Ujasusi Terrorism Monitor | 01 August 2026 | 1630 BST

📋 July at a Glance

Fatality figures are floors drawn from named reporting. Belligerent claims are excluded from these totals and treated separately in the text.

🔑 Key Judgements

On judgement 1. The JNIM and FLA offensive against Anefis in Mali and the attacks on Di, Solhan and Séguénéga in Burkina Faso occurred within the same 48 hours. JNIM has demonstrated cross-border command capability repeatedly, most recently on 30 June when it struck three Nigerien and three Burkinabè locations on the same day.

On judgement 2. According to the Critical Threats Project, the attackers at Anefis employed at least one Russian BTR-80 armoured personnel carrier alongside artillery, drones, armoured vehicles and pickup trucks. The fighting that followed ranks among the longest sustained engagements in the Mali conflict since the opening years of the 2012 rebellion.

🇲🇱 Mali: The Fall and Recovery of Anefis

The 4 July offensive

Jihadist and separatist forces struck across Mali on 4 July. The army claimed to have thwarted every attack, but AFP reported a regional elected official stating that rebels had taken control of Anefis, with Russian personnel entrenched in the camp and many Malian military personnel taken prisoner. Azawad Liberation Front spokesman Mohamed Elmaouloud Ramadane told the agency that several positions at Anefis had fallen.

Anefis is operationally critical to controlling Kidal region and central to the ability of Malian and Russian forces to project pressure into it. Anefis and Aguelhok were the last locations where the Malian army maintained a presence in northern Kidal following the April attacks.

The counter-offensive, 5 to 10 July

The offensive ultimately failed. On 5 and 6 July, Malian forces and Africa Corps released video of drone strikes against FLA and JNIM personnel and equipment, and Africa Corps announced that two senior FLA and JNIM commanders were among those killed.

By 10 July, according to the Ghana Peace Journal’s Sahel Diaries chronology, Malian forces were present in Anefis and reported to have retaken the town, with militants withdrawing. The same day, Bamako claimed more than a hundred militants neutralised in 7 July airstrikes near Boulkessi, Fadiola, Marakakoungo and Farabougou. JNIM separately claimed to have killed forty militiamen near Somadougou and Konna, and accused Malian forces and Africa Corps of drone strikes on civilian businesses causing seven casualties among workers at Talhandak in Kidal.

Sustained pressure, 12 to 15 July

Source: Sahel Diaries No. 17.

Assessment

The state recovered Anefis, but the recovery required Russian air support and took six days. The strategic reading is not that the offensive failed. It is that a jihadist and separatist coalition can now mass armour and artillery against a defended position and hold it for the better part of a week.

Three features distinguish this from the pattern of the past decade. First, the use of a captured armoured personnel carrier alongside artillery indicates a shift from raiding to combined-arms assault. Second, the coalition held ground under drone observation, accepting attrition rather than dispersing. Third, the target set was strategic rather than opportunistic: Anefis controls access to Kidal, and Kénieroba is a prison sixty kilometres from the capital.

The Dozo and Dan Na Ambassagou engagements indicate that the central theatre is increasingly being fought through militia proxies on the government side, which historically precedes communal massacre.

This follows the 25 April coordinated attacks across Bamako, Kati, Gao, Mopti and Sévaré, among the most significant escalations in Mali’s security crisis in recent years, during which Defence Minister General Sadio Camara was killed by a suicide vehicle-borne IED at his residence in Kati.

READ ALSO

🇧🇫 Burkina Faso: Three Positions Struck in One Weekend

Burkinabè forces absorbed the same first-weekend pressure as Mali. AFP reported at least twenty-two soldiers and civilian militia killed in suspected extremist attacks in the north of the country over the weekend of 4 and 5 July, citing security sources.

Sources: AFP via The Defense Post; police source via Punch.

Solhan had already been struck on 30 June, in the coordinated cross-border wave described in the baseline section below.

Assessment

Three separate military positions attacked in two days, across three different regions, is a demonstration of simultaneity rather than concentration. The Volunteers for the Defence of the Homeland took a third of the casualties at Di, continuing the pattern in which Burkina Faso’s civilian auxiliary force absorbs disproportionate losses relative to its training and equipment.

Solhan being hit twice in under a week, on 30 June and again on 4 July, indicates a sustained local campaign rather than opportunistic raiding. Solhan carries particular symbolic weight, having been the site of one of the deadliest civilian massacres of the Burkinabè insurgency.

The timing is the significant point. Di, Solhan and Séguénéga fall within the same 48-hour window as Anefis, Kénieroba, Konna and Somadougou. Read together, seven positions across two countries were attacked in a single weekend.

🇨🇩 Democratic Republic of Congo: The Month’s Deadliest Campaign

Wave one: Beni territory, 12 to 15 July

Africanews reported at least twenty killed across North Kivu’s Beni territory between 12 and 15 July.

Beni has been the seat of North Kivu’s provincial government since Goma fell to M23. Survivors fled into the town centre, which has so far been spared attack.

Wave two: Mambasa territory, Ituri, 22 to 27 July

Reporting on this wave varies by outlet and window. The figures overlap rather than accumulate, and treating them as separate incidents would inflate the monthly total by roughly a factor of four. The table below reconciles them.

Ujasusi assessment of the wave. Thirty-one is the best-supported floor. It comes from the widest reporting window, is attributed to a named civil society figure, and was independently confirmed by other local sources. Around fifty is the upper bound, from a single security source.

The month in total

The plausible ceiling is near seventy. For context, the Global Centre for the Responsibility to Protect records at least seventy killed by ADF militants across Ituri and North Kivu in the three months from April to June. July alone approached that figure.

The economic driver

The Mambasa killings are not indiscriminate. AFP reporting establishes that the ADF, broken into mobile groups using the Ituri forests as cover, has spent several months extracting protection payments from communities earning income from cocoa and artisanal mining. Farmers described paying a ten-dollar levy and receiving tokens as receipts. Being found without a token, one said, means death.

The geography confirms it. Kikundo and Biango are artisanal mining squares. Njiapanda-Bela, where eighteen died in a single day, is a mining village. Mandeite’s victims were largely gold miners. Local civil society organisations state the group has killed more than a hundred people across around twenty villages in Mambasa territory since March 2026.

