Weekly Global Explosives Incident Brief: 2026/03/23- 2026/03/29

Ed Bundy -
March 30, 2026
Weekly Explosive Incident Brief

Period: Monday 23 March 2026 – Sunday 29 March 2026

Classification: UNCLASSIFIED // OSINT

Prepared for: International Guild of Master Bomb Technicians

Prepared: 30 March 2026

NOTE ON CONVENTIONAL CONFLICT EXCLUSIONS: This reporting period coincides with active conventional conflicts in multiple theaters generating high volumes of airstrikes, missile exchanges, and artillery. The ongoing Iran-proxy vs. US/Israel campaign in the Middle East and the Pakistan-Afghanistan conventional war are excluded from the Incident Cards and addressed in the Appendix. Only IED, improvised explosive, criminal explosive, and ERW incidents are carded here. Readers should cross-reference the Appendix for strategic context affecting the broader threat environment.

Audio Summary

EXECUTIVE SNAPSHOT

  • Three simultaneous IED events struck Nigeria on March 23, including a bridge demolition in Niger State killing eight, a vehicle-strike IED in Kwara State killing one, and two events indicating coordinated or opportunistic exploitation of a security seam along the Niger River corridor. The near-simultaneous timing warrants pattern tracking.
  • JNIM attacked a military post in Bagade, northern Burkina Faso on March 23, killing at least 14 soldiers. JNIM released video of the aftermath; the attack is part of a sustained offensive across more than 30 sites in Burkina Faso since late February and signals continued pressure on the Saharan military frontier.
  • Colombia saw two IED events in Cauca department within three days (March 23 and March 26), both attributed to FARC dissident structures. The March 26 motorcycle VBIED in Patía killed one soldier and was part of a coordinated offensive across ten municipalities, continuing the EMC pattern of small-payload motorcycle bombs against moving security force patrols.
  • France foiled a bomb attack outside Bank of America’s Paris headquarters on March 28, arresting three suspects under 18. The device included 650 grams of explosive powder and flammable liquid. French anti-terrorism prosecutors linked the plot to the Middle East conflict; the recruiter operated via Snapchat, offering €600 per operative.
  • Harakat Ashab al-Yamin al-Islamia (HAYI) claimed the arson destruction of four Hatzola ambulances in Golders Green, London on March 23, continuing a pattern of European attacks on Jewish targets since March 9. Two men were arrested on March 25. The group’s authenticity remains disputed — European analysts suggest it may be an astroturfed brand rather than an organic cell.
  • Netherlands experienced a wave of ATM bombings March 24-26, injuring one person. Multiple Geldmaat machines were destroyed across Laren, Lopik, Badhoevedorp, Landsmeer, and Amsterdam-Nieuw-West. Europol’s Operational Taskforce GRIMM remains active in the Dutch-German ATM bombing landscape.
  • Myanmar continued to see civilian IED casualties from PDF-attributed devices in Sagaing and Mandalay regions, with at least one casualty on March 23 in Myinmu Township.
  • Pakistan resumed military operations in Afghanistan after the Eid ceasefire expired on March 24, reactivating the cross-border conflict environment and resuming explosive targeting of railway infrastructure in Balochistan. No confirmed IED events directly within the March 23-29 window were isolated, but the operational tempo in Balochistan and KPK remained elevated.

Incident Ledger

#CountryCity/AreaCategoryTypeDeviceTargetCasualtiesConfidence
1NigeriaBorgu, Niger StateTerror/ UnknownDetonationIED (bridge)Bridge/ Troop access8 killedConfirmed
2NigeriaWoro, Kaiama, Kwara StateTerror/ CriminalDetonationRoadside IEDCivilian vehicle1 killed, 1+ injuredConfirmed
3ColombiaTimbio, CaucaTerror/ InsurgentDetonationRoadside IEDPolice patrol1 killed, 15 injuredConfirmed
4Burkina FasoBagade, Nord RegionTerror/ InsurgentDetonationNot specifiedMilitary post14+ soldiers killedConfirmed
5MyanmarMyinmu Township, SagaingConflict-relatedDetonationVictim-operated IEDCivilian area1 injuredConfirmed
6United KingdomGolders Green, LondonTerror/ InsurgentArson (explosive secondary)Incendiary deviceJewish ambulances/ synagogue0 (injuries from O2 blasts)Confirmed
7NetherlandsMultiple citiesCriminalDetonationExplosive charges (ATM)Cash deposit machines1 injuredConfirmed
8ColombiaPatía, CaucaTerror/ InsurgentDetonationMotorcycle VBIEDMilitary patrol1 killed, 2 injuredConfirmed
9FranceParis, 8th arrondissementTerror/ InsurgentDisruptionIED (powder + flammable liquid)Bank (US commercial target)0 (foiled)Confirmed
10SwedenHalmstadCriminalDetonationExplosive deviceResidential building2 lightly injuredProbable

INCIDENT CARDS

CARD 1: Nigeria — Bridge Demolition, Borgu, Niger State

Location/Time: Borgu LGA, Niger State, Nigeria | Approximately 0200 hrs local | 23 March 2026

Category / Context: Terror/Unknown — Suspected armed groups operating from Kainji National Park.

