November 2025 represents one of the most kinetically active and geographically expansive months of militancy recorded in Pakistan in recent years. The data reflects a security environment characterised by sustained terrorist operational tempo, simultaneous multi-theatre pressure on state forces, and an absence of any meaningful seasonal slowdown. The conflict during this period was neither episodic nor reactive. Instead, it demonstrated characteristics of planned, sustained, and adaptive insurgent warfare, combined with an increasingly aggressive but tactically constrained counter-terror response.

The violence landscape was dominated by two parallel conflict streams. The first involved Pashtun militant groups operating across Khyber Pakhtunkhwa and the former tribal districts. The second involved Baloch insurgent formations conducting coordinated operations across central and southern Balochistan. These streams operated independently but placed cumulative pressure on Pakistan’s internal security apparatus, stretching response capacity across terrain, force availability, and intelligence bandwidth.

PART I: QUANTITATIVE ANALYSIS

Incident Volume and Operational Density

A total of 285 militancy-related incidents were recorded during November 2025, indicating a high-frequency conflict environment averaging nearly ten incidents per day nationwide. Of these, 209 incidents were terrorist attacks, while 76 were counter-terrorism operations, highlighting that militant-initiated actions significantly outpaced state-initiated engagements.

Geographically, Khyber Pakhtunkhwa accounted for 176 incidents, representing nearly two-thirds of all activity, while Balochistan recorded 100 incidents, confirming its continued role as the second primary theatre of violence. The remaining incidents occurred in Punjab, Sindh, Islamabad, and other regions, but these were limited in number and largely symbolic or facilitative in nature rather than sustained campaigns.

The distribution underscores that militancy in Pakistan during November 2025 remained structurally anchored in peripheral and frontier regions, but with sufficient network depth to project violence into urban and politically sensitive locations when required. The suicide bombing outside the District Judicial Complex in Islamabad on 11 November that killed a dozen people and injured dozens is an instructive example of that urban reach and strategic intent to strike symbolic state targets. The Islamabad strike was claimed by a TTP faction and resulted in subsequent arrests of a cell believed to have provided the device, illustrating the link between rural militant networks and urban execution cells.

Casualty Patterns and Lethality

The month recorded 342 total casualties, reflecting a sharp lethality profile. Of these, 160 militants were killed, 67 security personnel were killed, and 115 civilians lost their lives. The casualty ratio demonstrates that while security forces succeeded in eliminating a significant number of militants, civilian harm remained high, indicating both indiscriminate attack patterns and operational spillover from CT engagements.

Bannu district emerged as the epicentre of violence, recording 61 casualties, the highest nationwide. This was followed by Kurram with 32 casualties, Lakki Marwat with 25, South Waziristan with 21, and Dera Ismail Khan with 20. These districts form a contiguous belt, suggesting a geographically coherent militant campaign rather than isolated flare-ups.

Civilian casualties were particularly pronounced in Islamabad, Kalat, Bajaur, and Bannu, indicating that militants deliberately targeted public spaces, judicial infrastructure, and populated localities to maximise psychological impact alongside physical damage.

Nature of Violence and Tactical Composition

The dominant form of violence during November 2025 was direct armed confrontation, with 81 incidents classified as clashes or firefights. This indicates a high degree of militant confidence, as sustained gunfights typically expose fighters to counter-fire, aerial surveillance, and reinforcement.

Explosive violence was also prominent, with 65 explosion-related incidents, including four suicide bombings. Although suicide attacks were numerically limited, their targeting and location, particularly the Islamabad District Courts bombing and suicide explosion targeting Frontier Corps HQ at Reko Diq-Saindak Zone in Nokundi, Chagai, gave them disproportionate strategic significance.

Targeted violence accounted for 47 incidents, largely comprising assassinations of police personnel, tribal elders, political figures, and peace committee members. This reflects a deliberate strategy aimed at dismantling local governance structures, silencing informants, and deterring collaboration with the state.

Infrastructure sabotage, though fewer in number at 15 incidents, targeted transport routes, construction equipment, security installations, and communication assets, particularly in Balochistan. These attacks had a cascading economic and logistical impact disproportionate to their frequency.