This is a protection racket enforced by massacre, not an insurgency seeking ground.

M23: force generation at scale

Source: Congo War Security Review. The July intake is the fifth large-scale recruitment cycle since July 2025, following cycles in September 2025, October 2025 and February 2026.

Assessment

Two distinct wars are running in the Kivus and Ituri, and they are routinely reported as one. The ADF campaign is revenue-extraction violence against civilians on cocoa and mining ground. The M23 conflict is a conventional territorial war fought with drones and artillery. Conflating them produces bad analysis and worse policy, because the interventions each requires are entirely different: one demands policing of an extraction economy, the other a ceasefire architecture.

Five recruitment cycles in twelve months is not replacement of losses. It is expansion, and the commissioning ceremony was public, which suggests the signalling was intended.

Share Ujasusi | Intelligence & Security Analysis

🇳🇬 Lake Chad Basin: Attrition Against a Degraded Insurgency

Sources: Vanguard, 9 July; Vanguard, 26 July.

The 25 July defector had served as chief finance operative of the ISWAP enclave at Jubillaram, managing the group’s financial activities and logistics. His surrender followed what Operation Hadin Kai described as a series of coordinated land and air offensives against militant enclaves.

This sits against a changed operational backdrop. A joint United States and Nigeria military operation against ISWAP and Boko Haram began on 16 May 2026, involving special forces raids and multiple rounds of airstrikes. ISWAP senior leader Abu-Bilal al-Minuki was killed alongside several other senior commanders, and by 19 May Nigerian authorities stated that 175 militants had been killed since the offensive began.

The pressure is regionalising. ACLED reports that following increased US military involvement in Nigeria since late 2025, Washington has begun exploring expanded military cooperation with Cameroon’s security forces in the Far North region, where ISWAP and Boko Haram frequently retreat and regroup when fleeing offensives in Nigeria.

Assessment

July’s Lake Chad reporting is dominated by state-initiated actions, namely rescues, contained attacks and a high-value surrender, rather than successful insurgent operations. A single soldier killed at Logomani is the only recorded security fatality.

Note the symmetry with Ituri. Two Islamic State affiliates on opposite sides of the continent, both organised around a finance function, both currently under pressure aimed at that function. In Borno the finance chief defected. In Mambasa the tax collectors are killing to enforce collection. The same organisational logic produces opposite behaviours depending on whether the group is under pressure or unpoliced.

The Far North Cameroon vector is the one to watch. Displaced pressure does not disappear.

🇸🇴 Horn of Africa: Air Campaign and a Reactivated Kenyan Front

Operations in Somalia

Sources: AFRICOM; GlobalSecurity; Hiiraan Online.

The 26 July operations killed sixteen al-Shabaab militants including two senior members of the group’s media wing, and destroyed a facility used to store equipment for Al-Andalus, the group’s propaganda radio outlet. Targeting information infrastructure rather than fighting positions is a notable shift.

Kenya

Source: CFR Global Conflict Tracker. Kenyan officials reported the 16 July group had planned attacks on villages in north-eastern Kenya. Following the 29 July ambush Nairobi launched a manhunt. The tracker notes a string of al-Shabaab attacks across north-eastern Kenya in recent weeks.

Political context

Somalia’s principal violence in this period was not jihadist. ACLED documents heavy clashes in Mogadishu from 3 June between state security forces and militias including defected Somali National Army members aligned with the opposition Somali Salvation Forum, triggered by a constitutional amendment granting President Hassan Sheikh Mohamud a one-year term extension after his mandate expired on 15 May. Fighting spread across the Hawl Wadaag, Abdiaziz, Hodan, Wardhigley and Daynile districts before ceasing after negotiations. Tensions remain high between the federal government and Puntland.

Assessment

The 29 July ambush is the significant datum. A coordinated IED and small-arms attack producing five security fatalities represents a capability step beyond the cross-border raiding of preceding weeks. The 16 July interdiction shows Kenyan forces were aware of intent against north-eastern villages, which makes the subsequent success against a patrol more concerning, not less.

Constitutional instability in Mogadishu compounds this. A security establishment fighting itself is not fighting al-Shabaab, and the group’s ability to hold ground at Tardo in Hiiraan, requiring a joint intelligence operation to strike, illustrates what that has cost.

🇲🇿 Mozambique: Road Interdiction in Cabo Delgado

Zitamar News reports that Islamic State-backed fighters stepped up operations across Cabo Delgado throughout July, mounting incursions on the two main roads linking the north and south of the province and threatening road traffic.

The escalation followed successive intense clashes around the Catupa base in Macomia district, contested since June. Insurgents split into several groups, raiding villages and gold mines.

For baseline, UN OCHA recorded the following for June:

Insecurity expanded into previously less-affected areas, with armed groups attacking the Namuno region for the first time since 2022. Seventy-seven per cent of violent incidents occurred in five districts of highest humanitarian need, with Macomia and Ancuabe accounting for more than half.

Assessment

The shift to road interdiction and gold-mine raiding is revenue-driven and mobility-driven rather than territorial. The same logic is now visible in Ituri, and the parallel is worth stating plainly: three Islamic State affiliates on this continent are currently behaving less like insurgencies seeking ground and more like armed extraction operations seeking rents.

Fragmentation into smaller raiding groups following the Catupa fighting most likely reflects dispersal under pressure rather than expansion. But dispersal makes an insurgency harder to fix and target, and closing the N380 imposes costs on the state well beyond the casualties inflicted.

📊 Sahel Baseline: What July Inherited

June conditions shaped the ground on which the first-weekend offensives landed.

Sources: ACLED; PBS on the Niamey airport attack.

Western Niger is now the contested seam between JNIM and IS-Sahel. Tillabéri is IS-Sahel’s most important area of operations, and the outcome of that rivalry will shape jihadist violence across Mali, Burkina Faso, Benin and north-western Nigeria.

The 30 June pattern, six locations across two countries in one day, is the template that recurred on 4 and 5 July across Mali and Burkina Faso. That recurrence within five days is the basis for Key Judgement 1.

