Tactical Diffusion: How Militant Drone Warfare Spreads – Part I

CommandEleven Intelligence Desk · Transnational Threats Desk, status as of November 10, 2026

Bottom Line Up Front

Armed commercial drones are now documented in the hands of the Tehreek-e-Taliban Pakistan (TTP) and its allies, the Sahel’s JNIM and Islamic State affiliates, and Mexican cartels. The tactic began with the Islamic State in 2016 and 2017, but the public record does not show it moving along a pipeline from one theater to the next. What it shows is parallel adoption driven by cheap commercial drones, the example of the Ukraine war, competition between groups, and captured equipment. That distinction matters: it means the threat spreads wherever the hardware is cheap and the lesson is visible, whether or not any two groups ever talk. This is Part I of our Transcontinental Convergence series, which asks how terrorist, insurgent and criminal networks learn from and trade with one another, and it holds every link to the standard of evidence.

Key Judgments

• CONFIRMED: The Islamic State first used a bomb-laden commercial drone in October 2016, killing two Kurdish peshmerga, and showed about a dozen modified drones in a January 2017 video (Combating Terrorism Center, 2018).
• CONFIRMED: Armed-drone use is now documented in each theater: TTP and Ittehad-ul-Mujahideen Pakistan (IMP) in Khyber Pakhtunkhwa, JNIM and Islamic State in the Greater Sahara in the Sahel, and the Jalisco New Generation Cartel (CJNG) in Mexico.
• CONFIRMED: The two Pakistani counts of 2025 drone attacks disagree: the army acknowledged 405 in December 2025, while Khyber Pakhtunkhwa Police reported 246 in May 2026.
• ASSESSED: The tactic is spreading through a demonstration effect, not a documented transfer chain. The sources point to the Ukraine war, regular armies’ drone use in Libya and the Middle East, group-to-group competition and captured equipment.
• REPORTED: Mexican cartels are learning from the Ukraine war, and some operatives reportedly trained there. The claim comes from a Small Wars Journal report cited by Brookings and is not independently verified.
• ASSESSED: Militants adapt to countermeasures within months, which is why counts and capability should be tracked, not just first uses.
• DATA DEFICIT: We found no credible public source linking drone know-how directly between a jihadist group and a Mexican cartel, and none showing the Levant-to-Sahel-to-South Asia-to-Mexico chain that earlier drafts of this series assumed.

Sourcing and Analytical Confidence

We grade every claim on one scale. Militant claims and propaganda are treated as claims, not evidence. Attack counts come from official or claimed sources and are reported as such. “(Unconfirmed)” is an inline hold tag only.

What Diffusion Means, and What It Does Not

Tactical diffusion is the spread of a method from one actor to others. It can happen three ways: direct transfer (trainers, advisers, shared supply), observation (a group sees a tactic work and copies it), or independent invention enabled by the same cheap technology. These have very different policy meanings. Direct transfer implies a network that can be disrupted. Observation and independent adoption imply a technology problem that no network disruption will solve.

A caution on method. A group using a tactic after another group did is not evidence that the second learned from the first. We therefore separate what is documented (who used what, where, and when) from what is inferred (why they did). Public output here stays at the organizational and strategic level; we do not describe how the systems are built or used.

The Origin: The Islamic State, 2016 and 2017

Don Rassler’s 2018 study for the Combating Terrorism Center at West Point dates the first Islamic State use of a bomb-laden drone to October 2016, when a device killed two Kurdish peshmerga who were examining it. In January 2017 the group released a video showing about a dozen modified quadcopters dropping munitions with what the study calls a fair degree of accuracy. The threat peaked in spring 2017 and was significantly degraded afterward. The study says the group’s actions could serve as an inspiration or model for other actors; it does not document that other groups adopted its methods.

Where It Has Spread

Our own reporting on the drone war in Pakistan and on cartel drone training covers parts of this ground in more detail.

How It Spreads: What the Sources Support

The Ukraine war as a common teacher. Felbab-Brown writes in Brookings (February 2026) that cartels are learning advanced drone tactics by watching Ukraine’s battlefield, and cites a Small Wars Journal report that cartel operatives trained there. A November 2025 GNET analysis says commercial drones used in the war have shaped militant thinking and that the TTP appears to be drawing lessons from it. Neither source ties the Ukraine lesson to a specific transfer from a jihadist group.

Regular armies as models. The Institute for Security Studies says Sahel groups likely draw inspiration from regular armies’ drone use in Libya and the Middle East, and emulate Sahelian armies’ own Turkish-made drones. It does not attribute the know-how to the Islamic State or to Ukraine. Drones are sold in local shops across West Africa.

Competition and captured equipment. GNET reports that IMP’s public claims pushed the TTP out of its earlier secrecy about drone attacks, and describes a possible arms race between groups. Militants claim to have captured security-force drones (the TTP’s 2025 report claims at least 10) and have been filmed with a captured anti-drone jammer. After counter-drone guns were deployed, militants reportedly moved to coordinated drone attacks within months in Dera Ismail Khan and Bannu. Much of this rests on militant claims and social media.