Weapons and Tactical Trends

Weapon usage data reveals a heavy reliance on small arms, used in 176 incidents, underscoring the continued primacy of light infantry tactics. However, the frequent use of IEDs and explosive ordnance, together accounting for 79 incidents, highlights sustained access to explosives and bomb-making expertise.

The increasing presence of drone-related incidents, including both state-operated quadcopters and alleged militant countermeasures, is a critical trend. Drone strikes and surveillance platforms were used extensively in North Waziristan, Khyber, and Bajaur, while militants demonstrated adaptive behaviour, including relocation, rapid dispersal, and attempts to shoot down aerial assets.

This indicates an evolving battlespace where aerial dominance no longer guarantees tactical surprise, forcing security forces into shorter engagement cycles and higher collateral risk.

Conflict Actor Involvement

Pashtun militant groups were linked to 107 incidents, making them the single most active category. Baloch insurgent groups followed closely with 96 incidents, reflecting near parity in operational tempo between the two theatres. Pakistani security forces were involved in 78 incidents, primarily CT operations rather than reactive engagements.

ISKP-linked activity remained numerically limited but strategically significant, particularly in districts like Karak and Bajaur, where recruitment, targeted killings, and ideological propaganda intersected with local militant ecosystems.

PART II: QUALITATIVE ANALYSIS

Khyber Pakhtunkhwa: Sustained Militant Momentum

Khyber Pakhtunkhwa witnessed persistent, high-intensity militant activity throughout November 2025, with no observable decline even as winter approached. Districts such as Bannu, North Waziristan, Khyber, Bajaur, Lakki Marwat, and Kurram experienced repeated attacks, often within short intervals, suggesting pre-positioned fighters and logistical depth.

The pattern of violence indicates a deliberate effort to normalize militant presence, as seen in attacks on police stations, checkpoints, and basic health units, as well as the public movement of armed militants on motorcycles. Abductions, executions, and intimidation campaigns were systematically employed to assert territorial control and undermine the writ of the state.

The return of militants from Afghanistan-based sanctuaries and their reintegration into local operational cells significantly contributed to this momentum, pointing to unresolved cross-border facilitation issues.

Balochistan: Coordinated Insurgency and Territorial Assertion

In Balochistan, the insurgency demonstrated a higher degree of coordination and planning compared to sporadic past cycles. Attacks in Awaran, Kalat, Kech, Panjgur, Khuzdar, Mastung, and Kachhi were not isolated but formed part of a broader campaign targeting military mobility, economic infrastructure, and administrative reach.

Insurgents repeatedly established temporary checkpoints, seized weapons, burned construction equipment, and targeted security convoys. The casualty profile, particularly the high number of security force fatalities in districts like Awaran, indicates tactical success from the insurgents’ perspective and effective use of terrain and intelligence.

The absence of large militant casualties in many of these engagements suggests disciplined withdrawal strategies and effective early warning systems.

Pashtun militants versus Baloch insurgents: a comparative tactical and MO assessment

Pashtun militants operating in KP and the former tribal districts displayed a hybrid insurgent-terrorist MO that blends guerrilla ambushes with urban-directed terror tactics. Their signature toolbox in November included complex ambushes on security convoys and checkpoints, frequent use of IEDs on transit routes, assassination of local police and peace committee figures to create a control vacuum, and intermittent suicide attacks intended to achieve political theatre, as illustrated by the Islamabad court bombing and multiple Bannu attacks. They also sustained cross-border linkages that enabled recruitment and replenishment of fighters from Afghan sanctuaries, which in November manifested as a surge of armed engagements with returning commanders and units. Tactically they rely on small unit manoeuvre, quick dispersal into difficult terrain, and an ability to shift between rural and urban targets through facilitation networks. Baloch insurgents in contrast pursued a campaign rooted in territorial denial and economic disruption. Their MO emphasised coordinated raids on military convoys, temporary seizure of road segments, sabotage of construction and telecom infrastructure, and extraction of weapons and equipment from security detachments. The Baloch approach in November favoured systematic hit-and-run operations designed to inflict material loss and interrupt developmental projects. While Pashtun militants sought shock value and attrition, Baloch groups focused on sustained denial and the economic cost of governance. These differences are reflected in the datasets: Pashtun-linked incidents skewed towards clashes, targeted killings and explosive violence, while Baloch-linked incidents more frequently involved infrastructure sabotage and successful seizures of materiel. The divergence in MO also implies different countermeasures are required i.e., hard CT and urban disruption for Pashtun militants and persistent area control, infrastructure protection and local governance restoration for Baloch insurgents.

