Weekly Explosive Incident Brief: 2026/03/02 – 2026/03/08

Ed Bundy -
March 9, 2026
Weekly Explosive Incident Brief

Period: Monday 2 March 2026 – Sunday 8 March 2026

Classification: UNCLASSIFIED // OSINT

Prepared for: International Guild of Master Bomb Technicians

Prepared: Monday 9 March 2026

NOTE — Conventional Conflict Context: The reporting period coincides with the opening phase of the 2026 Iran–US/Israel conflict (strikes commencing 28 February). High volumes of conventional munitions employment (cruise missiles, ballistic missiles, airstrikes) across Iran, Iraq, Lebanon, and the Gulf are excluded from incident carding. Only IED, improvised explosive, criminal explosive, drone-borne IED, and ERW incidents are carded below. Conventional conflict context with IED/asymmetric implications is addressed in the Appendix.

Audio Summary

Executive Snapshot

  • TATP IED attack in New York City is the week’s headline incident: two ISIS-inspired suspects deployed TATP-filled fragmentation devices at a protest outside Gracie Mansion on 7 March, prompting an FBI Joint Terrorism Task Force investigation. A third device was recovered from a vehicle on 8 March. This represents the most significant ISIS-linked IED event on US soil in years.
  • Incendiary/explosive device detonated at the US Embassy in Oslo, Norway on 8 March — no injuries, but police are investigating terrorism as a hypothesis, potentially linked to anti-US sentiment during the Iran conflict.
  • Pakistan recorded two significant IED attacks: a car bomb on the Bannu–Miranshah road (1 killed, 19 injured) on 6 March, and an RCIED in Wana’s Rustam Bazaar targeting police during Ramadan Iftar shopping (2 killed, 31 injured) on 7 March.
  • Nigeria’s Borno State saw coordinated ISWAP assaults on three Forward Operating Bases (28 Feb–1 Mar), with IED threats reported along reinforcement routes. One army major was killed.
  • Peru’s Trujillo experienced a criminal extortion bombing at the Dali nightclub on 7 March, injuring 44 — part of an endemic extortion campaign with 286 explosions across La Libertad region in 2025.
  • Myanmar’s Sagaing Region saw resistance forces employ improvised mines against a junta column near Kani Township (7–8 March), reportedly killing approximately 30 soldiers.
  • East Belfast, Northern Ireland — pipe bomb detonated at a residential property on 2 March in what appears to be a targeted criminal/paramilitary intimidation attack.
  • Russia’s Moscow Region — a teenager detonated an explosive device at a VTB Bank ATM in Putilkovo on 7 March, reportedly on instructions from remote handlers (Ukrainian-linked per Russian claims).
  • Niger’s Diffa Region continues to see ISWAP IED activity, with a claimed attack on a bridge between Diffa and Doutchi (reported 2 March) killing 6.
  • TATP emergence in a US domestic context and the Oslo embassy attack both warrant close monitoring for escalation or copycat activity in the coming weeks.

Incident Ledger

#CountryCity/AreaCategoryTypeDeviceTargetCasualtiesConfidence
1USANew York City, NYTerrorDetonation / DiscoveryTATP fragmentation IED (x3)Protest / Civic target0 killed, minor injuries reportedConfirmed
2NorwayOsloTerror / UnknownDetonationIncendiary deviceUS Embassy0 killed, 0 injuredConfirmed
3PakistanNorth Waziristan, KPTerrorDetonationVBIED (car bomb)Security checkpoint1 killed, 19 injuredConfirmed
4PakistanWana, South WaziristanTerrorDetonationRCIED/timed IEDPolice patrol / Bazaar2 killed, 31 injuredConfirmed
5NigeriaBorno State (Mayanti, Gajiram, Gajigana)Terror/ConflictComplex attack (IED component)IEDs along routes + armed assaultMilitary FOBs1 officer + 10 insurgents killedConfirmed
6PeruTrujillo, La LibertadCriminal/ExtortionDetonationExplosive device (type unspecified)Nightclub (Dali)0 killed, 44 injuredConfirmed
7MyanmarKani Township, SagaingConflictDetonationImprovised mines (x16 “padesa mines”)Military convoy~30 junta soldiers killed (claimed)Probable
8Northern IrelandEast BelfastCriminal/ParamilitaryDetonationPipe bombResidential property0 killed, 0 injuredConfirmed
9RussiaPutilkovo, Moscow RegionCriminal/SabotageDetonationIED (ATM-targeted)Bank ATM (VTB)0 killed, 0 injuredConfirmed
10NigerDiffa RegionTerrorDetonationIED (road/bridge)Military/Civilian transport6 killedProbable
11MyanmarMyinmu Township, SagaingConflictDetonationRoadside IEDCivilian vehicle0 killed, 1 injuredConfirmed

