Weekly Global Explosives Incident Brief: 2026/05/25- 2026/05/31

Ed Bundy -
June 1, 2026
IGMBT Weekly Explosives Incident Brief

Classification: UNCLASSIFIED // OSINT

Prepared for: International Guild of Master Bomb Technicians

Prepared: Monday 1 June 2026

NOTE – Scope and Exclusions: This reporting window overlaps two active conventional conflicts that generate high volumes of conventional munitions employment: the Russia–Ukraine war and the residual Afghanistan–Pakistan border instability. Only IED, improvised-explosive, criminal-explosive, and ERW incidents are carded below. Conventional missile, artillery, and one-way-attack drone activity tied to those theaters is summarized in the Appendix with its IED/asymmetric implications, not carded as discrete incidents. Two high-casualty industrial explosions this week (the TNLA-controlled mining-explosives depot blast at Kaung Tat/Kaungtup in Myanmar’s Shan State on 31 May, 39 to 45-plus killed, and the Liuyang fireworks plant follow-on reporting in China) are excluded as accidents, not security incidents, despite heavy news volume. Armed-drone delivery of improvised payloads (Colombia) again sits at the boundary between conventional and improvised; where the payload and intent are clearly improvised and the strike is discrete, those events are treated in context rather than re-carded, since the major Colombian drone-IED events of this cycle fell in the prior window.

Audio Summary

EXECUTIVE SNAPSHOT

  • Colombia dominated the week, and the driver was the election. Six discrete in-window explosive events clustered around the 31 May presidential vote, ranging from a standoff “tatuco” barrage on an army battalion in Riohacha to motorcycle-borne devices against police patrols and an election-day detonation in Caquetá. This is a coordinated pre-election pressure campaign by the ELN and FARC-dissident fronts, not a series of unrelated strikes.
  • The Riohacha attack is the week’s most instructive TTP case. ELN’s “6 de diciembre” front launched twelve improvised projectiles (“tatucos”) at the Batallón Cartagena from a pickup parked roughly 380 meters away. Only three of the twelve functioned inside the perimeter; the rest were rendered safe afterward. Standoff improvised-mortar employment against a fixed military target, with a high dud rate, is a recurring Colombian signature worth studying for both attack-profile and post-blast clearance load.
  • Criminal extortion-by-explosive surfaced on three continents. South Africa’s Woolworths suffered IED detonations at two stores (Pretoria 28 May, Bloemfontein 29 May) in what investigators read as an extortion campaign against the retailer. Ecuador logged extortion-linked devices and a grenade render-safe in Guayaquil and Esmeraldas. Israel saw two gang-assassination car bombings in a single day. Same tactic class, very different actors.
  • Israel’s criminal car-bomb wave continued. Two vehicles exploded within hours on 26 May, in Afula (morning) and near Or Akiva (evening), each killing one man. Police are treating both as targeted assassinations tied to the organized-crime conflict that has run through Israel’s Arab community and increasingly beyond it.
  • Two significant pre-emptive disruptions. Cypriot police consolidated a terror case in Larnaca built on an ammonium-nitrate-based bomb-making cache, with arrested suspects reportedly intending to strike Israeli targets. In Moscow, the FSB arrested a security guard who had assembled an IED to bomb the Russian Ministry of Justice building. Both are render-safe/disruption wins rather than detonations.
  • Nigeria’s Borno IED problem stayed steady on two tracks. A targeted ISWAP IED killed a Civilian Joint Task Force commander near Baga on 26 May, while on 29 May a tricycle struck a legacy buried IED in Biu, killing four civilians and a soldier. Emplaced command-detonated attack and uncleared legacy ERW are running side by side in the same operating area.
  • Geographic bottom line: confirmed, well-sourced asymmetric and criminal explosive activity concentrated in three zones this week, Colombia’s Caribbean and Catatumbo–Caquetá arc, Nigeria’s Borno, and a criminal-explosive band running through South Africa, Israel, and coastal Ecuador. Several historically active theaters (Somalia, the Sahel core, Mindanao, Thailand’s Deep South) again produced no clearly in-window, well-sourced IED incident, most likely a reporting gap rather than a true lull.


INCIDENT LEDGER

#CountryCity/AreaCategoryTypeDeviceTargetCasualtiesConfidence
1ColombiaRiohacha, La GuajiraTerror/ InsurgentDetonationStandoff improvised projectiles (“tatuco”) x12, 3 functionedArmy battalion (Bn Cartagena)12 woundedConfirmed
2NigeriaNear Baga, Kukawa LGA, BornoTerror/ InsurgentDetonationRoadside/ command IEDCJTF commander’s vehicle1 killedProbable
3NigeriaBuratai, BornoTerror/ InsurgentDisruption3x emplaced IEDs (destroyed)Abduction route / troops0 (92 rescued)Confirmed
4NigeriaBiu, BornoConflict/ ERWDetonationLegacy buried IED (victim-operated)Civilian tricycle / road5 killed, 2 woundedProbable
5IsraelAfula and Or Akiva (central)Criminal/ GangDetonationVBIED (x2, same day)Targeted individuals’ vehicles2 killedConfirmed
6South AfricaPretoria and BloemfonteinCriminal/ ExtortionDetonationIED (x2, consecutive nights)Retail stores (Woolworths)0Confirmed
7ColombiaSan José del GuaviareTerror/ InsurgentDetonationExplosives + small arms (complex)Army troops on election securityNot specifiedConfirmed
8ColombiaPamplonita, CúcutaTerror/ InsurgentDetonationExplosive thrown by motorcyclistPolice patrol checkpoint3 woundedConfirmed
9ColombiaFlorencia, CaquetáTerror/ InsurgentDetonationLow-yield homemade devicePolice motorcycle patrol (near market)Not specifiedProbable
10ColombiaEl Paujil, CaquetáTerror/ InsurgentDetonationIEDElection-day public orderNot specifiedConfirmed
11ColombiaLa EsperanzaTerror/ InsurgentDisruptionCylinder IED (“tatuco”)Road (population/ route denial)0 (rendered safe)Confirmed
12CyprusLarnaca / Governor’s BeachTerror  (disrupted)Cache find/ DisruptionAmmonium-nitrate bomb-making cacheSuspected Israeli targets0 (4 arrested)Confirmed
13RussiaMoscowTerror  (disrupted)Cache find / DisruptionAssembled IED (plot)Ministry of Justice building0 (1 arrested)Confirmed
14MozambiqueMacomia, Cabo DelgadoTerror/ InsurgentDetonationRoadside IEDFADM military convoyNot specifiedProbable
15EcuadorGuayaquil and EsmeraldasCriminal/ ExtortionDetonation/ DisruptionIEDs and grenadeBusinesses / government buildingNot specifiedProbable


