đ´ ALERT: Special Intelligence Update for Resurrection Sunday
Threat Intel bulletin for this coming Good Friday and Resurrection Sunday
CWT Special Edition | Threat Level: SEVERE (Red)
Facebook | X | Instagram | YouTube | LinkedIn | Threads | TikTok
đş Watch the Full Video Briefing on YouTube:
BLUF
Multiple converging threat streams are active this Easter Sunday. ISIS-aligned and AQAP media have published operational guidance within the past 60 days explicitly directing lone actors in America and Europe to attack religious gatherings. A Hezbollah-inspired attacker struck a synagogue in Michigan three weeks ago and was stopped by armed security. Iranian proxy networks are in an active retaliation posture following the death of a senior IRGC commander. ISISâs own internal publications have instructed their global network not to stand down after Ramadan. The NCTC flagged Easter specifically as an elevated-risk date. Church security teams should treat April 5, 2026 as the highest-threat worship event of the year and confirm all protocols before the first service opens its doors.
Key Judgments
Highly Likely: A lone actor motivated by Hezbollah, ISIS, or AQAP ideology will conduct an attack against a religious gathering somewhere in the United States or Europe during the Easter weekend.
Highly Likely: ISIS-affiliated networks will sustain or increase their global attack tempo through the post-Ramadan period. Their own leadership directed this explicitly on March 30, 2026.
Likely: Any domestic attack this weekend will most likely take the form of a complex lone-actor attack involving vehicle ramming, IED deployment, gunfire, or stabbing, consistent with the operational templates promoted in current AQAP and ISIS media and the attack pattern observed at West Bloomfield and Bondi Beach.
Possible: A chemical or poison-based attack methodology will be attempted against a large religious gathering, consistent with the Europol Early Warning Notification issued March 9, 2026.
The Threat Environment: Ramadan Surge Meets Resurrection Sunday
Easter Sunday 2026 falls at the intersection of two threat cycles that intelligence analysts watch closely: the end of Ramadan and the highest-attendance Christian worship event of the year. These two timelines colliding on the same weekend is not a coincidence that your adversaries have failed to notice.
Ramadan 1447 ended with what ISIS described internally as a historic surge in global operations. Their al-Naba newsletter #539, published March 30, tallied 81 attacks across seven provinces in the final week of Ramadan alone, producing 359 killed or wounded, 125 vehicles destroyed, and 10 military camps burned. The editorial accompanying those numbers was not a celebration of Ramadanâs end. It was a direct order to sustain the pace. The text explicitly instructed fighters that Ramadan may be over but jihad is a permanent season, and called on every Muslim capable of action to carry the operational tempo forward into the next period without pause. Your Easter Sunday morning falls inside that directed window.
At the same time, AQAP released Inspire Guide #12 in Spring 2026, using the December 14, 2025 mass shooting at a Jewish Hanukkah gathering at Bondi Beach, Sydney as its operational centerpiece. The publication is not abstract ideology. It is a step-by-step recruitment and operational template that closes with a direct personal appeal to Muslims living in the United States and Europe, telling them that what the two attackers did at Bondi Beach is the minimum expected of them and urging them to look around at nearby targets and act. It includes IED construction instructions. It was published weeks before your congregation gathers.
The NCTCâs Counterterrorism Digest for the week of March 26 through April 1 specifically listed Good Friday and Easter in its Upcoming Events calendar, a section reserved for dates carrying historical or current terrorism relevance. The NCTC does not put dates on that calendar as a formality.
Active Operational Guidance Targeting Your Congregation
Two separate pieces of terrorist operational media published in the past 60 days name religious gatherings explicitly as target locations. Your security team needs to understand what is in those documents.
The first is the Europol-flagged âInvadeâ magazine, released by an ISIS-aligned Pakistani media outlet in February 2026 and the subject of a formal Early Warning Notification from Europolâs European Counter Terrorism Centre on March 9. It promotes the use of botulinum toxin, oleander extract, and cyanide as alternatives to bombs and knives against crowds, specifically because they are easy to produce at home and difficult for law enforcement to detect. The documentâs planning section lists applicable targets by name: parties, festivals, religious gatherings, and markets. It recommends contaminating food and drinks at large events and applying toxins to surfaces in public spaces. Europol assessed it as active recruitment and operational material circulating in English to reach lone actors in Western countries.
