Two days after two bombs exploded in Damascus during French President Emmanuel Macron’s visit, Syrian security forces said on Thursday they had arrested the cell behind the attacks. Initial investigations found that it was affiliated with ISIS.
The blasts were especially sensitive because they struck near the luxury Four Seasons Hotel in central Damascus, where Macron was staying.
His visit was the first by the leader of a major Western power since President Ahmed al-Sharaa took office in late 2024.
The attacks have fueled unease among Damascus residents and raised a pressing question: Does the cell’s link to ISIS mean the group can breach security at will?
Ismat al-Absi, a strategic security and military expert close to the Defense Ministry, rejected that conclusion.
“The two explosions cannot in any way be seen as a sign of weakness or incapacity,” he said. “Rather, they confirm the nature of the asymmetric war Syrian security and military authorities are fighting against ISIS, which relies on suicide attacks and indiscriminate violence to spread fear.”
Speaking to Asharq Al-Awsat, Absi said the incident was “not a security breach in the technical sense, but a failed terrorist attempt that was uncovered and dealt with in record time.”
The bombs exploded several hundred meters from the hotel, minutes after Macron’s convoy left for the presidential palace.
He was heading to an expanded meeting with Sharaa, attended by delegations from both countries.
The twin blasts were caused by two improvised explosive devices. They killed one person and wounded 36 others, according to the Health Ministry.
The French presidency said Macron was safe and would continue his visit.
Macron later wrote on X that the trip “will continue.”
Absi said the visit had been protected by tight and complex security measures.
“The fact that the devices were detonated away from the official guest’s route, followed by the immediate arrest of those responsible, proves that the red line of national security was not breached,” he said.
“It also shows that the state can separate the enemy’s noise from the performance of its sovereign duties.”
The attacks came days after an explosion inside a cafe near the Palace of Justice in Damascus killed 10 people last Friday.
Absi drew a distinction between infiltration and the establishment of a foothold.
“The organization has no popular base and no real civilian presence,” he said. “It depends on scattered sleeper cells trying to exploit the temporary security vacuum left by years of war.”
The appearance of such cells around Damascus reflects desperate attempts by ISIS to restore its presence before the state eliminates it completely, he said.
It does not, he added, point to broad infiltration.
Absi said security agencies were now working through pre-emption and close surveillance.
That approach, he said, had allowed them to turn each case of infiltration into an arrest-and-prosecution operation, rather than letting it grow into a lasting threat.
Asked whether ISIS had a large number of cells in and around Damascus, Absi said numbers alone did not define the danger.
“One well-organized cell can be more harmful than dozens of scattered operatives,” he said.
“We are dealing with the remnants of an organization that was defeated militarily but has not yet been fully eliminated through judicial and security measures.”
Some remaining members, he said, were still looking for opportunities to take revenge or destabilize the new political order.
But their capabilities were now far more limited than before.
“Our task is to cut off the sources of this activity through community cooperation and intelligent monitoring,” he said. “We are seeing the results of this approach every day, as this operation showed.”
The bombings came as the Interior Ministry stepped up counterterrorism operations with the General Intelligence Service and the Counterterrorism Directorate.
On June 9, the ministry said it had dismantled seven ISIS cells and arrested 235 members of the group over the previous three months.
Absi said the latest attack would accelerate structural security reforms already underway.
“We will see stronger cooperation between the Internal Security Forces and the General Intelligence Service to build a unified and rapidly responsive information network,” he said.
Preventive operations would also be intensified in rural areas and towns surrounding the capital to stop cells from re-forming.
“The goal is not only a rapid response,” Absi said. “It is to build an integrated security system that makes the environment unsuitable for any terrorist activity.”
That, he added, would send a clear message to international partners that Syria was safe and stable for investment and political engagement.
On Thursday, the Interior Ministry also said that, working with the General Intelligence Service, it had dismantled several ISIS cells in southern Syria.
It announced the arrest of senior ISIS figure Firas al-Dagher and several prominent figures responsible for assassinations and financing.
Political researcher Diaa Qaddour, who specializes in security affairs, said ISIS was now waging a low-intensity escalation campaign against the Syrian state.
The group, he said, remained a persistent threat, continuing to exploit security gaps and vulnerable areas.
“The two recent explosions were painful and shocking,” Qaddour told Asharq Al-Awsat. “But the large security operations carried out by the security forces have also revealed their growing ability to fight the organization.”
He said the simultaneous arrest of so many cells showed the Interior Ministry had built a precise intelligence database and developed strong logistical capabilities to track its targets.
Qaddour said the main aim of the bombings was not necessarily to cause casualties.
Rather, he said, they were intended to disrupt Macron’s visit, portray the Syrian state as weak and undermine the current political phase.
He said the cell was linked to ISIS, but added that major intelligence agencies that did not want Syria to become calm and stable could also be behind it.
Despite talk of the group’s growing capabilities, Qaddour said the attacks did not mark a full return by ISIS.
The group was not trying to seize territory or rebuild the “ISIS,” he said.
Instead, it was trying to obstruct those rebuilding the state.
“This is ISIS’s strategy today: attrition and raising the cost,” he said.
As the security forces improve their technological capabilities and sanctions are lifted, it will become harder for the group to strike city centers, Qaddour said.
That could push it towards the suburbs and open areas.
“The security threat remains,” he said. “The state and its security agencies need a comprehensive and integrated response to the continuing ISIS threat.”
Statistics for 2026, he said, showed that ISIS operations had declined compared with the previous two years.
But the group could still exploit security gaps and carry out painful, shocking attacks.
The Syrian state, he said, needed to address the threat through a broader security formula.
That response should not rely only on stronger military, technological and security tools.
It should also tackle economic conditions and social and economic grievances.
“Security is an integrated equation,” Qaddour said.
“We are facing a long-term phase, and the battle is difficult. We may face setbacks and obstacles.”
“But with stronger expertise and capabilities, and greater intelligence cooperation with countries in the region, I believe we will reach an important result.”