INCIDENT CARDS

CARD 1: Riohacha Standoff “Tatuco” Barrage on Battalion Cartagena

Location/Time: Riohacha, La Guajira, Colombia | early morning | Wednesday 27 May 2026

Category / Context: Terror/Insurgent. Attributed by the Armed Forces commander to the ELN “6 de diciembre” front, reportedly as reprisal for recent arrests of group members.

Incident Type: Detonation (standoff improvised indirect fire)

Incident Summary (TTP-focused): Attackers used a Ford 350-type pickup positioned roughly 380 meters from the Batallón de Infantería Mecanizada No. 6 “Cartagena” to launch twelve improvised projectiles, locally called “tatucos,” toward the base. Three of the twelve functioned inside the military facility; the remaining nine failed to detonate and were neutralized afterward by explosive-ordnance teams. Twelve soldiers were wounded, none seriously per provincial authorities, and nine had been discharged within a day. Departmental authorities posted a 200-million-peso reward. The standoff launch platform, the improvised-projectile munition, and the very high dud rate are the defining features.

  • Device Type: Improvised standoff projectiles (“tatuco”), launched in volley
  • Delivery & Placement: Vehicle-mounted launch rack on a pickup, ~380 m from the target
  • Initiation Method: Standoff launch; per-round functioning on impact/time (most failed)
  • Target Type: Fixed military installation (mechanized infantry battalion)
  • Effects: 12 soldiers wounded (none serious reported); 9 unexploded projectiles requiring render-safe
  • Suspected Perpetrator: ELN “6 de diciembre” front (official military attribution)
  • Confidence: Confirmed
  • Source Reliability: High (official attribution plus multiple national outlets)

Sources:

Analyst Note: The “tatuco” standoff barrage is a mature, repeatable Colombian insurgent profile, and the 75 percent dud rate here is the operationally important detail. For EOD, a single attack of this kind generates a render-safe problem an order of magnitude larger than the detonation itself, nine live improvised projectiles scattered in and around a working military base. Expect this signature to recur through the post-election period; route- and perimeter-clearance teams in Catatumbo, La Guajira, and Caquetá should plan for multi-item UXO callouts as the standard aftermath of an ELN standoff strike, not the exception.

CARD 2: Targeted ISWAP IED Kills CJTF Commander near Baga

Location/Time: Near Baga, Kukawa LGA, Borno State, Nigeria | not specified | on/about Tuesday 26 May 2026

Category / Context: Terror/Insurgent (ISWAP suspected)

Incident Type: Detonation (vehicle-targeted IED)

Incident Summary (TTP-focused): A prominent Civilian Joint Task Force commander was killed when suspected ISWAP fighters detonated an IED targeting his vehicle near Baga in the Kukawa Local Government Area. The CJTF is the local auxiliary militia that supports the Nigerian military against Boko Haram and ISWAP, and its commanders are high-value targets for the insurgents precisely because they hold the local human intelligence picture. Targeting a specific leader’s vehicle indicates either route prediction with a command-detonated emplacement or a victim-operated device sited on a known route.

  • Device Type: Roadside/command IED (not specified in open sources)
  • Delivery & Placement: Emplaced on a route used by the target’s vehicle
  • Initiation Method: Command or victim-operated (not specified)
  • Target Type: CJTF (pro-government militia) leadership
  • Effects: 1 killed (the commander)
  • Suspected Perpetrator: ISWAP (suspected; consistent with group’s leadership-decapitation pattern)
  • Confidence: Probable
  • Source Reliability: Medium (single aggregator citing Nigerian reporting)

Sources:

Analyst Note: ISWAP’s deliberate targeting of CJTF leadership is an intelligence-denial campaign as much as a kinetic one, killing the people who can identify fighters and read the ground. For C-IED planners, the takeaway is that auxiliary and militia movement patterns are now a priority emplacement-prediction problem, and protective measures (route variation, screening) cannot stay concentrated only on regular-force convoys. Watch for a sustained tempo of leader-targeted IEDs around Kukawa and the Lake Chad shoreline through the rainy season.

CARD 3: Operation Hadin Kai Rescues 92, Destroys Three IEDs in Biu

Location/Time: Buratai–Kamuya Road, Biu LGA, Borno State, Nigeria | not specified | Monday 25 May 2026

Category / Context: Terror/Insurgent (Boko Haram / ISWAP)

Incident Type: Disruption (route IEDs located and destroyed during rescue operation)

Incident Summary (TTP-focused): Troops of the Joint Task Force North East, Operation Hadin Kai, rescued 92 civilians who had been abducted by Boko Haram/ISWAP along the Buratai–Kamuya Road and, in the course of the operation, located and destroyed three emplaced IEDs. The pairing of mass abduction with route IEDs on the same corridor shows the insurgents using explosives to protect and channel movement, seeding the extraction route to deter or punish pursuing forces.

  • Device Type: 3x emplaced IEDs (type not specified)
  • Delivery & Placement: Buried/roadside on an abduction extraction route
  • Initiation Method: Not specified (consistent with victim-operated route denial)
  • Target Type: Pursuing security forces / route denial
  • Effects: No casualties reported; 92 civilians rescued; 3 IEDs destroyed
  • Suspected Perpetrator: Boko Haram/ISWAP
  • Confidence: Confirmed (official military statement)
  • Source Reliability: High (JTF operational statement via aggregator)

Sources:

Analyst Note: Route-seeding around abduction corridors is a force-protection problem that lands directly on EOD and route-clearance teams supporting rescue operations. The tactical lesson is that any deliberate operation into a known abduction corridor should assume an IED-defended extraction route and resource clearance accordingly before troops commit. The clean outcome here (rescue plus three devices destroyed, no casualties) is the model; the failure mode is a rescue force that pushes into the same ground without clearance and takes the casualties the abductors intended.