Vehicle-Borne Attacks and Combined Assaults

Earlier drafts of this series argued that armored vehicle bombs were perfected in the Levant and exported to South Asia. The record we can document does not support that as stated. The Baloch Liberation Army’s Majeed Brigade carried out its first known vehicle-borne attack in December 2011, long before the TTP-era drone surge, and a Diplomat analysis argues the movement is indigenous. What is documented is combination: in March 2025 a Majeed Brigade vehicle-borne attack on a military convoy at Noshki was followed by a ground assault by the BLA’s Fateh Squad, and in Khyber Pakhtunkhwa drone attacks are typically paired with infantry assaults and vehicle-borne devices. Casualty figures conflict sharply (the BLA claimed 90 soldiers killed at Noshki; the military reported five dead), and Pakistan attributes the BLA’s operations to Indian sponsorship and Afghan handlers. We hold both attributions as claims.

Video and Propaganda

The TTP’s media wing, Umar Media, produces a polished series, “Battles Are Accelerated”, whose eighth episode in December 2023 cut together a year of attacks on Pakistani forces, with infographics of claimed successes. Earlier episodes leaned on thermal-sniper and night-vision footage, and later ones on daylight ambushes. In November 2025 GNET reported the group’s first known use of publicly available satellite imagery in propaganda, to threaten a tribal militia compound; the author suggests the TTP may be learning from the Islamic State and al-Qaeda, a point he notes “cannot be ruled out”. We did not find a credible source for a similar pattern among Mexican cartels, so we do not assert one.

What To Watch

• Whether the Pakistani army and Khyber Pakhtunkhwa Police reconcile their drone-attack counts.
• First documented cartel armed-drone attacks on U.S. soil.
• Evidence of direct trainer, supplier or financing links between a jihadist group and a cartel.
• Counter-drone adaptation cycles: how fast militant tactics change after new defenses.
• New group entrants in the Sahel, where drone use is spreading quickly.

What Would Change Our Assessment

• A credible government, UN or court document showing direct drone-related training or supply between a jihadist group and a cartel.
• Verified documentation of cartel operatives trained in Ukraine.
• A reconciled official count showing TTP drone use is smaller or larger than reported.

Calls We Will Score

1. By December 31, 2026: No government, UN or court source will publicly document direct operational transfer of drone know-how between a jihadist group and a Mexican cartel.
2. By March 31, 2027: No cartel armed-drone attack on U.S. soil will be officially confirmed.
3. By December 31, 2026: The Pakistani military and Khyber Pakhtunkhwa Police will not publish a reconciled count of 2025 TTP and IMP drone attacks.

We score each call on its due date and publish the result, hit or miss, on the Foresight Record.

What This Assessment Does and Doesn’t Establish

• Does establish: that armed commercial drones are documented in each theater, with counts and dates, and that the Islamic State’s 2016 and 2017 use is the earliest we can document.
• Does not establish: that any group copied another, that a pipeline connects these theaters, or that Ukraine-trained personnel supplied specific groups. Counts rely on official or claimed sources that disagree, and much of the militant behavior comes from propaganda.

Frequently Asked Questions

Who first used armed commercial drones?

The Islamic State was first, according to the Combating Terrorism Center: a bomb-laden drone in October 2016 and a video of about a dozen modified drones in January 2017.

Are Mexican cartels learning from terrorist groups?

Not that the public record shows. Brookings reports cartels learning from the Ukraine war and does not link them to terrorist groups.

How many drone attacks has the TTP carried out?

The Pakistani army acknowledged 405 in 2025, combined for the TTP and IMP. Khyber Pakhtunkhwa Police reported 246 for the year, 215 of them in Bannu. The figures differ by agency and source.

What is Part II about?

Part II, The Money, looks at how hawala, crypto clearing and scam compounds connect criminal and terrorist finance, with each link tiered.

Related CommandEleven Intelligence Reading

• Transcontinental Convergence: A CommandEleven Intelligence Series
• The Afghan Taliban’s Drone War Against Pakistan
• Cartel Infiltration and Drone Training
• Jet Gerans: Threat Maps
• CENTCOM’s 25,000 Systems: Bases Still Exposed
• Project Meridian: The Fort Irwin Drone Gap
• The Rear-Area War

Sources

• Don Rassler, “The Islamic State and Drones: Supply, Scale and Future Threats,” Combating Terrorism Center, July 11, 2018
• Vanda Felbab-Brown, “How Mexican Cartels Are Using Drones, Now and in the Future,” Brookings, February 18, 2026
• Institute for Security Studies, “Sahel Militants Turn Civilian Drones into Deadly Weapons”
• South Asian Voices, “Facing the TTP Drone Threat in Pakistan,” June 2026
• GNET, “From Defence to Offence: How Anti-Drone Technologies Are Empowering Militants,” January 23, 2026
• Akash Shah, “Space Tech and Terrorism: Satellite Imagery and GPS-Guided Drones in TTP Propaganda,” GNET, November 20, 2025
• “Noshki Bus Attack: The Baloch Liberation Army’s Evolving Suicide Attack Strategy,” The Diplomat, March 2025
• “Markay Hain Taiz Tar: An Analysis of the Pakistani Taliban’s Final Propaganda Video of 2023,” Terrorism Monitor, Jamestown Foundation