Michigan Worship Site Attack Cluster: Threat Intelligence Briefing

Mar 18, 2026

CHRISTIAN WARRIOR TRAINING | Threat Intelligence Bulletin | UNCLASSIFIED/OSINT | March 18, 2026

Three Attacks on Congregations in Nine Months: An Unprecedented Threat Pattern

BLUF

Michigan has experienced three armed attacks on worship sites in less than nine months. Two were thwarted by armed security teams. One killed four people and destroyed the building. Two attackers used vehicles as primary forced-entry weapons. A church deacon stopped the third attacker with his own vehicle after security engaged the attacker. This pattern has no documented precedent in the American record. Every congregation in this country should treat it as an operational signal, not a regional anomaly.

Key Judgments

Findings

The cluster is unprecedented. Between June 2025 and March 2026, Michigan experienced three armed attacks on worship sites in less than nine months. Texas recorded four worship-site attacks across fourteen years. Georgia recorded three across nine years. Michigan’s three occurred in approximately 265 days. No comparable cluster exists in the American record.

The attackers were not connected. All three were independent actors with distinct, unrelated motives — mental health crisis and personal grievance at CrossPointe, ideological religious hatred at Grand Blanc, and geopolitical grief and retribution at Temple Israel. This was not a coordinated campaign.

Pre-incident indicators were present in every case and went unreported in time. Browning posted his grievance publicly on Facebook. Sanford vocalized his hatred to multiple people in the week before the attack. Ghazali’s withdrawal from work and social contact was visible, and his phone call to his ex-wife alarmed her enough to contact police. In no case did the observation reach a security or law enforcement contact before the attack began.

Two of the three attackers used vehicles as primary forced-entry weapons. Sanford rammed the chapel wall. Ghazali drove a loaded truck through the synagogue entrance. At CrossPointe, Browning staged erratically in the parking lot before a church deacon used his own vehicle to stop him. Vehicle approach to the building was a factor in all three incidents.

Armed security determined the outcome. CrossPointe and Temple Israel had trained, armed security teams on site. Both attacks were stopped before congregation members were killed. Grand Blanc had no equivalent response. Four people died and the building was destroyed.

A federal intelligence flag on Ghazali existed seven years before the attack and did not prevent it. CBP flagged his contacts with suspected Hezbollah members in 2019. That information did not translate into intervention. This is an intelligence-to-local-law-enforcement communication failure with direct implications for how existing federal threat data is acted on before an incident.

JOIN THE WARRIOR BIBLE STUDY-SIGN UP BELOW TO GET IT EACH SUNDAY

Assessments

Highly Likely: Congregations without trained armed security teams and physical vehicle barriers are at elevated risk. The pattern in this cluster is documented and reproducible by any motivated attacker with a vehicle and a grievance.

Highly Likely: Pre-incident indicators will precede the next worship-site attack, as they have preceded every attack in this cluster and the majority of mass casualty events in the broader national database. The question is not whether indicators will appear — it is whether anyone will know how to report them.

Highly Likely: The vehicle-as-weapon tactic will be replicated at worship sites beyond Michigan. It requires no specialized training, defeats standard perimeter control, and was employed successfully in two of the three most recent worship-site attacks in the country.

Highly Likely: Michigan’s threat environment will remain elevated through 2026 given the ongoing Middle East conflict, the state’s geopolitical demographics, and the demonstrated pattern of worship-site targeting. Law enforcement has stated this directly.

Possible: The Michigan cluster will function as an operational template that influences future attackers in other states, particularly the vehicle forced-entry method combined with an armed interior response as the primary point of failure to plan against.

Incident Timeline

Five incidents define the Michigan threat environment since 2021. The first two establish the state’s sustained mass violence pattern at secular targets. The final three are the unprecedented worship-site cluster.

November 2021 — Oxford High School | 4 Killed

Shooter: Ethan Crumbley, 15. Parents had been called to the school that morning over a behavioral warning that was not acted on. Pre-incident indicator failure. Secular target.

February 2023 — Michigan State University | 3 Killed

Shooter: Anthony McRae, 43. No prior connection to MSU. Carrying a note expressing hatred toward the school. Pre-incident indicators existed and were not acted on. Secular target.

June 22, 2025 — CrossPointe Community Church, Wayne | THWARTED

Attacker: Brian Anthony Browning, 31. Armed with an AR-15 style rifle, handgun, and hundreds of rounds. No criminal history. Mother was a church member; he had attended two or three times. Had posted on Facebook blaming the church for a friend’s death and was in a documented mental health crisis. Drove erratically in the parking lot. A church deacon struck him with his truck. Church security engaged and killed him outside the entrance. Zero congregation fatalities. One guard wounded. Approximately 150 people inside.