Incident Type: Detonation / Infrastructure destruction

Incident Summary (TTP-focused): Terrorists used an IED to destroy a bridge linking Wawa and Luma communities in Borgu LGA, Niger State. Eight civilians in a passing vehicle were killed in the blast. The attack occurred before dawn. Security sources assessed the primary tactical purpose as interdicting troop movement and blocking military access to the area. The bridge served as a key artery for rural commerce including the Babana border market, which draws traders from across the Benin Republic border. The tactic mirrors IS-affiliated and Sahelian insurgent behavior of targeting infrastructure to fix and delay security force response, though no group has formally claimed responsibility.

  • Device Type: IED (specific construction not disclosed in open sources)
  • Delivery & Placement: Placed on bridge structure; detonated when civilian vehicle crossed
  • Initiation Method: Victim-operated or timer — not specified in open sources
  • Target Type: Critical infrastructure (bridge) and troop movement corridor
  • Effects: 8 civilians killed; bridge destroyed; severed trade route and military access corridor to Babana border area
  • Suspected Perpetrator: Armed groups operating from Kainji National Park. No formal claim. Security officials did not publicly name a specific group. ISWAP territorial expansion into the northwest-central border zone is a plausible but unconfirmed attribution.
  • Confidence: Confirmed (multiple Nigerian outlets, security source statements)
  • Source Reliability: High — reported by Daily Post Nigeria, Daily Trust, Hallmark News, and Politics Nigeria; incident confirmed by Nigerian military statement.

Sources:

Analyst Note: The deliberate targeting of a bridge before dawn, with tactical rationale linked to blocking security force movement, indicates operational planning beyond opportunistic banditry. This is the first confirmed infrastructure IED in Niger State during this reporting period. If the threat actor is expanding from the northwest into the Niger-Benin border zone, this marks geographic spread from traditional ISWAP operating areas. EOD teams should anticipate IEDs emplaced on damaged or alternate crossing points as security forces attempt route clearance. A second device was also found and defused during clearance operations in Kwara State on the same day, suggesting possible parallel planning or overlapping actor networks.

CARD 2: Nigeria — Roadside IED, Woro/Kaiama, Kwara State

Location/Time: Near Woro Village, Kaiama LGA, Kwara State, Nigeria | 0743 hrs local | 23 March 2026

Category / Context: Terror/Criminal — Suspected armed bandits or militants operating in the Kaiama LGA corridor.

Incident Type: Detonation

Incident Summary (TTP-focused): A passenger vehicle travelling from Wurumakoto Village to New Bussa in Niger State ran over a pressure-activated IED at approximately 0743 hrs. The driver, Mallam Zunairu, died on impact. A nursing mother in the vehicle sustained serious injuries; her infant was unharmed. During subsequent clearance operations, a second IED was discovered and defused by Nigerian Army bomb disposal personnel from the Kaiama base. The back-to-back device placement — a detonated primary and a secondary awaiting clearance forces — is a classic IED employment pattern designed to cause maximum casualties during first responder operations.

  • Device Type: Pressure-operated roadside IED (specific construction not disclosed)
  • Delivery & Placement: Buried in roadway or placed on road surface
  • Initiation Method: Victim-operated (vehicle pressure)
  • Target Type: Civilian traffic / road corridor (may have been intended for security force vehicles)
  • Effects: 1 killed (driver), 1 critically injured (nursing mother), infant unharmed; secondary device defused
  • Suspected Perpetrator: Armed bandits or militants linked to the group responsible for a deadly attack in the same Woro area the previous month. No formal claim.
  • Confidence: Confirmed (police statement, multiple Nigerian outlets, Washington Post wire)
  • Source Reliability: High — confirmed by Kwara State Police Commissioner; reported by TV360 Nigeria, Politics Nigeria, Washington Post.

Sources:

Analyst Note: The secondary device discovered during clearance is the operationally significant detail here. This pattern — primary device to generate casualties, secondary to target first responders — demands that clearance teams treat the entire surrounding area as a potential IED threat zone before approaching any device scene. The simultaneous timing with the Niger State bridge bombing (Card 1) raises the question of coordinated actor networks or exploitation of a regional security gap. Nigerian Army bomb disposal teams confirmed the secondary device was successfully defused, but the capability to emplace multiple devices on the same day across two states signals a threat actor with logistics and planning capacity beyond improvised opportunistic attacks.

CARD 3: Colombia — Pan-American Highway IED, Timbio, Cauca

Location/Time: Río Las Piedras Sector, Pan-American Highway, Timbio Municipality, Cauca Department, Colombia | 1331 hrs local | 23 March 2026

Category / Context: Terror/Insurgent — FARC dissident structures operating in southern Cauca.

Incident Type: Detonation

Incident Summary (TTP-focused): A National Police patrol was travelling the Pan-American Highway toward Timbio to investigate a report of cylinder bombs on the route when an IED detonated beneath or beside the patrol vehicle. The explosion killed one uniformed officer, wounded five police personnel, and injured at least ten civilians in the vicinity. The blast created a large crater that disrupted traffic on the Pan-American Highway — a critical corridor connecting Cauca with the departments of Valle, Nariño, and the broader southwestern Colombia supply network. Activation appeared command-initiated or victim-operated; the patrol was responding to a reported threat, suggesting the report itself may have been a lure to fix the patrol in the target area.

