The Syrian General Intelligence Directorate announced on 15 October the arrest of Ali Kayali, better known as Mihrac Ural. The statement was terse, yet its implications reached far beyond its few lines. Kayali has long been accused of responsibility for the 2013 massacres in al‑Bayda and Ras al‑Nabaa in Baniyas—atrocities documented by Syrian and international human rights organisations as among the most brutal of the conflict.
The significance of his arrest lies not only in the identity of the suspect, whose record places him among the most notorious figures associated with wartime violence. It also lies in the circumstances that led intelligence officers to him, and in the message his capture sends to those who believe that time can obscure the memory of their crimes.
The breakthrough comes as the General Intelligence Directorate, led by Major General Abdul Qader Tahan since his appointment on 19 July, continues to define its new institutional identity and operational doctrine.
Reconstituted as part of the sweeping restructuring of Syria’s security establishment following the fall of the former regime in late 2024, the directorate is increasingly operating under a different set of priorities. Once an instrument of intimidation and repression, it is now expected to pursue suspected criminals, contribute to transitional justice, protect Syrians’ interests and help safeguard stability within Syria and across the wider region.
Kayali’s arrest was not a stroke of luck, nor an unexpected prize delivered amid the formidable security challenges confronting the country. According to the sequence of operations described by the authorities, it was the culmination of a series of interconnected investigations and arrests conducted in coordination with Turkish intelligence.
The process began with the detention of individuals linked to Kayali’s network. Further arrests followed, accelerating after the collapse of the former regime.
Between 2024 and 2026, Syrian intelligence, working alongside its Turkish counterpart, apprehended several alleged members of the network—including Sertel, Dokancı and Kuralı—in successive operations. The investigations eventually led, earlier this year, to Jamal Trabulsi, officially identified as Kayali’s deputy, and Omar al‑Khatib, described as the network’s principal logistics coordinator in the 2013 Reyhanlı bombing.
Each arrest opened a new line of inquiry and uncovered another strand of evidence. As information accumulated, investigators gradually assembled a more complete picture of the network, ultimately leading them to the man believed to have stood at its head.
The investigation resembled the painstaking reconstruction of a complex puzzle whose pieces had been scattered across years and jurisdictions. Through sustained surveillance and careful follow‑up, Syrian intelligence officers brought those pieces together, culminating in the arrest of the alleged leader of one of the region’s most dangerous transnational sectarian militant networks.
This approach points to a tangible development in Syria’s intelligence capabilities. The succession of arrests suggests that Kayali’s capture was the product of sustained investigative work extending over weeks, and possibly months.
The operation therefore offers evidence of an increasingly systematic approach to intelligence gathering—one capable of pursuing complicated investigations through successive stages until principal targets are identified and apprehended.
Similar methods appear to have been employed in other security investigations.
In the case of the network associated with Ghiyath Dalla, suspected associates were arrested one after another in operations involving the Internal Security Forces, intelligence personnel and counterterrorism units.
More recently, authorities announced the arrest of Mared Mohammed, nicknamed “the Guardian of the Capital.” Earlier operations had resulted in the detention of other fugitives allegedly implicated in crimes committed in Qaboun, al‑Hameh, Wadi Barada, Qudsaya, Ain Tarma and Jobar.
In each instance, an arrest helped close an investigative gap and answer questions that had remained unresolved. The pattern appears to have been repeated in the pursuit of Kayali’s network.
Taken together, these operations suggest the emergence of a security approach that seeks to bring long‑running investigations to a conclusion and establish accountability for crimes previously left unresolved. They may also herald further high‑profile arrests.
This assessment is reinforced by another operation announced by the Internal Security Forces, in cooperation with the General Intelligence Directorate, just one day before this article was written.
Security personnel dismantled a cell affiliated with the Islamic State (ISIS), a violent extremist organisation responsible for severe harm and human rights violations, in the Damascus countryside. The group had reportedly been preparing an attack against a police patrol.
According to the authorities, the same cell was responsible for an unsuccessful attack on a bus transporting security personnel near al‑Tall in August.
Its dismantling marked the third ISIS cell that Syrian security agencies have reportedly disrupted through pre‑emptive operations in Damascus and its surrounding areas since August.
The speed with which these investigations have progressed suggests that security institutions are becoming more effective in responding to emerging threats and closing operational gaps before extremist groups and criminal networks can exploit them.
A comparable pattern can be observed along Syria’s Mediterranean coast, where security agencies have made significant gains against armed groups during 2026.
There, the authorities have increasingly adapted their strategy, moving away from broad security responses toward targeted, pre‑emptive operations based on intelligence, much of it reportedly supplied by local residents.
Over the past year, security forces have dismantled numerous active cells and weapons depots. They have also eliminated the leadership of the group known as Rijal al‑Nour (Men of Light), killed militants associated with the Azrael Regiment and pursued suspects implicated in the attacks of last March.
Meanwhile, the Coastal Shield Brigade, led by Miqdad Fatiha and regarded as one of the largest insurgent organisations operating in the region, has carried out no significant operation for more than nine months. Most available reports suggest that Fatiha has fled to a neighbouring country.
These developments should also be considered alongside the repercussions of the Syrian army’s swift and decisive military operations against the Syrian Democratic Forces (SDF), particularly in the densely populated and heavily fortified district of Sheikh Maqsoud.
Those operations are presented as having imposed a strategic stalemate on armed factions associated with remnants of the former regime and other insurgent groups, curtailing their freedom of movement and forcing many to retreat into dormant cells with limited capacity to launch coordinated attacks.
As the security infrastructure of the SDF continued to be dismantled, groups affiliated with the former regime reportedly followed developments closely, with growing disappointment. Some acknowledged that they had lost fighters during confrontations with government forces.
Against this complex yet interconnected security landscape, the arrest of a figure such as Kayali takes on broader significance.
Combined with the cumulative security gains claimed by Syria’s new authorities, it appears to have further diminished the prospects of former regime factions seeking to reassert themselves through low‑intensity insurgency or renewed disorder.
For those groups, the narrowing of operational space, the disruption of their networks and the growing capacity of security institutions to pursue individual suspects represent mounting obstacles to any attempt to regain influence.
Kayali’s arrest is therefore unlikely to mark the end of this process. It represents another stage in an evolving campaign that may yet produce further surprises, including the apprehension of individuals accused of even more serious crimes.
The challenges facing Syria’s security institutions remain considerable, and the road toward lasting stability and justice is still long. Even so, the initial steps suggest a more coordinated and determined approach, offering grounds for cautious optimism about the country’s prospects for a more secure and accountable future.
This article was translated and edited by The Syrian Observer. The Syrian Observer has not verified the content of this story. Responsibility for the information and views set out in this article lies entirely with the author.
The post The Long Hunt for Ali Kayali: How Syrian Intelligence Closed In first appeared on The Syrian Observer.