Incident Cards

CARD 1: TATP IED Attack at Gracie Mansion Protests — New York City

Location/Time: Manhattan (East 87th Street / East End Avenue), New York City, USA | ~11:00 AM ET | 7 March 2026; third device recovered 8 March 2026

Category / Context: Terror/Insurgent — ISIS-inspired

Incident Type: Detonation / Attempted / Discovery

Incident Summary (TTP-focused): During dueling protests outside Gracie Mansion (the official residence of NYC Mayor Zohran Mamdani), 18-year-old Emir Balat allegedly ignited a TATP-based IED and threw it toward the protest area. The device — a glass jar wrapped in black tape, packed with nuts, bolts, and screws around a TATP charge with a hobby fuse — partially detonated but self-extinguished near responding officers. Balat then reportedly retrieved a second device from 19-year-old Ibrahim Kayumi, ignited it, and attempted to flee before dropping it. Both suspects were detained on scene. On 8 March, a third suspicious device was discovered inside a vehicle on East End Avenue (81st–82nd Streets), prompting evacuations; the Bomb Squad safely removed it for testing.

  • Device Type: Fragmentation IED — glass jars packed with TATP, nuts, bolts, screws; hobby fuse initiation. Described as smaller than a football.
  • Delivery & Placement: Hand-thrown by attacker into protest crowd
  • Initiation Method: Lit hobby fuse (manual ignition)
  • Target Type: Protest gathering / civic target adjacent to mayoral residence
  • Effects: No fatalities reported. Minor injuries possible but not confirmed in reporting. Significant psychological impact and area disruption.
  • Suspected Perpetrator: Emir Balat (18, Langhorne, PA) and Ibrahim Kayumi (19, Newton, PA). Both reportedly self-radicalized; one suspect allegedly shouted “Allahu Akbar” and referenced ISIS. Both had recent travel to Istanbul; Kayumi also traveled to Saudi Arabia and Australia. FBI JTTF investigating as potential act of terrorism.
  • Confidence: Confirmed
  • Source Reliability: High — NYPD official statements, FBI confirmation, multiple tier-1 national outlets

Sources:

Analyst Note: This is the most significant ISIS-linked IED deployment on US soil in recent memory. The use of TATP (“Mother of Satan”) is a hallmark of jihadist operations globally (Brussels 2016, Paris 2015, Manchester 2017). The suspects’ youth (18–19), self-radicalization pathway, and travel history to known hotspots fit the “inspired lone actor” profile that Western security services have struggled to detect pre-attack. The hobby fuse as initiation method suggests relatively unsophisticated bomb-making — had the devices functioned as intended, the fragmentation fill (nuts, bolts, screws) could have produced mass casualties in the densely packed protest. The recovery of a third device from a vehicle raises questions about whether additional co-conspirators or a cache exist. Bomb technicians and security planners should anticipate heightened vigilance requirements at protest events in the near term and monitor for copycat attempts.

CARD 2: Explosion at US Embassy — Oslo, Norway

Location/Time: Sørkedalsveien (US Embassy compound, consular section entrance), Oslo, Norway | ~01:03 CET | 8 March 2026

Category / Context: Terror / Unknown — under investigation

Incident Type: Detonation

Incident Summary (TTP-focused): Neighbors reported a loud explosion near the US Embassy in Oslo at approximately 01:03 local time. The blast was caused by an incendiary device detonated at the entry to the compound’s consular section. Police cordoned the area and determined it was safe with no lingering threat. Norwegian police are treating terrorism as one investigative hypothesis.

  • Device Type: Incendiary device — type not specified in open sources
  • Delivery & Placement: Placed at or near the embassy’s consular section entrance
  • Initiation Method: Unknown
  • Target Type: US diplomatic facility
  • Effects: No injuries. Minor structural damage. Embassy security perimeter activated.
  • Suspected Perpetrator: Unknown. No arrests reported. Police are exploring terrorism and other motives. Context of US–Iran conflict raises the possibility of retaliatory or solidarity attacks, though no link has been established.
  • Confidence: Confirmed
  • Source Reliability: High — Norwegian police statements, multiple international wire services

Sources:

Analyst Note: The timing — one week into US/Israeli strikes on Iran — makes this incident particularly significant regardless of whether a direct Iran connection is established. It signals that US diplomatic facilities worldwide face elevated threat from both state-directed actors and ideologically motivated individuals. The device appears relatively unsophisticated (incendiary rather than high-explosive), suggesting either limited capability or a symbolic/harassing intent rather than a mass-casualty goal. European EOD teams and diplomatic security units should be on heightened alert for similar low-sophistication attacks at US and Israeli facilities.