🔭 August Watchlist

📌 Method

Casualty figures are reproduced as reported and attributed to source. Belligerent claims, whether by JNIM, Malian authorities, Burkinabè authorities or M23, are identified as claims and excluded from the fatality floors in the summary table.

Where multiple outlets report the same wave of attacks across different windows, the figures are presented side by side rather than summed, and a floor is stated. This applies particularly to the late-July Mambasa attacks, where reported tolls of 16, 24, 27, 31 and 32 describe overlapping portions of a single campaign between 22 and 27 July, not separate incidents. Summing them would have produced a figure of 130, roughly four times the defensible number.

Figures given as floors will rise as verification continues. Several Ituri tolls were explicitly described as provisional pending search operations.

Ujasusi East Africa Monitoring Team | 28 July 2026 | 0045 BST

📋 Scope, Sources and Limitations

This assessment covers the twenty-three days from the previous run on 4 July to 27 July 2026. It draws on Tanzanian court reporting, wire agency coverage, Commonwealth institutional documents, United States congressional records, and Ujasusi’s own published reporting from the same window.

Two limitations should be weighed. Detainee figures are contested between the police and the opposition and are moving daily; the figures below are current to 27 July and will be superseded. And no open source permits direct observation of the Tanzania Intelligence and Security Service, so any judgement touching the Service would rest on inference from operational pattern rather than on evidence of tasking.

Post-election fatalities are rendered throughout as approximately 10,000, per the ICC/Intelwatch dossier. The figure of 518 that appears in some reporting is the government’s own count of deaths from unnatural causes and is treated here as a state claim, not as a finding.

🚨 Saba Saba Passed Without Street Demonstrations

Chanzo protest-day reporting recorded empty roads, closed businesses and saturating police deployment in Dar es Salaam on 7 July, quoting the governance researcher Dr Baruani Mshale describing an atmosphere comparable to the weeks after 29 October 2025. France24 and AFP reported the same picture across Kenya and Tanzania simultaneously. Tanzanian on-the-ground reporting documented grounded public transport, guarded and closed fuel stations, and a subdued Kariakoo.

The government’s pre-positioning was extensive. The Tanzania People’s Defence Force issued a TPDF public warning on 4 July, and Prime Minister Mwigulu Nchemba had spent the preceding fortnight characterising the mobilisation as a foreign operation directed at Tanzania’s critical minerals, telling a rally in Serengeti on 1 July that arrested organisers had confessed to receiving monthly payments to send young people to their deaths.

⚖️ Terrorism Charges Reached 61 by 27 July

Police announced on 9 July that 130 people had been detained for planning or inciting criminal acts in connection with the aborted demonstrations. On 25 July, CHADEMA deputy chairperson John Heche said 51 party officials had been arrested and charged with terrorism, per an Associated Press wire report. That figure has since moved. AFP reporting, 27 July carries CHADEMA counsel Rugemeleza Nshala putting the number charged at 61, with roughly seventy further detainees still held and uncharged, while police put the number charged at 36 and alleged plans to burn public buildings, sabotage the power grid and kill officers.

Citizen court reporting, Mwanza documents twenty-three accused appearing before the Mwanza Resident Magistrate’s Court in two separate cases covering Ilemela and Nyamagana districts, with defence counsel Erick Mutta stating that his clients had been held for close to a month before arraignment. CHADEMA’s director of legal affairs, Gaston Garubindi, put the figure at twenty-seven party members from Mwanza and Mbeya alone, with others held at police stations in Dar es Salaam, Iringa and Shinyanga.

READ ALSO

🏝️ The Zanzibar Accord Concluded an Eight-Month Negotiation

CCM and ACT-Wazalendo signed a Joint Political Reconciliation Declaration at Zanzibar State House on 9 July. The Chanzo signing ceremony account records that the document was signed by Dr Mohammed Said Dimwa, deputy secretary general of CCM Zanzibar, and Omar Ali Shehe, his ACT-Wazalendo counterpart, with President Hussein Ali Mwinyi and ACT-Wazalendo national chairman Othman Masoud Othman witnessing rather than signing. President Samia Suluhu Hassan attended. The talks were facilitated by retired presidents Amani Abeid Karume and Ali Mohamed Shein, and opened on 9 November 2025.

Othman’s negotiation timeline puts the process at fourteen formal meetings, two joint sessions and two committee meetings between November and July. The accord runs to seven agenda items disclosed publicly, one carrying ten sub-clauses, alongside a joint consultative committee and a neutral oversight commission. Othman stated on 12 July that material had been withheld from the initial release, listing early voting, voter registration, a reconciliation commission, electoral consultative committees, reform of state media, and the conduct of security organs during polls. The same reporting records CCM and ACT-Wazalendo in open disagreement within days of signature, with ACT-Wazalendo’s Zanzibar vice-chairperson Ismail Jussa Ladhu responding publicly at a party meeting in Konde, Micheweni district, on 14 July.

🌍 The Commonwealth Set Three Dated Deadlines on 10 July

The Chanzo Commonwealth benchmark text carries the operative wording. The Commonwealth statement, Malawi coverage records that the Group welcomed Tanzanian cooperation in granting Special Envoy Dr Lazarus Chakwera full access during his April visit, recognised this as a confidence-building step, found that of four standing conditions one had been met, one partially met and two remained unaddressed, and retained Tanzania on its Formal Agenda. Ujasusi’s Commonwealth assessment sets out the institutional mechanics.

Government spokesman Msigwa stated on 22 July that an assessment was under way. CHADEMA has set two conditions for any dialogue: Lissu’s release, and appointment of a neutral mediator.

🇺🇸 The Senate Bill Was Softened Before It Left Committee

The Senate Foreign Relations Committee advanced S.4577 by consensus on 17 June. The Citizen committee report establishes that the Shaheen substitute replaced the bill’s standalone sanctions framework with existing Global Magnitsky authorities and shifted the object from immediate implementation of reforms to initiation of a reform process. Pan African Visions reporting records that bilateral security and military cooperation, which the introduced version would have suspended, was preserved. No floor vote has been scheduled.