Urban and Symbolic Targeting

The suicide bombing at the Islamabad District Courts marked a strategic escalation. Unlike routine attacks in peripheral regions, this strike targeted the judicial core of the capital, signalling both operational reach and intent to challenge the state symbolically.

Parallel developments in Karachi and Lahore, including arrests linked to suicide logistics and explosive recovery, indicate that urban networks remain active, even if not consistently deployed. These networks function as latent capabilities, activated selectively for high-impact operations.

Counter-Terrorism Response and Its Limitations

State CT activity during November achieved discrete, tactical successes including the neutralisation of named commanders and arrests tied to urban attacks. CGTs included intelligence-based raids, targeted drone strikes and coordinated police operations that removed facilitators and disrupted planned attacks. However, the data shows a consistent pattern of CT action producing short term disruption followed by retaliatory operations or opportunistic attacks in nearby districts. Drone strikes and quadcopter operations while tactically effective also caused or were alleged to have caused civilian harm on multiple occasions, creating exploitable grievances that militants inserted into propaganda narratives. Arrests linked to the Islamabad attack and successful seizure of explosive vests in Karachi illustrate capability to disrupt urban plots, yet they did not eliminate the underlying facilitation networks that source explosives, safe houses and funding. November therefore reveals a capability gap in transitioning from tactical wins to structural network dismantlement.

Propaganda, Recruitment, and Transnational Linkages

November showed intensified propaganda efforts aimed at both domestic audiences and foreign recruits. Pashtun militant media released coordinated videos asserting active operations inside Pakistan, a tactic intended to counter narrative claims that militants were confined to Afghan sanctuaries and to attract recruits by showcasing battlefield success. CNAWS dataset confirm the presence of foreign fighters embedded with Pashtun groups, including recruits from Bangladesh and Afghanistan, which complicates the operational picture by adding external recruitment vectors and cross-border logistics. Baloch organisations simultaneously used local communications and tribal networks to publicise successful attacks on state infrastructure to recruit sympathisers and to delegitimise state-sponsored development projects. The interplay of messaging and operational success in November contributed to a feedback loop where battlefield victories amplified recruitment and propaganda reach.

Governance, service delivery and social resilience impacts

The operational environment in November directly degraded local governance and service delivery. Repeated attacks on polio protection details and the abduction or murder of teachers and local administrators undermined public health and education activities in frontier districts. In Balochistan the destruction and confiscation of construction machinery delayed projects and increased costs, while temporary telecom and transport disruptions reduced state oversight and economic activity. These conditions increase local vulnerability to militant influence because they reduce alternative sources of authority and erode confidence in the state’s ability to provide security and basic services. The datasets show that even where CT gains were made, the gap in restoration of local services allowed militant narratives to persist and, in some cases, to strengthen.

High-Impact Attack: BLF Suicide Assault in Nokundi (30 November)

A major shift in Baloch insurgent capability appeared on 30 November when the BLF’s Saddo Operational Battalion executed a complex suicide assault on the Pakistan Army’s Brigade Headquarters in Nokundi and overran the compound linked to the Saindak and Reko Diq mining projects. The assault began at 20:19 hrs and continued for 36 hours, during which fighters breached the perimeter, entered the compound, seized foreign engineers’ offices and residential quarters, and held ground under sustained SSG counterassaults supported by helicopters. The suicide bomber, Zareena Rafiq alias Tarang Maho, marked the fifth known female suicide operator deployed by Baloch insurgent factions.

This operation demonstrated several unprecedented capabilities. BLF fighters penetrated and held a high security military installation for more than a day, captured foreign personnel likely including Chinese nationals connected to Saindak operations, and repelled coordinated military attempts to retake the site. The action represents a doctrinal shift from dispersed sabotage to structured special operations designed for high political and economic impact. It mirrors the complex assault model used by TTP but is tailored to economic warfare by targeting mineral extraction infrastructure and foreign investment nodes.