  • Device Type: Roadside IED (possible cylindrical explosive, consistent with FARC dissident TTP in the region)
  • Delivery & Placement: Roadside or subsurface placement on the Pan-American Highway
  • Initiation Method: Probable command-wire or victim-operated; not confirmed in open sources. The lure-and-detonate pattern suggests command initiation.
  • Target Type: Police patrol
  • Effects: 1 police officer killed; 5 police wounded; 10 civilians wounded; large crater; highway disrupted
  • Suspected Perpetrator: FARC dissident structures (EMC/Estado Mayor Central) operating in Cauca. Consistent with Carlos Patiño Front TTP, which operated in the same area two days later (Card 6). No specific claim in open sources for this incident.
  • Confidence: Confirmed (Colombian National Police statement, multiple Colombian outlets)
  • Source Reliability: High — Colombian National Police confirmed casualties; reported by Infobae Colombia and El País Colombia.

Sources:

Analyst Note: The lure-to-target pattern — where the patrol was dispatched in response to a reported threat that placed them exactly at the IED position — is a disciplined and tactically mature technique that requires surveillance capability and communications coordination. If confirmed, it elevates this from a static ambush to a planned counter-response operation. The two Cauca IED events within 72 hours (Cards 3 and 6) suggest a sustained coordinated offensive, not isolated incidents. EOD/C-IED planners supporting Colombian forces should treat all reported device sightings in Cauca as potential lures until the area is cleared.

CARD 4: Burkina Faso — JNIM Attack on Military Post, Bagade

Location/Time: Bagade, Nord Region, northern Burkina Faso | Saturday | 22-23 March 2026

Category / Context: Terror/Insurgent — Jama’at Nusrat al-Islam wal-Muslimin (JNIM), al-Qaeda affiliate.

Incident Type: Detonation / Direct attack (IED and small arms)

Incident Summary (TTP-focused): JNIM fighters attacked a Burkinabe Armed Forces (FAB) military post in Bagade, northern Burkina Faso. JNIM claimed responsibility and released video showing approximately 15 dead soldiers, some burned. Official security sources reported a “provisional toll” of 14 soldiers killed and others missing; WAMAPS (West African security journalists network) estimated up to 20 soldiers and VDP (Volunteers for the Defense of the Homeland) fighters killed. The attack employed combined arms — small arms fire with IED or explosive munitions — consistent with JNIM’s ongoing offensive campaign against the FAB, which includes more than 30 attacks since late February across Burkina Faso’s Sahel, Boucle du Mouhoun, and Centre-Nord regions.

  • Device Type: Not fully specified in open sources; JNIM attacks in this period have employed a mix of IEDs, RPGs, and small arms
  • Delivery & Placement: Direct assault on military post
  • Initiation Method: Not specified
  • Target Type: Military post / Burkinabe Armed Forces
  • Effects: At least 14 soldiers killed (provisional); several missing; JNIM released video of aftermath
  • Suspected Perpetrator: JNIM — formally claimed via JNIM media; confidence is High
  • Confidence: Confirmed (JNIM claim, security official statement, AFP wire)
  • Source Reliability: High — AFP dispatch carried by NAMPA and The Standard; TRT Afrika; Punch Nigeria corroborates.

Sources:

Analyst Note: This attack is part of a campaign, not an isolated event. JNIM’s broader March offensive across Burkina Faso followed a senior JNIM commander’s defection to the rival Islamic State Sahel Province (ISSP), which appears to have prompted JNIM to demonstrate strength through high-tempo attacks. The release of a graphic post-attack video is consistent with JNIM information operations — intended to undermine military morale and FAB’s public legitimacy. Bomb technicians and C-IED advisors operating in Burkina Faso should anticipate IED-initiated ambushes as a force-multiplier tactic in JNIM’s next phase; the current pattern of direct attacks on static posts may transition to route interdiction as FAB adapts its base defense posture.

CARD 5: Myanmar — Victim-Operated IED, Myinmu Township, Sagaing Region

Location/Time: Forest west of Bal Lone Gyi Village, Myinmu Township, Sagaing Region, Myanmar | 1320 hrs local | 23 March 2026

Category / Context: Conflict-related — IED attributed to People’s Defence Force (PDF) by Myanmar government sources.

Incident Type: Detonation

Incident Summary (TTP-focused): A civilian man sustained shrapnel injuries after stepping on an IED while cutting firewood in a forest west of Bal Lone Gyi Village. He was admitted to Mandalay Public Hospital on March 24 with shrapnel wounds. The Myanmar government attributed the device to PDF forces. The incident reflects the ongoing proliferation of victim-operated IEDs across Sagaing and Mandalay regions, where both junta forces and PDF have acknowledged device placement — though attribution in individual cases is contested.

  • Device Type: Victim-operated IED (pressure or tripwire-activated); specific construction not disclosed
  • Delivery & Placement: Subsurface or concealed in forested area
  • Initiation Method: Victim-operated (pressure or tripwire)
  • Target Type: Assessed as area denial / military use; civilian casualty was likely unintended
  • Effects: 1 civilian injured (shrapnel)
  • Suspected Perpetrator: PDF (per Myanmar government); government attribution should be assessed with caution given ongoing information conflict
  • Confidence: Confirmed (government statement, Counter-IED Report)
  • Source Reliability: Medium — Myanmar government source confirmed the incident; Counter-IED Report published the report. Independent verification of PDF attribution is not possible in the current information environment.

