimin (JNIM) anti-military IED campaign

Incident Type: Detonation

Incident Summary (TTP-focused): JNIM militants detonated an IED targeting a Burkinabe Armed Forces vehicle in the Barga area of Yatenga province. Yatenga is a strategically significant province in northern Burkina Faso that sits on supply lines to the besieged northern city of Titao and forms part of the broader contested corridor from Ouahigouya. Casualties were not confirmed in available open sources.

  • Device Type: IED – specific type not specified in open sources; prior JNIM TTPs in the area favor road-emplaced command-detonated devices against military vehicles
  • Delivery & Placement: Roadside emplacement targeting military vehicle (probable)
  • Initiation Method: Not specified in open sources
  • Target Type: Burkinabe Armed Forces vehicle
  • Effects: Casualties not confirmed in open sources
  • Suspected Perpetrator: JNIM – attributed by Sahel security analysts tracking Pravda Mali/Niger reporting
  • Confidence: Probable (single regional source, Pravda Mali; no independent corroboration found)
  • Source Reliability: Medium – Pravda Mali covers Sahel events with reasonable consistency but is a single regional outlet without official corroboration

Sources:

Analyst Note: JNIM’s continued IED use against Burkinabe Armed Forces vehicles in Yatenga is consistent with the group’s broader campaign to isolate northern supply routes and interdict QRFs that would respond to attacks on population centers. JNIM has incorporated drones carrying IEDs as a newer capability layer (first used in Mali in September 2023 and documented in Burkina Faso), suggesting that vehicle-targeting IEDs and drone-dropped IEDs may be employed in combination in future Yatenga operations. EOD professionals supporting ECOWAS or French-successor advisory missions in the region should treat northern Burkina Faso road networks as high-threat IED corridors, with particular attention to vehicle-kill zones near chokepoints and culverts.

CARD 5: Dissident Republican CBIED Attack on Lurgan Police Station, Northern Ireland

Location/Time: Lurgan, County Armagh, Northern Ireland, UK | Overnight 31 March into 1 April 2026

Category / Context: Terror/Insurgent – dissident Republican (New IRA or Continuity IRA probable)

Incident Type: Attempted Detonation (prevented/controlled detonation by ATO)

Incident Summary (TTP-focused): Two masked men – one armed with a pistol – hijacked a delivery driver in the Kilwilkie area of Lurgan and ordered him to drive a white Audi A4 to the town’s police station or be killed. An improvised device had been concealed in the boot of the vehicle. The driver escaped after arriving near the station and alerted security personnel. A significant security operation was mounted: approximately 100 homes were evacuated and Ammunition Technical Officers carried out a controlled explosion on the vehicle. Post-blast examination confirmed the device was crude but viable. No injuries reported.

  • Device Type: CBIED (car-borne improvised explosive device) – vehicle used as unwitting carrier; device in vehicle boot
  • Delivery & Placement: Hijacked civilian vehicle (Audi A4) driven by coerced civilian to target
  • Initiation Method: Unknown; the vehicle was assessed as a delivery device, not a command-detonated VBIED; the intended initiation method is unspecified in open sources (possible timer or command)
  • Target Type: Police station (PSNI Lurgan)
  • Effects: 0 casualties (device controlled by ATO); significant community disruption (~100 households evacuated)
  • Suspected Perpetrator: Dissident Republican groups – PSNI assessed this as “highly likely” to be dissident Republicans. Likely New IRA or Continuity IRA based on geographic pattern of prior Lurgan-area incidents.
  • Confidence: Confirmed (PSNI official statement, multiple UK regional and national outlets)
  • Source Reliability: High – official PSNI statement, corroborated across multiple reliable regional outlets

Sources:

Analyst Note: This is the most significant dissident Republican device incident in Northern Ireland in recent months. The “proxy bomb” or “human delivery” technique – coercing a civilian to transport a device to a target under threat of death – is a classic IRA-era TTP that was used extensively from the 1970s through the 1990s and has been periodically revived by dissident factions. The coercion element is significant: it shifts device-delivery risk away from operatives and onto civilians, making it harder to preempt through normal surveillance. ATOs and PSNI should anticipate potential follow-on proxy bomb attempts in Lurgan and surrounding Co. Armagh areas. The “crude but viable” descriptor suggests limited access to skilled bomb-makers but sufficient motivation to improvise. Watch for whether dissident groups attempt to improve device sophistication in follow-on attacks.

