SNAPSHOT: Assault on Mozambique’s Palma underscores growing militant threat to commercial operations



On Wednesday (24 March), about 100 unidentified gunmen staged a complex assault on the northern town of Palma, Cabo Delgado province. The militants reportedly first targeted a police station in a nearby village, after which they attacked Palma from several directions. The militants blocked several roads leading into the city to hamper reinforcements of the security forces.

Several days of fighting ensued, with several thousand people trapped in the town; some 185 people were trapped for more than 24 hours inside the Amarula Lodge, a hotel popular with foreign workers and visitors in Palma. After initial attempts at airlifted evacuations failed on Friday (26 March), evacuations were attempted through a convoy of 16 to 17 trucks. Nevertheless, the convoy was ambushed by the militants, allowing only seven vehicles to escape through a nearby beach north of the hotel complex. The fate of the remaining evacuees remains unclear.

Over the weekend (27-28 March), seaborne evacuations continued and were made possible by the contribution of multiple non-state actors. By Sunday evening, more than 1,300 evacuees arrived in the port of Pemba, the provincial capital, while more people were on their way. However, dozens of people remain unaccounted for. Tens of thousands of local residents have fled the town, which is now largely abandoned.

Sporadic fighting continued to be reported as of Monday morning (29 March) after security forces received reinforcements.

Authorities have confirmed dozens of people killed, including expatriate workers from Portugal, Spain, South Africa, and the United Kingdom, but at least 40 more remain unaccounted for. This means the death toll is likely to increase.


During the attack, a number of foreign companies were targeted or affected. The militants robbed several bank branches, including South Africa’s Standard Bank and Banco Internacional de Moçambique (BIM), destroyed telecommunications infrastructure owned by Vodacom, and stole weapons from the security forces. Communications remained interrupted throughout the weekend.

French energy group Total said on Saturday that it would suspend plans to resume construction of infrastructure to support its production of liquefied natural gas (LNG) on the Afungi peninsula, about 7km south-east of Palma, which had been announced on the same day of the assault. Total had planned to progressively resume operations in April. 

African Century Real Estate, which has several developments in the town, said on Saturday that it had evacuated some of its staff but several workers remained unaccounted for. Other companies have also been affected by the attacks.

Australia’s RBR Group, which an interest in the 668-bed Wentworth Accommodation Camp, has also announced a suspension of operations.


The assault in Palma is unprecedented in Mozambique and is likely to mark a turning point in the Cabo Delgado insurgency, given the elevated number of expatriates killed and affected. While it was not the first time that foreign contractors had been targeted, the scale of the assault has raised the international profile of the insurgency.

The militants are almost certainly loyal to the Islamic State-affiliated insurgency in Cabo Delgado, commonly referred to as Ahlu al-Sunnah wal-Jamaah (ASJ) and locally known as ‘al-Shabaab’. The group is not linked to the Somalia-based al-Qaeda-affiliated outfit of the same name.

ASJ staged its first attack in Mocímboa da Praia, a town 65km south of Palma, in October 2017. Since then, it has intensified the number of attacks across Cabo Delgado, killing more than 2,300 people and displacing more than 700,000 as of March 2021.

In mid- 2019, the group was incorporated into Islamic State in Central Africa Province (ISCAP), which also includes the DRC-based Allied Democratic Forces (ADF). Both groups and their leaders were designated Global Foreign Terrorist Organizations by the US on 10 March.

The latest attack confirms ASJ’s improved kinetic capabilities, demonstrating the group’s increasingly sophisticated tactical skills and access to high-calibre weapons in combination with its historically crude and rudimentary tactics such as beheadings and arson.

The ostensibly well-coordinated attack suggests it was planned ahead of time, making it unlikely to be an opportunistic response to Total’s planned resumption of operations on Wednesday.


In the immediate term, companies and organisations with operations in Palma should continue to take active steps to ascertain the wellbeing and whereabouts of their personnel. Crisis response measures should be enacted, including post-traumatic support services and medical evacuations.

In the short term, the high level of sophistication in the attack raises the security threat profile to commercial operations in the area. While the human casualties and material damages are still being assessed, security managers should review security planning to ensure they are fit-for-purpose and conduct a gap analysis, including on-site inspections, to find any potential risk exposures once the situation has stabilised. Establishing and maintaining a robust intelligence-collection network is crucial to any security threat assessment.

In the long term, the heightened security threat posed by ASJ activities in Cabo Delgado is likely to require increased spending on security upgrades and application of stricter journey-management protocols to ensure welfare of in-country staff.