| Houthis (Ansar Allah) | 5 | non-state | Middle East | The Houthis hold Yemen's entire Red Sea coast and the Yemeni side of Bab el-Mandeb and extended their reach across Saudi Arabia on Sept 14 and 15, with missile and drone attacks on Khamis Mushait, Abha and Taif that the Saudi-led coalition says wounded 13 civilians and prompted the first emergency alerts for Mecca of the war. Their ground advance was checked in western Taiz on Sept 14 by Saudi-backed government forces operating under heavy Saudi air cover. | 144 |
| Iran (IRGC / Supreme Leader) | 5 | state | Middle East | Iran keeps the Strait of Hormuz effectively closed and rejected a reopening of talks on Sept 15, when security official Mohsen Rezaei said Tehran would negotiate only if its conditions are met after the Trump administration signalled it was seeking a way to end the war. Tehran continues drone and missile strikes on Iranian Kurdish opposition camps in Iraq's Kurdistan Region and accused the IAEA of politicisation after its nuclear chief was refused entry to Vienna on Sept 14. | 23 |
| JNIM (al-Qaeda Sahel) | 5 | non-state | Africa | JNIM sustains the fuel blockade that keeps Bamako on escorted convoys, having destroyed more than 300 tankers on the Kayes and Segou corridors since September 2025, and has shifted from storming cities to strangling them economically. It struck Bamako and Kati in April, hit Niamey airport in June, and is expanding incursions into northern Benin and Togo, with no verified change in its posture through Sept 15. | 0 |
| Rapid Support Forces (Hemedti) | 5 | non-state | Africa | The RSF runs the parallel Tasis government from Nyala, keeps El Obeid under partial siege with a significant build-up around the city, and sustains a drone campaign against courthouses, hospitals and power and fuel infrastructure, including the Umm Ruwaba courthouse strike on Sept 8. A UN fact-finding mission reported in September that external support networks, including up to 2,000 former Colombian soldiers operating its drones and artillery in Darfur and Kordofan, are fuelling its campaign, and no change in that posture was verified through Sept 15. | 8 |
| Russia (Putin / Kremlin) | 5 | state | Europe & Russia | The Kremlin kept fighting while refusing to concede anything at the table: Russian forces made no confirmed advances on Sept 14 but sustained nightly drone waves and are scaling jet-powered Geran-4 production, fielding roughly 2,800 in August against 350 in June, with ISW assessing Russia may build at least 100 ballistic missiles in September. Peskov welcomed Trump's call for Ukrainian restraint on energy strikes on Sept 14 while refusing any reciprocal Russian commitment, and officials are setting conditions for involuntary reserve call-ups after the Sept 18-20 State Duma elections. | 63 |
| Arakan Army | 4 | non-state | Indo-Pacific & South Asia | The Arakan Army holds 14 of Rakhine State's 17 townships plus Paletwa with a force estimated at about 40,000, and as of Sept 15 had conceded no territory or outposts to the junta's Operation 4926, repelling columns at Ponnagyun and intercepting a junta advance from Awa Taung village near the Taung Maw Oo naval station in Kyaukphyu Township on Sept 9 and 10 while seizing weapons and ammunition, and capturing three junta outposts in Ayeyarwady's Laymyethna Township by Sept 12. It governs as the ULA with conscription and curfews, faces a BHRN allegation of forced labour of more than 300 Rohingya in northern Maungdaw that it denies, and has pledged to protect Chinese and Indian projects including the Kyaukphyu port and pipelines without issuing any statement on the port during the September fighting. | 3 |
| Chinese state hackers (Salt/Volt Typhoon) | 4 | non-state | Transnational & Hybrid | APT31 first deployed the BlueMoon exploit kit, chaining Microsoft Windows and Google Chrome vulnerabilities, on Aug 28, and several other suspected China-nexus espionage clusters adopted it within days. Salt Typhoon's long-running telecom and critical-infrastructure compromise, active since at least 2021 and spanning hundreds of organisations in more than 80 countries, remained unresolved through Sept 15 with no new public advisory. | 1 |
