INTELLIGENCE ANALYSIS

As the head of the CJNG, El Mencho was one of the most wanted people in all of Mexico and the US and had a USD 15,000,000 bounty on his head issued by US authorities. Since its founding in 2009, the CJNG has developed into Mexico’s strongest cartel. In 2024, the fracturing of the Sinaloa Cartel after the capture of several of its key leaders allowed CJNG to expand its presence across multiple states, resulting in a nationwide spike in homicides and other violent crimes.

Past cases of arrests or killings of key cartel leaders have resulted in immediate-term waves of violence. For instance, in October 2019, the arrest of Ovidio “El Ratón” Guzmán López, son of Sinaloa boss “El Chapo”, resulted in the outbreak of severe violence in Culiacán, known locally as “Culiacanazo”. Faced with extreme levels of cartel violence, authorities took the controversial decision to release Guzmán.

CJNG will highly likely continue to respond to the killing of its leader with targeted violence against police, authorities, and security forces across its areas of operations, while also staging violent actions aimed at causing major disruptions and undermining the government. The states that will likely be most affected by the violence include Jalisco, Nayarit, Michoacán, Baja California and Baja California Sur, Colima, Tamaulipas, and Sinaloa; areas where the CJNG is most influential.

There is a realistic possibility that the public acknowledgement of US involvement in the killing of the CJNG’s leader has temporarily increased the risk to US tourists, personnel, and businesses in Mexico. The operation follows months of US pressure, threats of military intervention in Mexico, record extraditions to the US and the sharing of intelligence with Mexico. This has resulted in more visible security coordination between Mexico and the US, and an increase in anti-cartel operations in Mexico.

Increased counter-cartel operations have resulted in direct threats from CJNG to target US Border Patrol personnel along the international border. Furthermore, CJNG-aligned elements have reportedly left “narcomantas” (publicly displayed cartel banners) at tourist resorts, warning that US tourists and government officials could face reprisals in response to alleged US involvement in anti-cartel operations.

In the medium term, the death of El Mencho is likely to intensify infighting within the CJNG, with different factions likely seeking to inherit control over the cartel. This would mirror the case of Sinaloa, whereby following the arrests of “El Chapo” and “El Mayo”, the cartel’s historic leaders, Sinaloa fragmented among various factions, which are currently engaging in an internal war. Possible splinters or rival CJNG factions are likely to prioritise securing access to key revenue-generating areas and smuggling routes.

INTELLIGENCE ANALYSIS

Multiple militant groups operate in Pakistan, but the attack was highly likely conducted by either the Tehrik-i-Taliban Pakistan (TTP) or Islamic State Khorasan Province (ISKP).

The TTP has claimed responsibility for numerous attacks in Pakistan’s major cities, including a 2014 attack on Jinnah International Airport in Karachi, a 2017 suicide bombing in Lahore, and a 2023 attack on a police headquarters in Karachi. The TTP has previously targeted Islamabad, attempting a suicide bombing in Islamabad’s government district in December 2022. In August 2025, Pakistan’s intelligence agency announced that it foiled a planned TTP suicide car bombing. In November 2025, the TTP detonated a bomb outside Islamabad’s District Judicial Court complex.

ISKP has also claimed responsibility for numerous attacks in the country. Person-borne improvised explosive devices (PBIEDs) are often used by the group; however, most of ISKP’s attacks in Pakistan have taken place in Balochistan and Khyber Pakhtunkhwa, and the group is not thought to have conducted any attacks in Islamabad in recent years.

Both the TTP and ISKP have conducted attacks against Shia Muslims in Pakistan before. Moreover, both militant groups have absorbed fighters from Lashkar-e-Jhangvi (LeJ), a now-dissolved militant group with a long history of anti-Shia violence.

The attack comes amid heightened tensions between Afghanistan and Pakistan. Islamabad has frequently accused the Afghan Taliban-led government of allowing militant safe havens across the border, from which attacks are launched into Pakistan. Recent tensions escalated into airstrikes conducted by Pakistan on TTP targets in Kabul on 15 October 2025, following TTP raids on Pakistani military posts along the Afghanistan-Pakistan border that killed 11 on 11 October.

There is a realistic possibility that Pakistan will conduct further cross-border strikes into Afghanistan targeting militant hideouts. Additionally, Islamabad may suspend ongoing diplomatic engagement, fully close partially open border crossings, and/or impose further travel restrictions on Afghan nationals.