The second is AQAPâs Inspire Guide #12. The operational lessons it draws from the Bondi Beach attack are specific and instructional. The attackers conducted months of prior rural weapons training. They performed pre-attack reconnaissance at the location two nights before the shooting. They used legally owned firearms and home-assembled explosive devices. They staged from an Airbnb. AQAP framed every one of those choices as a model for readers to replicate. The final message section closes by telling readers in America and Europe to look around them, identify targets, and act. Your congregation on Easter Sunday morning is visible, concentrated, predictable in its timing, and spiritually significant. That combination is exactly what these documents describe as an ideal target environment.
The pre-attack surveillance angle deserves specific attention. The West Bloomfield, Michigan attack on March 12 was preceded by weeks of online target research. FBI investigators confirmed the attacker conducted no physical pre-attack surveillance at the temple itself. That tells you something important: physical surveillance is not always the warning sign your team will see first. What you are more likely to see is behavioral indicators in the days and weeks before an event, not the night before.
The Iranian Proxy Threat and Its Domestic Implications
The Iranian threat to your congregation this Easter is not primarily a question of a direct state-sponsored attack on American soil. It is a question of a motivated and networked proxy ecosystem that has demonstrated the ability to inspire, finance, and direct violence in Western countries, and that is currently operating in an elevated retaliation posture.
On March 26, Israeli forces killed IRGC Navy Commander Ali Reza Tangsiri in a strike in Bandar Abbas, Iran. Tangsiri commanded the IRGC Navy for eight years, oversaw the closure of the Strait of Hormuz during Operation Lionâs Roar, and was under U.S. Treasury sanctions for plotting attacks against vessels in international waters. His death was a significant decapitation strike. Organizations like the IRGC do not absorb that kind of loss quietly, and the response window is still open.
On March 31, the IRGC issued direct threats against 18 named U.S.-based companies with Middle East operations, warning that attacks could begin as early as April 1. Iran-aligned Islamic Resistance in Iraq groups claimed 23 separate attacks against U.S. assets across Iraq and the region in a single day during the reporting period, stating they had conducted approximately 600 attacks since the outbreak of the broader Iran conflict. Hezbollah cells were disrupted in Kuwait and Bahrain during the same week. Two individuals with connections to Hezbollah and the IRGC-Quds Force were arrested in Ecuador on March 25. Kataâib Hezbollah was directly linked to the kidnapping of a U.S. journalist in Baghdad on March 31.
The domestic connection runs directly through the West Bloomfield attack. The FBIâs determination on March 30 that Ayman Mohammad Ghazaliâs attack on Temple Israel was Hezbollah-inspired confirms what experienced threat analysts already knew: the Iranian proxy network does not need to send an operative across the border to generate domestic violence. It cultivates, inspires, and directs individuals already living in American communities, some of whom have no prior law enforcement file and no placement on any watchlist. Ghazali had neither.
For your security team, this means the threat is not confined to Jewish institutions. The pattern of Ashab al-Yaminâs operations across European synagogues, using Telegram channels associated with Shia militant groups and accepting payment of $691 to recruit attackers via Snapchat, tells you that the barrier to entry for this kind of violence is lower than at any prior point in recent history. A motivated individual with a consumer-grade accelerant and ten minutes can create a mass casualty event. Your job is to make sure that individual never gets those ten minutes inside your building.
What Your Team Needs to Do Before the First Service
This section is written directly to the men and women who will be standing the line on Easter Sunday morning. Your pastor needs to read it too.
Pre-service walkthrough is mandatory. Every entrance, exit, parking lot, and gathering area needs eyes before the first car arrives. You are looking for anything that breaks the pattern you know: unfamiliar packages, vehicles in unusual positions, propped doors, unknown personnel.
Tighten access control. High-attendance events create noise that attackers exploit. Reduce open entry points even if it creates longer lines. Two controlled doors are safer than five unwatched ones.