CARD 6: Al-Shabaab Lead Bombmaker Killed in Precision Airstrike, Somalia

Location/Time: Middle Juba / Lower Juba region, vicinity of Jilib, southern Somalia | Approximately 5 April 2026

Category / Context: Terror/Insurgent – targeted strike against al-Shabaab explosive weapons capability

Incident Type: Disruption (counterterrorism strike eliminating bomb-making HVT and infrastructure)

Incident Summary (TTP-focused): Somali intelligence services (NISA) in collaboration with international forces conducted a precision airstrike in the Middle Juba / Lower Juba region targeting al-Shabaab’s explosives network. The strike killed a senior bombmaker identified by the alias Ibrahim al-Sudani, described as al-Shabaab’s lead explosives specialist linked to dozens of deadly IED attacks against Somali security forces and civilians. At least nine al-Shabaab fighters were killed. Six heavy manufacturing engines used by the group to fabricate explosives were also destroyed.

  • Device Type: N/A (strike disrupted ongoing bomb-making capability, not a device employment)
  • Target Type: al-Shabaab bomb-making HVT and explosives manufacturing site
  • Effects: Ibrahim al-Sudani KIA; 8+ additional fighters KIA; 6 bomb-manufacturing engines destroyed; significant disruption to VBIED and pressure-plate production assessed
  • Suspected Perpetrator: N/A – this is a counterterrorism operation by Somali NISA and international partners
  • Confidence: Probable (Radio Dalsan reporting, Hiiraan Online; confirmation of Ibrahim al-Sudani’s identity pending official AFRICOM/NISA confirmation)
  • Source Reliability: Medium-High – Radio Dalsan and Hiiraan Online are credible Somali-language and English outlets; official AFRICOM confirmation not yet available in open sources as of publication

Sources:

Analyst Note: The elimination of a lead bombmaker represents a genuine degradation of al-Shabaab’s near-term IED production capacity, but the group has historically reconstituted after similar losses. In January 2026, AFRICOM already eliminated a previous senior explosives specialist (Engineer Ismail, real name Abdullahi Osman Mahamed) near Jilib – the same general area as this strike. The recurrence suggests Jilib remains a persistent hub for al-Shabaab’s explosives network and continues to attract high-value targets. The destruction of six manufacturing engines (heavy machinery used for device fabrication) is more impactful than the personnel kill alone. Bomb techs and C-IED analysts supporting Somali National Army and ATMIS operations should expect a temporary reduction in VBIED frequency followed by a gradual return to pace as the group redistributes bomb-making functions. Pressure-plate and victim-operated IEDs that require less centralized manufacturing will likely maintain pace.

CARD 7: Pro-Iran Cell Charges in Paris Bank of America Bomb Plot

Location/Time: 8th arrondissement, Paris, France | Attack: ~03:30 local, 28 March 2026 (pre-reporting window); Charges filed: 1-2 April 2026 (within reporting window)

Category / Context: Terror/Insurgent – ISIS-inspired cell with suspected pro-Iran motivation

Incident Type: Attempted Detonation (disrupted)

Incident Summary (TTP-focused): On 28 March, a young adult recruited three minors to approach a Bank of America branch near the Champs-Élysées and place an improvised explosive device. The device consisted of approximately five liters of liquid fuel combined with 650 grams of high explosive and an ignition system – a quantity French forensic investigators described as unprecedented for a domestically constructed device in France. Police intervened as the suspect was attempting to activate the device. French counter-terrorism prosecutors took jurisdiction. By 1-2 April, all four suspects had been charged. Investigators explored connections to a pro-Iranian network, with the adult suspect having allegedly recruited the minors via online radicalization channels in exchange for 500-1,000 euros each.

