Executive Summary

The 2026 mid-year audit confirms a terminal shift in transnational threat dynamics: the transition from insurgent disruption to the formalized “Dark-State” model. The “Bamako Blueprint” has established a repeatable manual for state displacement, characterized by a 45-day terminal window from administrative friction to total institutional rupture. In the Middle East, the IRGC’s “Garrison State” has centralized economic and military command to enforce a “Western Alignment Penalty” against regional adversaries through cyber-kinetic interdiction and maritime denial.

Transnational actors have achieved high-velocity geofinancial autonomy by pivoting to Analog Liquidity ($L_a > 0.85$) and the direct seizure of artisanal mineral resources, generating sovereign-level operational capital. The implementation of the Mosaic Defense model ensures that these entities maintain kinetic persistence even during total command-and-control (C2) “Flash-Dark” events.

3 Key Takeaways

• Administrative Asymmetry & The 45-Day Window: Non-state alliances are successfully inducing state collapse through logistical strangulation and shadow governance, hollowing out sovereign legitimacy in a compressed 45-day timeline.
• Cyber-Kinetic Convergence: Transnational threats have pivoted to the physical sabotage of critical infrastructure – specifically energy bypasses and desalination plants – utilizing HMI Ghosting to bypass digital safety protocols.
• Geofinancial Autonomy via Resource Interdiction: By controlling 85% of artisanal mining sites in the Sahel, militant groups have decoupled from the global financial system, utilizing gold and lithium to fund permanent “Dark-State” administrations.

The Post-Kinetic Shift

The mid-year update for 2026 confirms a fundamental transformation in the global counter-terrorism landscape: the transition from traditional insurgent tactics to the formalized “Dark-State” model. We are no longer tracking groups seeking merely to disrupt; we are auditing entities capable of terminal administrative seizure and sovereign-level governance.

The Emergence of the “Dark-State”

The success of the “Bamako Blueprint” has proven that synchronized non-state alliances can induce total institutional collapse without a protracted conventional war. By prioritizing administrative paralysis and logistical strangulation over urban combat, groups such as JNIM and the FLA have established a repeatable manual for state displacement. This shift necessitates a move away from “kinetic-only” counter-terrorism strategies toward a doctrine that addresses Administrative Asymmetry.

Operational Velocity: The 45-Day Standard

The baseline for state failure has been radically compressed. Our analysis indicates that once the “Siege Architecture” is fully deployed, the window from administrative friction to terminal rupture is approximately 45 days.

• This velocity is driven by the collapse of military legitimacy and the rapid implementation of shadow governance in rural peripheries.
• The 45-day standard mirrors the rapid successive captures witnessed in the 2021 Taliban offensive and the 2024 HTS consolidation in Syria.
• International restoration processes currently lack the agility to intervene within this window, often activating only after the militant-led administrative architecture has achieved permanence.

The Mosaic Defense and Cyber-Kinetic Convergence

Transnational threats have evolved into a Mosaic Defense structure, utilizing decentralized, autonomous “tiles” to maintain persistence.

• This model ensures that the loss of a centralized command node does not paralyze regional operations.
• We identify a critical shift toward Cyber-Kinetic Convergence, where groups prioritize the sabotage of physical infrastructure – such as the Habshan-Fujairah pipeline or regional desalination plants – over digital-only attacks.
• The integration of Analog Liquidity ($L_a > 0.85$)allows these entities to bypass Western financial sanctions and maintain high-intensity kinetic operations through the direct interdiction of mineral resources like gold and lithium.

Regional Theaters – Tactical Audits and Administrative Contagion

The 2026 mid-year update identifies a critical expansion of the “Dark-State” model from landlocked Sahelian hubs toward maritime and energy corridors. The primary threat is no longer border incursions but the systemic “Administrative Contagion” that hollows out state legitimacy from within.

The Sahelian Front: Post-Collapse Dynamics

Mali now serves as the primary operational laboratory for the JNIM/AQIM administrative model.

• Administrative Consolidation: Following the 45-day terminal rupture of Bamako, militant cadres have successfully transitioned from rural sieges to urban administration.
• The Littoral Infiltration Vector: We are auditing a high-velocity spillover into Northern Côte d’Ivoire, Ghana, and Benin. Unlike previous years, this is not a hit-and-run campaign; it is the deployment of the “Bamako Blueprint” designed to isolate savannah regions from southern port capitals.
• Logistical Denial: Militants are increasingly utilizing the W-Arly-Pendjari (WAP) complex as a sovereign logistics hub to interdict transit corridors connecting landlocked states to the Gulf of Guinea.