CARD 4: Legacy IED Strikes Tricycle in Biu

Location/Time: Biu, Borno State, Nigeria | not specified | Friday 29 May 2026

Category / Context: Conflict-related ERW (uncleared legacy device)

Incident Type: Detonation (victim-operated legacy IED)

Incident Summary (TTP-focused): A three-wheeled tricycle taxi triggered an old, previously emplaced IED in Biu, killing four civilians and a soldier and wounding two others. Open reporting frames this as an accidental strike on a legacy device rather than a fresh command-detonated attack, meaning the charge had been in the ground long enough to outlive whatever operation it was laid for. This is the ERW tail of the Borno insurgency: devices emplaced during earlier fighting that remain live on civilian roads.

  • Device Type: Legacy buried IED (type not specified)
  • Delivery & Placement: Previously emplaced on a road now in civilian use
  • Initiation Method: Victim-operated (vehicle strike)
  • Target Type: None specific; civilian transport struck the device
  • Effects: 5 killed (4 civilians, 1 soldier), 2 wounded
  • Suspected Perpetrator: Original emplacement attributed to Boko Haram/ISWAP; no fresh attack intent
  • Confidence: Probable
  • Source Reliability: Medium (regional Nigerian outlet)

Sources:

Analyst Note: Same week, same LGA cluster, opposite ends of the IED lifecycle: a deliberate leader-targeting strike (Card 2) and an accidental legacy-device casualty (this card). The legacy-ERW problem will outlast the active insurgency by years and is a humanitarian-demining and route-survey burden, not a tactical C-IED one. For anyone planning stabilization or return-of-population work in Borno, the operative assumption is that any road that saw fighting holds live charges until it has been cleared, and civilian traffic resuming on uncleared routes is the predictable casualty generator.

CARD 5: Two Criminal Car Bombings in a Single Day (Afula and Or Akiva)

Location/Time: Afula (morning) and near the Or Akiva interchange, Route 2, central Israel (evening, ~2004 local) | Tuesday 26 May 2026

Category / Context: Criminal/Organized crime (gang assassinations)

Incident Type: Detonation (two VBIEDs, same day)

Incident Summary (TTP-focused): Two vehicles exploded hours apart on 26 May. In the morning, a man in his 30s was killed in a car blast in Afula. That evening, Magen David Adom received a report of a vehicle that had exploded on Route 2 near the Or Akiva interchange and found a man dead at the scene with multi-system injuries, plus a brush fire started by the blast. Police are investigating both as targeted assassinations within the organized-crime conflict that has driven a sustained wave of vehicle bombings in Israel, predominantly affecting the Arab community but also claiming other victims.

  • Device Type: VBIED (under/within target vehicle); exact configuration not specified
  • Delivery & Placement: Emplaced on or in the victims’ vehicles
  • Initiation Method: Not specified (consistent with remote or movement-triggered initiation typical of these assassinations)
  • Target Type: Specific individuals tied to criminal disputes
  • Effects: 2 killed (one per incident)
  • Suspected Perpetrator: Organized-crime factions (no group named)
  • Confidence: Confirmed (two reputable outlets, emergency-service detail)
  • Source Reliability: High

Sources:

Analyst Note: Israel’s criminal VBIED problem is a high-frequency, high-competence threat that bomb techs should not file under “terrorism.” The builders are proficient, the targeting is precise, and collateral (the Or Akiva brush fire, prior bystander deaths) is routine. Two functioning vehicle bombs in one day points to either a single team running a tight tasking cycle or competing factions trading strikes. For protective-security professionals advising clients in the region, vehicle search and standoff discipline are the practical countermeasures, and the steady cadence suggests no near-term de-escalation.

CARD 6: Consecutive IED Detonations at Woolworths Stores (Extortion-Linked)

Location/Time: Woolworths Menlyn Park, Pretoria (early hours 28 May) and Woolworths Preller Square, Bloemfontein (early hours 29 May), South Africa

Category / Context: Criminal/Extortion

Incident Type: Detonation (two IEDs on consecutive nights)

Incident Summary (TTP-focused): Improvised explosive devices detonated inside or at two Woolworths stores on consecutive nights, first at the Menlyn Park branch in Pretoria, then less than 24 hours later at the Preller Square branch in Bloemfontein. Both fired between roughly 0100 and 0200 while the stores were closed, causing extensive property damage with no injuries. Woolworths confirmed the incidents publicly and raised vigilance nationwide. A former SAPS explosives investigator assessed the hallmarks as a likely extortion campaign against the retailer, while not ruling out other motives. The timing (empty stores, overnight, damage without casualties) is consistent with intimidation rather than mass harm.

  • Device Type: IED (configuration not specified in open sources)
  • Delivery & Placement: Placed inside/at the storefronts overnight
  • Initiation Method: Timer or remote (not specified)
  • Target Type: Commercial retail (single corporate victim, two locations)
  • Effects: Extensive property damage, no injuries
  • Suspected Perpetrator: Extortion network (suspected; no group named)
  • Confidence: Confirmed (company statement plus multiple outlets)
  • Source Reliability: High

Sources:

Analyst Note: This is the clearest single example this week of explosives migrating into commercial extortion in a country that already has a mature ATM- and cash-in-transit-bombing ecosystem (see the foiled Welkom CIT-bombing plot, 18 May, and ongoing North West and Free State ATM cases). The strategic risk is normalization: once a corporate target accepts that store bombings are a cost of doing business, the technique spreads to other retailers and the device-builders gain a steady revenue stream. Bomb techs and corporate security in South Africa should treat overnight, no-casualty IED placement at commercial premises as the signature of an extortion campaign and look for the demand that almost always precedes or follows it.