  • Device Type: IED – fuel/explosive mixture with ignition system; 650g explosive content + 5L liquid fuel accelerant
  • Delivery & Placement: Placed by foot outside bank entrance by juveniles; adult suspect directed operation
  • Initiation Method: Manual ignition attempted; device placed and ignition attempted but disrupted by police
  • Target Type: US financial institution (Bank of America Paris headquarters, 8th arrondissement)
  • Effects: 0 casualties; attack disrupted; device seized intact by French police
  • Suspected Perpetrator: Suspected pro-Iranian network. Three minors and one adult suspect charged; investigators assess Iranian connection but not yet confirmed. Group Ashab al-Yamin (People of the Right Hand) claimed a related Amsterdam WTC attack on 16 March, suggesting a possible broader network.
  • Confidence: Confirmed (French counter-terrorism prosecution, multiple major wire services)
  • Source Reliability: High – France 24, ABC News, Washington Post, Bloomberg, CNBC, UPI

Sources:

Analyst Note: The scale of the device (650g explosive + 5L fuel) distinguishes this from typical “low sophistication” pro-Iran attacks in Europe and represents a meaningful escalation in device potency. The use of minors as operational couriers – in exchange for small cash payments – is a concerning evolution in operational security and recruitment tradecraft. This tactic was also present in the earlier Amsterdam Jewish school bombing (14 March) and the Ashab al-Yamin WTC attack in Amsterdam (16 March), suggesting a regional network is actively exploiting minors. EU bomb squads and intelligence services should treat this as a campaign indicator, not a one-off event. The Iran-war geopolitical backdrop (active since late February 2026) is a direct accelerant for this threat vector. Anticipate continued attempts against US and Israeli-linked financial and commercial targets in major EU cities while the wider conflict remains active.

CARD 8: White Plains, NY – 25-Pipe Bomb Cache Discovered

Location/Time: 11 Odell Ave., White Plains, Westchester County, New York, USA | 30 March 2026

Category / Context: Criminal – neighbor intimidation / homemade explosive possession

Incident Type: Cache Find / Arrest

Incident Summary (TTP-focused): Following months of complaints from neighbors about loud explosions, authorities executed a search warrant at an apartment in White Plains. Inside, they found materials to make explosives and 25 complete assembled pipe bombs in the residence of Raymond Elders, 65. Elders was arrested at the scene. Prosecutors confirmed the devices were functional and complete.

  • Device Type: Pipe bombs (25+) – complete, assembled
  • Delivery & Placement: Stored in residential apartment; not yet deployed
  • Initiation Method: Not specified; pipe bombs typically use fuse/friction or electrical initiation
  • Target Type: Unknown – probable neighbor intimidation based on complaint history
  • Effects: 0 casualties; 25 devices seized; suspect arrested
  • Suspected Perpetrator: Raymond Elders, 65, Westchester County resident – charged with making pipe bombs
  • Confidence: Confirmed (Westchester County prosecutor, CBS New York, multiple outlets)
  • Source Reliability: High – prosecutor’s statement, multiple major outlets

Sources:

Analyst Note: A cache of 25 functional assembled pipe bombs in a single residential location represents significant manufacturing output and a serious public safety risk. The neighbor complaint history (reported detonations over months) suggests Elders was actively testing or demonstrating devices in or near the structure prior to arrest. The fact that neighbors’ complaints eventually prompted the investigation – not proactive intelligence – highlights a community reporting gap. For EOD professionals: residential pipe bomb caches require careful storage and movement considerations; 25 devices in a confined space present a sympathetic detonation risk during render-safe or evidence handling. The age of the suspect (65) does not fit standard domestic terrorism demographic profiles and suggests an idiosyncratic criminal motivational pattern rather than ideological terrorism.