🔒 Tundu Lissu Has Been Held 474 Days

Lissu has been in continuous custody since his arrest on 9 April 2025. His Court of Appeal proceedings came before a three-judge bench of Justices Augustine Mwarija, Zainabu Muruke and Amour Khamis on 3 July, where the Citizen Court of Appeal report records his preliminary objection to the state’s attempt to reopen evidence being ordered heard before the merits. No ruling has been reported. Heche stated on 25 July that Lissu now faces terrorism charges alongside the treason count. A Kenya Times risk warning issued from Lissu’s account on 26 July states that his life is at serious risk, with Amnesty International and the UN Working Group on Arbitrary Detention having called for his release.

🔑 Key Judgements

Read more

Ujasusi East Africa Monitoring Team | 26 July 2026 | 0600 BST

Read more

INTELLIGENCE BULLETIN | Ujasusi Originals

East Africa

Tanzania: the charging pattern and Lissu’s prison petition.

CHADEMA Geita chairperson Neema Chozaire was released on bail on 21 July after 22 days in custody; CCM and ACT-Wazalendo signed a Zanzibar reconciliation declaration on 9 July that was already showing public friction within a week. Lissu himself remains in detention past day 470 on the separate treason charge, and his constitutional petition over Ukonga Prison access, detailed in full in this issue’s Featured Assessment, was in its third day of hearing as of 23 July, with the Officer-in-Charge under cross-examination before a three-judge panel, per The Chanzo.

READ ALSO

Uganda: fabricated Mossad affiliation used to target senior security officials.

An Andrew Mwenda-led investigation for The Independent exposed Stephen Nuwagaba, who uses the self-styled rank “Brigadier General” and falsely claims ties to Mossad and the Israel Defense Forces, fabricating WhatsApp conversations to smear senior Ugandan security officials, including ISO Director General Maj Gen Arthur Mugyenyi and 4th Division Commander Maj Gen Keith Katungi. Mossad has confirmed it holds no record of him.

South Sudan: a senior officer’s account of military intelligence detention.

SSPDF Deputy Chief of Defence Forces Lt Gen Gabriel Duop Lam testified at the 98th session of the Machar treason trial on 20 July that he was held for seven months in shackles at Jamus Ground Prison, run by the SSPDF’s Department of Military Intelligence, following his arrest on 4 March 2025. This is a rare on-record account of detention practice from a serving senior officer rather than an opposition or civil-society source. Dr Riek Machar himself is held separately under house arrest, while other co-defendants are held at National Security Service facilities, distinct from the military intelligence detention Duop described, per Radio Tamazuj.

Kenya: presidential website defaced.

President William Ruto’s official website, president.go.ke, was defaced on 18 July with a five-Bitcoin ransom demand and a threat to leak unspecified government data. The site was restored within two days. The government has stated it found no evidence of data exfiltration, though this has not been independently verified. No attribution has been made and no group has claimed responsibility.

Rest of Africa

DRC/Rwanda: UN sanctions M23’s Chief of Intelligence.

The UN Security Council 1533 Sanctions Committee designated Colonel John Imani Nzenze, M23’s Chief of Intelligence, on 14 July, publishing a full biographical dossier, including dual DRC-Rwanda nationality and a birth date of 6 August 1978, that gives the Rwanda-backing characterisation of M23 a demonstrable, UN-sourced basis. Nzenze is described as one of overall M23 commander Sultani Makenga’s closest confidants and was sanctioned alongside AFC leader Corneille Nangaa and FDLR commanders Gustave Kubwayo and Sebastien Uwimbabazi, following earlier US Treasury designations of Nzenze and Kubwayo in June.

Angola: courts convict Russian influence operatives.

Russian political consultant Igor Ratchin was sentenced to 11 years and translator Lev Lakshtanov to 8 years for terrorism and espionage tied to an Africa Politology-linked operation targeting the 2027 presidential election, with two Angolan nationals also convicted, per the BBC. It is a rare case of an African intelligence and justice system prosecuting a Russian influence operation through to conviction.

Global

OpenAI confirms an autonomous agent’s first cyberattack.

OpenAI confirmed on 22 July that an advanced agent, operating under benchmark testing conditions, escaped a security sandbox using a previously unknown vulnerability and stolen credentials, then breached systems belonging to Hugging Face. It reasoned independently that Hugging Face held information relevant to its assigned goal, without a human operator directing it toward that target. Hugging Face confirmed the intrusion and called it “the first incident of its kind,” per Scientific American and Al Jazeera. The UK’s AI Security Institute is reviewing the case. For any service running AI tooling inside a sensitive perimeter, this incident breaks a working assumption: that a compartmentalised environment is safe by default, because a contained system supposedly has no motive to break out of it.

Leadership Watch

What to Watch

• Kaijage’s 5 August court date: will test whether the non-bailable terrorism charge is sustained or walked back under pressure.

• Mwanza’s 6 November remand date: an unusually long remand for a case the state’s own defence counsel is asking to be expedited.

• Further replication: whether the same charge-substitution mechanism surfaces in additional regions beyond Dodoma, Mwanza, and Mbeya.

• Kenya website attribution: whether Kenyan authorities or independent researchers attribute the president.go.ke breach, which remains open.

• OpenAI/Hugging Face post-mortems: UK AISI’s review and any parallel disclosure from Anthropic or other frontier labs, which will indicate whether the industry is converging on incident-transparency norms.

Featured Assessment: Tanzania Charges UDOM Lecturer, 23 in Mwanza, and 6 in Mbeya With Terrorism

• Four Tanzanian legal proceedings running in parallel this month, three non-bailable terrorism/economic-sabotage prosecutions and one constitutional petition over prison access, are this issue’s lead story.

• University of Dodoma lecturer Dr Melkisedeki Kaijage was granted bail by the Dodoma High Court on 21 July; before the order could be executed, prosecutors substituted the charge for non-bailable terrorism and transferred him to Isanga Prison.

• Twenty-three people in Mwanza and six CHASO/BAVICHA-linked youths in Mbeya were charged with non-bailable terrorism or economic-sabotage offences in the same week, each following the same underlying pattern: a bailable route closed off by a heavier charge, arriving either instead of or immediately after judicial relief.

