At the beginning of the week in which Netanel Shukrun, a father of six from Alei Zahav, was murdered, the two ends of the campaign the IDF is waging in Judea and Samaria were on clear display. On one side is intelligence activity that leads forces to terrorists before they can carry out the attacks they are planning. On the other is someone who decides to act alone, takes a weapon and sets out to kill, leaving almost no signs that can be detected in advance.
That weekend, Duvdevan Unit troops arrested two terrorists in Qabatiya who, according to the IDF, were planning to carry out an attack in the immediate future. Intelligence led the forces to the two before they could put their plans into action.
At the other end of the spectrum was Qadri Samara, a 37-year-old Hamas operative from the village of Biddu. Samara arrived at the Ein Raya spring near Neve Tzuf, opened fire at Shukrun and his son, murdered the father and fled. According to a senior security official who spoke with Israel Hayom, it was the first attack in about a year in Area C of Judea and Samaria in which a terrorist who set out armed and intending to kill succeeded in carrying out his plan.
The gap between the two incidents illustrates one of the central challenges currently facing Israel's security establishment in Judea and Samaria.
Organized terrorist cells leave an intelligence signature
When dealing with organized cells and terrorist infrastructure, the IDF and the Shin Bet security agency have a significant advantage. Terrorist infrastructure requires people, weapons, money and coordination, and sometimes the transmission of orders and training of operatives as well. Almost every such activity can leave an intelligence signature.
The results can be seen on the ground. During 2025, the IDF reported an approximately 78% decline in terrorist incidents in Central Command, alongside some 7,400 arrests and the seizure of about 1,340 weapons. Throughout 2026, forces have continued to conduct operations almost nightly against terrorist infrastructure, arrest wanted suspects and seize weapons.
The picture is entirely different when it comes to a lone attacker. When someone does not share his decision with others, does not recruit a cell and does not need to coordinate a time or target, the number of points at which he comes into contact with intelligence systems is greatly reduced. There is not necessarily an unusual phone call, no accomplice who might be exposed and no chain of operatives that can be tracked.
That is precisely the advantage sometimes enjoyed by attackers who are particularly difficult to stop in advance. The pattern has recurred in several incidents over the past year and a half. In September 2025, a resident of the Shuafat refugee camp stabbed two hotel guests at Kibbutz Tzuba, seriously wounding one and moderately wounding the other. A month earlier, a resident of the Tulkarem refugee camp attempted to infiltrate Kibbutz Metzer while carrying a knife and was stopped before he could hurt anyone.
Earlier this month, a terrorist arrived in a commercial vehicle at the Maoz Yehuda farm near the village of Aqraba in Samaria. He asked 19-year-old Netanel Yaakovs where his weapon was, then stabbed him repeatedly until the knife broke and fled. About an hour later, he was killed after attempting to stab the force pursuing him as well. In all of these incidents, there was no specific intelligence warning identifying the attacker in advance.
Concern over the next attacker
After a deadly terrorist attack, the concern is not limited to the terrorist who carried it out. It also extends to those who may see him as an example. For years, the IDF has used the term "inspired attacks" to describe cases in which someone who is not necessarily part of an organized terrorist network decides to carry out an attack in the wake of an earlier incident, amid a tense atmosphere or out of a desire to imitate another attacker.
In such cases, the time between the individual's decision and the attack itself can be extremely short, sometimes leaving the security establishment with no meaningful window in which to act.
That also changes the way the threat is confronted. Against a terrorist cell, the emphasis is on intelligence and thwarting the attack before it happens. When there is no concrete information about an individual, the weight shifts much more heavily toward protection on the ground: the presence of forces, checkpoints, security screening, patrols, rapid response and identifying unusual behavior in real time.
That shift also helps explain the scale of the forces currently operating in Judea and Samaria. Division 96 was deployed to the sector earlier this year, reinforced by reserve battalions and regular forces, and began operating alongside the Judea and Samaria Division. During a single week in March, the two divisions carried out hundreds of operations and seven brigade-level operations, arresting more than 200 wanted suspects.
Deploying another divisional headquarters means more than simply putting additional soldiers on the ground. It adds another layer of command and control, makes it possible to operate several brigades simultaneously and allows broader offensive and defensive activity to be managed.
This week, the IDF went a step further. Following the recent incidents, IDF Chief of Staff Lt. Gen. Eyal Zamir ordered the headquarters of Division 98 to begin operating in Judea and Samaria and assume command of the Judea and Etzion regional brigades. The IDF said the move was intended to strengthen command and control and expand defensive and offensive capabilities in the sector.
As a result, alongside the permanent Judea and Samaria Division and Division 96, which is already operating in the area, the headquarters of Division 98 is now also being used to divide responsibility and enable forces to deal with several operational hotspots simultaneously.
But even a substantial reinforcement cannot fully solve the problem posed by a lone attacker. More battalions can set up more checkpoints, increase patrols and shorten the time it takes forces to reach the scene. They cannot generate an intelligence warning about a decision someone made alone and told no one about.
After the Neve Tzuf attack, security forces raided Biddu, mapped Samara's home, searched more than 100 locations in the village and questioned dozens of suspects. Among other things, the operation was intended to determine whether he had a support network that assisted him and to reduce the risk of follow-up attacks.
That may be the paradox of the current campaign in Judea and Samaria: The better the security establishment becomes at detecting those who organize, recruit operatives and build terrorist infrastructure, the more conspicuous the threat becomes from those who do not organize at all. There is no cell to dismantle, no infrastructure to uncover and, at times, no warning on which to act. In such cases, the struggle shifts from intelligence trying to reach the terrorist before he sets out to the troops on the ground once he has already decided to act.