Sources:

Analyst Note: Civilian IED casualties in forested and agricultural areas in Sagaing and Mandalay are a growing ERW and legacy IED concern, distinct from military target IED events. The broader Myanmar IED environment now includes persistent contamination of rural areas that will require systematic clearance operations once the conflict stabilizes. Humanitarian demining teams planning future operations in Myanmar should treat Sagaing, Mandalay, and Ayeyarwady regions as high-priority survey areas given the current density of reported incidents. Attribution to specific actors in individual cases is not reliably determinable through open sources.

CARD 6: Colombia — Motorcycle VBIED, Patía, Cauca

Location/Time: Patía Municipality, Cauca Department, Colombia | Approximately 2300 hrs local | 26 March 2026

Category / Context: Terror/Insurgent — Carlos Patiño Front, EMC/FARC dissident structure.

Incident Type: Detonation

Incident Summary (TTP-focused): An IED concealed in a motorcycle was detonated as a Colombian Army patrol approached the vehicle. Soldier Romario Roque Gutiérrez was killed and two comrades were injured. The attack was attributed to the Carlos Patiño Front of the Estado Mayor Central (EMC), the largest FARC dissident faction. The device was consistent with the EMC’s established TTP of emplacing relatively small-payload IEDs in motorcycles and detonating them command-initiated against approaching security force patrols — distinct from earlier static VBIED tactics targeting police stations. The event was part of a coordinated offensive across ten Cauca municipalities within a 24-hour period, resulting in 80 people injured across the department including four children, and at least one soldier killed (this event). Separately, Colombian Army and Police also disrupted a planned motorcycle VBIED attack in El Plateado, Cauca, arresting a suspect known as “Barbas” who was linked to the same front.

  • Device Type: Motorcycle VBIED (relatively small payload; victim or command-operated)
  • Delivery & Placement: Motorcycle parked or mobile in patrol route; command-detonated on approach
  • Initiation Method: Command-initiated (consistent with EMC pattern)
  • Target Type: Military patrol
  • Effects: 1 soldier killed; 2 soldiers wounded
  • Suspected Perpetrator: Carlos Patiño Front, EMC/FARC dissidents. Security forces confirmed; Counter-IED Report confirmed attribution.
  • Confidence: Confirmed (Colombian Army statement, Counter-IED Report, City Paper Bogotá)
  • Source Reliability: High — Colombian Army confirmed casualties and attribution; multiple outlets corroborated.

Sources:

Analyst Note: The near-simultaneous disruption of a second motorcycle VBIED in El Plateado the same day — where a suspect was arrested before detonation — suggests the broader EMC offensive employed multiple motorcycle VBIED cells simultaneously. When multiple VBIED operators are deployed in a single operational cycle, the risk of secondary and tertiary devices in the area is high. EOD and security forces responding to the detonated device in Patía should have treated the surrounding area as a potential multi-device environment. The EMC’s transition from large static VBIEDs to smaller mobile command-initiated motorcycle bombs against moving patrols reflects adaptation to hardened static targets and a preference for force-on-force engagements over infrastructure attacks.

CARD 7: United Kingdom — Hatzola Ambulance Arson, Golders Green, London

Location/Time: Highfield Road / Machzike Hadath Synagogue, Golders Green, North London, United Kingdom | Approximately 0140 hrs GMT | 23 March 2026

Category / Context: Terror/Insurgent (assessed) — Harakat Ashab al-Yamin al-Islamia (HAYI) claimed; Iran-linked networks suspected.

Incident Type: Detonation (incendiary / arson with explosive secondary effects)

Incident Summary (TTP-focused): Three hooded individuals poured an accelerant onto four Hatzola volunteer Jewish ambulances parked on the grounds of Machzike Hadath, an Orthodox Jewish synagogue in Golders Green, and ignited the vehicles. No persons were directly injured, but explosions from oxygen cylinders within the burning ambulances broke windows in a nearby apartment block. Six fire engines and forty firefighters responded and extinguished the blaze by 0306 hrs. HAYI claimed responsibility via a Telegram video that included a map of the target location and footage of the vehicles burning. British counterterrorism police took over the investigation. Two men aged 47 and 45 were arrested at northwest London and central London addresses on March 25; both were later released on bail. The investigation probed possible links to Iranian-aligned Iraqi Shia militia networks.

  • Device Type: Incendiary device (accelerant, likely petroleum-based); oxygen cylinder explosions were secondary effects, not primary IED
  • Delivery & Placement: Accelerant poured directly onto vehicles in open parking area
  • Initiation Method: Direct ignition
  • Target Type: Jewish communal infrastructure / symbolic target (ambulances, synagogue)
  • Effects: 4 ambulances destroyed; no injuries; secondary explosions from O2 cylinders broke windows
  • Suspected Perpetrator: HAYI claimed. Social media activity traced to channels linked to Iraqi Shia militia groups aligned with Iran’s IRGC. European analysts note HAYI may be an astroturfed brand rather than a standalone cell. Confidence in Iran state direction: Low. Confidence in Iran-aligned network involvement: Probable.
  • Confidence: Confirmed (Metropolitan Police confirmed, arrests confirmed, HAYI claim confirmed)
  • Source Reliability: High — multiple major outlets (CNN, NPR, Jerusalem Post, Times of Israel) confirmed; police statement confirmed arrests.