CARD 9: Palm Springs Airport Controlled Detonation

Location/Time: Palm Springs International Airport, Palm Springs, California, USA | 30 March 2026

Category / Context: Unknown

Incident Type: Disruption (controlled detonation)

Incident Summary (TTP-focused): Palm Springs bomb squad responded to a suspicious item discovered at Palm Springs International Airport. The item was transported to a desert area near North Gene Autry Trail and detonated in a controlled manner. No injuries were reported.

  • Device Type: Unknown; nature of item not described in open sources
  • Delivery & Placement: Found at airport location; transport method not specified
  • Initiation Method: N/A (controlled detonation)
  • Target Type: Airport (if intentional placement)
  • Effects: 0 casualties; item destroyed
  • Suspected Perpetrator: Not identified in open sources
  • Confidence: Confirmed (KESQ reporting, local Palm Springs media)
  • Source Reliability: Medium – local television reporting only; limited detail available

Sources:

Analyst Note: Insufficient open-source detail to assess device nature or intent. Airport finds require precautionary controlled detonation regardless of threat confidence level; this may be a low-threat item or an abandoned package misidentified as suspicious. The incident warrants monitoring only if follow-on reporting confirms device construction. No evidence of broader threat pattern.

CARD 10: Norwalk, Iowa – Suspicious Device with Energetic Materials Near Bike Trail

Location/Time: 500 block of Beardsley Street, Norwalk, Iowa, USA | 31 March 2026

Category / Context: Unknown (criminal or individual threat behavior probable)

Incident Type: Disruption (device disassembly)

Incident Summary (TTP-focused): Norwalk police and the Des Moines bomb squad responded to a suspicious backpack left near a public bike trail. The backpack contained a metal box filled with nails and an unidentified powder, a canister of butane fuel taped to a plastic container, and associated materials consistent with an improvised incendiary/explosive device. The bomb squad disassembled the package and removed it for analysis. No injuries. Investigation remained open.

  • Device Type: Improvised device with energetic materials – metal box with nails (fragmentation), unidentified powder, butane fuel canister – consistent with a shrapnel-producing incendiary or explosive device
  • Delivery & Placement: Backpack left near public bike trail (apparent abandoned placement)
  • Initiation Method: Unknown – no remote or timed ignition component described, but investigation ongoing
  • Target Type: Unknown – public recreational trail users (if intentional)
  • Effects: 0 casualties; device disassembled
  • Suspected Perpetrator: Unknown; investigation ongoing
  • Confidence: Confirmed (KCRG, WHO13 local reporting)
  • Source Reliability: Medium-High – local TV reporting corroborated across multiple Des Moines-area outlets

Sources:

Analyst Note: The combination of nails (fragmentation), unidentified energetic powder, and a butane fuel accelerant in a backpack represents a low-sophistication but potentially lethal anti-personnel device configuration. Whether this was a functional device or a partially assembled one remains unresolved in open sources. The public trail location – rather than a high-value target – is more consistent with a motivated individual actor (grievance-driven or testing behavior) than an organized group. This incident alongside the White Plains cache (30 March), Palm Springs airport controlled detonation (30 March), and Spokane search-warrant device (1 April) suggests an elevated North American domestic device tempo for the reporting week. None of these appear to be connected, but the clustering is worth monitoring.

CARD 11: Spokane, Washington – Suspicious Device During Search Warrant Execution

Location/Time: 7700 block of North Altamont, Spokane, Washington, USA | 1 April 2026

Category / Context: Unknown (probable criminal possession)

Incident Type: Disruption (bomb squad response during warrant execution)

Incident Summary (TTP-focused): Spokane County Sheriff’s deputies executing a search warrant at a residential address encountered a suspicious device. The bomb squad was called and the street was temporarily blocked. The device was removed and assessed. No arrests were reported in connection with the device.

