In May of this year, Malaysia suffered its second Islamic State (IS)-linked attack in Ulu Tiram, Johor. This attack came almost eight years after the Movida Pub bombing in 2016, the country’s first ever successful IS attack. The 2016 Movida attack was linked to Muhammad Wanndy Mohd. Jedi, a high-profile Malaysian IS operative who was operating in Iraq and Syria at the time. He facilitated the attack via a Telegram group, virtually directing two IS ground operatives, Imam Wahyudin Karjono and Jonius Ondie.
Since the fall of the so-called IS Caliphate in the Middle East in 2019, Malaysia has experienced a relative lull in terrorist activity. Previously, the highest period of activity was during 2014-2019, when Malaysia faced several IS-inspired plots linked to high-profile militants operating in the Middle East. Malaysian militants such as Zainuri Kamaruddin and Mohd. Rafi Udin had also appeared in IS videos threatening attacks in the country. Ever since their deaths in the Middle East, the IS threat seemed to have receded in Malaysia.
This year, however, IS-linked activity has made a resurgence.
The 2024 Ulu Tiram Attack
The attack was carried out by 21-year-old Radin Luqman, who attacked a police station in the district of Ulu Tiram, killing two police officers. The attack bore the signatures of an IS-inspired attack, being low-tech (Luqman used a knife) and targeting a police station. Luqman, who was killed in the attack, stabbed a police officer who approached him, and shot a second officer to death with a confiscated weapon. Investigations revealed that the attacker was a “lone wolf” who was “driven by a certain (extremist) motivation.”
The attacker’s ideological affiliation became clearer when his father, Radin Imran, was found to have pledged allegiance to IS in 2014. He was previously investigated for having links to Indonesian jihadist group, Jemaah Islamiyah (JI). He was charged with encouraging terrorist acts by spreading IS ideology within his family, possession of four homemade air rifles, and possession of a book written by Aman Abdurrahman, the leader of Jemaah Ansharut Daulah (JAD), an Indonesian IS-linked group. His other son, Radin Romyullah, was charged with possession of IS-related materials on an external hard disk.
The family was known to have been isolated and often avoided mixing with the general public. The attacker had only four years of mainstream education in a public school. Only one out of his three other siblings had completed public education. The family also avoided praying at local mosques due to the belief that they were built by the government, which they viewed as infidels.
Other Recent Incidents
Last month, six men and two women aged between 25 and 70 were arrested for their links to IS. They had threatened attacks against the king, the prime minister, and several high-profile dignitaries, including senior police officers. They were also found to be spreading IS ideology. The individuals were from different economic and social backgrounds including a retired university lecturer, a construction worker, and a housewife.
Also in June, there were several other arrests of Malaysians relating to IS. The first was 31-year-old Muhammad Sani, who was charged with supporting IS via his Facebook account and for possession of IS-related materials. Sani was previously charged and jailed twice in 2016 and 2018 for possession of terrorism-related videos and IS materials.
The second was 28-year-old Aabid Zarkasi, who was charged with possession and attempted production of explosive materials with the intention of carrying out an attack in the name of IS, and possession of videos and articles relating to the group. Similarly, Aabid was previously jailed in 2018 for possession of numerous videos, documents, and pictures related to IS on his cellphone and thumb drive.
Two other cases involved the arrest of a 35-year-old restaurant worked named Muhammad Muzzammil and a 45-year-old unemployed man named Hasbullah Hassan. In the former case, the individual was charged with supporting IS on Facebook and Telegram, possessing articles and videos relating to IS, and pledging allegiance to the group. Similarly, Hasbullah was found to have supported and promoted IS on Facebook and was in possession of materials relating to the extremist group. He was sentenced to prison in 2017 for possession of IS-related materials via his Facebook account.
The Current Threat
There are several trends that are worth noting with regards to the terrorist threat in Malaysia. The first is that of “isolated actors” – a single individual or small group (cell) who are inspired by an extremist group’s ideology and are motivated to carry out attacks independently as opposed to being centrally directed by a group. This group may be divided into two categories: individual(s) who are purely isolated, i.e. completely free of any links to other extremists and act on their own; or semi-isolated, i.e. individual(s) who execute attacks independently but who may have either physical or virtual links with other extremists who may assist in the planning of the attacks.
The Ulu Tiram attacker and his family can be considered a cell that was isolated and inspired by IS ideology to carry out an attack. It is unclear if the attacker and his family members were in touch with or directed by other extremists to carry out their actions. The fact that they had little physical contact with the outside world makes detection of the threat they pose more challenging as opposed to attacks that involve a larger network of individuals, which often increase the chances of interdiction by the security forces. Similarly, the other four cases seem to involve isolated individuals, but it is unclear if they had links to a wider extremist network or other individuals.
The Ulu Tiram case also highlights the role that the family can play in radicalization. This trend has been seen in several cases in Indonesia. For example, the 2018 Surabaya bombings involved three families linked to JAD who had carried out a series of five bombings in the city. The case was an example of “entire family networks,” including both parents and children, perpetrating a terrorist attack, after the parents radicalized and used the children as bombers. In the Ulu Tiram case, although the exact operational roles of the father and other family members in the attack remain unclear, it appears the father had spread his radical ideology to his children and the entire family unit had become radicalized as a result. This may have had a direct or indirect impact on Luqman’s actions.
The third point concerns the threat of recidivists. At least three individuals had been charged earlier for IS-related offences. Sani had repeated his offense of possessing materials and declaring support for the group, but Aabid had taken it a step further and become operational, attempting to manufacture explosives with the intent of carrying out attacks. Radin Imran, the father of the Ulu Tiram attacker, was investigated for his links to JI several years prior. He seemed to have shifted and pledged allegiance to IS in 2014, spreading his beliefs to his entire family.
The aforementioned cases also highlight the continued role played by social media in spreading extremism. All four were found to have been active on social media, particularly Facebook. Social media has always played a key role in the radicalization of Malaysians. Unlike Indonesia and the Philippines, Malaysia never had an indigenous IS-linked group. The IS phenomenon in Malaysia was driven by key personalities – high-profile Malaysian fighters operating in Iraq and Syria – who were able to inspire and recruit members through a mix of open social media platforms such as Facebook and Twitter and closed platforms such as Telegram and WhatsApp. With the death of these personalities, social media still plays a crucial role in Malaysia, with 90 percent of IS recruitment still being done through social media.
Apart from mainstream social media applications, several alternative platforms such as Rocket.Chat, Tam Tam, Threema, Hoop, and Element have mushroomed and been used by IS. The rise of these platforms enables handlers to communicate with recruits and sympathizers more easily and securely. This also opens the doors to the threat of virtual direction whereby IS handlers are able to direct attacks and provide technical support to operatives located in target countries purely via virtual means. This technique has been used by the handlers associated with the Islamic State Khorasan Province in several recent attacks, such as the 2024 Moscow and Iran attacks.
Outlook
Despite a significant weakening of IS in the Middle East since 2019, the threat from the group remains persistent in Malaysia and Southeast Asia. This persistence is exacerbated by the rapid evolution of digital technologies, particularly social media. The threats that need to be prioritized are those posed by inspired and isolated operatives, family networks, and recidivists, as well as the challenges posed by online radicalization and social media.
In this regard, continuous cyber-vigilance and monitoring of extremist spaces, intelligence sharing, and coordination is crucial. Additionally, comprehensive monitoring of released detainees is also needed to prevent recidivism. The fusion of technology and proactive strategies will be key in preserving national and regional security and battling extremism in the region.