Sources:

Analyst Note: This is the fifth or sixth HAYI-linked incident in Europe since March 9, following an explosive attack on a Liège synagogue, an arson at a Rotterdam synagogue, a bomb at a Jewish school in Amsterdam, and an arson at a synagogue elsewhere in the Netherlands. The group’s Telegram channels are active and appear operationally coordinated, even if the group itself is a loose brand. The pattern is consistent with Iran’s strategy of proxy harassment of European Jewish targets as pressure in the broader Middle East conflict — low-lethality, high-symbolic-impact attacks that create community fear without triggering a NATO-level response. For European security services, the threat picture from HAYI-style actors includes fire-setting, incendiary devices, and small explosive devices — all achievable with minimal tradecraft and outside materials controls.

CARD 8: Netherlands — ATM/Cash Machine Explosions, Multiple Cities

Location/Time: Badhoevedorp; Landsmeer; Lopik (Utrecht); Amsterdam-Nieuw-West; Laren | Night of 24-25 March and 25-26 March 2026

Category / Context: Criminal — Organized criminal gangs (Dutch-German cross-border ATM bombing networks).

Incident Type: Detonation (multiple)

Incident Summary (TTP-focused): A series of coordinated ATM and cash deposit machine explosions hit five locations across the Netherlands over two nights, March 24-26. Targets were Geldmaat cash deposit machines (a shared Dutch banking infrastructure). In Amsterdam-Nieuw-West, a teenage girl was injured by flying glass. In Lopik, the apartment above the machine was evacuated due to structural risk. In Laren, two masked suspects fled on a scooter. The attacks continued a surge in ATM bombings linked to Dutch-German criminal networks, tracked by Europol’s Operational Taskforce GRIMM. The Netherlands saw a notable uptick in such attacks in 2025-2026, with solid explosives or gas injection methods used to breach ATM housings and extract cash. The attacks are typically nocturnal, rapid (under 2 minutes per site), and use getaway vehicles or motorcycles.

  • Device Type: Solid explosive charges or gas-injection IEDs (specific construction varied by site; not specified in open sources for this event)
  • Delivery & Placement: Placed on or against ATM/cash deposit machine housing
  • Initiation Method: Command-initiated or timer; rapid detonation sequence
  • Target Type: Cash deposit machines / ATM hardware
  • Effects: Multiple cash machines destroyed; 1 teenager injured (Amsterdam); structural damage to adjoining buildings; rail disruption at Amsterdam-Zuid (prior incident reference)
  • Suspected Perpetrator: Organized criminal network, consistent with Dutch-German ATM bombing groups tracked under Europol’s Taskforce GRIMM. No specific attribution for this event in open sources.
  • Confidence: Confirmed (Dutch police confirmed incidents; NL Times, DutchNews.nl reporting)
  • Source Reliability: High — NL Times and DutchNews.nl are reliable Dutch-language wire services; police confirmed injuries and locations.

Sources:

Analyst Note: The multi-site, multi-night campaign suggests operational maturity — reconnaissance of targets, pre-positioned explosive materials, and coordinated getaway logistics across multiple Dutch cities simultaneously. This is not improvised; it reflects a criminal enterprise with supply chain, transport, and coordination infrastructure. The pattern of adjoining residential building damage creates a growing secondary casualty risk that has attracted Dutch prosecutor attention. Europol’s active Taskforce GRIMM has been making arrests in this network, but the bombing rate in early 2026 indicates the network has not been significantly disrupted. For bomb technicians, the key hazard is ATM-adjacent structural compromise — buildings above or adjoining detonated machines should be assessed for instability before close approach.

CARD 9: France — Foiled Bank of America Bomb Plot, Paris

Location/Time: 8th Arrondissement (near Champs-Élysées), Paris, France | Approximately 0330 hrs local | 28 March 2026

Category / Context: Terror/Insurgent — ISIS-inspired or Iran-proxy-inspired; anti-Western/anti-US commercial target.

Incident Type: Disruption (device intercepted before detonation)

Incident Summary (TTP-focused): French police intercepted a suspect at approximately 0330 hrs outside the Bank of America headquarters building in Paris’s 8th arrondissement as he attempted to ignite a device. The device consisted of two bottles of flammable liquid secured with adhesive tape, containing 650 grams of explosive powder. The suspect — a minor — had been recruited via Snapchat and offered €600 to carry out the attack. French anti-terrorism prosecutors opened an investigation and linked the plot to the broader Middle East conflict. Two additional suspects, both under 18, were arrested on March 29. A total of three suspects under 18 were detained in connection with the plot. Interior Minister Laurent Nunez characterized it as a foiled “violent terrorist attack.”

  • Device Type: Improvised incendiary/explosive device — flammable liquid bottles with explosive powder, ignition-initiated
  • Delivery & Placement: Placed outside Bank of America building entrance; attacker attempted to ignite with lighter
  • Initiation Method: Direct ignition (failed)
  • Target Type: US commercial presence (Bank of America) / symbolic anti-US targeting
  • Effects: Device neutralized before detonation; no injuries; no damage
  • Suspected Perpetrator: Recruiter operating via Snapchat; linked by French authorities to Middle East conflict dynamics. Specific group direction not publicly confirmed. HAYI activity in same period is co-incident but no direct link confirmed.
  • Confidence: Confirmed (French Interior Ministry statement, anti-terrorism prosecutor, multiple major outlets)
  • Source Reliability: High — confirmed by French government statements; reported by France 24, Al Jazeera, CNBC, ABC News, CBS News.

