Explosions opposite Four Seasons Hotel in Damascus

INTELLIGENCE ANALYSIS

The attacks on both 2 and 7 July share multiple characteristics. Both attacks occurred in central Damascus, both attacks were in close proximity to a government ministry, and both attacks relied on planted explosive devices rather than firearms. Moreover, available footage of the second explosion (reportedly the more powerful blast) at the site does not suggest it was particularly large. The improvised explosive device (IED) detonated at the 2 July café bombing was a “crude [IED] weighing approximately one kilogram equipped with metal shrapnel”, according to the Ministry of Interior. These characteristics indicate that the attacks are likely connected, coordinated, and conducted by the same threat actor.

The attacks also follow another attack against a government ministry on 19 May, when a vehicle-borne IED (VBIED) was detonated outside a Defence Ministry building in the Bab Sharqi district of Damascus, killing one soldier and injuring at least 21 people. Just before the explosion, soldiers had identified and defused a separate vehicle rigged with explosives in the same part of the city.

Overall, the attacks highlight that despite a gradually improving security environment in Damascus for foreign travellers since the fall of the Assad regime, the risk of terrorism remains high and regime forces are unable to fully secure central Damascus.

Potential perpetrators of the attack include Salafi jihadist terrorist groups such as the Islamic State in Iraq and Syria (ISIS) and Saraya Ansar al-Sunnah, or Assad-regime remnant forces.

ISIS remains the most active terrorist group in Syria. Despite the Islamic State (IS) globally having shifted in strength towards sub-Saharan Africa, the group’s weekly newsletter al-Naba maintains a key focus on Syria and regularly calls for attacks against the Syrian transitional government (STG), which it classifies as “apostate”. Earlier this year in February, the ISIS spokesman Abu Hudhayfa al-Ansari released a statement announcing a new phase of operations targeting the STG.

Moreover, ISIS channels have previously been observed as calling on supporters to kill foreigners travelling to Syria, with foreign travel to Syria having considerably increased since the fall of the Assad regime. This would align directly with the 7 July attack being conducted close to the Four Seasons Hotel, which hosts foreign diplomats, business travellers, and UN staff, and the attack occurring shortly after President Macron had left the area. Macron’s visit to Syria is notably the first visit by a Western leader to Syria under the STG, and an attack during his visit is likely calculated to undermine President al-Sharaa and Western involvement in Syria.

Saraya Ansar al Sunnah was formed in 2025 as a splinter of Hay’at Tahrir al-Sham (HTS), the al-Sharaa-led Islamist rebel group which spearheaded the offensive that brought down the Assad regime in late 2024, by radicals who are disillusioned with the more moderate approach pursued by the government. The group shares much of its ideology with IS, and uses a similar communications style, although links between the two groups are unconfirmed. On 22 June 2025, Saraya Ansar al-Sunnah militants carried out a suicide bombing in the Mar Elisa Greek Orthodox Church in Douailah, Damascus, during mass. The attack killed 30 people and injured more than 50, and remains the most deadly terrorist attack to have been conducted in Damascus since the fall of the Assad regime.

​

Since the HTS-led takeover of Syria, the new al-Sharaa-led STG has cracked down on foreign jihadist fighters who were in the ranks of HTS, particularly Central Asian and North Caucasian militant factions. On 5 May, for example, Syrian security forces arrested over 24 Uzbek militants in Idlib, following an armed standoff between Uzbek fighters and security forces after a raid. In issue 547 of al-Naba published in May, ISIS called on former foreign fighters to join its ranks.

Assad-regime remnants also likely have incentives to have conducted the attacks, and previous unverified sources have suggested the initial investigations of the 2 July café have pointed away from ISIS; however, investigations remain in the early stages. In March 2025, major clashes broke out between STG forces and Assadist insurgents from Syria’s Alawite minority in Latakia and Tartus governorates. The 2 July café bombing, which killed six lawyers, occurred next to the Ministry of Justice, with trials ongoing for former regime figures such as Bashar al-Assad’s cousin, Atef Najib, and Syria’s former grand mufti, Ahmed Hassoun. Surviving Assad-regime networks could be attempting to disrupt the trials and discredit the STG, with the “primitive” nature of the IED on 2 July potentially pointing towards a smaller and less organised actor.

Other potential perpetrators include Druze and Kurdish militants, and Hezbollah. However, initial indications suggest that these actors are less likely to have conducted the attacks.

Druze militant violence has so far been localised in the south of Syria, with no established practice of conducting similar terrorist bombings. While some Kurdish hardliners in the Syrian Democratic Forces (SDF) maintained opposition to integration into the STG following their effective defeat by STG forces in early 2026, such a campaign of bombings in Damascus would almost certainly undermine their legitimacy for little operational gain.

Finally, while US pressure has been applied against the STG to intervene in Lebanon against Hezbollah in recent days, Syria’s Foreign Minister, Asaad al-Shaibani, has stated that Damascus has no intention of intervening in the country militarily. A regional expert briefing the media stated after the 2 July attack that there were no indications from Hezbollah’s supporters that pointed to Damascus as a target in recent days.

Security forces are highly likely to maintain a higher threat posture than usual in Damascus in the coming weeks, which will likely materialise with greater numbers of checkpoints and vehicle checks. Authorities may additionally conduct raids against suspected cells, which could lead to localised firefights in the vicinity of the raids. If the attack/s are attributed to Assad-regime remnants, there is a realistic possibility of a crackdown being launched in Latakia and Tartus governorates.

​