Insurgent attacks in southern Thailand: geolocation and analysis

Author & Investigator: Sindre Langmoen

On 22 July 2026, at 18:45, a group of heavily armed men in vehicles attacked a military checkpoint in Bukeh Sami (Thai: บูเก๊ะซามี), a village in Thailand’s far southern Narathiwat Province, near the Malaysian border. Five members of Ranger Company 4509 were killed and six civilians were wounded, including a 10-year-old boy. The company forms part of Ranger Regiment Task Force 45, one of the paramilitary ranger units supporting the Thai military in the region.

The Bukeh Sami assault took place amid a cluster of violence. A police station in the same province was bombed the previous day, while a road construction foreman was shot the following day in the neighbouring province of Yala. Authorities believe the three attacks are connected and have issued several arrest warrants.

No group has claimed responsibility, nor has the government publicly attributed the attack to a specific organisation. However, it is most likely connected to the southern Thailand insurgency, which is led by the Barisan Revolusi Nasional (BRN, National Revolutionary Front), an Islamist Patani independence movement.

Following the checkpoint attack, security forces expanded martial law powers across Narathiwat Province, broadening their authority to search, detain, and use force in operations against the suspected insurgents.

The checkpoint attack

A group of six well-equipped, black-clad and masked attackers in the back of a pickup truck, followed by two men on a scooter, drove up to the checkpoint and immediately opened fire on the soldiers. The attackers reportedly used M16 and AK-type rifles and a handgun, and threw one or several pipe bombs, depending on the source.

Two CCTV videos of the attack circulated online. One (CCTV A) overlooks the junction and carries the channel label 073F – Bukeh Sami checkpoint; the other (CCTV B) is a street-level camera pointed at the checkpoint itself. Both carry burnt-in clocks, which allows the sequence to be reconstructed frame by frame.

How the attack unfolded

Reconstruction22 July 2026 · camera clocks5 frames · 2 CCTV cameras

01

CCTV A18:44:14

A black pickup carrying six masked, black-clad men in the bed passes the junction on Ra-ngae Makha Road. Two scooters ride ahead of it, both apparently carrying bystanders, and both ride clear.

Six attackers confirmed in the bed; at least one more in the cab, inferred rather than seen.

02

CCTV B18:44

At the checkpoint itself, the attackers open fire immediately as they pass the soldiers — including from inside the cab — before the vehicle comes to a halt.

Fire from the cab confirms a seventh attacker inside the vehicle.

03

CCTV A18:44:20

Six seconds after the pickup passes, a red-and-white scooter that had been following it stops at the same junction.

Nine attackers now accounted for: six in the bed, one in the cab, two on the scooter.

04

CCTV ASeconds later

Both riders dismount and open fire — one with an automatic weapon, the other with a handgun. One is wearing what appears to be a full-body hijab, likely as a disguise.

One automatic weapon and one handgun; the rifle is carried openly as the pair leave the scooter.

About 1 hr 15 min later · about 20 km south-west

05

Scene photo20:00

Police find a pickup burning on a remote stretch of Highway 5027, about 20 km from the checkpoint in a straight line. It is believed to be the vehicle used in the attack.

Sequence endsThe engagement lasted roughly 90 seconds. Five rangers of Company 4509 were killed and six civilians wounded, including a 10-year-old boy. More than 100 spent cartridge cases were recovered at the scene.Frames 01–04 are timed by the cameras’ own burnt-in clocks, which run about a minute behind the 18:45 given in official accounts; frame 05 follows the time reported by the authorities. Neither camera clock has been independently verified.

In total, nine attackers are visible across the two videos: six in the back of the truck, at least one person in the cab, and two on the scooter. Two further scooters — one red, one blue — ride in front of the pickup and away as the attack begins; their riders were likely bystanders.

After the attack, more than 100 spent cartridges were reportedly found at the scene, including M16, AK, and 11mm pistol cartridges. The attackers also stole equipment from the killed soldiers, possibly including AK-47 rifles, a pistol, bulletproof vests, ammunition, and mobile phones. Early accounts gave differing details about the number and type of equipment taken.

Geolocation

The two CCTV videos enabled a precise geolocation of the attack site: Ra-ngae Makha Road/Highway 4055, Tanyong Mat Subdistrict, Ra-ngae District, Narathiwat Province, Thailand (6.288853, 101.705872).

Images from both CCTV cameras, satellite imagery, and images taken in the aftermath of the attack all show the same identifiable white pickup truck in a parking lot at the corner of the intersection, next to an electricity pole.

The same T-shaped intersection can be seen in the satellite image, in one of the CCTV shots (CCTV A), and in the image of the aftermath. The same roof can be identified in the other CCTV shot (CCTV B), the satellite image, and the aftermath image. The same white stop-line marking on the road is visible in the satellite imagery and in CCTV A. The wide-angle lens of the CCTV A camera distorts the perspective, making the parking space seem smaller than it does in the satellite image.