  • Device Type: Unknown – described only as “suspicious device”
  • Delivery & Placement: Residential location; found during warrant execution
  • Initiation Method: Unknown
  • Target Type: Unknown – residential context
  • Effects: 0 casualties; device secured
  • Suspected Perpetrator: Not specified in open sources
  • Confidence: Probable (multiple local Spokane media outlets)
  • Source Reliability: Medium – local television only; minimal detail

Sources:

Analyst Note: Insufficient detail to characterize device type or threat level. Included for situational awareness as part of the elevated US domestic device tempo during this reporting window.

WEEKLY TTP AND THREAT PATTERN ANALYSIS

Device construction trends – The most significant construction development this week was the Paris Bank of America bomb (Card 7), which French investigators described as containing 650g of high explosive material combined with five liters of liquid fuel accelerant. This combination – bulk explosive plus an accelerant designed to produce a thermobaric-like incendiary effect – exceeds the complexity of prior pro-Iran or IS-inspired attacks in Western Europe and suggests either direct technical guidance from a trained operative or significant self-directed research. Separately, the Norwalk, Iowa device (Card 10) reflected a more rudimentary shrapnel-and-fuel configuration, likely self-constructed without external guidance. Northern Ireland’s Lurgan device (Card 5) was assessed as crude but viable – consistent with the reduced bomb-making depth typical of current dissident Republican cells compared to the Provisional IRA era. Overall, the week showed a spectrum from technically informed (Paris) to rudimentary (Northern Ireland, Iowa), with no evidence of significant new construction materials or configurations outside the Paris device.

Targeting pattern shifts – Three distinct targeting patterns stand out. First, anti-military IED use persisted in Africa (Burkina Faso/JNIM, Nigeria/Boko Haram) and the Levant (Hezbollah in Lebanon), consistent with campaign-level operational patterns rather than opportunistic strikes. Second, anti-Western-institution targeting in Europe – US bank branch in Paris, Jewish school in Amsterdam (14 March), Ashab al-Yamin Amsterdam WTC attack (16 March) – reflects a coherent campaign against Israeli-adjacent and US-aligned targets by pro-Iran networks activated by the ongoing Iran-Israel war. These targets (banks, Jewish institutions) are soft targets with significant symbolic value and low physical security compared to government or military installations. Third, domestic US device incidents (White Plains, Palm Springs, Norwalk, Spokane) share no apparent connection but reflect individual criminal and idiosyncratic behaviors rather than organized threat activity. The most operationally significant targeting shift is the emergence of peacekeepers as IED targets in Lebanon – a precedent not established in significant volume since the height of Hezbollah’s anti-UNIFIL campaign in 2006-2007.

Geographic spread or contraction – IED activity is not expanding significantly geographically this week; established hotspots are intensifying. The Lebanon corridor (Tyre District) is now generating both Hezbollah IED claims against IDF and a verified UNIFIL peacekeeper killing within a five-day window – a concentration that suggests active device emplacement by a Hezbollah cell in a specific geographic zone rather than a distributed campaign. West Africa (Burkina Faso, Nigeria) continues on an elevated but persistent baseline. The pro-Iran European campaign, initiated earlier in March with Amsterdam attacks, extended into France by the end of March, suggesting geographic expansion from Netherlands into France. No new geographies opened during this reporting period.

Cross-regional TTP convergence – Two convergences are worth flagging. The proxy bomb / civilian coercion technique (Lurgan, Card 5) appears in isolation this week but represents a technique previously associated with the Provisional IRA that has historically spread to other conflict theaters when observed as effective. Second, and more significant, the use of minors as device-placement couriers appeared in both the Paris attack (three minors recruited to carry and ignite device) and was documented in the broader Amsterdam Ashab al-Yamin network earlier in March. This mirrors a technique seen in the Middle East – particularly by Iran-backed groups in Iraq and Lebanon – of using younger, less-known individuals as delivery operatives to reduce exposure of trained operatives. If this pattern is being deliberately exported to Europe by a trained network, it represents a meaningful tradecraft adaptation.