The Gulf & Levant: The Garrison State Response

In the Middle East, the IRGC’s transition to a “Garrison State” has fundamentally altered the proxy war landscape.

• Enforcing the “Western Alignment Penalty”: The IRGC is utilizing its proxy matrix to punish the UAE for its OPEC exit and US-Israeli defense pact.
• Maritime Interdiction Zones: We identify a synchronized shift in IRGC-N patrol vectors toward the Habshan-Fujairah pipeline exit terminals, prioritizing economic interdiction over conventional naval engagements.
• Asymmetric Siege Tactics: The use of “Grey Zone” operations – such as HMI Ghosting and vessel seizures – aims to demonstrate the futility of Western security umbrellas within the 72-hour flashpoint window.

South Asia: The Tactical Exchange

The Afghanistan-Pakistan theater remains the ideological and tactical foundry for the “Dark-State” model.

• Taliban-HTS-JNIM Cross-Pollination: We audit a continuous exchange of “best practices” regarding the seizure of artisanal mineral resources and the implementation of shadow judicial systems.
• State Erosion in Pakistan: The TTP continues to utilize the “Villages-to-Cities” inversion model, successfully hollowing out administrative control in the border regions to create contiguous non-state governed zones.

Target City Audit: High-Probability Ruptures

Based on current “Security Void” indicators, the following urban centers are flagged for potential administrative seizure before EOY 2026:

• Ouagadougou, Burkina Faso: Currently facing a terminal logistical stranglehold mirroring the pre-collapse Bamako environment.
• Niamey, Niger: Vulnerable to the “Shadow Governance” infiltration vector as the IRGC-style Garrison State model fails to provide localized security.

Strategic Focus – Cyber-Kinetic Convergence and Geofinancial Autonomy

The 2026 mid-year audit identifies a critical shift in how transnational actors project power and sustain operations. The focus has moved from purely digital disruption to the physical sabotage of critical infrastructure, underpinned by a total decoupling from the Western financial system.

HMI Ghosting and Infrastructure Sabotage

We are witnessing the maturity of Cyber-Kinetic Convergence, where groups prioritize “Hardware Truth” over data theft.

• HMI Ghosting Protocols: Intelligence confirms the deployment of specialized malware designed to seize Human-Machine Interfaces (HMI) in energy and water sectors. This allows attackers to bypass remote safety protocols and induce physical over-pressurization or mechanical failure in assets like the Habshan-Fujairah pipeline.
• Physics-Based Vulnerability: The global failure to implement the #72/48 Requirement – which mandates physics-based, analog overrides for all critical nodes – has left energy bypasses and desalination plants vulnerable to non-kinetic interdiction that yields kinetic results.
• The Desalination Threat: In the Gulf, asymmetric probes are increasingly targeting the intake and filtration systems of desalination plants, aiming to trigger “Civilian Shock” events that force governmental concessions.

Geofinancial Autonomy: The Analog Liquidity Baseline

To survive Western sanctions and “Flash-Dark” events, both the IRGC Garrison State and Sahelian “Dark-States” have pivoted to Analog Liquidity (L_a> 0.85)

• Resource Interdiction: Non-state actors now prioritize the direct control of artisanal mineral extraction over illicit drug trafficking. In Mali, JNIM’s control over gold and lithium sites provides a monthly revenue baseline of $50M+ USD, functioning as a sovereign-level war chest.
• Non-Networked Ledgers: The transition to physics-based, non-networked financial ledgers ensures that military and administrative funding remains operational even if the state is disconnected from SWIFT or global data bundles.
• The Conflict Premium: Militant groups are successfully leveraging “Synthetic Panic” to artificially inflate energy and insurance costs, capturing the resulting premium through laundered mineral exports and black-market energy sales.

The Mosaic Defense: Operational Persistence

The implementation of the Mosaic Defense model has rendered traditional “Decapitation Strikes” largely obsolete.