| ELN (Colombia) | 4 | non-state | Americas | The ELN lost eight hostages on Sept 15 when army Gaula units freed them in rural Convencion, Norte de Santander, in an operation De la Espriella said was carried out with US assistance, eleven days after its Sept 4 assault on the El Trapiche military cantonment in Ocana killed two soldiers and wounded five. It remains the principal armed driver of escalation in Catatumbo and Norte de Santander against a government that revoked its negotiating delegation and all political status on Sept 11. | 1 |
| Iraqi Shia militias (Kataib Hezbollah etc.) | 4 | non-state | Middle East | Kataib Hezbollah and Harakat Hezbollah al-Nujaba continue to refuse disarmament before the Sept 30 deadline unless US and Turkish forces leave Iraq, one of ten stated conditions, while Baghdad is reported to be preparing army and Counter Terrorism Service deployments around militia centres. Drones launched from Iraq struck Saudi Arabia's East-West pipeline on Sept 10, and the prime minister dismissed the Maysan operations commander and provincial police chief in response. | 0 |
| Myanmar junta (Min Aung Hlaing) | 4 | state | Indo-Pacific & South Asia | Its Operation 4926, launched on Sept 4 as the largest Rakhine offensive in over two years across five fronts, had captured no Arakan Army territory or outposts as of Sept 14, with columns in Kyaukphyu Township forced back onto airstrikes and naval artillery after heavy losses and reporting of rising casualties and desertions among newly conscripted troops. With ground advances stalled it leans on air power, killing two civilians and wounding three in an airstrike near the Uri Taung Pagoda in Ponnagyun town on Sept 13. | 3 |
| Russia's Africa Corps / Wagner | 4 | non-state | Transnational & Hybrid | Five Africa Corps personnel were killed alongside more than 50 Malian soldiers when JNIM overran the Dioura camp in Mali's Mopti region on Sept 11, reported on Sept 14, the formation's heaviest publicly reported single loss of 2026. Africa Corps continues to function as a regime-protection force with as many as 2,500 Russian personnel in Mali, pulled back from the north to shield Bamako while JNIM sustains the selective blockade of the capital it began in September 2025. | 1 |
| Russian state hackers (GRU / Sandworm / APT28) | 4 | non-state | Transnational & Hybrid | Anthropic reported on Sept 11 that GTG-20006, whose attribution is consistent with Midnight Blizzard, ran AI-driven phishing, malware-development and evasion workflows against more than 20 organisations, mostly Ukrainian government, military and diplomatic entities, rebuilding its toolkit automatically whenever security products flagged it, and hijacked DNS records at three hotel Wi-Fi providers to stage malware on guests' devices. No further publicly attributed Russian state cyber operation surfaced through Sept 15. | 0 |
| Saudi Arabia | 4 | state | Middle East | Saudi Arabia is prosecuting an air campaign against the Houthis, who reported 54 Saudi raids over Lahj, Taiz, al-Jawf, Marib and Hajjah in the 24 hours to Sept 15 after more than 300 in the preceding five days, while absorbing missile and drone fire that wounded 13 civilians in Khamis Mushait, Abha and Taif. Riyadh activated Mecca's emergency warning system for the first time in the war on Sept 15 and, through coalition spokesman Turki al-Maliki, vowed to respond firmly, as US officials said the shut East-West pipeline would resume exports within days. | 126 |
| Sudanese Armed Forces (Burhan) | 4 | state | Africa | The SAF holds the ground initiative in Kordofan, having claimed the Khartoum-El Obeid highway in July, and rejects both a nationwide arms embargo and negotiation with the RSF. Its UN envoy argued on Sept 11 that a comprehensive embargo would contradict Sudan's right of self-defence, and no shift in that position was verified through Sept 15. | 4 |