CARD 7: Complex Explosive-and-Small-Arms Attack on Election-Security Troops, Guaviare

Location/Time: San José del Guaviare, Guaviare, Colombia | not specified | Monday 25 May 2026

Category / Context: Terror/Insurgent (FARC dissidents)

Incident Type: Detonation (complex attack: explosives plus gunfire)

Incident Summary (TTP-focused): The Army reported that troops providing security for the 31 May elections were attacked with explosives and small-arms fire in San José del Guaviare. Reporting attributes the action to the “Jhon Linares” structure of the Jorge Suárez Briceño Bloc of the FARC dissidences (EMC-aligned). The complex-attack profile, an explosive initiation paired with direct fire, is designed to fix and then engage a patrol, and its placement against election-security forces ties it to the same pre-vote pressure campaign visible across the country this week.

  • Device Type: Explosives (type not specified) used with small arms
  • Delivery & Placement: Against deployed troops on election-security tasks (not specified)
  • Initiation Method: Not specified
  • Target Type: Army troops securing the electoral period
  • Effects: Not specified in open sources
  • Suspected Perpetrator: FARC dissidence, “Jhon Linares” structure / Jorge Suárez Briceño Bloc
  • Confidence: Confirmed (Army statement via national outlet)
  • Source Reliability: High

Sources:

Analyst Note: Guaviare extends the pre-election campaign into the EMC dissident heartland, separate from the ELN actions in the north, which matters because it shows two distinct armed structures running parallel explosive campaigns toward the same date. The complex-attack format (explosive plus fire) is more dangerous to responders than a single device, since the explosive often serves to channel reinforcements into a prepared killing area. Through early June, any quick-reaction or medevac response in EMC-influenced municipalities should assume a layered ambush rather than an isolated blast.

CARD 8: Motorcycle-Borne Explosive Against Police Patrol, Pamplonita

Location/Time: Pamplonita tollgate area, Cúcuta–Pamplona road, Norte de Santander, Colombia | not specified | Tuesday 26 May 2026

Category / Context: Terror/Insurgent (ELN suspected per Defense Ministry)

Incident Type: Detonation (thrown/placed device from a motorcycle)

Incident Summary (TTP-focused): A man on a motorcycle activated an explosive device against a police patrol conducting security checks on the Cúcuta–Pamplona road near Pamplonita, wounding three officers. The motorcycle-borne approach gives the attacker mobility to close on a static checkpoint, deliver the device, and exit, and it has become a common urban and peri-urban delivery method in Norte de Santander. The Defense Ministry pointed to the ELN.

  • Device Type: Hand-emplaced/thrown explosive (type not specified)
  • Delivery & Placement: Delivered from a moving motorcycle against a checkpoint
  • Initiation Method: Likely command/throw-initiated (not specified)
  • Target Type: Police patrol conducting road checks
  • Effects: 3 police officers wounded
  • Suspected Perpetrator: ELN (Defense Ministry attribution)
  • Confidence: Confirmed (official attribution plus outlets)
  • Source Reliability: High

Sources:

Analyst Note: Motorcycle-borne IED delivery against fixed police checkpoints is the Catatumbo signature that most directly threatens routine policing. The countermeasure problem is hard: a checkpoint is by definition static and predictable, and a single rider can deliver and disengage in seconds. For Colombian police EOD and force-protection planners, the practical mitigations are checkpoint hardening, standoff vehicle screening lanes, and rotating checkpoint locations, and the threat should be assumed elevated across Norte de Santander through the post-election window.

CARD 9: Low-Yield Device Against Police Patrol, Florencia

Location/Time: Near a supermarket on a main road, Florencia, Caquetá, Colombia | not specified | Wednesday 27 May 2026

Category / Context: Terror/Insurgent (EMC dissidence assessed, not confirmed)

Incident Type: Detonation (low-yield homemade device)

Incident Summary (TTP-focused): A homemade, low-intensity explosive detonated as police patrolled on motorcycles near a supermarket on one of Florencia’s main roads. Preliminary reporting characterizes the charge as small and homemade. Placement in a commercial area against a moving police patrol, in the departmental capital of Caquetá and days before the vote, again fits the pattern of low-cost harassment strikes meant to project insurgent presence in urban centers.

  • Device Type: Low-yield homemade IED (not specified further)
  • Delivery & Placement: Roadside/urban, near a supermarket
  • Initiation Method: Not specified
  • Target Type: Police motorcycle patrol; urban commercial setting
  • Effects: Not specified (low intensity reported)
  • Suspected Perpetrator: Not confirmed in open sources (EMC dissidence presence in Caquetá)
  • Confidence: Probable
  • Source Reliability: Medium (single regional outlet, preliminary)

Sources:

Analyst Note: The value of this incident is less the blast than what it signals: insurgent willingness to detonate small charges in crowded urban commercial space to manufacture a sense of insecurity around the election. Low-yield does not mean low-consequence in a market environment, where fragmentation and panic injuries scale with the crowd. Bomb techs supporting Caquetá should expect a higher baseline of small, hard-to-predict urban devices through early June, and treat “low intensity” as a description of charge size, not of the render-safe or investigative workload.

CARD 10: Election-Day IED Detonation, El Paujil

Location/Time: El Paujil, Caquetá, Colombia | election day | Sunday 31 May 2026

Category / Context: Terror/Insurgent (anti-election)

Incident Type: Detonation

Incident Summary (TTP-focused): On the day of the presidential election, the commander general of the military reported the detonation of an explosive device in El Paujil, Caquetá, among a set of public-order incidents that also included grenade and blockade activity near polling areas elsewhere in the country. The National Police had mobilized roughly 120,000 officers and dozens of aircraft to secure the vote in response to detected risks. The device functioned on the highest-visibility day available, the textbook timing for an anti-election strike.

  • Device Type: IED (type not specified)
  • Delivery & Placement: Not specified
  • Initiation Method: Not specified
  • Target Type: Electoral process / public order
  • Effects: Not specified in available sources
  • Suspected Perpetrator: Not named (consistent with EMC dissidence active in Caquetá)
  • Confidence: Confirmed (military command statement via national outlet)
  • Source Reliability: High

Sources:

Analyst Note: El Paujil is the capstone of the week’s election narrative, the campaign delivering on its evident intent on voting day itself. The forward-looking concern is the immediate post-election window: armed groups that invested in a pre-vote campaign frequently continue into the result and inauguration period, either to contest the outcome or to demonstrate they were not suppressed by the security surge. C-IED tempo across Caquetá, Guaviare, and the Catatumbo arc should be expected to stay high into mid-June rather than subside with the close of polls.