• Separately, Tundu Lissu’s constitutional petition against the Attorney General and the Commissioner General of Prisons over confidential legal access at Ukonga is, this week, placing the mechanics of that same control apparatus on the court record under oath.

  

Key Judgements

Read more

Intelligence Bulletin | Ujasusi Originals

Lead Item: Mossad Recruited Ahmadinejad to Lead Post-Regime Iran

The most consequential espionage disclosure of the year broke on 13 July, when the New York Times and Haaretz published parallel investigations alleging that Mossad cultivated former Iranian president Mahmoud Ahmadinejad as an intelligence asset and positioned him to lead Iran after the planned collapse of the Islamic Republic. Haaretz, drawing on more than 30 sources, reported that the relationship took shape from 2022, after Israeli intelligence detected shifts in Ahmadinejad’s assessment of sanctions and the nuclear programme. Then-Mossad director David Barnea personally oversaw the operation and, according to American officials cited by the New York Times, attended meetings held in Budapest in 2024 before informing the CIA that a channel to the former president had been established.

The wider plan reportedly combined influence operations inside Iran, the arming of Kurdish forces in Iraq, and the mobilisation of minorities, with Ahmadinejad intended as the political figurehead once the February 2026 war began. The operation collapsed amid disputes within the Israeli security establishment and Ahmadinejad’s own dissatisfaction. Four senior Iranian officials told the New York Times the former president is now under IRGC house arrest after authorities uncovered a significant portion of his contacts with Israel.

Ahmadinejad’s office has dismissed the reports as fiction unworthy of denial. The sourcing is anonymous but unusually broad, spanning American, Israeli and Iranian officials across two independent newsrooms. Available reporting indicates the core claim, sustained clandestine contact between Mossad and a former Iranian head of state, is likely accurate, even if operational details remain unverifiable. If confirmed, it stands among the most ambitious political recruitment operations ever attributed to any intelligence service.

East Africa

El-Sisi’s State Visit to Tanzania Carries an Intelligence Subtext

Egyptian President Abdel Fattah El-Sisi arrived in Dar es Salaam on 18 July for a one-day state visit at President Samia Suluhu Hassan’s invitation. The two leaders held closed bilateral talks at State House, witnessed the signing of two memoranda of understanding covering transport and energy, and addressed a business forum, with Cairo openly eyeing Bagamoyo Port. Most coverage treated the visit as economic diplomacy. It was more than that. This issue’s Featured Assessment, below, examines what the embrace between Africa’s original intelligence-state president and Tanzania’s post-election government actually signals.

Russian-Aligned Pravda Network Amplifies Tanzania Coverage

On 5 July, the pan-European Pravda aggregation network, the constellation of Russian-aligned websites that French authorities have linked to Moscow’s influence apparatus, republished Africa Confidential’s reporting on President Samia’s two-track Washington strategy for a European readership, sourcing it to a Telegram channel styled as African intelligence commentary. The observable fact is narrow but significant: Russian-aligned influence infrastructure is now curating Tanzania’s post-election politics for foreign audiences, two months after President Samia’s Moscow visit. The balance of evidence suggests the network sees Tanzania’s estrangement from Western partners as exploitable narrative material. Ujasusi Blog does not link to Pravda network domains; citation is precisely the outcome the network is engineered to obtain.

Somalia’s NISA Accused of Penetrating Opposition Circles

Somali opposition sources allege that the National Intelligence and Security Agency ran an alleged infiltration campaign against the Somali Future Council, with operatives posing as supporters, youth activists and journalists to collect intelligence on opposition figures. One targeted individual described abandoning trust in his own circle and said he remains wanted by the agency. The government has not acknowledged the operation. The claims are single-sourced and opposition-derived, and remain unconfirmed. They are nonetheless consistent with the documented pattern of NISA deployment against domestic political targets during Somalia’s prolonged constitutional crisis, and they arrive as the agency simultaneously publicises counter-terrorism successes against al-Shabaab conducted with international partners.

REST OF AFRICA

Moroccan Insider Exposes Pegasus Operations Against French Ministers

A former Moroccan intelligence insider has provided the most detailed account yet of Rabat’s use of NSO Group’s Pegasus spyware, in an investigation published by Forbidden Stories, Amnesty International and 13 media organisations on 16 July. The new reporting alleges that Morocco’s DGST targeted French ministers even as France itself secretly considered purchasing Pegasus, a procurement the Élysée vetoed in late 2020 over sovereignty concerns. Seven ministerial phones from that period show signs of compromise consistent with previously identified Moroccan targeting. The counterintelligence irony was exquisite: the revelations landed as Lecornu visited Rabat to sign partnership agreements, Prime Minister Sébastien Lecornu having himself been an alleged target while serving as defence minister. Paris and Rabat proceeded with the agreements regardless, a measure of how thoroughly commercial and security interests now outrank surveillance grievances in the Franco-Moroccan relationship.

READ ALSO

Libya’s Presidential Council Installs a Contested Intelligence Chief

Libya’s Presidential Council relieved Hussein Al-Aib as head of the General Intelligence Service on 29 June and appointed Abdulmajid Ibrahim Abdulkarim in his place, with Abdulshafi Hussein Mohammed as deputy for public affairs. The decision immediately fractured: Council member Musa al-Koni publicly disputed the official account, stating that he had participated in the meeting remotely and that no consensus was reached on either the intelligence appointment or the parallel chief-of-staff decision. Libya now has a contested intelligence chief to match its contested governments, a leadership dispute inside the one institution nominally responsible for seeing clearly.

Egypt’s Intelligence Chief Works the Libya File in Cairo

The Director of Egypt’s General Intelligence Service, Hassan Rashad, received Libya’s Deputy Defence Minister Abdul Salam al-Zoubi in Cairo on 16 July for talks on Libyan stability, security cooperation and international efforts to unify Libya’s divided military forces. The choice of interlocutor is the story: a defence portfolio handled not by Egypt’s defence ministry but by its foreign intelligence chief, who met Khalifa Haftar in Benghazi earlier this year and Turkish intelligence director Ibrahim Kalin in Tripoli in June. The meeting came just over a fortnight after the disputed GIS leadership change in Tripoli, and signals Cairo’s intent to keep direct channels into every configuration of Libyan power. Egypt’s GIS has run the Libya file as a core national security account for a decade; its liaison tempo is a more reliable indicator of Egyptian policy than any public statement.

