On April 17, a month after Philippine President Rodrigo Duterte imposed quarantine orders across the southeast Asian country, ISIS-linked gunmen opened fire on a military convoy in the remote province of Sulu. They killed 11 troops attempting to conduct an operation against the leader of ISIS in the Philippines, who the armed forces has been tracking since he masterminded a deadly Cathedral bombing in January 2019.

That ambush was just one of several claimed by ISIS in April; two others took place in countries whose governments had never before officially recorded an attack. In the Maldives, “soldiers of the caliphate” set several boats ablaze in a warning to the Indian Ocean archipelago’s “apostate” government, ISIS’s weekly Al Naba magazine boasted. On April 24 Mozambican authorities acknowledged for the first time that ISIS was present in their country, after police reported a “massacre” of 52 villagers in the oil-rich Cabo Delgado region. Like a spate of other recent attacks in Mozambique’s northernmost province, the massacre was claimed by a local affiliate of the transnational jihadist group.

The violence offers a stark reminder that ISIS continues to pose a threat far beyond its heartland in Iraq and Syria, even as it wages an insurgency in both countries. It has also raised fears that the jihadist group will capitalize on COVID-19 induced instability to stage a broader resurgence. “Since the pandemic started, and weakened the capacity of law or security enforcement around the world, ISIS has persisted in operations across Afghanistan, West Africa, Central Africa, the Sahel, Egypt, and Yemen,” says Rita Katz, director of the SITE Intelligence Group, which tracks online networks affiliated with jihadist and white supremacist organizations. ISIS has “specifically exploited the pandemic with attacks in Iraq, the Maldives, and the Philippines,” she adds, and aggressively publicized calls for attacks on the West.

Those calls have apparently been heeded. On April 15, German police arrested four suspected ISIS members in the western state of North Rhine-Westphalia, who authorities believe were planning to attack American military facilities in the country. Meanwhile, U.N. Secretary-General Antonio Guterres has warned that extremist groups are taking advantage of COVID-19 lockdowns to spread hatred and intensify social media efforts to recruit young people spending more time online.

ISIS has now begun its “annual barrage of increased incitements for the month of Ramadan,” reads an April 21 SITE Intelligence communique. The holy month, which began on April 24, is a time for prayer and reflection for the vast majority of Muslims. But for years, ISIS has attempted to make it one of violence and bloodshed. Here’s what to know about the threat the group poses amid COVID-19.

Mourners ride on a hearse during the funeral procession of a victim killed in the Jan. 27, 2019 cathedral bombing in Jolo, Sulu province on the southern island of Mindanao, Philippines. Nickee Butlangan—AFP via Getty Images

What Does ISIS’s Presence in Iraq and Syria Look Like Today?

In March 2019, American-backed Syrian Democratic Forces (SDF) captured the Syrian village of al-Baghouz, bringing an official end to ISIS’s self-proclaimed caliphate that, at its peak in 2015, spanned a land mass over Iraq and Syria that was roughly the size of Britain. Seven months later, a team of U.S. special operatives killed former ISIS leader al-Baghdadi in northwest Syria.

But neither ISIS’s loss of territory nor Baghdadi’s death, has prevented the group from functioning. In fact, there are still some 20,000 to 25,000 ISIS fighters in Iraq and Syria, according to estimates by the Washington-based Center for Strategic and International Studies (CSIS). The think tank estimates that another 15,000 to 20,000 fighters are attached to Al Qaeda-linked groups in Syria and Iraq.

ISIS has established safe havens in Syria’s Badiya desert and the Jazira region along the Iraqi-Syrian border. From there, it amasses arms and perpetrates guerrilla hit-and-run attacks against local forces. In Iraq, ISIS conducted 34 operations between April 15 and April 21, according to SITE Intelligence. “The Islamic State is attempting to restore its networks east and west of the Euphrates River as part of its desert strategy. The goal is to rebuild the movement’s territorial strength,” says Seth Jones, director of CSIS’s Transnational Threats Project.

The pandemic itself is not likely to seriously aid the militant group, Jones tells TIME. What would boost it is thousands of imprisoned jihadists rejoining the battlefield.

Trump’s abrupt pullout of most U.S. troops from northeast Syria last October had already compromised the Kurdish dominated SDF’s ability to guard about 10,000 ISIS detainees imprisoned across more than 30 detention facilities in Northern Syria. A local COVID-19 outbreak could further jeopardize their control. On March 30, ISIS detainees overran a much smaller prison in Hasakah city, taking over a floor of the compound before SDF forces were able to quell the uprising. SDF authorities later said that fear of contracting the virus in such cramped quarters had compelled prisoners to stage the breakout attempt, according to reports compiled by the Brussels-based International Crisis Group (ICG).

A similar attempt at al-Hol, which U.S. forces have called a “ticking time bomb,” would add a disastrous new dimension to an already complex humanitarian crisis. Like all other Syrian detention camps, the 66,000 women and children at al Hol— most of whom are relatives of ISIS fighters—live without adequate food or reliable medical services, much less soap, hand-sanitizer, and protective gear. Border closures restricting aid shipments have exacerbated already dire conditions amid the failure of western governments to repatriate their nationals. “The strain of guarding and feeding tens of thousands of ISIS-affiliated detainees is overwhelming the Kurdish administration,” says Dareen Khalifa, ICG’s senior Syria analyst. “Should the virus hit these densely populated camps, we risk being in a position where we are just going to watch people die.”