CARD 11: ELN Cylinder IED Rendered Safe, La Esperanza–San Alberto Road

Location/Time: Road between La Esperanza and San Alberto, Cesar, Colombia | not specified | Monday 25 May 2026

Category / Context: Terror/Insurgent (ELN)

Incident Type: Disruption (device located and destroyed)

Incident Summary (TTP-focused): Security forces located and destroyed a cylinder-type ELN explosive (“tatuco”) that threatened the road between La Esperanza and San Alberto. Cylinder IEDs of this kind are a long-standing ELN munition, used both as emplaced road charges and as standoff projectiles, and their appearance on a connecting road indicates route-denial or ambush preparation rather than a strike against a specific target. The render-safe outcome removed the threat before initiation.

  • Device Type: Cylinder IED (“tatuco”)
  • Delivery & Placement: Emplaced to threaten a road
  • Initiation Method: Not specified (consistent with command or victim-operated road charge)
  • Target Type: Road / route denial
  • Effects: None (rendered safe)
  • Suspected Perpetrator: ELN
  • Confidence: Confirmed (military operation reported by outlet)
  • Source Reliability: High

Sources:

Analyst Note: This is the same munition family as the Riohacha barrage (Card 1), here in its emplaced-road-charge role, which underlines how versatile the cylinder “tatuco” is across the ELN inventory. A pre-detonation find on a connecting road is a clearance win but also an indicator: the presence of emplaced cylinders signals the front is preparing the ground for ambush or route interdiction in Cesar. Bomb techs working the Cesar–Norte de Santander boundary should treat cylinder finds as a leading indicator of a planned action rather than a one-off, and sustain proactive route survey in the area.

CARD 12: Larnaca Bomb-Making Cache Disrupted (Suspected Israeli Targets)

Location/Time: Governor’s Beach and Kamares (Larnaca district), Cyprus | arrests from 22 May, developments through 30 May 2026

Category / Context: Terror (disrupted)

Incident Type: Cache find / Disruption

Incident Summary (TTP-focused): Cypriot police, investigating a suspected terror plot, recovered bomb-making materials including ammonium nitrate and other chemical substances at two properties, a house in the Governor’s Beach area and an apartment in the Kamares area of Larnaca. Two suspects (aged 32 and 38) were arrested near Governor’s Beach on 22 May, with two more arrested in the Larnaca district as the investigation widened; local media identified the suspects as Palestinians, and one reportedly admitted Israelis were the intended targets. Authorities believe the arrests prevented attacks on the island. Larnaca police stated they had stopped attacks following the explosives find.

  • Device Type: Ammonium-nitrate-based bomb-making cache (precursors, not assembled devices reported)
  • Delivery & Placement: Stored at two residential properties
  • Initiation Method: N/A (pre-construction stage)
  • Target Type: Suspected Israeli/Jewish targets on Cyprus
  • Effects: None (plot disrupted; four arrested)
  • Suspected Perpetrator: Under investigation; suspects reportedly Palestinian, coordination with foreign partners
  • Confidence: Confirmed (police statements plus multiple outlets)
  • Source Reliability: High

Sources:

Analyst Note: This is the second consecutive cycle in which a Mediterranean tourist jurisdiction has surfaced an ammonium-nitrate cache tied to suspected Israeli-target plotting, and it fits a broader pattern of transnational targeting of Israeli and Jewish sites in Europe. For C-IED and protective-security professionals, the operative signal is precursor acquisition and storage in soft, low-scrutiny residential settings in holiday areas, where neither the materials nor the operators draw attention. Liaison-driven disruption is doing the heavy lifting here; the watch item is whether the network has parallel cells elsewhere that did not get rolled up.

CARD 13: FSB Disrupts IED Plot Against Russian Ministry of Justice

Location/Time: Moscow, Russia | arrest reported 30 May 2026

Category / Context: Terror (disrupted)

Incident Type: Cache find / Disruption

Incident Summary (TTP-focused): Russian authorities arrested a 61-year-old security guard who had assembled an improvised explosive device and, per the reporting, planned to detonate it at the Russian Ministry of Justice building. A criminal case was opened for manufacturing explosives and the suspect was remanded into pretrial detention. The case sits within a run of 2026 Russian domestic plots, some attributed by the FSB to recruitment by Ukrainian services, including a separately reported incident in which a man stored an IED in his refrigerator after sourcing build instructions online.

  • Device Type: Assembled IED (configuration not detailed)
  • Delivery & Placement: Intended emplacement at a government building (not reached)
  • Initiation Method: Not specified
  • Target Type: Russian Ministry of Justice (government infrastructure)
  • Effects: None (plot disrupted; one arrested)
  • Suspected Perpetrator: Lone suspect; broader 2026 pattern of recruited domestic actors
  • Confidence: Confirmed (Russian official sources plus multiple outlets)
  • Source Reliability: Medium-High (state-linked sourcing; treat motive framing with caution)

Sources:

Analyst Note: The consistent thread across Russia’s 2026 domestic-IED cases is the recruited or self-radicalized lone builder working from online instructions against fixed government targets, a profile that is hard to detect before the materials come together. State framing around foreign-service recruitment should be read critically, but the underlying device-builder problem is real and not propaganda. For analysts, the watch item is the continuing diffusion of build knowledge and the relatively low technical bar these cases display, which keeps the domestic IED threat inside Russia at a steady simmer regardless of attribution.