Implications for EOD/C-IED professionals – Three items demand attention in the coming week. First, UNIFIL contingents in southern Lebanon should treat Tyre District roads – particularly the Bani Hayyan area – as live IED corridors requiring systematic clearance prior to convoy movements. Second, EU bomb technicians and intelligence services should watch for continued attacks against US financial and Israeli-linked targets in France, Netherlands, and Germany; the pro-Iran network activated by the Iran-Israel war appears to still be operational and willing to use higher-yield devices than seen in previous European IS-adjacent attacks. Third, Nigerian EOD units should maintain route clearance focus on the Pulka-Ngoshe corridor in Borno State – the Boko Haram IED ambush on returning displaced civilians (Card 3) may recur as humanitarian movements continue in the region.

APPENDIX: CONVENTIONAL CONFLICT CONTEXT (IED/ASYMMETRIC IMPLICATIONS)

Israel-Iran War (Active since ~28 February 2026)

Situation Summary: The current Israel-Iran war, initiated following large-scale US and Israeli strikes on Iranian military targets beginning 28 February 2026, has produced a high-intensity conventional exchange involving ballistic missiles, cruise missiles, drones, and airstrikes across the broader Middle East. During 28 March – 5 April, Iran and its proxies launched nearly 90 documented incidents, with increasing accuracy against Israeli energy infrastructure, airports, ports, and telecommunications hubs. The Houthis resumed attacks on Israel on 28 March. Israeli operations in Lebanon intensified, with the IDF striking over 140 Hezbollah sites over one weekend and conducting sustained demolition and bombing operations in southern Lebanon through 5 April.

IED/Asymmetric Implications: The conventional escalation has directly activated Iran’s proxy networks in Europe, as demonstrated by the Paris bomb plot (Card 7) and the earlier Amsterdam Ashab al-Yamin attacks in March. As the war continues, expect continued proxy activation in European cities with significant diaspora communities and US/Israeli-linked targets. Hezbollah’s persistence with IEDs against IDF ground forces in Lebanon (Card 2) – even while absorbing intense Israeli airstrikes – signals the group’s commitment to asymmetric attrition tactics as a complement to its conventional missile posture. Bomb squads and security services in the US, EU, and Israel should maintain elevated alert posture for Iran-inspired lone-actor or network attacks targeting financial, cultural, and government institutions.

Israel-Lebanon Front (Active since 2 March 2026)

Situation Summary: Israel resumed large-scale military operations in Lebanon on 2 March 2026. By early April, the IDF had reoccupied positions in southern Lebanon it had held before the 2024 Hezbollah ceasefire, as the Lebanese Army withdrew from several positions. Israeli airstrikes killed at least 14 people in Lebanon on 5 April. Hezbollah is conducting layered asymmetric attacks – rockets, anti-tank missiles, IEDs, and drone operations – against IDF forces and northern Israel.

IED/Asymmetric Implications: The reoccupation of southern Lebanese territory by the IDF creates direct parallels to the 2006-2009 period, when Hezbollah employed a dense network of pre-emplaced IEDs and prepared fighting positions. UNIFIL personnel are now confirmed casualties of IED use in this environment (Card 1). Bomb tech teams supporting any advisory or monitoring role in southern Lebanon should expect a layered IED/minefield threat environment in contested areas. The Tyre District is currently the highest-density IED reporting area.

Russia-Ukraine Conflict

Situation Summary: The Russia-Ukraine conflict continued through the reporting period. The shadow war component – car bomb assassinations, railway sabotage, and asymmetric strikes – has produced multiple casualties on both sides throughout 2025-2026. During the reporting window, no specific IED-attributable incidents in the Russia-Ukraine context were confirmed in open sources, though the operational pattern of car bomb assassinations of Russian military officers (documented in December 2025 with Lt. Gen. Sarvarov and February 2026 with a Moscow police car bomb) remains active.