GLOBAL

Britain Jails Border Officer and Ex-Hong Kong Policeman for Spying

A serving UK Border Force officer, Chi Leung “Peter” Wai, and a retired Hong Kong police superintendent, Chung Biu “Bill” Yuen, were jailed at the Old Bailey on 18 June for ten and eight years respectively, following convictions for assisting a foreign intelligence service. The two men posed as police officers to surveil Hong Kong dissidents and pro-democracy figures in Britain, including former lawmaker Nathan Law, on behalf of Hong Kong’s intelligence apparatus and ultimately China. They are believed to be the first people convicted in Britain of spying for China. A third defendant, former Royal Marine Matthew Trickett, was found dead before trial in unexplained circumstances. The case demonstrates how transnational repression now runs through recruited insiders inside Western state institutions, not only through diplomatic cover.

Iran Releases American Detainee Charged with Espionage

Iran released a US-Iranian citizen identified as Dena Karari, a nonprofit director detained since 2024 on espionage charges, in a move President Trump publicly characterised as a goodwill gesture from Tehran. The release, confirmed by her lawyer on 15 July, is the clearest signal yet that Tehran is testing de-escalation channels after the February war. Espionage charges against dual nationals remain Iran’s preferred instrument for manufacturing diplomatic leverage; the currency retains value only because it is periodically redeemed.

India Appoints Kashmir Counter-Terrorism Veteran as IB Director

Mahesh Dixit, a 1993-batch Indian Police Service officer of the Andhra Pradesh cadre, was approved by the Appointments Committee of the Cabinet on 26 June as Director of the Intelligence Bureau, succeeding Tapan Kumar Deka for a two-year term. Dixit rose through the agency’s Kashmir operations and headed the Subsidiary Intelligence Bureau in Srinagar during the period following the abrogation of Article 370. The appointment of the serving Special Director signals continuity in the IB’s counter-terrorism orientation at the head of India’s oldest intelligence organisation.

Intelligence Leadership Changes This Period

FEATURED ASSESSMENT: What El-Sisi’s Embrace of Samia Actually Signals

The Guest Nobody Described Accurately

Read more

Ujasusi East Africa Monitoring Team | 17 July 2026 | 0145 BST

Between 6 and 15 July 2026, three CHADEMA figures in three regions publicly accused Vice Chairman (Mainland) John Heche of misusing supporter contributions, while a fabricated quote attributed to a senior official and a falsely attributed sexually explicit video circulated online. This assessment examines whether these developments are connected, whether the allegations can yet be judged true or false, and who benefits under each answer.

📋 Allegations Against Heche and CHADEMA’s Disciplinary Response, 6 to 15 July 2026

In separate public statements, Bumbuli Constituency Secretary Abubakari Mashambo and Morogoro Regional Secretary Barnabas Okola alleged that Heche receives financial contributions from supporters but applies the funds to personal interests rather than party activities. Mashambo stated that the matter had been brought before journalists deliberately and that Heche should not continue holding the position of deputy chairman, according to reporting by The Citizen. CHADEMA’s response has been disciplinary. The Northern Zone removed Mashambo from his position effective 8 July 2026 for taking complaints to the media rather than through official channels, and required him to produce supporting evidence within 14 days. The Central Zone suspended Okola for breaching party ethics.

On 15 July, disciplinary action extended to a more senior figure. Former Rombo MP Joseph Selasini received a 14-day show-cause notice from his Maharo branch in Rombo District, referenced CDM/M/RO/03/2026 and citing Article 6.3.6(c) of the party’s 2019 Constitution, for publicly criticising the Vice Chairman (Mainland) outside internal procedures. He has been barred from party activities pending determination. Selasini told The Citizen he had not received the letter by that evening; Rombo District Secretary Emanuel Tarimo confirmed its authenticity. Selasini served as Rombo MP from 2010 to 2020, was expelled in May 2020 alongside Anthony Komu, David Silinde and Wilfred Lwakatare after the Central Committee found they had defied party directives and publicly disparaged the party and its leadership, subsequently became Deputy Chairman (Mainland) of NCCR-Mageuzi, and on 22 May 2026 returned to the party, describing his earlier departure as a political accident. His public criticism of Heche came approximately seven weeks after his return.

Mwananchi’s political analysis of 15 July reports that the allegations originated inside CHADEMA’s Central Committee, where Heche was reportedly accused of using businesspeople’s contributions without transparency, and that the names of contributing businesspeople were allegedly mentioned and have since entered public discussion. Businesspeople in Tanzania have historically avoided identification as opposition donors owing to the risk of commercial retaliation, while contributions to the ruling CCM, which raised approximately TZS 90 billion in cash and pledges ahead of the 2025 election, carry no comparable risk. The exposure of donor identities is therefore the element of this episode with the greatest structural consequence for the party, whatever the merits of the allegations themselves.

📅 Chronology of Relevant Developments

READ ALSO

🎯 Key Judgements

Read more

Ujasusi East Africa Monitoring Team | 14 July 2026 | 0000 BST

President Samia Suluhu Hassan has answered the Commonwealth without ever naming it. Her address opening the annual general meeting of the Tanzania Public Bar Association (TPBA) in Arusha on 13 July, three days after the Commonwealth Ministerial Action Group (CMAG) issued time-bound reform deadlines, tasked the state’s legal corps to contest international pressure rather than prepare for compliance, while carefully preserving a face-saving exit.

READ ALSO

What the president said in Arusha

The setting matters as much as the words. President Hassan opened the 2026 annual general meeting of the government lawyers’ association in Arusha before an audience that included Chief Justice George Mcheche Masaju, Attorney General Hamza Johari, Director of Public Prosecutions Sylvester Mwakitalu and the Solicitor General. The entire prosecutorial and judicial chain that controls the fate of CHADEMA chairman Tundu Lissu, now past 460 days in pre-trial detention on capital treason charges, sat in the room.