• Decentralized C2: Transnational groups have restructured into autonomous “tiles,” each capable of independent persistence and kinetic response.
• Autonomous ROE: Regional units are empowered with pre-set Rules of Engagement, ensuring that the neutralization of a centralized headquarters – whether in Bamako or Tehran – does not stop localized interdiction efforts.

Group Profiles – The Architecture of Non-State Sovereignty

The mid-year 2026 update identifies a shift from “terrorist cells” to “administrative cadres.” The following entities have successfully transitioned to the Mosaic Defense model, enabling them to maintain territorial and geofinancial sovereignty despite international kinetic pressure.

The JNIM/AQIM Unified Front: The “Dark-State” Standard

Jama’at Nusrat al-Islam wal-Muslimin (JNIM) has moved beyond insurgency to become the primary administrative authority in the Sahel.

• Ethnic-Administrative Integration: By incorporating the FLA (Azawad Liberation Front) and the Macina Battalion into a unified governance council, JNIM has effectively neutralized ethnic friction in favor of a monolithic “Sahelian Void” administration.
• Shadow Judicial Primacy: JNIM’s shadow courts now serve as the primary judicial bodies in Central and Northern Mali, offering a “predictable” alternative to the collapsed state bureaucracy.
• Resource Management: The group operates as a de facto state mining ministry, taxing and protecting artisanal gold and lithium extraction to generate a monthly operational baseline of $50M+ USD.

The IRGC Proxy Matrix: Decentralized Maritime Denial

Under the “Garrison State” model, the IRGC has restructured its regional proxies into autonomous, high-velocity “tiles”.

• The “Western Alignment” Punishment Wing: Specialized units within the IRGC-N and its regional affiliates are now tasked specifically with interdicting UAE and Western economic interests in the Gulf.
• Autonomous ROE: Regional proxy commanders are empowered with autonomous Rules of Engagement (ROE), ensuring that maritime seizures or HMI Ghosting attacks can proceed even during a total C2 “Flash-Dark” event.
• Tactical Coordination: We audit a high degree of technical coordination between these proxies and the IRGC’s cyber-kinetic units, specifically targeting subsea data bundles and energy bypass infrastructure.

TTP and the South Asian Inversion

Tehrik-i-Taliban Pakistan (TTP) is successfully deploying the “Villages-to-Cities” inversion strategy to hollow out state control in the border regions.

• Shadow Governance Normalization: The TTP is mirroring the 2021 Taliban model by implementing parallel administrative structures, including tax collection and judicial oversight, in the tribal peripheries.
• Tactical Cross-Pollination: Intelligence suggests a continuous exchange of urban siege tactics between the TTP and the JNIM/AQIM cadres, specifically regarding the isolation of provincial capitals through logistical strangulation.

ISGS: The Littoral Expansion Vector

The Islamic State in the Greater Sahara (ISGS) has pivoted from purely kinetic mass-casualty events to the territorial infiltration of littoral West Africa.

• The Savannah Corridor: ISGS is moving into the northern savannah regions of Ghana and Benin, utilizing the porous borders of the WAP complex to establish sovereign logistics zones.
• Supply Chain War: Their primary focus is the interdiction of transit routes connecting southern ports to landlocked Sahelian hubs, effectively militarizing the West African “Supply Chain War”.

Geofinancial Impact – The Conflict Premium and Monetary Rupture

The transition to the “Dark-State” and “Garrison State” models has introduced systemic instability into global markets. We are auditing a shift from traditional economic friction to the intentional weaponization of supply chains and sovereign wealth through Resource Interdiction and Synthetic Panic.

Resource Interdiction and Supply Chain Militarization

Non-state actors have moved from illicit trafficking to the direct oversight of primary extraction.

• The Gold-Lithium Standard: In the Sahel, JNIM’s control over artisanal mining cooperatives has converted mineral-rich peripheries into sovereign-level war chests, generating a baseline of $50M+ USD monthly.
• Militant Commodity Dominance: By controlling 85% of artisanal extraction sites in the Mali-Burkina-Niger tri-border area, these groups effectively dictate the “Conflict Premium” ($P_{\Delta}$) for rare earth minerals essential to Western green energy transitions.
• Sovereign Wealth Conversion: The IRGC’s centralization of the Ministry of Petroleum ensures that Iranian energy exports are directly converted into “Operational Kinetic Capital,” bypassing civilian oversight and international transparency requirements.