CARD 14: ISM Roadside IED Against FADM Convoy, Macomia

Location/Time: Macomia, Cabo Delgado, Mozambique | date imprecise (May 2026) | in/around the reporting window

Category / Context: Terror/Insurgent (Islamic State Mozambique Province)

Incident Type: Detonation (roadside IED against a convoy)

Incident Summary (TTP-focused): Conflict-monitoring reporting indicates that Islamic State Mozambique (ISM) elements deployed an IED against a Mozambican Armed Forces (FADM) convoy in Macomia during May, amid a broader resurgence of insurgent activity that displaced tens of thousands across Cabo Delgado. ISM’s adoption and repeated use of roadside IEDs against military road movement is a meaningful escalation in a theater historically dominated by raids and small-arms ambushes. The exact in-window date could not be isolated from open monitoring summaries.

  • Device Type: Roadside IED (type not specified)
  • Delivery & Placement: Emplaced against a military convoy route
  • Initiation Method: Not specified (consistent with command/victim-operated roadside charge)
  • Target Type: FADM military convoy
  • Effects: Not specified in open monitoring
  • Suspected Perpetrator: Islamic State Mozambique Province (ISM)
  • Confidence: Probable (conflict-monitoring sourcing; date imprecise)
  • Source Reliability: Medium (analytic monitoring, not incident-level press)

Sources:

Analyst Note: If ISM’s roadside-IED use against convoys is consolidating, Cabo Delgado is following the same escalation curve seen in the Sahel and Somalia, where insurgent IED capability matured from opportunistic to systematic over a few seasons. The practical implication is that FADM and partner-force road movement in Macomia and Chiúre now needs route-clearance and convoy hardening that the force may not have, and the displacement surge means civilian traffic is mixing into the same threatened road network. This is the regional escalation indicator most worth tracking into the next quarter, even though the in-window detail here is thin.

CARD 15: Extortion-Linked Devices and Grenade Render-Safe, Coastal Ecuador

Location/Time: Guayaquil (Guasmo Sur, La Pradera) and Esmeraldas, Ecuador | 27–31 May 2026

Category / Context: Criminal/Extortion

Incident Type: Detonation and Disruption (multiple low-level events)

Incident Summary (TTP-focused): Coastal Ecuador logged a cluster of extortion-linked explosive activity in the back half of the week. In Guayaquil, the National Police GIR conducted a controlled detonation of a grenade found near a temple in Guasmo Sur, while a separate explosive damaged a battery shop in La Pradera in a suspected extortion case. On 27 May a supermarket administrator in Caluma Viejo (Bolívar province) reported a suspicious package accompanied by written threats, handled as extortion-by-leaflet plus device. On 29 May a suspected explosive device was found in front of the Provincial Government building in central Esmeraldas. The common thread is extortion pressure on businesses and, in the Esmeraldas case, a government building, using small devices and grenades.

  • Device Type: Hand grenade (render-safe) and improvised/IED charges (not specified)
  • Delivery & Placement: Placed at businesses and a government building; grenade abandoned/emplaced
  • Initiation Method: Mixed (one grenade rendered safe; others detonated or found)
  • Target Type: Commercial premises and a provincial government building
  • Effects: Property damage reported (battery shop); no casualties specified
  • Suspected Perpetrator: Organized-crime extortion networks (no group named)
  • Confidence: Probable (local outlets; extortion link assessed, not confirmed)
  • Source Reliability: Medium (regional Ecuadorian press and police releases)

Sources:

Analyst Note: Ecuador’s criminal-explosive picture is converging with the South African and Israeli criminal cases this week: extortion enforced by small devices against commercial targets, with military grenades circulating freely in the criminal economy. The grenade prevalence is the EOD-specific concern, since trafficked military ordnance lands degraded and unpredictable in the hands of untrained users and police EOD inherit the render-safe burden. Watch for the Esmeraldas government-building device to mark a shift from purely private-sector extortion toward intimidation of state institutions, which would raise the threat tier materially.

WEEKLY TTP AND THREAT PATTERN ANALYSIS

Device construction and delivery trends. The standout construction signature this week is Colombia’s improvised projectile, the “tatuco,” seen in both of its roles: as a standoff barrage munition launched in volley from a vehicle against a fixed base (Riohacha, Card 1) and as an emplaced cylinder road charge rendered safe before initiation (Cesar, Card 11). The Riohacha event also surfaced the most operationally significant detail of the week, a roughly 75 percent dud rate, with only three of twelve projectiles functioning. High failure rates are characteristic of improvised indirect-fire munitions and they convert every standoff attack into a large multi-item UXO clearance problem. Elsewhere, construction held to established patterns: criminal VBIODs in Israel, overnight commercial IEDs in South Africa, motorcycle-delivered and low-yield homemade charges in Colombia’s urban centers, and a precursor cache (ammonium nitrate) in Cyprus that had not yet reached device assembly. No genuinely novel fill or initiation chemistry appeared in open reporting.

Targeting pattern shifts and identifiable campaigns. Two campaigns define the week. The first is Colombia’s pre-election insurgent campaign, the clear connective thread across at least six in-window events (Cards 1, 7, 8, 9, 10, 11), run in parallel by the ELN in the north and Caribbean and by EMC/FARC-dissident structures in Guaviare and Caquetá, and culminating in an election-day detonation at El Paujil. The second is a cross-continental criminal extortion-by-explosive pattern, with South Africa’s Woolworths bombings (Card 6), Ecuador’s business-targeted devices and grenades (Card 15), and the broader South African ATM and cash-in-transit ecosystem all expressing the same logic: explosives as coercion leverage against commercial targets, calibrated for damage and fear rather than mass casualties. Israel’s same-day double car bombing (Card 5) is a third, distinct pattern, targeted assassination within an organized-crime conflict. On the counter-threat side, two pre-emptive disruptions (Cyprus, Card 12; Moscow, Card 13) show liaison- and intelligence-led interdiction removing devices before initiation.

Geographic concentration. Confirmed, well-sourced activity concentrated in three zones. Colombia’s Caribbean–Catatumbo–Caquetá arc was the densest, driven entirely by the election. Nigeria’s Borno produced the week’s clearest mix of deliberate attack and legacy ERW in a single LGA cluster (Cards 2, 3, 4). And a criminal-explosive band ran through South Africa, Israel, and coastal Ecuador. This is concentration in existing hotspots plus a notable criminal-explosive breadth, rather than insurgent spread into new territory. The recurring negative finding also held: the Sahel core, Somalia, Mindanao, and Thailand’s Deep South produced nothing clearly in-window and well-sourced, which for Somalia and the Sahel almost certainly reflects media-access constraints and conventional-conflict reporting crowding out IED-specific detail, not a real pause.