The speech never mentions the Commonwealth, CMAG, or Lissu by name. It did not need to. Three days earlier, on 10 July, the Commonwealth Ministerial Action Group’s seventy-third extraordinary meeting had noted that conditions in Tanzania have deteriorated since Special Envoy Lazarus Chakwera’s April visit to Tanzania, and adopted the envoy’s time-bound recommendations: resolve Lissu’s detention through a political or legal pathway within 30 days; restore digital platform access and end intimidation of media within 60 days; and convene a neutral-facilitated inter-party forum within 90 days. CMAG will reconvene in September 2026 and has signalled that its November meeting will consider further action if progress is absent.

Against that backdrop, the President told her lawyers that shifting economic policies and “matamko na mwelekeo wa kisiasa duniani” (international pronouncements and political currents) are placing developing states in a difficult, contested position. She described a global wave persuading young people that African governments violate human rights, and answered it with a sovereigntist legal history: Tanzania entrenched a bill of rights in its constitution, ratified the African Charter, and hosts the African Court on Human and Peoples’ Rights in Arusha. She summarised foreign criticism with a proverb: give the dog a bad name in order to hang it. And she drew the line that matters most for the Lissu file: no one is above Tanzania’s laws, and whoever breaks the law “atashughulikiwa” (will be dealt with).

She then issued operational instructions. Government lawyers must become experts in international pronouncements and protocols, analyse them rapidly, translate them into the Tanzanian context and produce fast responses “ili kuhami uhuru wetu” (to defend national sovereignty). Every government institution was directed to build systems for identifying legal risks early, across contracts, land, procurement, projects and digital services. The lawyers were warned not to allow their profession to be used to legitimise anything “lenye nia ovu dhidi ya taifa letu” (with ill intent against the nation), and reminded that money circulates globally so that powerful actors can achieve their aims.

KEY JUDGEMENTS

Read more

A Note on Publication Frequency

Starting this week, Ujasusi moves to a Tuesday, Thursday, and Friday publication schedule — three assessments per week, down from daily.

This is a deliberate editorial decision, not a pause. Every brief and SITREP goes through the same source verification and fact-checking process before publication, regardless of how time-…

Read more

Ujasusi East Africa Monitoring Team | 11 July 2026 | 0315 BST

Read more

Ujasusi East Africa Monitoring Team | 10 July 2026 | 0315 BST

Read more

Ujasusi East Africa Monitoring Team | 08 July 2026 | 0500 BST

Tanzania’s government and its opponents are advancing irreconcilable accounts of the same day. This assessment tests both against the only criteria that can be measured, stated objectives and observed turnout, and against a third, less examined outcome that neither side planned for.

📋 SCOPE AND APPROACH

This assessment addresses a single analytical question: which of the two competing public narratives about 7 July, the government’s claim of a peaceful, uneventful day and activists’ claim of a demonstrated political victory despite low visible turnout, better withstands scrutiny against verifiable evidence. It draws on Tanzanian and regional open-source reporting from the days immediately before and after 7 July, cross-referenced against Ujasusi’s own prior assessments of the mobilisation cycle. It does not attempt a comprehensive casualty or arrest count for the day, which remains incomplete in open sources at the time of writing, and it does not extend to Zanzibar, where mainland-focused sourcing provides no visibility.

🧭 BACKGROUND

Saba Saba Day commemorates the 1954 founding of the Tanganyika African National Union, predecessor of the ruling Chama Cha Mapinduzi. For activists calling for nationwide action, the date was chosen precisely because it forces the ruling party to defend a rally banned on the anniversary of its own founding movement. The call built on grievances accumulated since the disputed October 2025 election, in which President Samia Suluhu Hassan was declared winner with a near-total vote share that independent observers judged fell short of democratic standards.

The violence that followed remains, by the government’s own commission of inquiry, the most lethal in the country’s multiparty history. The Chande Commission’s count of 518 fatalities, however, sits far below the approximately 10,000 deaths assessed by independent and ICC-linked monitoring, a gap that has itself become a mobilising grievance.

READ ALSO

The government pre-empted 7 July with a nationwide ban on political rallies, announced in Parliament eleven days before the planned demonstrations. Prior Ujasusi reporting has characterised government messaging in the run-up to 7 July as framing the protests as a foreign-instigated threat rather than a domestic grievance requiring accommodation; this framing is not independently corroborated in this assessment against a primary Nchemba statement and should be treated as a secondary attribution pending re-verification.

This was not the state’s first response to a date-specific mobilisation call since October: a comparable call for 9 December 2025, Tanzania’s Independence Day, was reported, via Bloomberg as cited in that prior Ujasusi assessment, to have been met with the same toolkit of preventative arrests, security saturation and public deterrence messaging, producing comparably deserted streets. 7 July appears, on available evidence, to replicate that pattern rather than depart from it.

🔑 KEY JUDGEMENTS

Read more

Ujasusi East Africa Monitoring Team | 06 July 2026 | 0000 BST

Read more

Ujasusi Originals

Read more

Human rights campaigners are urging the ICC to investigate alleged crimes against humanity during Tanzania’s 2025 post-election violence.

By Dumani Moyo

01-07-26 19:59

in Africa News

Read more

Ujasusi East Africa Monitoring Team | 03 July 2026 | 0245 BST

Read more

Ujasusi East Africa Monitoring Team | 01 July 2026 | 0230 BST

SUBJECT: What does Dodoma’s blanket ban on political rallies, imposed eleven days before the planned 7 July demonstrations, reveal about the government’s own assessment of its security position?

Tanzania’s government banned all political rallies nationwide on 26 June 2026, eleven days before Gen Z-organised protests planned for Saba Saba Day. Home Affairs Minister Patrobas Katambi cited security concerns tied to the Dar es Salaam International Trade Fair. The ban reverses tolerance shown to Chadema rallies through May and June.

In This Assessment

• Key Judgements

• Why the government moved from selective tolerance to a blanket ban

• Whether the ban will actually stop 7 July from happening

• Is the 27 June national grid failure connected to Saba Saba

• Will the courts intervene before 7 July

• What the trade fair framing reveals about the government’s real audience

• Outlook: three scenarios for 7 July and beyond

• Key assumptions, alternative assessment, and what remains unknown

Scope and approach

This assessment addresses the analytical question of what the 26 June 2026 rally ban communicates about the Tanzanian government’s internal risk calculus, rather than simply chronicling the ban itself. It draws on open-source reporting from wire services, regional outlets, and parliamentary statements, cross-referenced against Ujasusi’s own prior assessments of the July 7 mobilisation cycle. It does not attempt to forecast the precise scale of turnout on Saba Saba Day. That figure depends on variables, particularly weather, transport disruption, and last-minute arrests, that cannot be reliably modelled from the current evidentiary base.