IED/Asymmetric Implications: The Ukrainian intelligence-attributed car bomb campaign targeting Russian military personnel in Moscow and surrounding areas represents a persistent asymmetric IED threat in Russia’s urban environment. Russian security services are actively interdicting suspected Ukrainian-linked operatives (two men jailed in January 2026 for an attempted car bomb against a former Ukrainian agent). Analysts tracking Russian domestic counter-IED activity should expect continued assassination attempts against senior military figures, with car bomb and concealed device TTPs dominant.

DATA GAPS AND LIMITATIONS

  • Middle East & Levant (Iraq, Syria): General reporting on Iran-proxy drone/missile activity was available; no confirmed IED-specific incidents in Iraq or Syria during the reporting window surfaced in open sources. The dominant conventional conflict reporting likely suppressed IED-specific coverage. Iraq IED activity likely occurred but was unattributed to specific dates in this window. Search terms used: “IED bomb attack Iraq Syria March April 2026,” “Iraq IED bomb explosion April 2026.”
  • Sahel & West Africa (Burkina Faso, Mali, Niger): One confirmed incident (Card 4, Burkina Faso). The Niger-Benin oil pipeline attack by IS-Sahel (21 March) and JNIM activity in Mali were documented but fall outside the strict reporting window. ACLED event-level data was not publicly accessible in open sources for the specific 30 March – 5 April window. The Sahel reporting environment is partly suppressed by media access restrictions in military-governed states (Burkina Faso, Mali, Niger). Coverage relies heavily on Pravda Mali/Niger aggregators and regional security outlets of varying reliability. Search terms used: “explosive device attack Sahel Mali Niger Burkina Faso March 2026,” “ACLED Sahel IED March 30 April 5 2026.”
  • East Africa & Horn of Africa (Kenya, Mozambique): No confirmed IED incidents in Kenya or Mozambique during the reporting window. An IED attack in Garissa county, Kenya (three GSU officers wounded) occurred in February 2026 but precedes the window. Al-Shabaab bombmaker elimination (Card 6) is the primary Horn of Africa incident. Mozambique ASWJ activity was not found in open sources for this window. Search terms used: “Kenya Mozambique bomb IED March April 2026.”
  • South Asia (Pakistan, India, Bangladesh, Sri Lanka): Pakistan IED data for the specific reporting window was ambiguous; TRT World reporting on IED blasts killing 2 and injuring 25 in Balochistan and KP appears to date from January 2026, not this window. Indian government declared Naxalite insurgency effectively ended 30 March 2026 (a historic development); a residual IED blast in Jharkhand injured a CRPF jawan on 6 April but falls just outside the reporting window. No Bangladesh or Sri Lanka incidents found. Search terms used: “Pakistan IED bomb March 30 April 5 2026,” “India Naxalite IED blast April 2026.”
  • Southeast Asia (Philippines, Thailand, Myanmar): Philippines Mindanao – no confirmed incidents in the reporting window (last significant incident December 2023 Marawi bombing). Thailand deep south – coordinated petrol station bombings documented January 2026 but nothing confirmed for March 30 – April 5. Myanmar – IED injuring civilian documented March 23 (outside window); junta airstrikes on civilian areas ongoing. Search terms used: “Philippines Mindanao bomb April 2026,” “Thailand deep south bomb April 2026,” “Myanmar bomb IED March April 2026.”
  • China: No explosive incidents meeting the skill definition (IED, criminal, or terrorism-related) were found for the reporting window. A construction tunnel gas explosion in Chongqing (30 March, 4 workers killed) was industrial/accidental in nature and excluded. No terrorism-related explosive incidents surfaced in open sources. Search terms used: “China explosion bomb 爆炸 炸弹 March April 2026.”