The attack also produced immediate economic reverberations. Barrick Gold shares dropped nearly five percent after the assault, illustrating market sensitivity to operational risk around strategic minerals. By combining territorial breach, hostage taking, and symbolic targeting of Chinese aligned projects, the Nokundi assault delivered a layered message. It highlighted the vulnerability of Pakistan’s resource corridor, challenged the state’s narrative of securing CPEC projects, and signalled that BLF intends to raise extraction costs for foreign operators. The operation is likely to trigger expanded militarization in Chagai and may inspire replication attempts by other Baloch factions seeking similar visibility and leverage.

The Nokundi suicide assault is a strategic shock and will almost certainly change the CT landscape. A breach of this scale is a direct challenge to state authority and undermines Pakistan’s claim of securing Chinese and multinational investments. China’s long-term involvement in Saindak gives the incident bilateral weight and increases pressure on Islamabad to deliver a visible response. Given these factors CT operations in Balochistan are very likely to rise in the short term as the state attempts to restore deterrence and reassure external partners. The immediate response will focus on restoring control across the Chagai to Kech corridor. Security forces are likely to launch rapid kinetic sweeps in Chagai, Awaran, Kech and Panjgur with a mix of intelligence-based raids and area domination operations. Expect more helicopter backed searches, deeper HUMINT penetration and tighter surveillance of BLF enablers and Saddo Operational Battalion facilitators. Hardening of CPEC and minerals infrastructure will follow with expanded checkpoints, movement restrictions and forward deployments along transit routes. Urban networks in Quetta and Khuzdar will come under higher pressure through arrests, interrogations and targeted disruption of logistical nodes. The state will also employ administrative tools such as extended communication shutdowns and wider security cordons. This spike will remain high for several weeks and may moderate once the state restores control. If BLF attempts another complex or hostage driven operation the security response will shift from short duration escalation to sustained force posture across the entire western belt.

Comparative Assessment of Counter-Terrorism Operations in Khyber-Pakhtunkhwa and Balochistan

Overview of CT Operational Distribution

The quantitative dataset for November 2025 highlights a clear asymmetry in counter-terrorism operational intensity between Khyber Pakhtunkhwa and Balochistan. Of the 76 CT operations recorded nationwide during the month, 66 were conducted in KP, while only 7 were recorded in Balochistan. This disparity is not incidental nor reflective of lower threat levels in Balochistan. Instead, it underscores structural differences in the nature of militancy, intelligence availability, terrain, and state risk calculus across the two theatres.

While both provinces experienced high levels of militant violence overall, the state response differed fundamentally in posture. KP remained an offensive CT theatre, whereas Balochistan functioned largely as a reactive security environment, where CT activity was selective, episodic, and constrained.

CT Operations in Khyber Pakhtunkhwa: Offensive Disruption Model

In KP, CT operations formed an integral and continuous component of the security forces’ engagement strategy. Districts such as Bannu, North Waziristan, Khyber, Bajaur, Lakki Marwat, Kurram, and Dera Ismail Khan collectively accounted for the bulk of CT activity. These operations were primarily intelligence-based, involving cordon-and-search missions, targeted raids, drone-assisted strikes, and arrest operations.

The data shows that KP recorded 153 militant fatalities, compared to 36 security force deaths and 60 civilian deaths, reflecting an environment where militants were frequently located, engaged, and neutralised. The high militant kill count is directly linked to repeated CT encounters, particularly in districts like Bannu and Kurram, where militant clusters were engaged multiple times across the month.

This operational density is enabled by the character of the militant threat in KP. Pashtun militant groups, including TTP factions and ISKP-linked cells, operate in semi-concentrated networks, often embedded within populated or semi-populated zones. Their reliance on logistics hubs, facilitators, mosques, safe houses, and identifiable commanders generates a steady stream of actionable intelligence. As a result, the security forces are able to sustain persistent disruption, even at the cost of frequent contact and escalation.

KP’s CT posture in November was therefore pre-emptive and attritional, aimed at preventing militant consolidation, disrupting leadership cycles, and denying militants territorial normalisation.

CT Operations in Balochistan: Selective and Constrained Engagement

In contrast, Balochistan recorded only 7 CT operations during November 2025, despite witnessing 100 total militancy-related incidents, nearly equal to KP’s 176 incidents. This imbalance highlights the limits of CT applicability in the Baloch insurgency context rather than a lack of threat perception.