CARD 3: Car Bomb on Bannu–Miranshah Road — North Waziristan, Pakistan

Location/Time: Near Chashma Sarbandki checkpoint, Bannu–Miranshah Road, North Waziristan, Khyber Pakhtunkhwa, Pakistan | 6 March 2026

Category / Context: Terror/Insurgent

Incident Type: Detonation

Incident Summary (TTP-focused): A vehicle-borne improvised explosive device detonated near the Chashma Sarbandki security checkpoint on the main Bannu–Miranshah road, killing one person and injuring 19 others, four critically. The explosion targeted the vicinity of a security forces checkpoint, a common TTP tactic to disrupt military freedom of movement in the former FATA regions.

  • Device Type: VBIED (car bomb)
  • Delivery & Placement: Parked or driven vehicle near checkpoint
  • Initiation Method: Not specified in open sources
  • Target Type: Security forces checkpoint
  • Effects: 1 killed, 19 injured (4 critical). Emergency declared at district headquarters hospital.
  • Suspected Perpetrator: Not claimed; TTP or affiliated groups suspected based on operational pattern and geography
  • Confidence: Confirmed
  • Source Reliability: High — Dawn News, Pakistani police official statements

Sources:

Analyst Note: North Waziristan remains Pakistan’s most active IED corridor. This VBIED attack follows a similar incident near Miryan Police Station in Bannu on 16 February (motorcycle-borne IED, 2 killed). The targeting of checkpoints along the Bannu–Miranshah axis is consistent with TTP efforts to contest security force control of key transit routes. The use of a vehicle-borne device rather than a roadside IED suggests a deliberate effort to maximize casualties at a hardened target. C-IED teams operating in this theater should expect continued VBIED threat along the FATA highway network.

CARD 4: IED Targets Police Patrol in Wana Bazaar — South Waziristan, Pakistan

Location/Time: Rustam Bazaar, Wana, Lower South Waziristan, Khyber Pakhtunkhwa, Pakistan | ~17:00 PKT | 7 March 2026

Category / Context: Terror/Insurgent

Incident Type: Detonation

Incident Summary (TTP-focused): An IED planted near the main entrance of a supermarket in Rustam Bazaar detonated as police on routine patrol passed through the area. The blast killed two police constables (Mirza Alam and Gul Shah) and injured 31 others, including five more policemen and 26 civilians. The attack exploited the dense crowd gathered for Ramadan Iftar shopping to maximize civilian casualties.

  • Device Type: IED — planted/concealed near supermarket entrance
  • Delivery & Placement: Concealed at main gate of supermarket in crowded bazaar
  • Initiation Method: Remote control or timed device (per initial reporting)
  • Target Type: Police patrol in crowded commercial area
  • Effects: 2 police killed, 31 injured (5 police, 26 civilians)
  • Suspected Perpetrator: Not claimed; TTP or affiliated groups suspected
  • Confidence: Confirmed
  • Source Reliability: High — Dawn, Express Tribune, Pakistan Today, multiple local outlets

Sources:

Analyst Note: The deliberate timing during Ramadan evening shopping maximized the civilian casualty count — a well-known TTP tactic designed to undermine public confidence in security forces and to generate media attention. Placement near a supermarket entrance suggests pre-operational surveillance of police patrol patterns. The dual initiation options (remote/timed) indicate a degree of bomb-making sophistication. Two major IED attacks in Pakistan’s tribal belt within 24 hours (Cards 3 and 4) suggest either a coordinated campaign or an independently elevated tempo of operations. Security forces in KP should anticipate further attacks targeting soft commercial areas during Ramadan.

CARD 5: ISWAP Complex Attacks on Nigerian Military FOBs — Borno State, Nigeria

Location/Time: Forward Operating Bases at Mayanti, Gajigana, and Gajiram, Borno State, Nigeria | 28 February – 1 March 2026

Category / Context: Terror/Conflict — ISWAP

Incident Type: Complex attack with IED component

Incident Summary (TTP-focused): Islamic State West Africa Province (ISWAP) launched coordinated midnight assaults on three Forward Operating Bases. At FOB Mayanti (28 Feb), a large force attacked under heavy gunfire; reinforcements navigating to the base encountered ambushes and IED threats along routes. At FOB Gajiram (~01:15 on 1 Mar), attackers employed PKT guns, RPGs, and an armed drone. Troops repelled all three assaults with air support. Recovered materiel included an armed drone, locally fabricated mortar bombs, and anti-tank ordnance.

