EU Terror Incidents Increased in 2023 as Groups Leveraged Societal Divisions to Recruit New Members
Terrorists completed 98 attacks in the European Union in 2023 and were involved in a total of 120 incidents—marking a significant increase from the 28 attacks logged in 2022, according to an annual Europol assessment.
Most of the attacks took place in France (80) and Italy (30), followed by Germany (three), Spain (three), Belgium (two), Greece (one), and Luxembourg (one). Thirty-two of these attacks were attributed to left-wing and anarchist terrorism, with 23 of them being completed, Europol found in its European Union Terrorism Situation and Trend Report (EU TE-SAT) 2024 published on 12 December.
The deadliest form of terrorism in the bloc continued to be in the form of jihadist attacks, which killed six people and injured 12 others in 2023. European authorities arrested 426 individuals for terrorism-related offenses, and jihadist offences accounted for 78 percent of the total arrests. A growing number of these arrestees are young people, the agency noted.
“The targeting of young people and their involvement by terrorist groups, including their active role in the production of online propaganda and the planning of attacks, is an increasing concern,” said Catherine De Bolle, executive director of Europol, in a statement. “Equally concerning is the use of [artificial technology] and other technology by terrorist groups to strengthen their messages and facilitate operations.”
Active Ideologies in 2023
Europol continues to rank jihadist terrorism as the most significant threat to EU security—citing five completed attacks out of 14 attempts in 2023.
“All of these [attacks] were carried out by lone actors, highlighting the challenges of preventing attacks by isolated individuals,” Europol said. “Furthermore, these so-called lone actors are well connected via online communities. Most attacks used weapons such as knives and firearms, with perpetrators often radicalized online.”
Most of the completed attacks—from data that was reported to Europol—targeted critical infrastructure (15), private businesses (seven), civilians (four), and police officers (three). The methods of attack included arson (20), bombing (eight), property damage (six), stabbing (six), and shooting (five).
Right-wing terrorism remains a concern, particularly activity from lone actors or small groups who are motivated by accelerationist ideas.
“Young right-wing terrorists and violent extremists are taking up a more active role as creators of propaganda, recruiters, and organizers of attacks and active incitement,” Europol explained. “New right-wing violent extremist groups are emerging online and seeking to act in real life.”
While extremists may be connecting online, they are also interacting in person with potential recruits. Europol found that fitness centers focused on combat training and sports have become “very popular in EU right-wing circles and can be abused as a cover for radicalization and networking for terrorist and violent extremist purposes.”
Members gathered at training events to partake in joint martial arts training, airsoft, war games, survival exercises, shooting, and weapons handling training.
“The emphasis on physical training is reflected in the propaganda material, which glorifies these ideals and uses them to bring affiliates together or to recruit new followers,” Europol explained.
On the opposite end of the spectrum, left-wing and anarchist terror and violent extremist groups in the EU are “coalescing around anti-state, anti-capitalism, anti-fascism, anti-racism, anti-militarism, and climate-related narratives,” Europol said. “Solidarity with imprisoned anarchists remained a strong catalyst for violent acts in a number of countries.”
Europol is tracking the targets of left-wing and anarchist groups’ attacks, which can include private companies that are perceived to control or play key roles in the economy, trade, or industry.
“When left-wing and anarchist attacks target the police during demonstrations and protests, this is largely a consequence of their confrontational approach rather than a feature of their ideology,” Europol assessed.
These groups tend to provide training for recruits in the form of workshops and exchanges of best practices, such as manuals on making explosives or incendiary devices. Europol has also tracked collaboration between left-wing violent extremists in the EU and Kurdish activists that resulted in EU nationals traveling to Syria to join Kurdish organizations operating in the region.
Ethno-nationalist and separatists were active in 2023 and responsible for 70 attacks in the EU during the year in Corsica, France. Thirty-four of those attacks were conducted during the night of 8-9 October.
One of the groups Europol is tracking is Partiya Karkerên Kurdistanê (PKK), a Kurdish militant organization, that attracts new members in the EU to fight in conflict zones. Other groups include those in Northern Ireland, which use terrorism as a key threat to pursue constitutional and political change. They often manufacture improvised explosive devices (IEDs) and have access to firearms and ammunition, using guidance previously provided from Irish Republican Army members.