  • Scandinavia (Sweden, Denmark, Norway): Sweden’s gang bombing rate remained at record levels (621 explosion offenses in 2025; pace continuing in 2026), but no individual incidents with confirmed dates in the 30 March – 5 April window were found in English-language open sources. Swedish-language source coverage would likely surface specific incidents. Denmark and Norway produced no results. Search terms used: “Sweden explosion bombing gang March 30 April 5 2026,” “Sweden gang bombing explosion March April 2026.”
  • Russia & Former Soviet Union: February 24 Moscow police car bombing (outside window) and broader car bomb assassination pattern documented. No confirmed IED-specific incidents within the reporting window surfaced in open sources beyond Hezbollah-related activity (covered in Appendix and main cards). Russian-language source coverage (взрыв, СВУ) returned results primarily from the Ukraine conflict theater. Search terms used: “Russia explosion bomb взрыв СВУ March April 2026,” “Russia Ukraine IED car bomb assassination March April 2026.”
  • European Union (Germany, Italy, Spain, Greece, Balkans): No confirmed IED incidents in the EU outside France and Netherlands during this window. The Paris Bank of America bomb plot follow-on charges (Card 7, within window) and Amsterdam attacks (14 and 16 March, outside window but campaign-relevant) were the primary EU events. Balkans and Mediterranean EU states produced no results. Search terms used: “Europe IED bomb explosion controlled detonation March 30 April 5 2026.”
  • British Isles: Lurgan CBIED (Card 5) is the primary event. No confirmed events in Great Britain (England, Scotland, Wales) during the reporting window. Northern Ireland remains the active IED threat zone. Search terms used: “UK viable suspect device controlled explosion bomb squad March April 2026.”
  • North America: Multiple incidents carded (Cards 8-11). MacDill AFB case (device placed 10 March, discovered 16 March) is outside the strict reporting window, though follow-on sibling arrest and media coverage (26 March – 3 April) falls within it. The Gracie Mansion ISIS-inspired TATP attack (7 March, two suspects charged) also falls outside the window but is operationally relevant background. Search terms used: “North America pipe bomb device found controlled detonation March April 2026,” multiple location-specific searches.
  • South America (Colombia, Ecuador, Brazil, Venezuela): ELN explosive attack in Chinácota, Norte de Santander documented approximately 22 March (outside window); two ELN suspects captured 2 April in follow-on operation (within window but not a device incident). Ecuador-Colombia border bomb diplomatic incident (March 2026) was resolved before the reporting window. No Brazil, Venezuela, or Peru incidents for this window. Search terms used: “South America artefacto explosivo March April 2026,” “Colombia ELN FARC explosive March 30 April 5 2026.”
  • Central America (Honduras, Guatemala, El Salvador): No confirmed explosive incidents meeting the skill definition were found for the reporting window. Central American gang violence typically generates firearm rather than explosive incidents, though grenades are used periodically for extortion enforcement. The post-Bukele crackdown in El Salvador has significantly suppressed gang activity. Search terms used: “Central America Honduras Guatemala El Salvador granada extorsion explosive April 2026.”
  • Caribbean: No confirmed bomb or explosive device incidents found for the reporting window. US military operations in the Caribbean (targeting drug trafficking vessels) continue under Operation Southern Spear but are conventional military strikes, not IED events. Search terms used: “Caribbean bomb explosion device found April 2026.”

End of Brief – Next scheduled brief: Monday, 13 April 2026

Sources compiled from: Al Jazeera, Times of Israel, UN News, Counter-IED Report, France 24, ABC News, Washington Post, Bloomberg, CNBC, Radio Dalsan, Hiiraan Online, AFRICOM, Truth Nigeria, Pravda Mali, KCRG, WHO13, KXLY Spokane, CBS New York, KESQ Palm Springs, FDD Long War Journal, Critical Threats, US News/AP, The National News, Farming Life (UK), Gothamist, HSToday, DOJ press release, NordiskPost, ACLED Africa Overview March 2026

Latest Posts

PDF Version

Explosive Incident Brief for the Week of 6-12 Apr 2026Download
#No Tag

Comments are closed