The 59-second video shows eight men clasping hands and pledging allegiance to the "Emir of the Believers" and the "Caliphate of the Muslims." They were about to launch a series of devastating attacks in Sri Lanka, an atrocity that took the lives of more than 250 people and simultaneously declared that ISIS is far from extinguished as a global threat.
Within days of the attacks, ISIS' online publication al Nabaa crowed about "raising the Caliphate banner in new arenas... The days are pregnant with more disappointments for the enemies of Allah." The video was released by a news agency linked to ISIS.
There is much yet to be learned about the organization behind the Sri Lankan attacks, but counterterrorism experts are united on one point: the small Islamist groups on the island could not have carried out such a complex attack without outside help.
Counterterrorism analyst Bruce Hoffman of the Council on Foreign Relations says last Sunday's attacks would have been "a leap of an order of magnitude in organizational and logistical capabilities for any extremist group."
That begs several questions: is ISIS successfully exporting expertise in bomb-making, fund-raising and recruitment far beyond what was its core territory? Where is it finding fertile ground? And how far is "ISIS central" -- subject to a crippling war of attrition over the last three years -- capable of organizing and directing attacks far from its heartland?
CNN senior international correspondent Ben Wedeman was in Baghouz in northern Syria for nearly two months as he reported on ISIS' last stand. "I don't think there is any doubt that many militants -- hundreds -- managed to escape to fight another day," he says. "As the Syrian Democratic Forces (SDF) closed in on Baghouz, there were plenty of opportunities to escape. The number of SDF fighters was relatively small and the area they needed to secure large."
Many will still be underground in Iraq and Syria. We are already seeing the adaptation of ISIS in Iraq into a low-level insurgency, with ambushes and assassinations against government forces and Shia militia in several Sunni areas this year. A UN report early this year noted: "This network is being established at the provincial level with a cellular structure mirroring the key functions covered by the central leadership."
In January, an ISIS sleeper cell was able to carry out a suicide attack that killed at least 14 people, including four Americans, in Manbij in northern Syria, far from the sliver of land it still controlled. Just in the past week, ISIS fighters staged a surprise attack on al Kawm in the desert near Palmyra.
Aimen Dean, who joined al Qaeda in 1996 before becoming an asset for British intelligence, told CNN he estimates that as many as 5,000 ISIS fighters are at large in the area.
Most assessments suggest (though this is an imprecise science) that thousands rather than hundreds of ISIS fighters and planners slipped out of the caliphate after the loss of Mosul and Raqqa in 2017.
"We don't know how many have died," says Edmund Fitton-Brown, coordinator of the ISIS/Al-Qaeda/Taliban Monitoring Team at the United Nations. "But we can assume that at least 50% survive. My personal guess is more."
Intelligence sources say some slipped through Iran into the Pakistani province of Balochistan and into Afghanistan. Its propaganda suggests ISIS sees India as promising territory and is intent on aggravating Muslim-Hindu tensions there. Others have gone home to Jordan and Saudi Arabia -- where there was an ISIS-inspired attack on the same day as the Colombo bombings.
The ISIS network in Libya is regrouping since being ejected from the coastal town of Sirte and has carried out several attacks this year against other Libyan factions.
In the Philippines, a pro-ISIS group held parts of the town of Marawi for five months in 2017; it included many foreign fighters.
"Indonesia, Malaysia, Egypt, Saudi Arabia and Jordan: these are the countries where returnees are going to pose a significant threat," says Aimen Dean.
Push and pull
Beyond the battle-hardened survivors of the caliphate, there are plenty of ISIS sympathizers sustained by online radicalization and extremist preachers. The collapse of the caliphate may have diminished ISIS' appeal, but despite US President Donald Trump's boasts that "We just took over 100% caliphate," it has certainly not extinguished it. The group's leadership long prepared for this new phase of its existence. Before he was killed in a drone strike, ISIS spokesman Abu Mohammed al-Adnani said the loss of territory would not spell the group's end.
"No: defeat is losing the will and the desire to fight," he said.
ISIS' leadership has been hollowed out, communication and planning disrupted. But the message is still out there. Edmund Fitton-Brown says attacks inspired by ISIS will become the new normal.
"It's angry, radicalized individuals responding to something they're seeing online," he told the Combating Terrorism Center's Sentinel.
Some will sign up to ISIS' ideology; some will look to al Qaeda. And in some places, such as the Sahel in north Africa, there are signs of budding cooperation between members of each group. Aimen Dean, who follows the fighting in Syria closely, says some former ISIS fighters are gravitating to a group aligned with al Qaeda -- Hurras al Deen -- in northern Syria.
In some ways a devolved structure is more difficult to confront than a highly centralized one. Cutting off the head of the snake has less effect. Al Qaeda's affiliates in Africa, Yemen and elsewhere survived and even prospered long after al Qaeda central was decimated.
The bank of terror
Where ISIS has a critical advantage is at the bank. Fitton-Brown says that estimates of its assets fall between $50 million and $300 million. Other estimates go even higher. The revenues of the Caliphate have been invested in legitimate businesses, laundered through banks and money-lenders and literally hidden under floorboards.
One overriding question about the Sri Lanka attacks is how they were financed. Dean estimates the operation may have cost between $30,000 and $40,000. "Who put together that sort of money and how did they get it?" asks Dean.
Father's story about losing children in Sri Lanka attacks 02:20
Similarly, after the attack in Riyadh a week ago, Saudi authorities raided a recently-built farm complex whose construction, according to Dean's sources, would have cost nearly $200,000. There were plenty of cash and weapons there too.
So, the ISIS leadership may still exercise some control over the distribution of funds. "Money absolutely was moved outside [of Iraq and Syria]," says Fitton-Brown. "And caches of money and gold were transferred to other locations."
"The cash is always centrally administered by an ultimate authority within the organization," says Dean. Operations may be at the discretion of local franchises; their funding rarely is. "ISIS is the Bank of Terror," Dean told CNN.
A global phenomenon
In decades past, terrorism tended to be local or national. In 1998, al Qaeda announced itself on the world stage with attacks in east Africa, followed by the September 11 attacks on the United States three years later. The age of transnational jihad had arrived. The global reach of terrorism has since been fed by online radicalization, encrypted messaging and the ease of international travel.
Set this within what Bruce Hoffman, writing for the Council on Foreign Relations, describes as religious intolerance and sectarian tensions everywhere, "whether it be rising Islamophobia, as in the March 2019 attacks on two mosques in New Zealand; increased anti-Semitism ... the unrestrained targeting of Christians by the Islamic State in Egypt, Syria and Iraq; or attacks on Shia communities by Sunni extremists in Pakistan."
This is the environment in which ISIS thrives. Its attacks in Paris, France, in 2015, for example, were designed to stoke anti-Muslim sentiment. Wherever the group's remaining leaders are hiding -- probably in the deserts of western Iraq -- they will be hoping religious animosity is kindled in Sri Lanka.
As Edmund Fitton-Brown puts it: "We have to live with an ambient threat. That's the modern world."
PUKmedia / By Tim Lister, CNN