The casualty data reinforces this assessment. Balochistan recorded 70 total casualties, including 36 security force deaths, 28 civilian deaths, but only 6 militant fatalities. This indicates that most militant actions in Balochistan concluded without direct militant losses, either because insurgents disengaged successfully or because engagements did not evolve into encounters conducive to CT action.

Baloch insurgent groups operate in a highly decentralised, rural, and terrain-dependent manner. Their tactics emphasise hit-and-run raids, infrastructure sabotage, convoy ambushes, and temporary road control, often executed far from permanent settlements. These actions are typically short-duration, with rapid withdrawal into sparsely populated or mountainous areas, leaving minimal exploitable intelligence residue.

As a result, CT operations in Balochistan are opportunity-driven rather than campaign-driven, executed only when intelligence confidence is high enough to justify kinetic action.

Structural Drivers of the CT Asymmetry

The difference in CT operational intensity stems from the nature of the two insurgencies.

KP hosts an entrenched jihadist threat, with active TTP and ISKP cells that are organisationally layered, command-driven, and logistically sustained. These characteristics require constant disruption to prevent regrouping, recruitment, and planning. Militants in KP operate in concentrated clusters, frequently interacting with civilian infrastructure and local support networks, which generates persistent CT opportunities.

Balochistan’s militancy, by contrast, is dispersed, rural, and decentralised, relying on sabotage and mobile raids rather than static presence. This structure presents fewer actionable CT targets. The terrain is expansive, the population sparse, and insurgent cells are often transient, operating without fixed bases.

Terrain, sparse population, and political constraints together create operational friction that limits frequent CT actions. In many cases, intelligence is insufficiently granular to justify raids, or the likelihood of collateral damage is assessed as outweighing the tactical gain. As a result, security forces deliberately avoid heavy kinetic activity when intelligence is thin or when civilian fallout could escalate local resentment or international scrutiny.

Posture Implications: Offensive versus Reactive Models

The net effect is a dual CT model. In KP, the state maintains an offensive CT posture, characterised by frequent engagement, leadership targeting, and disruption of militant ecosystems. This model accepts regular contact and escalation as the cost of containment and attrition.

In Balochistan, the state remains largely reactive, responding to attacks with area domination, checkpoints, patrols, and selective raids rather than sustained CT campaigns. This posture reflects strategic caution rather than weakness, shaped by the insurgency’s structure and the political sensitivity of the theatre.

Strategic Assessment (CT)

The November 2025 data demonstrates that CT effectiveness cannot be measured by frequency alone. High CT activity in KP reflects threat concentration and intelligence density, while low CT activity in Balochistan reflects threat dispersion and operational constraint.

However, the asymmetry carries long-term risks. Sustained offensive CT in KP may prevent militant consolidation but risks civilian fatigue and blowback. Limited CT in Balochistan, while tactically prudent, allows insurgent groups to retain initiative, freedom of movement, and symbolic dominance in remote areas.

The comparison underscores that a uniform CT template is not viable across Pakistan’s internal conflict theatres. KP demands relentless disruption. Balochistan demands intelligence deepening, political calibration, and long-term area control rather than short-cycle kinetic success.

Strategic Outlook (Overall)

Absent a rapid and integrated disruption of cross-border facilitation, financing networks and urban facilitators, the operational tempo recorded in November is likely to persist. Analysts should expect continued ambushes and targeted killings in the KP belt, episodic high-impact urban attacks, and sustained sabotage and convoy operations in Balochistan. The presence of foreign recruits and the intensifying propaganda campaign increase the probability of coordinated actions designed to synchronise rural attrition with urban shock attacks. Operationally, this implies that security forces will need to maintain high-intensity CT operations while simultaneously investing in community protection, rapid restoration of services after CT strikes, and intelligence-driven targeting of logistics and finance nodes to convert tactical successes into strategic degradation of militant networks.

The assessment is based on insights drawn from CNAWS’s open source incident database. (The views expressed are those of the authors and do not represent the views of CNAWS.)

Sushant serves as the Intelligence/ Lead Analyst for the Pakistan Security Desk at CNAWS, specializing in the Balochistan insurgency and Tehrik-e-Taliban Pakistan (TTP). Mohit Vashisth is Founder and Executive Director (Intelligence) at CNAWS.