“Republican groups use mainstream social media, often through accounts of affiliated and non-proscribed organizations, to propagate their narratives and publicize accounts of their interactions with law enforcement,” Europol said. “Finance is raised through ad hoc fund-raising events and criminal activities such as the smuggling of illicit goods and taxation of other criminal actors.
Messaging Effects
Terror groups, especially those that engage in jihadist attacks, used propaganda to exploit societal divisions related to geopolitical events. Europol released a separate report on 16 December looking at the state of online jihadist propaganda and how it changed in 2023 following the death of Ayman al-Zawahiri, second general emir of al Qaeda, in 2022.
“In the absence of an ideological leading figure of al-Zawahiri’s standing, [al Qaeda in the Arabian Peninsula] seems to have been entrusted with the ideological indoctrination of the global Muslim audience,” Europol assessed. “Khaled Batarfi and other senior officials upheld the cornerstones of [al Qaeda’s] brand, namely the unity of intent and closeness to population.”
This propaganda report found that the 7 October 2023 Hamas attack on Israel created a series of changes in the production of jihadist propaganda. The volume of propaganda vastly increased, which initially aimed to justify the attack before blaming Israel for a “disproportionate” response, Europol said.
In the foreword to this year’s terrorism trend report, De Bolle wrote about how regional crises outside the EU are having a significant impact on members’ societies that include the manifestation of terrorists and violent extremists.
“The terrorist attack by Hamas against Israel on 7 October 2023 and the Israeli military response in Gaza created additional ripples in all violent extremist and terrorist ideological scenes,” De Bolle explained. “It has provided new motivation to terrorist actors to recruit, mobilize, or build up their capacities, exploiting social grievances and rekindling hateful narratives against the Western world, minorities, and ethnic groups.”
Europol found that the 7 October attack and subsequent response exposed lines of convergence between supporters and sympathizers of jihadist, right-wing, left-wing, and anarchist terrorism and violent extremism scenes. Online content calling for jihadists to attack Jewish and Israeli interests or avenge Palestinians spread quickly, and right-wing groups encouraged supporters to join efforts to eradicate Israel.
“Some accelerationist channels exploited the unfolding situation in the Middle East to incite further violence, circulating [Islamic State] and [Al Qaeda] memes and videos calling on followers to target Jewish communities around the world, including in the EU,” Europol said. “There were incitements to violence and threats against schools, synagogues, Israeli embassies, media-figures, and pro-Israel demonstrations.”
Another point of convergence that Europol noted is that right-wing and jihadist discourse share common anti-LGBTQ+ and anti-government positions, along with a desire to return to an idealized version of the past.
“These common elements have been exploited by some neo-Nazi and neo-fascist accelerationist idealogues to promote the adoption of violent jihadist tactics and methods, with several instances of right-wing violent extremists sympathizing with or praising jihadist ideology,” Europol explained. “The reverse dynamic has been largely absent, with rare instances of jihadists reciprocating admiration. However, the online activity of young jihadi-Salafists appears to indicate a potential further convergence, particularly around right-wing narratives that oppose progressive politics and a fascination with the extreme violence promoted by adherents of accelerationism.”
Europol also highlighted that anti-system and anti-government narratives are gaining momentum in some European countries and member states, such as creating movements to militate for individual sovereignty and denying legitimate authorities.
“These narratives also often integrate conspiracy theories and disinformation or topics borrowed from other ideologies, particularly right-wing,” Europol added. “Some of these groups accept or justify violence, while others have clearly demonstrated potential for violence or have engaged in violent activities against representatives of the state.”
Joe Frederick, head of the corporate intelligence practice at NSSG and a member of the ASIS International Extremism and Political Instability Community (EPIC) Steering Committee based in the UK, tells Security Management via email that adversarial states can use proxy actors to conduct terror activities aimed at keeping other states off balance. For instance, Iran uses Hezbollah, Hamas, and the Houthis, while Russia might leverage young people on the Internet, and North Korea poses threats in the cyber domain.
“I think what makes geopolitical tensions a significant driving force is there has been an erosion of authority of multilateral institutions—mainly the United Nations—and international norms,” Frederick says. “The guardrails are coming off, and we are heading into more turbulent times.”