  • Device Type: IEDs along reinforcement routes; armed drone; locally fabricated mortar bombs
  • Delivery & Placement: Roadside IEDs on approach routes; drone-delivered ordnance
  • Initiation Method: Not specified (likely victim-operated for road IEDs)
  • Target Type: Military Forward Operating Bases
  • Effects: 1 Nigerian Army major killed; 10 insurgents killed; weapons and drone recovered
  • Suspected Perpetrator: ISWAP (Islamic State West Africa Province) — Confirmed
  • Confidence: Confirmed
  • Source Reliability: High — Nigerian military official statements, Premium Times, multiple Nigerian outlets

Sources:

Analyst Note: The coordinated three-base assault with IED route denial demonstrates ISWAP’s continued operational sophistication. The recovery of an armed drone at Gajiram is particularly significant — drone-borne IED employment is an evolving TTP that has appeared across multiple theaters (Syria, Iraq, Mexico, Ukraine) and is now firmly established in West Africa. The use of IEDs to interdict reinforcement routes during a complex attack is a tactical escalation from simple roadside ambush. C-IED planners in the Lake Chad Basin should anticipate combined drone/IED threats as standard ISWAP operating procedure.

CARD 6: Criminal Extortion Bombing at Nightclub — Trujillo, Peru

Location/Time: Dali nightclub, Trujillo, La Libertad Region, Peru | Pre-dawn hours | 7 March 2026

Category / Context: Criminal/Extortion

Incident Type: Detonation

Incident Summary (TTP-focused): An explosive device detonated inside or at the Dali nightclub in Trujillo during operating hours, injuring 44 people including three minors (ages 16–17). Victims suffered shrapnel wounds and amputations, indicating a fragmentation effect. Three suspects were subsequently arrested. Authorities linked the bombing to an extortion scheme operated by organized criminal gangs, including Los Pulpos.

  • Device Type: Explosive device — specific type not disclosed in open sources
  • Delivery & Placement: Placed at or inside the nightclub
  • Initiation Method: Not specified in open sources
  • Target Type: Commercial entertainment venue — extortion target
  • Effects: 0 killed, 44 injured (4 serious, including amputations); 3 minors among injured
  • Suspected Perpetrator: Organized crime / Los Pulpos gang — linked to extortion campaign
  • Confidence: Confirmed
  • Source Reliability: High — Associated Press, Al Jazeera, CBS News, ABC News, PBS

Sources:

Analyst Note: Trujillo recorded 136 extortion-linked explosions in 2025 alone (286 across La Libertad region), making this one of the world’s most concentrated criminal bombing theaters outside a conflict zone. The Los Pulpos gang has extended operations to Chile and other countries. This incident — injuring 44 people including minors — represents a significant escalation in lethality compared to the typical warning-type detonations. The pattern closely mirrors extortion bombing campaigns in Ecuador and Colombia. Security professionals operating in Peru’s northern coast should treat this as a sustained criminal IED campaign requiring dedicated C-IED resources.

CARD 7: Resistance Forces Mine Ambush on Junta Column — Kani Township, Myanmar

Location/Time: Near Aung Zay Yar Village, Kani Township, Sagaing Region, Myanmar | 7–8 March 2026

Category / Context: Conflict — Resistance vs. Military Junta

Incident Type: Detonation (mine ambush)

Incident Summary (TTP-focused): On 7 March, a junta column of approximately 300 troops in 12 vehicles advanced from the Chindwin Bridge area and shelled a religious celebration in Natla-po-taung Village, killing two novice monks and three civilians. On the morning of 8 March, a coalition of resistance forces (NMD, Unicorn Guerrilla Force, People Servant Force, Chanmyathazi Township PaKaFa, and Mingun PDF allies) ambushed the column near Aung Zay Yar Village using 16 “padesa mines” (command-detonated improvised anti-vehicle mines). Resistance sources claim approximately 30 junta soldiers were killed.