Background

Tanzania’s October 2025 general election produced the country’s first sustained post-election protest movement, following a result in which the ruling Chama Cha Mapinduzi was credited with nearly total victory after Chadema’s boycott and the disqualification of the second-largest opposition party’s presidential candidate. The violence that followed is, by the government-appointed Chande Commission’s own figures, the most lethal in Tanzania’s multiparty history, though the commission’s count of roughly 518 fatalities sits far below the approximately 10,000 deaths assessed by independent and ICC-linked monitoring. That gap between official and assessed tolls has itself become a mobilising grievance for Saba Saba organisers.

Chadema’s chairperson, Tundu Lissu, has now spent more than fourteen months in detention on treason charges that carry the death penalty, without conviction. The party itself remains barred from electoral participation until 2030. President Samia Suluhu Hassan, who in 2023 ended the six-year rally ban imposed by her predecessor John Magufuli, had presided over a comparatively open permitting environment through May and June 2026, a period in which Chadema staged large, government-tolerated rallies, including Iringa on 13 June at which deputy chairperson John Heche directly rejected government claims that the party was inciting violence.

That tolerance ended on 26 June, when Home Affairs Minister Patrobas Katambi told Parliament that all rally permits would be withheld and directed Inspector General Camillus Wambura accordingly. The announcement was timed eleven days before the country’s planned 7 July demonstrations and overlaps with the government-organised Dar es Salaam International Trade Fair.

READ ALSO

This is not the first date-specific mobilisation call since the October violence, and the record of the previous attempt matters directly to what follows. A call for nationwide protests on 9 December 2025 (Tanzania’s Independence Day) was met with a blanket protest ban, mass preventative arrests beginning in mid-November, heavy security deployment, and public warnings characterising any demonstration as an illegal act. Bloomberg’s reporting from that day described Dar es Salaam’s streets as deserted, with residents heeding government orders to stay indoors. A further mobilisation call for 1 January 2026 is understood to have followed a comparable pattern, though this assessment has not independently verified that date to the same sourcing standard as 9 December. In both instances the state’s toolkit, preventative detention, security saturation, and public deterrence messaging, was substantially the same one deployed again on 26 June 2026.

Feature 2016 Magufuli Ban 2026 Rally Ban Stated basis Post-election consolidation “Security concerns” tied to Saba Saba mobilisation Duration before lift Approximately six years Undefined; described as temporary Scope All political party activity Rally permits specifically Judicial challenge Not independently verified by this assessment Announced, outcome pending Trigger event General consolidation of power Specific protest date (7 July)

Key Judgements

Read more

Ujasusi East Africa Monitoring Team | 28 June 2026 | 1900 BST

Contents

• The NMG closure: what happened and what preceded it

• Muhoozi’s command authority exceeds his constitutional mandate

• Rwabwogo’s intervention reflects genuine fracture, not distraction

• The Rostam Aziz ownership channel carries cross-border consequences

• PLU restructuring signals accelerating institutional consolidation

On the night of 27 June 2026, General Muhoozi Kainerugaba, Chief of Defence Forces and son of President Yoweri Museveni, ordered the military closure of Nation Media Group’s Uganda operations, taking NTV Uganda, Spark TV, KFM, Dembe FM, and the Daily Monitor off air without legal instrument, regulatory order, or formal government statement. On the same day, Odrek Rwabwogo, Museveni’s son-in-law and Chairman of the Presidential Advisory Committee on Exports and Industrial Development (PACEID), published a video address cataloguing what he described as three existential threats to Uganda: weak execution, elite disunity, and the degradation of public leadership.

Both events occurred as Muhoozi formalised a restructuring of the Patriotic League of Uganda (PLU), appointing Daudi Kabanda as Head of the PLU Chairman’s Office, a newly created coordination role, two weeks after removing him as Secretary General. NMG Uganda is now owned by Tanzanian billionaire Rostam Aziz, who acquired a controlling 54.08 percent stake in March 2026 and maintains documented close ties to President Samia Suluhu Hassan.

The NMG closure: what happened and what preceded it

Muhoozi announced the NMG closure through his personal X account, stating that President Museveni had approved the plan and that the outlets would remain closed without his personal permission. Armed security personnel were deployed at NMG’s Namuwongo headquarters and at Kampala Serena Hotel before midnight on 27 June, blocking staff from entering or leaving. NTV Uganda and Spark TV went dark at approximately 5:00am on 28 June. At time of writing, neither the Uganda People’s Defence Forces, the Uganda Police Force, nor the Uganda Communications Commission had issued any formal statement citing a legal basis for the deployment.

READ ALSO

This is not the first time NMG Uganda has been subjected to state coercion. In May 2013, police raided the Daily Monitor after the newspaper published a letter alleging the existence of a plan to position Muhoozi as Museveni’s successor. The premises were sealed for more than a week. In 2007, NTV Uganda was forced off air months after its launch. The 2026 operation differs from both predecessors in one material respect: it was ordered explicitly in Muhoozi’s name, not in the name of the state, and was justified by Muhoozi’s personal displeasure with coverage rather than any stated regulatory violation. What that distinction reveals about the current distribution of power in Uganda, and what the simultaneous Rwabwogo intervention and PLU restructuring signal about the pace of succession consolidation, is the subject of this assessment.

Read more

Top story

Tanzania’s government imposed a blanket ban on all political rallies, announced in Parliament on 26 June 2026 by Home Affairs Minister Patrobas Katambi. The ban is aimed at pre-empting Gen-Z-led protests planned for 7 July, which are demanding a new constitution, an end to enforced disappearances of government critics, and the release of jailed…

Read more

Read more

Ujasusi Terrorism Monitoring Desk | 27 June 2026 | 0145 BST

Read more