September 28, 2025 — Grand Blanc LDS Chapel | 4 Killed

Attacker: Thomas Sanford, 40. USMC Sergeant, Iraq War veteran, vehicle mechanic by specialty. Rammed his truck through the chapel wall, exited with an assault rifle, shot the congregation, and set the building on fire with gasoline. Four killed, eight wounded. Building destroyed. Sanford killed in a parking lot shootout three minutes and forty-seven seconds after dispatch. Years-long documented hatred of the LDS church, vocalized to multiple people in the week before the attack. Erratic behavior observed by neighbors two days prior. FBI confirmed motive: targeted anti-religious violence.

March 12, 2026 — Temple Israel, West Bloomfield | THWARTED

Attacker: Ayman Ghazali, 41. Naturalized US citizen from Lebanon. No criminal record. Flagged in federal databases in 2019 for contacts with suspected Hezbollah members — that flag did not prevent the attack. His two brothers, including an IDF-confirmed Hezbollah commander, were killed in an Israeli airstrike on March 5. In the weeks after, Ghazali stopped working and withdrew from contact. Waited in the parking lot over two hours. Called his ex-wife before the attack asking her to care for their children — she called police, but too late. Drove a truck loaded with fireworks and gasoline through the front entrance. Armed security team, trained by FBI Detroit two months earlier, stopped him in the hallway. Zero congregation fatalities. One guard struck by the vehicle. More than 140 children in the building.

What This Means for Your Congregation

The three attacks were carried out by men with completely different motives — mental health crisis, religious hatred, and geopolitical grief. They were not connected. What they share is method, behavioral pattern, and target category, and those commonalities are actionable.

Every attacker communicated distress or intent before the attack. Browning posted it publicly. Sanford said it out loud to anyone who would listen. Ghazali’s withdrawal was visible to coworkers, and his phone call alarmed his ex-wife enough to contact police. The indicators were there. What was missing was a reporting pathway. If your congregation does not have a designated security contact that members know how to reach, the next warning sign that surfaces in your community has nowhere to go.

Two of the three attackers drove vehicles through the entrance of the building. If a vehicle can reach your front door at speed, that is a vulnerability. Deliberate parking configurations, planters, and standoff distance are low-cost measures that change the geometry of the threat.

The armed security outcome in this cluster speaks for itself. CrossPointe and Temple Israel stopped attacks cold. Grand Blanc did not have that capacity. Four people died. If your security team is not trained and armed, that gap is your most urgent priority.

Recommendations

Harden vehicle entry points. Assess whether a vehicle can reach your front entrance at speed and place physical barriers accordingly.

Establish a threat reporting pathway. Name a security point of contact your congregation knows how to reach. Train your people to report behavioral changes, threatening statements, and concerning posts. Connect that contact directly to your local FBI field office.

Train and arm your security team. Get them connected to your FBI field office for coordination and training resources. The FBI Detroit Field Office trained Temple Israel’s team two months before the March 2026 attack. That training saved lives.

Expand exterior observation. Monitor the parking lot before and during services. Pre-attack staging behavior was visible at all three worship-site incidents in this cluster.

Build the law enforcement relationship now. West Bloomfield law enforcement was in direct contact with Temple Israel’s security director in the weeks before the attack. Increased patrols, direct communication, and a trained team on site — zero congregation members died. That relationship does not build itself.

This is the plan that I use and trust. Even in a righteous shooting, you’ll need representation. Use code CWT for the discount above.

Biblical Lens

Nehemiah understood the threat environment he was operating in. When the returned exiles rebuilt the walls of Jerusalem, he organized the workforce so that half the men worked and half stood guard. His instruction was direct:

“Do not be afraid of them. Remember the Lord, who is great and awesome, and fight for your brothers, your sons, your daughters, your wives, and your homes.” — Nehemiah 4:14 (ESV)

Those men were steady not because they had superior weapons but because they knew what they were defending and who authorized them to defend it. Psalm 82:4 gives the same mandate in plain language: “Rescue the weak and the needy; deliver them from the hand of the wicked.” That command does not pause on Sunday morning. It applies with particular weight to every person who has taken a position on a security team.

The attackers in this cluster were men in visible crisis that the people around them saw but did not know how to report. The church has a responsibility not only to defend its people but to build a community where that kind of distress is visible, reported, and addressed before it reaches the parking lot. That is pastoral work as much as security work. The two belong together.

If this bulletin helped your security team, share it with your pastor or team leader. Leave a comment below with questions or observations from your congregation.

Christian Warrior Training

Discussion about this post

Ready for more?