A heightened security presence across major cities in Pakistan is highly likely, with increased security checkpoints, road closures, and military deployments. Heightened security will likely lead to increased travel disruptions in the short term, particularly around major hospitals. Intensified security operations in the border regions of Khyber Pakhtunkhwa and/or Balochistan are also likely.

Given that the attack targeted Shia Muslims, the terror attack is likely to inflame sectarian tensions. Shias make up approximately 10 to 15 per cent of Pakistan’s population and have been targeted in numerous acts of terrorism in recent years, including the 2019 Quetta market bombing. Shia political and religious leaders are highly likely to call for stronger security measures, and there is a realistic possibility of protests from Shia groups.

INTELLIGENCE ANALYSIS

Following the October 2025 ceasefire in the Gaza Strip, large-scale pro-Palestine protests have continued to occur regularly in Australia, often coinciding with events involving Israeli figures or companies.

Several of these protests have been characterised by clashes. For instance, in early November 2025, pro-Palestine protesters clashed with police outside the Sydney International Convention Centre, which was hosting an expo attended by weapons manufacturers. In September 2024, protesters and police clashed during a similar expo in Melbourne, with the protests resulting in more than 110 arrests.

It is highly likely that the protests scheduled to occur during Herzog’s visit will attract thousands of attendees, particularly in Sydney. In Sydney, the planned protest route passes through the CBD and will therefore be subject to PARD. Consequently, there is a higher likelihood of police carrying out mass arrests, which would likely lead to clashes.

If significant clashes break out, police may deploy pepper spray, tear gas, stun grenades and rubber bullets. Protests are highly likely to disrupt traffic in Sydney, possibly blockading key roadways like Anzac Bridge, Sydney Harbour Bridge (as during previous pro-Palestine protests), A4, Park Street, King Street, William Street, and Druitt Street.

While the 9 February protests in Sydney are likely to be the largest, it is highly likely that smaller protests will be held throughout Herzog’s visit throughout the country. Moreover, previous pro-Palestine protests in Australia have been attended by counterprotests, and there is a realistic possibility of clashes between opposing protester groups.

Extremist violence targeting protest attendees, possible counter-protesters, or Jewish individuals and places of worship cannot be ruled out. In late January, police detained a 19-year-old Sydney resident for allegedly threatening to assassinate Herzog. Moreover, several calls for violence against Herzog have appeared on social media, including appeals to extremist groups to join the protests.

INTELLIGENCE ANALYSIS

Cutting the internet has been used in Uganda in recent years during elections or periods of heightened tension. The internet was almost certainly pre-emptively cut to prevent the spread of footage of security forces using excessive force, the spread of anti-government sentiment, and the organising of mass rallies on social media. Internet restrictions will highly likely remain in place over the coming days.

Major youth protests have erupted in recent years in neighbouring Tanzania and Kenya, as well as numerous other African countries, including Morocco, Madagascar, and Angola. In Uganda in November 2020, in the lead-up to the January 2021 general election, security forces arrested Wine, citing violations of COVID-19 protocols. Widespread protests erupted across Uganda, particularly in Kampala and other urban areas. Security forces cracked down on demonstrations, deploying tear gas, rubber bullets, and live ammunition, and detaining approximately 3,000 people over the election period.

Following reports of security force violence, electoral fraud, and the placing of Wine under house arrest, anti-government sentiment is almost certainly heightened, significantly raising the risk of widespread civil unrest. Following the publication of the electoral results on 17 January and the almost certain announcement of Museveni’s victory, Wine is highly likely to double down on claims of electoral fraud. Amid the tense political environment, this is likely to trigger demonstrations from many Wine supporters, which would almost highly likely escalate if security forces were to formally place Wine under arrest.

If civil unrest breaks out, demonstrations are likely to occur in Kampala and other major cities. In Kampala itself, protests will likely be particularly intense around the Central Business District and near government buildings. Large anti-government protests would highly likely result in travel disruptions, with security forces likely to use roadblocks to prevent protesters from accessing government buildings and diplomatic zones.

Civil unrest would almost certainly raise the risk of a potential coup. Museveni’s son, Muhoozi Kainerugaba, is expected to take over the presidency should the 81-year-old president fail to complete his term in office. Kainerugaba, who has threatened to behead wine and called for him to be hanged, is a four-star general and top military commander, in charge of Uganda’s most powerful institution. Critics of Museveni have previously called on Kainerugaba to conduct a military coup to seize power from his father. Kainerugaba’s control of the military almost certainly heightens the risk of a military coup should major nationwide civil unrest break out.

