Inspire, Enlist, and Execute: The Islamic State’s Strategy in Southeast Asia




Close to 800 persons from Indonesia, Malaysia, and Philippines are among the foreign fighter network of the Islamic State (IS). The estimate is far larger than the number of Southeast Asians who had travelled to Afghanistan to be a part of the anti-Soviet Jihad. Some of these IS cadres are now in charge of the propaganda machinery that not only asks more people from the region to join the outfit, but exhorts  those who cannot, to carry out attacks at home. Year 2016 saw a number of IS inspires terror attacks in Indonesia, Malaysia and Philippines. With the authorities still in the process of giving shape to their respective national approaches to deal with the resurgence of Islamist radicalism, the IS seems to be making some significant gains within the region using a supportive ecosystem. 


In June 2016, the Islamic State (IS) launched a 20-minute video in which three men- a Filipino, an Indonesian and a Malaysian appeared together. Speaking in their native languages, they urged their countrymen to fight in Syria or the Philippines. Their subsequent message “If you cannot go to [Syria], join up and go to the Philippines”, however, represented a tweak in the outfit’s strategy which till then had focused on finding supporters and extricating them out of the region to either join its war efforts in Syria and Iraq or to simply be a citizen of the pure Islamic state carved out in the Levant region. The message was, thus, clear: ‘If you cannot get out of your country, stay put and act as a true IS agent’. Abu Abdul Rahman al-Filipini, one of the militants who featured in the video went on to pass the following instruction: “Kill the disbelievers where you find them and do not have mercy on them”. The IS had indeed sanctioned expanding its war theatre into Southeast Asia.

In 2016, in the months preceding and after the video was released, a number of attacks were carried out by the IS sympathisers in Malaysia, Indonesia, and the Philippines. The year, thereby, becomes a landmark year when the IS successfully executed all the three components of its overall strategy of expansion into the region: (i) Inspiring Muslims to sympathise with the IS; (ii) enlisting individuals or pre-existing radicalised groups for its future activities; and (iii) carrying out actual attacks. From here, the situation can only worsen, if the affected states do not attach seriousness to the challenge it deserves and evolve policies to strike at the heart of the IS growth.


(Aftermath of the attack at the Sarinah department store in central Jakarta, January 2016)

On 14 January 2016, eight people were killed – including four militants – in a terror attack in front of the Sarinah department store in central Jakarta. It was the first ever attack in Indonesia and for the entire South-east Asian region for which the IS claimed responsibility. It was also the first major attack in Indonesian capital since the 2009 bomb attacks at Ritz-Carlton and Marriott hotels and the first in which armed gunmen shot at civilians. Seven months later, on 5 July, a suicide bomber on a motorcycle blew himself up after he was stopped by officers from entering the local police headquarters in Solo city in Central Java.

While the overall strategy of the terrorists has been to target the police, they also have carried out attacks on churches. Both represent the IS war on non-believers as well as the state’s instrumentalities.  An attack on a Protestant church in Samarinda in November 2016 killed a toddler, and an attack on a Catholic church north Sumatran city of Medan in August was allegedly inspired by the killing of a priest by IS militants in Rouen, France. In the Medan attack, 18-year old Ivan Armadi Hasugian, wielding a knife-and-axe and carrying home-made explosives, attacked an Indonesian priest during a service, causing minor injuries before being beaten and wrestled to the ground by ­parishioners.

On 21 December three suspects planning a suicide bombing on Christmas Day or New Year’s Eve were killed in an encounter with the police on Jakarta’s outskirts. Investigations revealed that the suspects were planning to stab police officers at a traffic post and then detonate a homemade bomb as crowds gathered. In December, one of the IS cells had plans to attack the Istana Merdeka, the presidential palace in Jakarta with a female suicide bomber, but the plot was foiled by the counter terrorism unit, Densus 88. In addition, couple of plots aimed at avenging violence against Muslim Rohingyas in Myanmar were foiled. In November, for instance, Indonesian authorities detained a IS-linked militant for planning an attack on the Myanmar embassy there.

The number of alleged terrorists dealt with by Indonesian police in 2016 was more than double the previous year. Compared to only 82 terrorists in 2015, the year 2016 witnessed 170 terrorists being tackled by the police. Of the 170 cases, 40 militants were sentenced, six were returned to their families, 36 are facing trial, 55 are being investigated and 33 were killed. Similarly, 33 alleged terrorists killed by police in 2016 was also a steep increase from the seven killed in 2015. The 33 dead included the four terrorists in the Sarinah attack and Indonesia’s most wanted Islamist militant, Santoso, who was killed in a shootout in the jungles of Poso in Central Sulawesi in July. In December 2016, Indonesia’s police chief attributed the sharp rise to the influence of the IS and the defeats it is experiencing in the Middle East. Fraudulent transactions linked to terrorism had also doubled from 12 in 2015 to 25 cases in 2016.