  • Device Type: “Padesa mines” — improvised anti-vehicle command-detonated mines (x16)
  • Delivery & Placement: Emplaced along road/route of advance
  • Initiation Method: Command-detonated (likely command wire or remote)
  • Target Type: Military convoy (12 vehicles, ~300 troops)
  • Effects: ~30 junta soldiers killed (resistance claim; not independently verified). Casualties evacuated by vehicles.
  • Suspected Perpetrator: Coalition of resistance forces (PDF and allied groups)
  • Confidence: Probable — sourced from resistance media; no independent verification
  • Source Reliability: Medium — CDM domestic news aggregation, Mizzima Daily News

Sources:

Analyst Note: The 16-mine ambush represents a substantial improvised anti-vehicle capability by Myanmar’s resistance forces. The “padesa mine” designation indicates locally manufactured command-detonated devices, consistent with the increasingly sophisticated IED production seen across Sagaing’s resistance workshops since 2022. The multi-group coalition conducting the ambush demonstrates improved tactical coordination. The pattern of junta columns shelling civilian/religious gatherings followed by IED ambushes on withdrawal routes is now an established feature of Myanmar’s civil war and should be tracked for TTP evolution.

CARD 8: Pipe Bomb Attack on Residential Property — East Belfast, Northern Ireland

Location/Time: Sheskin Way, East Belfast, Northern Ireland, UK | ~23:25 GMT | 2 March 2026

Category / Context: Criminal/Paramilitary — targeted intimidation

Incident Type: Detonation

Incident Summary (TTP-focused): A pipe bomb-type device detonated at the front door of a residential property, causing damage to the door and windows. A man and woman were inside the house at the time but were not injured. Police and ATO (Ammunition Technical Officers) attended the scene, and a number of items were removed for forensic examination.

  • Device Type: Pipe bomb
  • Delivery & Placement: Placed at front door of house
  • Initiation Method: Not specified in open sources (likely fuse or simple timer)
  • Target Type: Residential property — individuals inside
  • Effects: Property damage to door and windows. No injuries.
  • Suspected Perpetrator: Unknown. Consistent with paramilitary-style intimidation or criminal targeting prevalent in Belfast.
  • Confidence: Confirmed
  • Source Reliability: High — PSNI official statement, multiple Northern Ireland media outlets

Sources:

Analyst Note: Pipe bomb attacks on residential properties remain a persistent feature of Belfast’s paramilitary/criminal landscape. While typically lower-order devices, they represent a genuine threat to life — a device detonating at a front door while occupants are inside carries significant blast injury potential. The East Belfast location and residential targeting pattern is consistent with loyalist paramilitary or criminal gang intimidation. ATO response and evidence recovery suggest investigators are treating this as a serious criminal matter. No escalation trend is evident from this single incident, but the continued availability and willingness to deploy pipe bombs in Northern Ireland warrants ongoing monitoring.

CARD 9: Teenager Detonates Explosive at Bank ATM — Putilkovo, Moscow Region, Russia

Location/Time: VTB Bank branch, Volnaya Street, Putilkovo, Moscow Region, Russia | Afternoon | 7 March 2026

Category / Context: Criminal/Sabotage — remotely directed

Incident Type: Detonation

Incident Summary (TTP-focused): A 16-year-old detonated an improvised explosive device at ATMs inside a VTB bank branch. The blast wave knocked out the doors and caused interior damage. The teenager was reportedly acting on telephone instructions from unidentified remote handlers. He was detained by local residents and handed to Rosgvardiya. The resulting fire was extinguished by passersby using snow.

  • Device Type: IED — type not specified in open sources
  • Delivery & Placement: Placed directly at/on ATM inside bank branch
  • Initiation Method: Not specified
  • Target Type: Banking infrastructure (ATM)
  • Effects: No injuries. Significant property damage; branch closed.
  • Suspected Perpetrator: 16-year-old acting on “telephone instructions from unknown people.” Russian authorities have implied Ukrainian intelligence direction, though this is unverified.
  • Confidence: Confirmed (incident occurred); attribution to Ukrainian handlers is Unconfirmed
  • Source Reliability: Medium — Russian state media and regional outlets; attribution claims lack independent verification

Sources:

Analyst Note: This fits a pattern of suspected Ukrainian-directed sabotage/arson operations inside Russia that has accelerated since 2024. Russian authorities have documented a wave of such attacks, often involving recruited teenagers or vulnerable individuals given remote instructions to target infrastructure. While the IED sophistication appears low, the tactical model — remote recruitment and direction via encrypted communications — is relevant to C-IED professionals tracking remote-directed attack methodologies. The use of minors as operatives adds a concerning dimension.