How Has ISIS Portrayed the Pandemic?

While recent articles in ISIS’s weekly Arabic-language Al Naba magazine stress that Muslims can be afflicted by COVID-19, the magazine initially suggested the virus was divine punishment against communist China. When cases spiked in Iran, Al Naba declared it a warning to Shi’ite “polytheists.” In Europe, ISIS said COVID-19 constituted retribution for “crusader nations” and cautioned its members in the Levant against travel to affected countries while urging those already in Europe to carry out attacks.

Those calls have found echoes around the world. In West Africa, the leader of ISIS-allied Boko Haram claimed the virus is a punishment for those who disobey Islam and proposed piety as a solution; an Indonesian ISIS supporter claimed it was retribution for Baghdadi’s death and called for attacks against the U.N.; and ISIS-linked accounts in the Philippines have disseminated threats against Muslims who follow government directives on COVID-19.

The uptick in propaganda has corresponded with ramped up efforts to make more English language content available on ISIS channels, monitors say. Although the effect is difficult to quantify, “the pandemic has made for conditions very well-suited to recruitment,” says SITE’s Katz, adding that the pro-ISIS groups are now active on more than a dozen social media platforms.

“After high profile IS attacks in recent years in Paris, Brussels, Berlin, Nice, etc., there was always an uptick in new jihadi channels and opportunism to get further support,” Michael Krona, author of The Media World of ISIS wrote on Twitter on April 27. “During Corona in [the] last month there has been a similar significant increase in activity online.”

Is ISIS the only extremist group trying to exploit the pandemic?

Far from it. In a recent communique, Al-Qaeda cast the coronavirus striking the Muslim world as a consequence of “our own sins and our distance from the divine methodology.” In Afghanistan, meanwhile the Taliban has adopted a different approach to COVID-19, increasing its political clout in the process. The group has assisted efforts to limit the spread of the virus, including by declaring ceasefires in areas under its control that have suffered COVID-19 outbreaks, set up quarantine centers, and run public health awareness campaigns, among other initiatives.

Because they control informal economies, groups like the Taliban or Lebanon’s Hezbollah are better placed to benefit from coronavirus than ISIS, says Nate Rosenblatt, a Middle East and North Africa security expert. A unique set of mostly political circumstances enabled ISIS to emerge in Syria, but for now, COVID-19 “is shifting economic paradigms more than political ones,” Rosenblatt says, adding that governments in the Middle East are “not at imminent risk of collapse; their economies are.” That could change if prolonged economic depression induces unrest or new terrorist attacks foment mass panic.

In the U.S., it is white supremacist and far-right nationalist groups who pose the greatest threat to homeland security. Telegram channels associated with white supremacy and racism grew by more than 6,000 users over the month of March, according to data the London-based Institute for Strategic Dialogue shared with TIME earlier in April, with one channel one white supremacist channel specifically focused on messaging related to COVID-19 growing its user base by 800%.

Does the spike in propaganda mean an attack in the West is more likely?

In the U.S., at least, the risk posed by far-right terrorism has surpassed that of jihadist groups like ISIS, according to CSIS’ Jones, but “Europe is a different ballgame.”

Since ISIS emerged in 2014, the group has tried to carry out attacks in the West in line with its official propaganda. That’s been integral to how the group garnered global attention and support. “Matching words with deeds has been the centerpiece of the group’s efforts to build a power of persuasion,” says Michael S. Smith II, a terrorism analyst, and lecturer at Johns Hopkins University’s Global Security Studies Program. He adds that ISIS’s ability to follow through on specific threats is one of the factors that has made it much more successful at recruitment that Al Qaeda. “ISIS propaganda has in fact been a credible source of information about where we can expect to see the terrorist group’s members and supporters attempt to perpetrate terrorist attacks.”

While all kinds of extremist groups are ready to exploit citizen’s grievances over their governments’ handling of the pandemic, governments themselves can exacerbate those grievances. For Smith, moves towards authoritarianism under the guise of protecting their citizens from COVID-19 will deepen pre-existing societal divisions and almost certainly “enhance some people’s receptiveness to calls for support from extremist enterprises.” In places like the Philippines, Hungary, Egypt, and Israel, activists say such anti-democratic moves are already underway.

Correction: May 6

The original version of this story misstated the date on which German police arrested four ISIS supporters, as well as where the arrests took place. German police arrested four suspected ISIS members on April 15 in North Rhine—Westphalia, not on April 12 near Frankfurt.

The Coronavirus Brief. Everything you need to know about the global spread of COVID-19 Please enter a valid email address. Sign Up Now Check the box if you do not wish to receive promotional offers via email from TIME. You can unsubscribe at any time. By signing up you are agreeing to our Terms of Use and Privacy Policy . This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. Thank you! For your security, we've sent a confirmation email to the address you entered. Click the link to confirm your subscription and begin receiving our newsletters. If you don't get the confirmation within 10 minutes, please check your spam folder.

Write to Joseph Hincks at joseph.hincks@time.com.