Indonesian police claim that this sharp rise in terrorist attacks and plots are directed by Indonesians based with the IS. Authorities further believe that the IS has galvanised militancy in Indonesia again after a largely successful crackdown on terror networks there in recent years. Between 300 and 700 Indonesians are believed to have joined the group in Syria and Iraq over the past two years. In Hasakah province, Syria, they have combined with fighters from Malaysia to form their own unit, Majmu’ah al-Arkhabiliy, also known as Katibah Nusantara Daulah Islamiyah.

Bahrun Naim, a 34-year old software professional who fled to Syria in 2014 to join the IS is also believed to be a key mastermind of the attacks. According to the Indonesian anti-money-laundering agency PPATK Naim had used online payment services such as PayPal and bitcoins to transfer money to his comrades back home to fund terrorist activities. He used the smartphone messaging app Telegram, to send instructions. Similarly the role of jailed local cleric Aman Abdurrahman, who leads a group called Jamaah Anshar Khilafah (JAK) from prison has also been investigated. The man who carried out the suicide attack in Solo in July, Nur Rohman, is also believed to be a JAK member and to have links to Naim.

The police in response has undertaken Operation Tinombala in Central Sulawesi at capturing all members of the East Indonesia Mujahideen dead or alive. Fifteen alleged terrorists have been killed in Poso in 2016. Santoso, former leader of the EIM eluded capture for years and was seen as a symbol of resistance to the government until he was shot dead in July 2016. IS-inspired cells exist and are a continuing threat, influenced by leaders both at home and abroad.


An estimated 100 Malaysians are part of the IS’ foreign-fighter network in Iraq and Syria. While these people who have used a range of methods to escape the home country, were seen initially as posing no direct threat to Malaysia, such perception has changed rapidly in the past year. According to an estimate, between 2014 (formation year of the IS) and June 2016, the Malaysian police had foiled nine plots to carry out terror attacks in Malaysian soil. Between 2013 and January 2017, 268 terror suspects have also been arrested.

On 28 June, the IS carried out its first successful attack in Malaysia by exploding a grenade at Movida, a night club near national capital Kuala Lumpur. The attack injured eight people. 15 people were arrested in wake of the attack, including the two men who lobbed the bomb. Those arrested also included two policemen. One of the policemen was picked up for harbouring IS elements, while the other was arrested for involvement in robberies to collect funds for the outfit.

What Bahrun Naim is to Indonesia, Muhammad Wanndy Mohamed Jedi is to Malaysia. Hailing from Malacca, 26 year old Muhammad Wanndy travelled to Syria in January 2016 with his wife, also aged 26. Assessed to be based in Raqqa, Wanndy, operating under the assumed name of Abu Hamzah al-Fateh, claimed responsibility for the attack on his Facebook page. Muhammad Wanndy has used Telegram application effectively to direct attacks on prominent Malaysians, including Prime Minister Najib Razak and counter terrorism senior police officials. Another attempted attack on a Light Rapid Transit train in Setiawangsa is also attributed to his ‘terror by remote control’- technique. The fact that Wanndy has been able to recruit people online and direct attacks demonstrate a rapid growth of radicalism in Malaysia in support of the IS.

Two of the arrested for the night club attack were hiding in a hut in remote Kuala Krai in Kelantan in wait for new orders from Wanndy to attack a Johor entertainment outlet. An M67 grenade was recovered from them. Another man arrested in connection too had received orders from Wanndy and was to attack the police headquarters in Kuala Lumpur, and government complexes in Putrajaya. Among the other chosen targets was a Hindu temple outside Kuala Lumpur. The suspects were planning to use grenades and firearms in the attacks.

Between 13 and 19 January 2017, four people, including three foreigners, were arrested in Sabah and Kuala Lumpur over their suspected involvement in a new IS cell based in the Philippines. The arrested included a 31-year-old Filipino man, two male Bangladeshi nationals aged 27 and 28, and a 27-year-old Malaysian woman. The unemployed woman had been recruited through social media into the outfit by the Filipino man on assurances of marriage. The Bangladeshi men were working in Malaysia as salespersons.