CARD 10: ISWAP IED Attack on Bridge — Diffa Region, Niger

Location/Time: Bridge between Diffa and Doutchi, Diffa Region, Niger | Reported 2 March 2026 (attack occurred previous Wednesday, approx. 26 February)

Category / Context: Terror/Insurgent — ISWAP

Incident Type: Detonation

Incident Summary (TTP-focused): Islamic State West Africa Province (ISWAP) claimed responsibility for an IED attack on a bridge between Diffa and Doutchi, killing 6 people. The attack targeted infrastructure along a key transit route in southeastern Niger, consistent with ISWAP’s strategy of disrupting movement corridors in the Diffa region.

  • Device Type: IED — specifics not reported
  • Delivery & Placement: Emplaced on/near bridge along highway
  • Initiation Method: Not specified in open sources
  • Target Type: Bridge / transport infrastructure
  • Effects: 6 killed
  • Suspected Perpetrator: ISWAP — claimed
  • Confidence: Probable — ISWAP claim; limited independent verification from the region
  • Source Reliability: Medium — Liveuamap aggregation of ISWAP claim; limited independent media access to Diffa

Sources:

Analyst Note: The Diffa region bridge targeting is tactically significant — it denies government forces and civilian traffic access to key routes, effectively cutting off communities. ISWAP has escalated IED attacks in southeastern Niger throughout early 2026, including the February 10 attack near Baroua that killed 11 in a mixed transport vehicle. The pattern suggests a deliberate IED interdiction campaign targeting Niger’s road network. JNIM has simultaneously claimed IED attacks near Niamey itself, indicating that Niger faces a two-front IED threat from both AQ and IS affiliates. ERW/C-IED teams deployed to the Sahel should anticipate bridge and culvert-targeted IEDs as a continued priority.

CARD 11: Roadside IED Injures Civilian — Myinmu Township, Myanmar

Location/Time: Near Ngar Kin Village, Myinmu Township, Sagaing Region, Myanmar | ~15:30 local time | 1 March 2026

Category / Context: Conflict

Incident Type: Detonation

Incident Summary (TTP-focused): U Chit Shwe, a 70-year-old man, was traveling by car from Kambalu Township to Mandalay City when his vehicle triggered or passed near an improvised explosive device on the road near Ngar Kin Village. He suffered shrapnel injuries and was admitted to Mandalay Public Hospital.

  • Device Type: Roadside IED
  • Delivery & Placement: Roadside / buried along route
  • Initiation Method: Likely victim-operated (pressure or command-wire; not specified)
  • Target Type: Road — likely intended for military targets; civilian struck
  • Effects: 1 civilian injured (shrapnel)
  • Suspected Perpetrator: Attributed to PDF resistance forces by Myanmar government. Not independently confirmed.
  • Confidence: Confirmed (incident occurred); perpetrator attribution is Unconfirmed
  • Source Reliability: Low — Myanmar government media only

Sources:

Analyst Note: Civilian IED casualties are an endemic feature of Myanmar’s civil conflict. Sagaing Region has the highest density of IED incidents in the country, with both junta and resistance forces employing improvised devices. This incident underscores the ERW/UXO risk to civilian populations in contested areas of central Myanmar and the indiscriminate hazard posed by emplaced devices long after combat operations have moved on.

Weekly TTP and Threat Pattern Analysis

The most consequential development this period is the confirmed use of TATP in the New York City Gracie Mansion attack (Card 1). TATP — sometimes called “Mother of Satan” — has been the signature explosive of jihadist IED campaigns in Europe since 2015, but its appearance in a US domestic incident involving self-radicalized teenagers represents a crossing of a threshold that Western bomb technicians have long anticipated. The device construction — TATP packed inside glass jars with metallic fragmentation and hobby fuse initiation — is a low-sophistication design that could be replicated by any motivated individual with access to widely available precursors (acetone, hydrogen peroxide, sulfuric acid). The fact that the devices only partially functioned may reflect poor quality control in manufacture, which is itself a TATP characteristic: the compound is notoriously unstable and difficult to handle, meaning failed detonations do not indicate lack of intent or future capability. The combination of TATP with fragmentation fill represents a deliberate effort to produce casualties, not merely create a spectacle.

Targeting patterns this period reveal a geographic and contextual clustering worth noting. Two IED attacks in Pakistan’s tribal belt within 24 hours (Cards 3 and 4) — one VBIED at a checkpoint, one concealed bazaar device targeting police — suggest either a coordinated TTP campaign or an independently elevated operational tempo, likely linked to Ramadan. The Wana bazaar device was specifically timed to exploit Iftar shopping crowds, a tactic that maximizes civilian collateral and media attention. In West Africa, ISWAP’s bridge-targeted IED in Niger’s Diffa region (Card 10) continues a deliberate infrastructure interdiction campaign that has expanded from ambushes on patrols to systematic denial of road networks. Meanwhile, in Nigeria, ISWAP’s coordinated assaults on three Borno FOBs (Card 5) featured IED emplacement along reinforcement routes — a combined-arms integration of IEDs with conventional assault that mirrors techniques pioneered by IS in Iraq and Syria.