Confirm your communication plan verbally with every team member before people arrive. Rally point, lockdown signal, evacuation route, who calls 911. If you have not done this in the past 30 days, do it this morning. It takes eight minutes.
Know your medical capability. Easter draws visitors and unfamiliar faces. Your team will not know everyone in the building. Confirm what medical support is on site and who is responsible for it.
Brief your greeters and ushers. They interact with more people at the door than anyone on your security team. Give them three things: what normal looks like, what abnormal looks like, and a name and face to report to. Keep it that simple.
Request a law enforcement patrol presence. If you have a relationship with your local agency, call today and ask for a drive-through during your service window. Most agencies will accommodate a reasonable request made in advance.
Watch for behavioral indicators, not just physical ones. The West Bloomfield attacker conducted no physical pre-attack surveillance at the temple. What preceded the attack was weeks of online research and observable behavioral changes. Your first warning may not come from the parking lot. It may come from a family member, a coworker, or a social media post.
Threat Assessment
The current threat posture for Christian congregations in the United States this Easter Sunday is SEVERE, Red.
This assessment is based on the convergence of five independent threat streams during the same reporting window. First, active ISIS-aligned operational guidance published in February 2026 explicitly names religious gatherings as preferred targets for lone-actor chemical attacks. Second, AQAPâs Inspire Guide #12, published Spring 2026, contains a direct personal call to action directed at Muslims living in America and Europe to replicate a mass shooting at a Jewish religious gathering. Third, the FBI confirmed on March 30 that a Hezbollah-inspired individual conducted a vehicular and firearms attack against the largest synagogue in Michigan on March 12, was engaged by armed security guards, and was stopped before mass casualties occurred. Fourth, ISISâs own internal editorial leadership explicitly directed their global network on March 30 to sustain attack operations after Ramadan without pause, placing the current period inside an active operational window. Fifth, Iranian proxy networks are in a confirmed elevated retaliation posture following the March 26 death of IRGC Navy Commander Ali Reza Tangsiri, with the IRGC itself issuing direct threats against U.S.-linked targets effective April 1.
No specific, credible threat against a named congregation has been identified in this reporting period. The SEVERE designation reflects the convergence of active threat streams, the symbolic significance of Easter Sunday as a high-attendance Christian worship event, the documented pattern of attacks against religious gatherings by multiple adversary networks simultaneously, and the explicit post-Ramadan operational directive from ISIS leadership.
It is Highly Likely that this threat environment remains elevated through the Easter weekend and into the following week. It is Likely that any attack on American soil during this period will be a lone actor motivated by Hezbollah, ISIS, or AQAP ideology rather than a directed operational cell. It is Possible that chemical or improvised incendiary means will be employed as alternatives to firearms, consistent with the Europol warning and the Bondi Beach attackâs use of home-assembled explosive devices. Your team should plan and posture accordingly.
Biblical Lens
This is the morning that changes everything. Before we talk about what your team needs to do in the next four hours, we need to remember what happened two thousand years ago on a morning like this one, and why it matters to every man and woman standing a post this Sunday.
âO death, where is your victory? O death, where is your sting?â The sting of death is sin, and the power of sin is the law. But thanks be to God, who gives us the victory through our Lord Jesus Christ. â 1 Corinthians 15:55â57 (ESV)
The people gathering in your building this morning are not gathering in fear. They are gathering in the power of a risen King. That does not diminish the threat. It reframes why you are standing the line. You are not guarding a building. You are protecting the people of God on the morning the world remembers that death has already been defeated.
Nehemiah understood this posture. His people were rebuilding the wall under active threat, weapons in hand, while the work continued around them. He told them:
Do not be afraid of them. Remember the Lord, who is great and awesome, and fight for your brothers, your sons, your daughters, your wives, and your homes. â Nehemiah 4:14 (ESV)
That is the calling of a church security team on Easter Sunday morning. Remember the Lord. Then do your job.
He is risen. Stand your post.
Thank You Brother for the UPDATES. Keep your head on a swivel.
Thank you, brother!!!! Blessings