(Sabah is emerging as a transit point for IS cadres to crisscross between Indonesia, Malaysia, and Philippines)

Malaysian police believe that the IS is attempting to use Kota Kinabalu and Sandakan in Sabah (see map) as a transit point for terrorists from Southeast Asia and South Asia, before they are smuggled into Mindanao in southern Philippines, a hotbed of Islamist insurgency. The cell was formed from an IS cell led by former University Malaya lecturer Dr Mahmud Ahmad, merging with the Isnilon Hapilon faction of the Abu Sayyaf Group (ASG). Mahmud Ahmad used his position as a lecturer to recruit cadres among his students has attempted to unify regional terror groups in Southeast Asia into a branch of the IS.

Continuing with the unravelling of the extent of IS penetration into the Malaysian society, between 27 and 29 January, another three persons were arrested. These included a security guard at Kuantan airport, with full access to aircrafts. Initial investigations found that he was not planning any terror attack, but had plans to go to Syria to join the outfit. Another person described to be of 38 years age had posted a plan to carry out an explosion in Kuala Lumpur in his Facebook page. The third person, an Indonesian with Malaysian residency, was attempting to flee to Syria to join the IS.

The Rohingya crisis in Myanmar has created another push factor for IS symapthisers to plan attacks in Myanmar. Malaysian Prime Minister Najib Razak has in the past raised concerns that tens of thousands of Rohingya who are seeking refuge in Malaysia may be exploited and radicalised by the IS. A suspected Indonesian IS follower, who worked as a factory worker in Malaysia since 2014, and was planning to head to Myanmar to carry out attacks was detained in Malaysia in December 2016. He was among seven people arrested for suspected links to IS. He was also involved in a plot to smuggle weapons to Indonesia’s Poso region, on Sulawesi island.


In Philippines, the IS is riding on the efforts of the existing Islamist separatist movements and individuals like Mahmud Ahmad with an Afghan and al Qaeda past. The alliance is also strategic for it has infused a new lease of life to some of the existing groups who were once struggling for survival. The Basilan based faction of the ASG led by Isnilon Hapilon and the minor Maute group, led by three brothers Abdullah, Omar and Otto Maute, that has been behind years of unrest in the southern part of the country,  have declared allegiance to the IS in January 2016. Other groups include the Bangsamoro Islamic Freedom Fighters, Ansar Khilafah, Jamaat al Tawhid wal Jihad, and factions within the Moro Islamic Liberation Front. As a result, southern areas of Basilan, South Cotabato, Sulu, Sarangani, Lanao del Sur, and the northern province of Isabela have transformed into IS’ operational areas.

On 2 September 2016, the Maute Group carried out a bombing at a street market in Davao city, the hometown of Philippine President Rodrigo Duterte, killing 14 people and wounded dozens. Duterte was in town for a visit. In the wake of that bombing, Duterte put a nationwide “state of lawless violence” in place, leading to an increase in the presence of the military and police around the country. In November the Maute group went on to occupy parts of a municipality in Lanao del Sur province, took over an abandoned town hall and raised the IS flag in the town, necessitating a military operation. Although at least 11 members of the group were killed in the operation, it was a major operation by the group.

(Mountains of Lanao del Sur has witnessed some of the recent attacks by the IS)

Hapilon, also known as Abu Abdullah, is on the Federal Bureau of Investigation (FBI)’s most wanted list for his role in the kidnapping of 17 Filipinos and three Americans in 2001 and carries a bounty of US$5 million. He is recognised by the Philippines military as the IS chief for country and consequently has become the target of some of the intense military operations in recent times. In January 2017, for instance, 15 IS militants were killed in air and artillery strikes in the mountains of Lanao del Sur. The military also claimed to have fatally injured Hapilon. According to the Philippine military sources, Hapilon had moved to Central Mindanao in a bid to unify extremist groups such as the Maute and the Bangsamoro Islamic Freedom Fighters and to make central Mindanao the base of the group’s activities, overcoming the limitations of operating in smaller islands such as Basilan and Jolo.

CT Moves: Kinetic Operations Plus

National measures initiated by these three countries to stem the growth of IS-inspired radicalism include launching kinetic operations to eliminate the terrorists; strengthening the legal framework; and also, evolving a counter-narrative to the IS’ version of Islam. In Indonesia, where police have campaigned aggressively against jihadists, killing or imprisoning many leaders, attempts have been made to tighten the existing anti-terrorism laws: to more clearly define terrorism and make it illegal to join militant groups like IS, enable police to detain people who support terrorist groups, and to enable them to hold terror suspects for longer periods. The PPATK too has attempted to tighten its scrutiny of financial transactions from overseas in order to curb terror funding.