The geographic spread of IED activity this week spans five continents. Notable is the simultaneous appearance of attacks in both “expected” theaters (Pakistan, Nigeria, Niger, Myanmar) and “unexpected” locations (New York City, Oslo). The Oslo embassy device (Card 2) and the NYC IED attack occurred within hours of each other and both targeted US/Western interests, though no operational link has been established. Both incidents occurred during the first week of US/Israeli strikes on Iran, and the threat environment for Western interests globally has materially elevated as a result of this conventional conflict.

Cross-regional convergence is evident in criminal explosive use. Peru’s Trujillo nightclub bombing (Card 6) — 44 injured in an extortion attack — is part of a campaign that produced 286 explosions in La Libertad region in 2025. This pattern directly parallels extortion bombing campaigns in Ecuador and Colombia, and the Los Pulpos gang responsible has already expanded operations internationally. Russia’s ATM bombing (Card 9), while lower-order, fits a growing pattern of remotely directed sabotage using recruited minors — a TTP that could be adopted by other state and non-state actors.

For EOD/C-IED professionals, the coming week demands vigilance on three fronts. First, the NYC TATP incident may inspire copycat attempts in the US or Europe, particularly at politically charged gatherings — bomb squads should prepare for elevated callout rates at protest events. Second, the Iran conflict will continue generating asymmetric spillover: drone-IED attacks on US bases in Iraq (see Appendix), potential attacks on diplomatic facilities worldwide, and possible activation of proxy networks. Third, Ramadan will continue to provide both tactical opportunity (crowded markets, religious gatherings) and ideological motivation for attacks in South Asia and the Sahel through approximately 30 March.

Appendix: Conventional Conflict Context (IED/Asymmetric Implications)

US–Israel Strikes on Iran (Commenced 28 February 2026)

The US and Israel launched major strikes against Iranian military, nuclear, and air defense infrastructure beginning 28 February 2026. By the end of this reporting period, at least 1,230 people had been killed in Iran, with strikes continuing across Tehran and other cities. Iran responded with over 500 ballistic and naval missiles and approximately 2,000 drones, directed at both Israeli and US regional targets.

IED/CT Implications: The conventional conflict has immediately generated asymmetric IED-relevant activity:

  • Iraqi militia drone/IED attacks on US bases: The Islamic Resistance in Iraq claimed 29+ operations with “dozens” of missiles and drones targeting US assets in Iraq. The Guardians of the Blood Brigade and Saraya Awliya al-Dam targeted Victory Base (Baghdad) and Erbil. Iraq’s Kurdistan Region absorbed 110+ missile and drone attacks. Iraqi security forces interdicted at least three trucks carrying missile launchers and a drone on 4–5 March. These militia attacks, while primarily drone/missile-delivered, carry IED implications: the armed drone recovered at FOB Gajiram in Nigeria (Card 5) demonstrates how drone-delivered IED technology proliferates across theaters.
  • Diplomatic facility targeting: The Oslo embassy attack (Card 2) may be a harbinger of broader anti-US targeting. Norwegian police specifically increased security around Iranian diaspora and Jewish communities in response. European and Gulf state security services should anticipate elevated threat to US, Israeli, and allied diplomatic facilities.
  • Proxy activation risk: Iran’s proxy network — Hezbollah, Iraqi militias, Houthis, and potentially sleeper cells — is under maximum activation pressure. Any of these groups could resort to IED attacks against Western or Israeli soft targets as the conflict continues.

Mexico — CJNG Retaliatory Violence (Post–El Mencho Killing, Late February 2026)

Following the killing of CJNG leader Nemesio “El Mencho” Oseguera Cervantes on 22 February 2026, the cartel launched widespread retaliatory violence across Jalisco and neighboring states. This included a car bomb in San Juan de los Lagos that killed National Guard Captain Leonel Cardoso Gómez, explosive attacks on National Guard facilities, and road blockades with vehicle burnings. Twenty-five National Guard members were killed in Jalisco during the retaliation period.