Cross-regional TTP convergence. The convergence to flag this week is criminal extortion-by-explosive arriving at the same solution on three continents at once. South African, Ecuadorian, and (in assassination form) Israeli criminal actors are all using explosives, including trafficked military grenades, as instruments of commercial coercion and score-settling. This is a different convergence from the insurgent-drone story that dominated the prior cycle, and it matters because criminal explosive use tends to scale faster than insurgent use once it proves profitable, and it puts EOD demand into civilian police forces that are often under-resourced for it. The persistence of ammonium-nitrate precursor plots against Israeli targets in Mediterranean Europe (Cyprus this week, following a similar pattern previously) is a second convergence worth holding on the board.

Implications for EOD/C-IED professionals in the coming week. First, Colombia is the priority watch: the post-election window (the result, transition, and any contestation) historically sustains or increases insurgent explosive tempo rather than ending it, so counter-UAS awareness, checkpoint hardening against motorcycle-borne delivery, and multi-item UXO clearance capacity should stay surged across the Catatumbo–Caquetá–La Guajira arc into mid-June. Second, the “tatuco” dud rate is a planning factor, not a footnote: treat any standoff improvised-projectile attack as generating multiple live rounds that must be cleared, and resource the render-safe tail accordingly. Third, criminal extortion bombings of commercial premises (South Africa, Ecuador) are a growth threat that local police EOD should expect to inherit, with overnight no-casualty device placement as the diagnostic signature. Fourth, Borno’s legacy-IED casualties are a reminder that route survey and humanitarian clearance must precede the return of civilian traffic to any ground that saw fighting. Finally, the Cyprus and Moscow disruptions are encouraging, but both depended on getting ahead of assembly, which argues for sustained precursor-acquisition monitoring as the highest-leverage prevention point.

APPENDIX: CONVENTIONAL CONFLICT CONTEXT (IED/ASYMMETRIC IMPLICATIONS)

Russia–Ukraine War

The war continued at high intensity through the window. Russia launched one of its largest combined missile-and-drone strikes of the year against Kyiv and other regions overnight on 24 May (immediately before this window), with further strikes reported through 30–31 May, and Ukraine reported striking the Saratov refinery in southwestern Russia on 31 May. A Russian drone crashed onto a residential building in Galați, Romania, on 29 May, causing an explosion and fire and injuring two people, a reminder of cross-border spillover onto NATO territory. The carded scope excludes missile, artillery, and one-way-attack drone strikes.

IED/CT Implications: The relevant threads for bomb techs are two. First, the domestic-Russia IED plot picture (Card 13) and the steady 2026 cadence of recruited or self-directed device-builders against fixed government targets, a home-front threat that is largely decoupled from front-line events and likely to persist. Second, the continued diffusion outward of cheap explosive-drone delivery expertise battle-tested in this war, which is the most plausible upstream source for the explosive-drone techniques now entrenched in Colombia and elsewhere. The Galați spillover also keeps Romanian and Moldovan EOD on a recurring callout footing for crashed munitions with live warheads.

Afghanistan–Pakistan Border Instability and the Balochistan/KP Insurgency

The reporting window opened on the immediate aftermath of the 24 May Quetta train suicide VBIED (carded in last week’s brief), which the Baloch Liberation Army claimed and which killed at least 14 to 23 and wounded dozens. Within the window, Pakistani open reporting was comparatively thin on fresh in-window IED detonations, with the most concrete items being a 10-kilogram remote-controlled bomb defused in Bannu (24 May, just before the window) and continued counter-militant operations across KP and Balochistan.

IED/CT Implications: Persistent border instability keeps TTP-aligned and Baloch separatist networks supplied with movement, sanctuary, and materiel, sustaining the roadside-IED, motorcycle-bomb, and VBIED threat across KP and the tribal districts and the rail and road corridors of Balochistan. The BLA’s sustained assault on Pakistan’s rail network should still be treated as an active corridor campaign, and the thin in-window detonation reporting is more likely a reporting and verification gap than a genuine lull, given the operational tempo on both sides. C-IED planners should keep route-clearance and standoff screening concentrated at rail nodes and along the Bannu–Wana–Dera Ismail Khan axis.

Myanmar Internal Conflict (Excluded High-Casualty Explosion Noted for Transparency)

The 31 May explosion at a mining-explosives store in the TNLA-controlled village of Kaung Tat/Kaungtup in northern Shan State killed at least 39, with rescue and independent reporting indicating more than 45 dead and roughly 70 injured. The TNLA, which controls the area and is in conflict with the military junta, attributed it to accidental detonation of explosives used for mining and quarrying.

IED/CT Implications: The event is excluded from the incident cards as an accident, not a security incident, but it is flagged here because it sits inside an active conflict zone and illustrates a real second-order hazard: armed-group control of bulk commercial and military explosives in ungoverned space, stored without safety oversight, creates both accidental mass-casualty risk and a ready feedstock for IED manufacture. For analysts tracking Myanmar’s resistance-versus-junta IED problem, insurgent-held bulk explosive stockpiles are the supply side of that threat, and incidents like this one are a window onto stockpile scale.