In Philippines, President Rodrigo Duterte in January 2017 admitted that he could no longer contain ‘extremist contamination’ and appealed to the country’s Muslim separatist groups – the Moro Islamic Liberation Front and the Moro National Liberation Front – to deny sanctuary to militants with links to the IS. This declaration of vulnerability, however, was intended at masking his own preferred way of dealing with all form of ‘illegal’ activities. Duterte went on to warn that a war to checkmate the IS would be an eventuality which would put civilians in danger and there can be no respect for human rights while such an effort is unleashed. Duterte has floated the idea of suspending the writ of ‘habeas corpus’ in response to violence and lawlessness in the country.

Malaysia has added to the capacities of the force centric operations by setting up a new Regional Digital Counter-Messaging Communication Center (RDC3) with assistance from the United States with the objective of winning the ongoing battle against the IS and convincing the world that Muslims have nothing to do with the group’s hateful ideology. Malaysia along with Singapore has also joined the U.S.-led ‘Global Coalition to Counter IS’. The RDC3 is similar to the one the US launched together with the United Arab Emirates (UAE) in July 2015, and is designed to counter the IS social media strength and sophistication and present a more positive alternative to the vision the group has outlined. New legislations to counter the IS also include the Prevention of Terrorism Act (POTA) and the National Security Council Act, a move that has been criticised by human rights groups.

The US assistance is seen as a major capacity building factor among the security agencies in Southeast Asia. A study published in 2015 by the Combating Terrorism Centre at West Point noted that the United States had provided $441 million in security assistance to the Philippines, mostly for its military, and $262 million to Indonesia, mostly for its police.

However, several challenges remain that continue to create an enabling ecosystem for Jihadist radicalism to grow. Notwithstanding the fact that the IS growth has been dependent on the efforts of a tiny fringe for the moment, prisons, slums and youth bulge of Southeast Asia remain important part of an ecosystem that breeds radicalism. Even though most Southeast Asian Muslims reject terrorism, the IS seem to be succeeding in attracting a number of persons to its fold, without necessarily looking at creating a mass support base.

In Malaysia, the army has been a worrying source of recruits. The country’s defence minister told parliament in 2015 that at least 70 former members of the military volunteered for the IS. In Indonesia, where the Jemaah Islamiyah (JI), the al-Qaeda-inspired group responsible for previous attacks has largely splintered, active recruiting appears to have led to a soaring of the JI’s cadre strength to about 2,000. According to estimates, some 800 militants have been imprisoned and 100 have been killed in security force operations since the Bali bombings. But with the deradicalisation and reforms process failing, hundreds of them – some with significant battlefield experience – when released after their prison term in the coming years may form a core of the IS growth in future. About 40 percent of the 400 militants released as of December 2016 have returned to their radical network.


Amanda Hodge and Nivell Rayda, ” Indonesia: ‘Terror attack’ at Catholic Church in Medan”, The Australian, 29 August 2016,

Caleb Weiss, “The Islamic State grows in the Philippines”, FDD’s Long War Journal, 24 June 2016,

Christopher Woody, “11 ISIS sympathizers have reportedly been killed in a siege in the southern Philippines”, Reuters, 28 November 2016,

Jonathan Edward, “Abu Hamzah, the face of terror, is unmasked”, Malay Mail, 5 July 2016,

“Malaysia arrests 4 for alleged involvement in new Islamic State cell in Philippines”, Channel News Asia, 24 January 2017,

“Malaysian militants plan to start ISIS faction in South-east Asia”, Straits Times, 15 November 2015,

“Malacca man behind terror plots in Malaysia” The Straits Times, 15 August 2016,

Marc Lourdes, “Islamic State launches first successful attack in Malaysia”, CNN, 4 July 2016,

“Militant Bahrun Naim used PayPal, bitcoin to transfer funds for terror attacks in Indonesia”, Straits Times, 9 January 2017,

Prashanth Parameswaran, “Malaysia Hails New Center to Counter Islamic State Messaging”, Diplomat, 27 July 2016,

Rohan Gunaratna, “Philippines: an Emerging Islamic State Base in Southeast Asia?”, Benar News, 30 January 2017,

(Bibhu Prasad Routray is the Director of MISS. This Special Report has been published as part of Mantraya’s “Islamic State in Asia” project. All Mantraya publications are peer-reviewed.)