| Viv Ansanm (Haiti gang coalition) | 4 | non-state | Americas | The US-designated coalition holds roughly 80 to 90 percent of Port-au-Prince and carried out the late-August Kenscoff raid that killed at least 47, abducted more than 50, burned 25 homes and displaced more than 2,600 people. It faces no meaningful counter-force before the Sept 30 Security Council vote on the Gang Suppression Force, which is not expected to reach full operational capacity until October at the earliest. | 0 |
| al-Shabaab | 4 | non-state | Africa | Al-Shabaab retains the territorial gains of its 2025 offensive and is exploiting the federal-state fight, joining or shadowing the militia assaults on Baidoa that government and South West State forces repelled through Sept 3. Analysts assess it is largely waiting out the Mogadishu term-extension standoff rather than pressing a new offensive, and no new major operation was verified through Sept 15. | 3 |
| Belarus (Lukashenko) | 3 | state | Europe & Russia | Lukashenko's regime moved its Sept 11 order to inspect the army 'up to mobilization' into a live Sept 15-18 Western Operational Command exercise on the Polish and Lithuanian borders, rehearsing border cover, martial law and counter-drone tasks, with no reservist call-up figures published. Belarus hosts Russian tactical nuclear weapons and, per Ukraine's HUR, the Oreshnik-armed 101st Missile Brigade, and its territory remained the corridor for the drone NATO jets shot down over Lithuania on Sept 15. | 29 |
| CJNG (Jalisco New Generation) | 3 | non-state | Americas | CJNG has been in a succession contest since Nemesio El Mencho Oseguera was killed in Tapalpa, Jalisco in February, and on Sept 12 Mexican forces dismantled a clandestine CJNG clinic in Tecalitlan, Jalisco used to treat forcibly recruited members, freeing eight people and arresting six guards. Its US terrorist designation and Rubio's Sept 9 hint at unilateral action make it the most likely target of any US operation on Mexican soil. | 0 |
| China (Xi / CCP / PLA) | 3 | state | Indo-Pacific & South Asia | China ran a live-fire joint air-naval drill at Scarborough Shoal on Sept 2 in which armed JL-10 trainers intercepted a Philippine aircraft, keeps coast-guard patrols rotating east of Taiwan on roughly 30-day cycles, and a CSIS study reported on Sept 13 found its coast guard had radio-queried nearly 200 commercial ships transiting the Philippine Sea. Xi attended the BRICS summit in New Delhi on Sept 12 and 13, meeting Modi in the first such bilateral on Indian soil in seven years ahead of a Sept 24 Washington summit, while PLA Daily articles on Sept 13 and 14 pressed civil-military mobilisation and the PLA high command remains thinned by the removal of Zhang Youxia and Liu Zhenli on Aug 28. | 26 |
| Hamas | 3 | non-state | Middle East | Hamas agreed in principle in August to disarm in stages but has surrendered no weapons and has not transferred governing authority, conditioning implementation on Israeli withdrawal under the Board of Peace plan. Israeli operations against its commanders continued, with the IDF saying on Sept 15 that it had killed Rafah Brigade commander Nael Abu Obeid and Jabalia Battalion commander Ahmad al-Batash. | 1 |
| Hezbollah | 3 | non-state | Middle East | Hezbollah continues to reject the disarmament element of the June trilateral framework, and Israel-Lebanon talks were postponed on Sept 12 amid Israeli strikes in the south. The IDF said on Sept 15 that its troops had located Hezbollah rocket launchers in southern Lebanon, days after the group lost the two-kilometre Ali al-Taher tunnel complex to an Israeli demolition on Sept 10. | 30 |
| Islamic State (core, ISIS-K, affiliates) | 3 | non-state | Transnational & Hybrid | The US Justice Department announced charges on Sept 15 against a 21-year-old Pennsylvania man, arrested Sept 12, for receiving a firearm and ammunition in support of the Islamic State, adding to plots disrupted in Kuwait, Israel, Turkey and France across August and early September 2026. ISIS-K external intent persists and affiliates remain active in Somalia, Mozambique and the Sahel. | 17 |