DATA GAPS AND LIMITATIONS

  • Middle East & Levant: Represented by the Israel criminal car bombings (Card 5) and the Cyprus precursor-cache disruption (Card 12, Mediterranean/EU). Iraq produced relevant but out-of-window or undated items, including an IED that killed three and wounded four Counter-Terrorism Service personnel in Nineveh (reported 24 May, just before the window) and an ISIS legacy device that wounded a farmer near Hit, Anbar. Iraqi militia activity again appeared mostly as rocket/drone reporting that could not be cleanly isolated into IED-specific events. Search terms: roadside bomb Iraq Syria, Nineveh IED, Damascus car bomb, militia explosive.
  • Sahel & West Africa: Nigeria’s Borno is strongly represented (Cards 2, 3, 4). For the Sahel core (Mali, Burkina Faso, Niger), JNIM IED-ambush activity remained active in analytic reporting but the cleanest dated items (a Russian Afrika Korps/Malian-army pressure-plate IED find near Bolibana, 24 May; an earlier JNIM civilian-transport IED at Negala) fell just outside or before the window. Search terms: engin explosif improvisé, convoi, gendarmerie, JNIM IED, Borno ISWAP IED.
  • East Africa & Horn of Africa: No clearly in-window carded incident isolated. The closest item was a Kenyan multi-agency patrol that recovered an IED on the Garissa–Dadaab road (reported 24 May, just before the window). Somalia/al-Shabaab returned only background and historical results despite a high baseline IED tempo; this is a media-access and verification gap, not an assessed lull. Search terms: al-Shabaab Mogadishu VBIED, Garissa Dadaab IED, Cabo Delgado ASWJ.
  • Southern Africa: Strongly represented. South Africa carded (Card 6, Woolworths) with additional in-region context (Welkom CIT-bombing plot foiled 18 May; ongoing North West/Free State ATM cases). Mozambique carded (Card 14, Macomia ISM IED, date imprecise). No incidents surfaced for Angola, Botswana, Lesotho, Malawi, Namibia, Eswatini, Zambia, or Zimbabwe. Search terms: ATM bombing, cash-in-transit explosives, Cabo Delgado IED.
  • South Asia: Pakistan context is in the Appendix; no clean in-window Pakistani IED detonation could be isolated beyond the 24 May Bannu defusal and the prior-week Quetta VBIED. India returned a Manipur grenade thrown at an Air India cargo manager’s residence in Imphal on 23 May (failed to detonate, just before the window; part of a KCP cargo-extortion series) and the early-May Kanker/Narayanpur demining IED, both outside the window. No in-window J&K, Bangladesh, or Sri Lanka incident isolated. Search terms: Naxalite IED Chhattisgarh, Kashmir grenade, Manipur IED, Bangladesh crude bomb.
  • Southeast Asia: No in-window IED incident isolated. Thailand’s Deep South returned the January petrol-station bombings; Philippines Mindanao returned historical BIFF/Abu Sayyaf material with no dated in-window event; Myanmar’s in-window explosion was the excluded TNLA mining-explosives accident (Appendix). Search terms: Pattani Narathiwat bomb, Mindanao Sulu IED, Myanmar PDF landmine.
  • China: No security-relevant IED incident. The high-casualty May fireworks-factory explosion (Liuyang) and a coal-mine blast are industrial accidents, excluded per scope. Search terms: 爆炸, 炸弹, 爆炸物, China attack.
  • Scandinavia: No clearly in-window incident isolated with reputable, dated sourcing. Sweden’s gang-bombing phenomenon remained active in background reporting (police noted dozens of bystander casualties over three years), but no specific 25–31 May detonation surfaced cleanly. Given Sweden’s near-daily baseline, this is an aggregation gap rather than a genuine pause. Search terms: sprängning, gängkriget bomb, Stockholm explosion, bostadshus blast.
  • Russia & Former Soviet Union: Represented (Card 13, Moscow MoJ plot; Novorossiysk refrigerator-IED detention). A drone crash-detonation into Lake Drīdzis, Latvia (23 May) fell just before the window and caused no injuries. Search terms: взрыв, СВУ, самодельное взрывное устройство, ФСБ задержан.
  • European Union: Represented by Cyprus (Card 12). Greece’s in-window explosive activity was render-safe of suspected Ukrainian-origin naval-drone explosives off Lefkada (7–11 May, before the window). Romania’s Galați drone-crash explosion (29 May) is in the Appendix. An Austrian court sentenced a man for a 2024 Taylor Swift concert knife-and-explosives plot (29 May, court outcome, not a new incident). No in-window EU criminal IED detonation isolated beyond the Cyprus cache. Search terms: explosive device parcel bomb, controlled detonation, Athens IED, Sprengsatz.
  • British Isles: Only ERW/UXO render-safe and low-level items surfaced in-window: a bomb-disposal detonation on Bridlington beach (31 May), a controlled explosion of an unexploded ordnance device in Norwich (late May), and a petrol-bomb attack on a house in Tandragee, Co. Armagh (28 May, not an IED). No viable terrorist IED incident isolated. Search terms: suspect device, viable device, controlled explosion, Northern Ireland, EOD device.
  • North America: No clearly in-window IED attack isolated. In-window items were court and possession cases (an Idaho man sentenced for possession of an explosive device, 27 May) plus an out-of-window infrastructure item (the grenade-type IED recovered at Mobile/Converse Reservoir, Alabama, ~13–15 May, flagged previously as significant water-supply-targeting context). A phosphorus canister washed ashore at Fripp Island, South Carolina (23 May) was ERW, just before the window. Search terms: pipe bomb, device found, bomb squad, controlled detonation, hazardous device, suspect device.
  • South America: Strongly represented, Colombia (Cards 1, 7, 8, 9, 10, 11) and Ecuador (Card 15). Beyond these, Colombian reporting also logged additional ELN explosive finds and a drone-IED strike at Tibú on 24 May (carded last week). Search terms: artefacto explosivo, bomba casera, tatuco, granada extorsión, drones explosivos.
  • Central America: No clearly in-window carded incident isolated. Guatemala’s DIDAE reported destroying multiple explosive devices in ongoing operations, and Guatemalan raids recovered explosives in extortion cases, but no dated in-window event met the sourcing bar. Search terms: artefacto explosivo, granada, pandilla, extorsión, DIDAE.
  • Caribbean: No discrete in-window carded incident. Haiti’s dominant explosive activity remained the state/quasi-state kamikaze-drone campaign against gangs in Port-au-Prince amid a major displacement surge (over 30,000 displaced, dozens killed in gang clashes from 9 May), treated as context rather than a carded IED event. Search terms: Haiti kamikaze drone, grenade gang, Port-au-Prince explosive, Trinidad grenade.

End of Brief – Next scheduled brief: Monday 8 June 2026

Latest Posts

PDF Version

IGMBT Explosives Incident Brief for the Week of 25-31 May 2026Download

#No Tag

Comments are closed