INTELLIGENCE ANALYSIS

The reported targeting of military facilities and airports inside Venezuela represents a significant escalation in US–Venezuela tensions, which have steadily deteriorated since August 2025. The substantial buildup of US naval and air assets in the wider Caribbean has largely been interpreted as pressure aimed at undermining the Maduro government. This posture has coincided with multiple US strikes against suspected narcotics trafficking networks, resulting in over 100 fatalities, as well as the seizure of illicit oil tankers suspected of transporting Venezuelan oil in circumvention of sanctions.

The reported strikes on airports and military installations likely suggest an effort to degrade Venezuela’s ability to conduct retaliatory military operations, by limiting air and logistical capabilities. Sustained damage to multiple airfields and port facilities would achieve a clear tactical advantage for any potential follow-on operations and further constrain the operational freedom of Venezuela’s armed forces.

Reports of President Maduro’s capture are yet to be confirmed; however, if true, the United States has likely achieved one of its primary objectives, which may decrease the risk of further US strikes on Venezuela in the immediate term.

In response to foreign military activity within Venezuelan soil, authorities are likely to implement heightened travel restrictions, curfews, and border closures in the coming days to manage potential unrest and support military operations. Increased security patrols, checkpoints, and the deployment of the armed forces to key infrastructure are likely. The authorities may also restrict the right to assembly or limit access to the internet and telecommunications, limiting situational awareness within Venezuela. Foreign nationals, particularly US and other Western citizens, will likely face an elevated risk of detention due to perceptions or allegations of involvement in the recent military activity.

If US strikes are sustained, they are expected to cause significant disruptions to air travel in the Southern Caribbean Basin. The proximity of Trinidad and Tobago and the ABC Islands, Aruba, Bonaire, and Curaçao, to mainland Venezuela is expected to make travel to and from these areas highly difficult. The closure of Venezuelan airspace is also likely to extend flight times on routes connecting the United States and Canada with areas of South America.

INTELLIGENCE ANALYSIS

The Bondi Beach mass shooting is the deadliest terrorist attack in Australian history and the deadliest mass shooting since the 1996 Port Arthur massacre.

Attribution for the attack has so far seen potentially conflicting reports. The Australian Security Intelligence Organisation (ASIO) reportedly “took interest” in one of the perpetrators, Naveed Akram, six years ago for ties to a Sydney-based Islamic State (IS) terrorist cell. This followed the July 2019 arrest of Isaac El Matari, the self-proclaimed head of IS in Australia, who wished to establish an “insurgency” in Australia.

Local media reports that investigators from the Australian Joint Counter Terrorism Team (JCTT) believe that the two perpetrators had pledged allegiance to IS, with two IS flags reportedly found in their vehicle at Bondi Beach. A senior JCTT official has briefed that Naveed Akram was “closely connected” to El Matari.

These findings, if confirmed, would strongly suggest at least a historical connection to an Australian IS cell. However, Australia’s Prime Minister Anthony Albanese has stated that intelligence authorities have informed him that there was “no evidence of collusion” and “no evidence that these people were part of a cell”. Investigations by Australian authorities remain ongoing.

In apparent contrast to the attribution to IS, whether that be via coordination with a wider network or through inspiration as lone actors, Israeli intelligence sources have briefed that the attack may have been carried out with the support of Iran or Iran-backed actors such as Hezbollah.

In August 2025, Iran’s ambassador to Australia, Ahmad Sadeghi, was expelled due to “credible evidence” that antisemitic attacks, including an arson attack against a café in Sydney in October 2024 and a synagogue in Melbourne in December 2024, were orchestrated by Iran’s Islamic Revolutionary Guard Corps (IRGC).

The Bondi Beach terrorist attack highlights the continuing elevated risk of terrorism in Western countries, particularly against Jewish targets. Other attacks in 2025 include the October 2025 ramming and stabbing attack targeting Jewish worshipers at a synagogue in Manchester, UK, during Yom Kippur, and the May 2025 shooting near the Capital Jewish Museum in Washington, D.C., USA.

In addition to the elevated risk of antisemitic terrorism against targets associated with Judaism, such as synagogues, Jewish schools, and events such as Hanukkah gatherings (14 December – 22 December 2025), the winter holiday season almost certainly entails an increased risk of terrorist attacks against ‘soft targets’. Symbolic and high-visibility events, such as Christmas markets, draw large crowds and are difficult to comprehensively protect against terrorist actors.

In the aftermath of the Bondi Beach attack, it is almost certain that security presence at Hanukkah events and synagogues will be elevated, as already reported in cities such as Berlin, London, and New York.