| M23 / AFC | 3 | non-state | Africa | M23/AFC holds Goma and Bukavu and keeps clashing with FARDC in North and South Kivu while negotiating in Doha, having agreed a sequenced peace roadmap on Aug 23 and accepted ceasefire monitors in Minembwe and Uvira from Aug 24. Reporting on Sept 15 described it running parallel administrations in the cities it holds and drawing revenue from taxation, coltan and cross-border trade; it is not a party to the Rwanda-DRC Geneva talks of Sept 16-17. | 0 |
| North Korea (Kim Jong Un) | 3 | state | Indo-Pacific & South Asia | Fired several Hwasong-11 series short-range ballistic missiles and 600mm rocket artillery from the Wonsan area on Sept 12, a day after the trilateral Freedom Edge exercise ended, and KCNA confirmed on Sept 14 that this was a joint firepower attack drill by five artillery and missile units against an island target using attack drones, a tactical cruise missile and a thermobaric multiple rocket launcher. Troops, drone operators and munitions continue to flow to Russia, and Kim Yo Jong says there is no communication with Trump. | 12 |
| North Korean hackers (Lazarus) | 3 | non-state | Transnational & Hybrid | DPRK-linked actors stole 2.02 billion dollars in 2025, a 51 percent year-on-year rise taking the cumulative total to roughly 6.75 billion dollars, and accounted for 76 percent of all crypto hack value through April 2026 on the strength of two attacks. The roughly 290 million dollar KelpDAO theft in April, attributed to Lazarus, remained the largest 2026 exploit through Sept 15, with no new major DPRK heist publicly reported. | 5 |
| Russian influence networks (Matryoshka / Storm-1679, Social Design Agency) | 3 | non-state | Transnational & Hybrid | ISD counted 269 Matryoshka posts on X between Jun 24 and Sept 1 targeting Germany's federal government and CDU, SPD, Green, Linke and FDP candidates ahead of the Saxony-Anhalt, Mecklenburg-Vorpommern, Lower Saxony and Berlin votes, using AI-generated video and stolen media branding. The network posted seven fabricated videos within one hour on Aug 18 alleging electoral fraud in Sweden and attacking Prime Minister Kristersson before the Sept 13 vote, tagging SVT and Dagens Nyheter accounts; no new campaign was documented through Sept 15. | 1 |
| Sinaloa Cartel | 3 | non-state | Americas | The Chapitos-Mayiza infighting that began on Sept 9, 2024 has now killed more than 3,000 people by AFP's count and continues to redraw Mexico's criminal map, with reporting of a possible Chapitos-CJNG alignment. Public anger at the war surfaced in a march of thousands through Culiacan reported on Sept 14, in which participants dressed in white released balloons and chanted for peace. | 0 |
| Taliban | 3 | state | Indo-Pacific & South Asia | Large-scale fighting with Pakistan has subsided since late June and early July 2026, but the Taliban still shelter the TTP, whose attacks drive record violence inside Pakistan, and trade and transit routes with Pakistan remain disrupted, with Torkham, Spin Boldak and Bahramcha reported open only for returning Afghan migrants as of September 2026. UNAMA attributed all 399 cross-border civilian casualties documented between April and June 2026 to Pakistani forces, while anti-Taliban armed groups led by the Afghanistan Freedom Front claim growing operations in the northeast. | 9 |
| Tren de Aragua | 2 | non-state | Americas | The US-designated organisation continues to be invoked as justification for the maritime strike campaign around Venezuela and for expedited deportations, with the campaign's cumulative toll standing at at least 230 killed in at least 68 strikes as of the Sept 9 Caribbean strike. No discrete operation or attack attributable to the group was verified between Sept 14 and Sept 15. | 0 |
| Venezuela interim government (Delcy Rodríguez; Maduro on trial in US) | 2 | state | Americas | Acting president Delcy Rodriguez refused on Sept 2 to name an election date, saying a vote will come when Venezuela is ready, while defending the 100-year oil concession signed with Washington as compatible with Venezuelan sovereignty. The government is negotiating with the part of the opposition led by Dinorah Figuera, which Machado is boycotting, and still held 382 political prisoners by Foro Penal's August count. | 23 |