Sources:

Analyst Note: The Snapchat recruitment-for-hire model — paying minors €600 to execute a bombing — signals a scalable radicalization-as-a-service approach. When minors are paid to carry out attacks, the operational signature is low-cost, low-sophistication, and high-deniability for the facilitating network. The attack comes within the same reporting week as the Golders Green arson (Card 7) and coincides with broader HAYI activity across Europe. Whether these attacks reflect a coordinated campaign or parallel opportunism exploiting the same information environment is the key analytical question. For European security managers, the Snapchat recruitment vector requires integration of social media monitoring into pre-attack indicator programs alongside traditional physical surveillance.

CARD 10: Sweden — Residential Building Bombing, Halmstad

Location/Time: Residential building staircase, Halmstad, Sweden | March 2026 (precise date reported as March 27)

Category / Context: Criminal — Gang-related explosive attack (assessed, no claim).

Incident Type: Detonation

Incident Summary (TTP-focused): An explosion destroyed the staircase entrance of a residential building in Halmstad, Sweden. Two persons were lightly wounded. No claim of responsibility was made; the incident is consistent with Sweden’s ongoing pattern of gang-related residential building bombings, which have been employed primarily as intimidation against rival gang members, their associates, or extortion targets sharing a building address. Sweden recorded 621 explosion offenses in 2025 — the highest since tracking began — and rates remained elevated in early 2026. The explosive device type and construction were not specified in open sources.

  • Device Type: Not specified in open sources
  • Delivery & Placement: Staircase entrance of residential building
  • Initiation Method: Not specified
  • Target Type: Residential building (specific target unclear — likely gang intimidation or rival targeting)
  • Effects: Staircase entrance destroyed; 2 persons lightly injured
  • Suspected Perpetrator: Criminal gang network — not specified in open sources; consistent with ongoing Swedish organized crime explosive campaign
  • Confidence: Probable (sourced via secondary reference in Bombings in Sweden Wikipedia article; no direct primary-source article retrieved)
  • Source Reliability: Medium — Wikipedia article on Swedish bombings references the event; primary Swedish-language media not independently retrieved. Incident pattern is consistent with documented Swedish gang bombing activity.

Sources:

Analyst Note: Sweden’s gang explosive problem is now a baseline environmental condition rather than a notable surge event. With shootings declining and explosions rising in early 2026, criminal networks appear to be substituting explosive devices for firearms — likely driven by increased firearms interdiction, the relative accessibility of improvised and smuggled explosive materials, and the psychological impact of explosions in dense residential settings. For security assessors covering Scandinavia, the key forward indicator is whether targeted residential bombings spread to commercial targets or public infrastructure, which would mark a tactical escalation beyond pure gang rivalry.

WEEKLY TTP AND THREAT PATTERN ANALYSIS

Device construction trends. This reporting period’s confirmed IEDs show a geographic split in sophistication. In West Africa (Nigeria Cards 1-2, Burkina Faso Card 4), devices appear to be conventional IEDs using locally available materials — sufficient for bridge demolition and vehicle targeting but construction details were not disclosed. In Colombia, the EMC’s motorcycle VBIED (Card 6) reflects an established and rehearsed platform with a command-initiation capability. The Paris device (Card 9) — flammable liquid bottles with loose explosive powder — sits at the low end of the sophistication curve, consistent with attack-for-hire schemes involving untrained operatives. The Netherlands ATM explosions likely involved solid explosive charges or gas injection, methods requiring more technical knowledge but widely documented in Dutch criminal networks. No novel materials or configurations were identified this period.

Targeting pattern shifts. The most notable targeting pattern this week is the simultaneous or near-simultaneous multi-event day in Nigeria on March 23 — bridge demolition, vehicle IED, and the context of the Kwara secondary device — all within the same geographic corridor. Whether this reflects coordinated multi-cell activity or exploitation of a regional security gap by separate actors with overlapping interests is not yet determinable. In Colombia, both IED events (Cards 3 and 6) targeted security forces in Cauca within 72 hours; the EMC’s coordinated offensive across ten municipalities indicates a deliberate campaign, not episodic violence. In Europe, the London arson (Card 7) and Paris bomb plot (Card 9) both targeted symbolic Western or Jewish-linked targets within the same week, with HAYI claiming the London event and French authorities linking Paris to Middle East conflict dynamics — suggesting parallel opportunism rather than direct coordination but consistent actor motivation.

Geographic spread or contraction. JNIM’s reach into northern Burkina Faso (Card 4) and its broader campaign extending toward the Gulf of Guinea is the most significant geographic expansion signal this period. Burkina Faso’s military frontier is actively contested, and JNIM’s multi-region offensive suggests territorial pressure, not consolidation. In Nigeria, the Niger State and Kwara State events mark activity further west and south than the traditional Borno-Adamawa ISWAP core area, consistent with reports of armed group expansion toward the Niger River corridor and the Benin border. In Europe, HAYI’s activity (London arson, Belgium synagogue, Amsterdam, Rotterdam, Oslo) has now spread across five cities in four countries since March 9. The geographic spread is notable but the lethality has been low — suggesting the group is in an operational build-up or is constrained by capability.