Looking outside of Europe, Frederick notes the rise of insurgency driven by Islamist militants and ethno-nationalists in the Sahel region in Africa.
“Burkina Faso became the number one terrorist hotspot in the 2024 Global Terrorism Index, surpassing Iraq, Syria, and Afghanistan for the first time in 13 years,” Frederick says. “So, while wars are raging in the Middle East, terrorism is gaining stronger momentum across the Sahel and into the Horn of Africa.”
This activity is likely to worsen in 2025, Frederick adds, especially since France has reduced its counter-terrorism presence in Africa, creating space and opportunity for militancy to grow. The fall of the Assad regime in Syria also means that there could be space for the Islamic State to reconstitute itself.
The Islamic State “has been decimated, and many fighters are detained by the Kurds in the northeast,” Frederick adds. “Syria will not become a stable state with a functioning bureaucracy and robust economy for many years, which means that conditions will still be optimal for the emergency of terrorist threats.”
Technology
Europol noted that terror groups are also leveraging encrypted communications and social media to evade detection while they target vulnerable people with their propaganda. The agency highlighted that young people are becoming increasingly involved in the effort to produce and share propaganda online.
For instance, Frederick recalls a recent development where Russia’s FSB targeted Ukrainian youths using a fantasy role-playing game or quest game.
“Ukraine’s SBU revealed that the FSB had tasked teenagers to provide details of targets, including coordinates, physical descriptions, etc.,” Frederick says. “This information was fed back to the FSB via these games, and the information was used for targeted strikes. There are even reports that some of these youths carried out arson attacks.”
Ukraine is at war with Russia, so the situation is slightly different than other countries in Europe, but using these platforms to recruit young people is not a new tactic, Frederick adds.
“These platforms provide an extension for state and non-state actors to recruit disenfranchised and susceptible individuals to carry out terrorist and violent extremist activities,” Federick says. “To detect these threats is extremely difficult. Even adversarial foreign governments can recruit someone to carry out sabotage attacks.”
Another technology that terror and extremist groups are leveraging is generative artificial intelligence (AI) and large language models to accelerate the spread of propaganda. Europol has tracked right-wing groups using AI-generated material and deepfakes to spread racist or anti-Semitic messages. Groups have also attempted to bypass AI models’ ethical safeguards to spread prohibited information, the agency noted.
“As deepfakes can alter videos in real time, there is growing concern that livestreaming deepfakes could be used for terrorist purposes in the future to spread social alarm,” Europol said. “AI has also been used to create fake identities and automated bots to manage chat groups.”
In the physical realm, Europol flagged 3-D printers as another tool that extremist groups are interested in using to create weapons like the one used earlier this month in the targeted attack on UnitedHealthcare CEO Brian Thompson. Threat actors are most interested in the 3-D printed FGC-9, a semi-automatic pistol that is known for its reliability.
“The intent among threat actors to acquire 3-D printed weapons has extended beyond the right-wing milieu,” according to the assessment. “Individuals from a variety of ideological backgrounds are actively seeking online training material and instruction manuals that contain attack tactics and information on how to make weapons, drones, bombs, or chemical weapons.”
Security Response
One way to measure the terrorism threat is the response to it, Frederick adds. In the EU, for instance, the European Council came to a consensus earlier this week on three broad areas to bolster counterterrorism efforts across the bloc:
- Information exchange
- Preventing physical penetration into the EU from terror threats
- Countering extremism and terrorism online
“These are policy level efforts aimed at creating a new EU agenda on tackling extremism and terrorism,” Frederick explains. “In effect, it is an acknowledgement of new and emerging threats that are driven by geopolitical factors and facilitated by technology.”
While council efforts play out, private security practitioners can review Europol’s findings to better understand their risk posture and potential mitigation measures.
“For security practitioners, you are effectively trying to operationalize geopolitical risk: taking macro level developments and using them to implement ground level mitigation measures,” Frederick says. “The ability to do this is usually constrained by internal political will and budgets. As a security practitioner, I would use the report as a horizon-scanning tool. Look for the indicators and warnings, and use them to analyze trends. This will give you the information needed to understand an organization’s risk exposure to terrorism and extremist violence.”