The “Synthetic Panic” and Market Manipulation

The IRGC and Sahelian cadres are utilizing asymmetric events to manipulate global geofinancial indicators.

• Maritime Insurance Inversion: By executing “Grey Zone” vessel seizures and infrastructure sabotage, the IRGC induces a “Synthetic Panic” that spikes Hull and Machinery (H&M) insurance premiums in the Persian Gulf.
• The Energy Surcharge: Coordinated probes against the Habshan-Fujairah pipeline are designed to artificially inflate global oil prices by signaling the vulnerability of the Strait of Hormuz bypass.
• Information Warfare: Militant groups utilize real-time disinformation regarding pipeline ruptures or “accidental” maritime collisions to capture the resulting market volatility through laundered energy sales.

Monetary Rupture and the BCEAO Risk

The administrative collapse of Sahelian states poses a direct threat to regional monetary unions.

• Central Bank Interdiction: The seizure of regional branches of the BCEAO (Central Bank of West African States) in captured administrative hubs like Bamako risks a total monetary rupture.
• Analog Liquidity Overhang: The proliferation of Analog Liquidity ($L_a > 0.85$) – physical gold and non-networked financial ledgers – creates a shadow economy that operates entirely outside the reach of regional central banks or Western sanctions.
• The Littoral Currency Contagion: As “Dark-State” entities expand into northern Ghana and Benin, they bring a high risk of hyperinflation and currency devaluation to the littoral states, hollowing out the economic stability required for a state-led “Restoration Process”.

The Cost of Institutional Failure

The “Western Alignment Penalty” imposed on the UAE and the collapse of the Malian state are primary drivers of a new global “Security Surcharge”.

• Private Security Escalation: The failure of state-led protection has forced multinational corporations to invest in Executive Protection (EP) and Kidnap, Ransom, and Extraction (KRE) services, increasing the overhead for operations in contested theaters.
• Infrastructure Abandonment: The 45-day velocity of administrative collapse is leading to “Successive Capital Flight” from regional infrastructure projects, further accelerating the transition to a non-state governed environment.

Forward Projections – The Q3/Q4 2026 Outlook

The final quarter of 2026 will be defined by the formalization of the “Sahelian Void” and the testing of the “Garrison State’s” kinetic limits. The velocity of administrative collapse and the maturity of cyber-kinetic interdiction indicate that traditional “containment” strategies are now obsolete.

Target City Audit: The Next Administrative Ruptures

Based on current logistical strangulation metrics, the following urban centers face a high probability of entering the 45-day terminal collapse window:

• Ouagadougou, Burkina Faso: Currently mirroring the pre-collapse Bamako environment, we project a total administrative rupture by mid-Q3 as rural shadow governance reaches the capital’s perimeter.
• Niamey, Niger: Vulnerable to successive garrison capitulations as the central military authority fails to secure the mineral-rich tri-border zones.
• The Littoral Port Hubs: While full seizure is unlikely in 2026, we anticipate increased “Grey Zone” sabotage and asymmetric probes against port infrastructure in Cotonou and Lomé to disrupt landlocked supply chains.

The 72-Hour “Flash-Dark” Surge

The IRGC’s transition to the Garrison State model suggests a planned surge in coordinated interdictions.

• Maritime Choke Point Normalization: We project that the IRGC will move to make “Single-Trigger” vessel seizures a monthly baseline, aiming to normalize a permanent “Conflict Premium” in global energy markets.
• The Fujairah Test: If the Habshan-Fujairah pipeline remains operational through Q3, the IRGC will likely escalate to high-visibility kinetic strikes against terminal pumping stations to demonstrate the failure of the US-Israeli security umbrella.

The Threshold of Restoration: Strategic Recommendations

To prevent the formalization of new “Afghanistan-style” encampments, the counter-terrorism paradigm must pivot toward Administrative Resilience.

• Mandatory #72/48 Implementation: Littoral West African states and GCC energy hubs must prioritize physics-based, analog overrides for all critical infrastructure to survive HMI Ghosting attacks.
• Mosaic Defense for States: Governments must decentralize their own administrative and security nodes, ensuring that the fall of a capital city does not result in the total cessation of sovereign functions.
• Resource Sovereignty: Reclaiming artisanal mining zones from non-state oversight is the only viable path to neutralizing the $50M+ USD monthly revenue streams currently funding the Dark-State expansion.