Cross-regional TTP convergence. Two patterns are worth tracking across theaters this period. First, the use of secondary devices to target clearance teams or first responders appeared in Nigeria (Card 2 — second IED found during clearance) and is consistent with doctrine observed in Iraq, Afghanistan, and Pakistan. This technique is re-emerging in West African contexts. Second, Snapchat-recruited attack-for-hire using low-sophistication devices (Paris, Card 9) mirrors online recruitment-to-violence patterns seen in the UK and Germany over the past 18 months. Social media recruitment of minors for tactical actions below the lethality threshold of formal terrorist attacks is an increasingly documented vector that does not require organizational depth or materials expertise.

Implications for EOD/C-IED professionals. In West Africa, clearance operations in Kwara and Niger State should treat the area surrounding any detonation site as a multi-device environment for a minimum search radius of 200 meters before close approach. In Colombia, the EMC’s motorcycle VBIED cycle suggests that security forces should treat any unattended or recently abandoned motorcycle in an active area of operations as a potential device. In Europe, the HAYI campaign’s shift from explosive devices to incendiary attacks against soft Jewish and Western targets suggests that security posture for these communities should now include fire risk as a primary threat vector alongside conventional IED awareness. In France, the arrest of three minors for a Snapchat-recruited bombing attempt confirms that attack-for-hire via social media is operationally active in Western Europe; pre-attack indicators will appear in social media behavior, not physical surveillance.

APPENDIX: CONVENTIONAL CONFLICT CONTEXT (IED/ASYMMETRIC IMPLICATIONS)

Iraq and the Broader Iran-Proxy Campaign (March 2026)

Situation summary: Throughout the reporting period, Iran and Iran-aligned militia groups continued a sustained campaign of drone and missile attacks against energy infrastructure, airports, military facilities, and population centers across Iraq, Saudi Arabia, the UAE, Kuwait, Bahrain, and Jordan. On March 24, an Iranian strike killed six Peshmerga fighters north of Erbil — the deadliest attack on the Kurdistan Region since late February. On March 28, airstrikes targeting PMF (Popular Mobilization Forces) headquarters near Kirkuk Airport killed three PMF fighters and two Iraqi police. These are conventional kinetic operations, not IED events, and are excluded from the main Incident Cards.

IED/CT Implications: The conventional campaign has two IED-relevant second-order effects. First, IS is continuing low-level guerrilla operations in Diyala, Kirkuk, and Anbar while security force attention is focused on the Iran-proxy conflict and on PMF-US tensions. This creates a tactical opening for IS to expand rural IED and ambush activity. Second, the PMF-US friction increases the risk of PMF-affiliated IED attacks against US personnel or infrastructure in Iraq — a return to 2019-2020 patterns. Bomb technicians and force protection personnel in the theater should reassess the IED threat profile as a dual-threat environment (IS + Iranian proxy).

Pakistan-Afghanistan Conventional War (March 2026)

Situation summary: Pakistan declared “open war” against Afghanistan in early March 2026 following sustained Taliban cross-border attacks. A Pakistan-Afghanistan Eid ceasefire mediated by Saudi Arabia, Turkey, and Qatar ran from approximately midnight March 19 to midnight March 24. Pakistan resumed military operations on March 27 after the ceasefire expired. During the ceasefire, Pakistani Taliban (TTP) announced a parallel 3-day ceasefire. Renewed fighting killed at least two civilians in eastern Afghanistan shortly after the ceasefire ended.

IED/CT Implications: The Pakistan-Afghanistan conventional conflict directly affects the IED threat picture in three ways. First, the TTP has historically used Pakistani military pressure as justification to escalate domestic IED attacks inside Pakistan — expect increased IED tempo in KPK, Balochistan, and Punjab in the weeks following the ceasefire breakdown. Second, Balochistan Liberation Army (BLA) railway targeting has been ongoing and is likely to intensify as Pakistani military resources are drawn toward the Afghan border. Third, the conflict is displacing armed actors and weapons across the border, increasing the IED material supply in both directions. EOD units and force protection teams operating in Pakistan’s western provinces or with Pakistani military counterparts should anticipate an elevated IED threat environment in the post-ceasefire period.

Haiti — Explosive Drone Campaign in Port-au-Prince (Ongoing)

Situation summary: Haitian security forces, with support from Vectus Global (a US-licensed private military firm), have been conducting explosive quadcopter drone strikes against gang-controlled areas of Port-au-Prince. A Human Rights Watch report released March 10 documented 1,243 people killed in 141 drone strike operations between March 2025 and January 2026, including at least 43 adult non-combatants and 17 children. The operational tempo has accelerated, with 57 strikes reported in the November-January period.

IED/CT Implications: The Haiti drone campaign represents one of the first sustained explosive drone operations by a government security force in an urban Western Hemisphere environment. The operational template — quadcopter drones armed with explosive payloads used against irregular forces in densely populated areas — has significant C-IED and force protection implications. As this technology becomes normalized by state actors in permissive environments, non-state adaptation (gang use of counterdrone tactics, IED-drones by gang actors) becomes a near-term risk. EOD specialists and security managers in the Caribbean and Latin America should begin integrating small UAS threat assessment into their planning frameworks.