IED/CT Implications: CJNG’s demonstrated VBIED, drone-IED, and FPV drone capability places it among the world’s most IED-capable non-state actors. The cartel has employed multi-munition drop systems, FPV drones that detonate on contact, and fiber-optic command-and-control systems. While the worst of the retaliatory violence appears to have occurred in late February, CJNG’s explosive capability persists and could be directed at government, rival cartel, or civilian targets at any time. US border security and law enforcement agencies should remain alert to potential IED technology transfer or spillover.

Russia–Ukraine Conflict (Ongoing)

Drone and missile attacks continued across the Russia–Ukraine theater this period, including explosions reported in Rostov Oblast, Krasnodar Krai (Armavir), and Kharkiv. A chemical plant explosion in Kirovo-Chepetsk (Kirov Region, 4 March) may or may not be conflict-related.

IED/CT Implications: The Russia–Ukraine conflict continues to serve as the world’s primary laboratory for drone-IED TTP development. FPV drone attacks, loitering munitions, and command-wire IED innovations from this theater are proliferating rapidly to other conflict zones (Myanmar, Sahel, Mexico). The ATM bombing in Putilkovo (Card 9) allegedly directed by Ukrainian handlers via phone represents a different dimension — the use of recruited agents for infrastructure sabotage inside Russia using IED techniques.

Data Gaps and Limitations

  • Middle East & Levant: Conventional conflict reporting dominates all search results for Iraq, Syria, Lebanon, and the wider region. IED-specific incidents could not be isolated from the massive volume of conventional strike reporting. Any non-conflict-related IED activity in Iraq or Syria during this period is likely unreported or unsearchable amid the fog of conventional war.
  • Sahel & West Africa: Niger’s Diffa region IED (Card 10) surfaced via ISWAP claim aggregation and specialized outlets (Counter-IED Report, Zagazola). Burkina Faso and Mali produced no March-specific IED reports despite known high activity levels — reporting is likely delayed or suppressed by media access restrictions under military juntas.
  • East Africa & Horn of Africa: No al-Shabaab IED incidents in Somalia surfaced for this specific period, despite al-Shabaab’s documented high IED operational tempo. This is likely a search limitation rather than a genuine pause in activity. Kenyan border area IED activity (last confirmed incident: 23 February) may have continued unreported. Mozambique (Cabo Delgado) produced no March 2026 IED reporting.
  • South Asia: Pakistan’s two incidents (Cards 3 and 4) are well-documented. India, Bangladesh, and Sri Lanka produced no IED/explosive incident reports for this period. Afghanistan produced no March 2026-specific incidents despite ongoing ISIS-K activity.
  • Southeast Asia: Myanmar is well-covered via resistance and junta media (Cards 7, 11). Philippines (Mindanao) and Thailand Deep South produced no March-specific IED reporting, though both have active IED threats — Thailand’s last confirmed incident was 8 February (Yala roadside IED).
  • China: No IED or criminal explosive incidents surfaced for March 2026. Searches using Chinese-language terms returned only industrial accidents and conventional news.
  • Scandinavia: The Oslo embassy device (Card 2) is the sole incident. Sweden’s endemic gang bombing problem (189 explosions in 2025) produced no individually indexed incidents for this specific week, though the high operational tempo makes it likely that unreported incidents occurred.
  • Russia & Former Soviet Union: The Putilkovo ATM device (Card 9) is the sole carded incident. Broader conflict-related explosions (Rostov, Krasnodar, Kirov) are covered in the Appendix. Independent verification of Russian incidents is limited.
  • European Union: No IED or explosive incidents surfaced for EU member states during this period. The EU’s broader hybrid warfare threat (including Russian-directed parcel bombs on aircraft) remains a background concern but produced no specific incidents this week.
  • British Isles: The East Belfast pipe bomb (Card 8) is the sole incident. No other UK bomb squad callouts or viable device reports surfaced for this period.
  • North America: The NYC Gracie Mansion attack (Card 1) dominates. No additional US bomb squad incidents or Canadian events surfaced.
  • South America: Peru’s Trujillo bombing (Card 6) is well-documented. Colombia, Ecuador, and Brazil produced no March-specific IED/explosive reports, though all three have active criminal explosive threats. The Mexico CJNG car bomb (Appendix) occurred in late February.
  • Central America: No IED or explosive incidents surfaced for this period. Gang-related grenade use in Guatemala, Honduras, and El Salvador may be ongoing but below the reporting threshold.
  • Caribbean: No incidents surfaced for this period.

End of Brief — Next scheduled brief: Monday 16 March 2026

Latest Posts

PDF Version

IGMBT Explosive Incident Brief for the Week of 2-8 Mar 2026Download
#No Tag

No responses yet

Leave a Reply

Your email address will not be published. Required fields are marked *