Data Gaps and Limitations

Middle East and Levant: Search dominated by conventional conflict reporting (Iran-proxy strikes, PMF/US friction, Peshmerga casualties). IED-specific attacks by IS in Iraq during the March 23-29 window could not be isolated from the broader conflict reporting. IS guerrilla activity in Diyala, Kirkuk, and Anbar is ongoing but specific IED events during this period were not surfaced in open sources. Syria: No confirmed IED incidents surfaced for the reporting window.

Sahel and West Africa: Niger-Benin oil pipeline attack by IS-Sahel (March 21) occurred 48 hours before the reporting window opens; it is excluded from cards but noted as a near-miss. Burkina Faso JNIM campaign is confirmed and carded. Mali: No specific IED events surfaced during the March 23-29 window. Search terms used: “engin explosif improvise,” “attaque,” “convoi,” “gendarmerie,” “JNIM Mali.”

East Africa and Horn of Africa: Somalia al-Shabaab IED activity is ongoing but no specific incidents surfaced for March 23-29. The March 13 al-Shabaab IED strike on Kenyan police in Mandera (6 officers injured) fell before the reporting window. Mozambique: ASWJ/ISCAP activity in Cabo Delgado ongoing; no IED-specific events surfaced for the window. Search terms used: “Somalia bomb,” “al-Shabaab IED March 2026,” “Kenya Mandera.”

South Asia: Pakistan-Afghanistan conventional war context is addressed in Appendix. BLA railway IED activity confirmed as ongoing in Balochistan but specific March 23-29 events could not be isolated with high confidence. Indian Naxalite theater: Government declared Naxalite eradication in March 2026; no IED events surfaced during the window. Kashmir: No confirmed IED events during window. Bangladesh, Sri Lanka: No incidents surfaced.

Southeast Asia: Philippines Mindanao: No confirmed IED incidents for March 2026. Thailand Deep South: Petrol station bombings were January 11, 2026 (not this window); no specific March 23-29 incidents surfaced. Myanmar carded (Card 5). Search terms used: “Philippines Mindanao bomb March 2026,” “Thailand Deep South March 2026,” “Myanmar PDF IED.”

China: No explosive incidents of security relevance surfaced for March 2026. Industrial and accidental explosions were found (fireworks store in February, lab accident at Chongqing University) but none in the March 23-29 window and none of security relevance.

Scandinavia: Sweden Halmstad bombing carded (Card 10, Probable confidence). No confirmed Norway or Denmark incidents during the window. Note: Sweden’s baseline explosion rate (~1.7/day annualized from 2025 data) means additional incidents almost certainly occurred but were not individually reportable from available English-language sources.

Russia and Former Soviet Union: Ukraine-Russia conflict dominates open-source reporting. An ATM arson in Moscow (March 19, attributed to a teenager following “Ukrainian fraudsters” instructions) fell before the window. No confirmed asymmetric IED events in Russia during March 23-29. Ukraine conflict context excluded per brief scope. Russian-occupied Ukraine territories: Reporting suppressed or inaccessible.

European Union: Netherlands ATM bombings carded (Card 8). Germany: No confirmed incidents during window; ATM bombing pattern ongoing. Belgium, France, Spain, Italy, Greece, Balkans: France Paris bomb plot carded (Card 9). No other confirmed EU IED events during the March 23-29 window (Belgium Liège and Oslo Embassy occurred March 9, before window).

British Isles: London Hatzola arson carded (Card 7). Northern Ireland: No viable device or controlled explosion incidents surfaced for March 23-29 window. Search terms used: “viable device Northern Ireland March 2026,” “controlled explosion Belfast.”

North America: MacDill AFB device (planted March 10, indictments March 26): The criminal charging falls within the window; the device itself predates it. Fort Washington Park (Maryland) — 9 explosive devices found March 22, one day before the window; included as near-miss context. NYC Gracie Mansion TATP attempt — March 7, outside window but ISIS-inspired attribution reported. No confirmed active detonations in North America during the March 23-29 window.

South America: Colombia carded (Cards 3, 6). No confirmed IED events in Venezuela, Brazil, Peru, Bolivia, Ecuador, or Argentina during the window. Search terms used: “artefacto explosivo,” “bomba casera,” “extorsion,” “cobro de piso.”

Central America: No confirmed IED or explosive incidents surfaced for March 23-29, 2026. Honduras lawmaker grenade attack (January 2026) was the most recent notable prior incident. Search terms used: “artefacto explosivo,” “granada,” “pandilla,” “extorsion” — Honduras, Guatemala, El Salvador.

Caribbean: Haiti explosive drone campaign addressed in Appendix. No discrete IED or explosive attack events surfaced for the March 23-29 window in Jamaica, Trinidad, Dominican Republic, or other Caribbean nations.

End of Brief — Next scheduled brief: 6 April 2026

Research methodology: 45+ distinct web searches conducted across all listed regions prior to drafting. Sources include wire services (AFP, AP), regional outlets (Punch Nigeria, Daily Trust, City Paper Bogotá, NL Times, France 24), subject-matter aggregators (Counter-IED Report, ACLED, Long War Journal, counteriedreport.com), and official sources (French Interior Ministry, Colombian National Police, AFRICOM, Europol). counteriedreport.com was searched directly for the reporting period.

Latest Posts

PDF Version

Explosive Incident Brief for the Week of 23-29 Mar 2026Download
#No Tag

No responses yet

Leave a Reply

Your email address will not be published. Required fields are marked *