At 20:00 on the day of the attack, authorities located a burning vehicle on a road approximately 20 km away in a straight line, suspected to be the vehicle used in the attack. They shared an image on social media showing the location where the vehicle was reportedly found, enabling its geolocation to a remote stretch of Highway 5027 (6.193094, 101.568564).

The related attacks

The attack is being treated as linked to two others that took place on the preceding and following days.

21 July — car bombing at Tanyong police station

On 21 July 2026, at 19:20, a car bomb exploded in front of the “old” Tanyong Provincial Police Station in Village No. 4, North Kalawoe Subdistrict, Mueang District, Narathiwat Province. The explosion caused minor injuries to officers and damaged the building. The vehicle contained two homemade, remotely detonated bombs. CCTV footage showed an individual parking the car near the station before leaving on a motorcycle driven by an accomplice.

23 July — the killing of a road construction foreman

Authorities also link the two attacks to the shooting of a construction foreman on 23 July. Narong Lamphungnit, 48, was supervising a road expansion project in Ban Da Lae Pae, Moo 6, Khuean Bang Lang Subdistrict, Yala Province. At around 11:45, two men on a motorcycle arrived and opened fire, killing him at the scene. Investigators later recovered 5.56mm and AK-47 cartridge cases. Government-linked construction projects and workers have been recurrent targets over the course of the insurgency, and infrastructure projects have consequently long required military protection.

The location can be identified to a high, though not exact, degree of precision. One of the published images shows an electricity pole numbered 115.

Using Google Street View, poles 104, 105 and 107 can be found on the same road before Street View coverage ends. The poles stand between 20 and 40 m apart, which allows the position of pole 115 — and therefore the general area where the shooting took place — to be approximated at around 6.156622, 101.246086.

Suspects named by the authorities

The Narathiwat Provincial Court has issued two arrest warrants for suspects allegedly involved in the checkpoint attack.

The first warrant is for a man identified as Azizan (อาซีซัน), on suspicion of involvement in the checkpoint attack. He was already the subject of an arrest warrant for his alleged involvement in a bomb attack in Narathiwat on 8 March 2025, which killed two people and injured at least 11, including three civilians. The second warrant concerns a man named Sahabuddin (ซาฮาบูดิน), after evidence reportedly linked him to the checkpoint attack.

Two other warrants were issued for two men suspected of involvement in the car bombing outside the police station in Mueang Narathiwat District. Both already had several outstanding warrants.

The first suspect was identified as Azmin, who authorities say was already subject to a warrant dated 4 September 2025 concerning an armed clash and shooting in the Su-ngai Kolok municipal area, and a second warrant dated 17 October 2025 concerning an armed robbery involving explosives at a gold shop inside a shopping centre in Su-ngai Kolok District on 5 October 2025.

The second suspect was identified as Abdul Rahum, who was subject to a previous warrant dated 8 January 2020 concerning a shooting, and a separate warrant dated 30 September 2024 concerning an improvised explosive device placed in a vehicle near the residence of the Tak Bai District chief.

Multiple other individuals were brought in for questioning but are not listed as suspects.

The southern Thailand insurgency

Approximately 92.5% of Thailand’s population practises Buddhism. Southern Thailand, on the border with Malaysia, is home to most of the country’s Muslim minority, around 5% of the population. The Malay-majority provinces of Pattani, Yala, and Narathiwat, together with the north-eastern part of Malaysia (Kelantan), formed the Sultanate of Patani from around 1400 until it was absorbed into what became modern Thailand in the 19th and early 20th centuries. Bangkok then pursued a policy of forced assimilation of the local Malay Muslim population.

The 1950s saw a growing Patani rights movement advocating autonomy in the face of forced Thaification. A multitude of groups with sometimes conflicting ideologies were founded, most notably the Barisan Revolusi Nasional (BRN) in 1960. The second half of the 20th century saw some low-level insurgent activity before violence escalated at the beginning of the 21st century, when the BRN became the most prominent insurgent group in the country, coordinating with other aligned groups. The insurgency took on an increasingly Islamist character, displacing the nationalism it had previously espoused.

Citing security sources, some media claimed that the checkpoint attack was “carried out by a militant group led by Mr. Maseafi Timo and Mr. Abdullo Masa, operational leaders active in four districts (Ra-ngae, Janae, Si Sakhon, and Rueso).” A specific group such as the BRN has not yet been named. The same media quoted security sources claiming that the attackers purposefully target sites with known CCTV coverage so that their attacks are publicised.

They also claimed that the timing of the attack had historical significance, as it took place shortly before 1 August, a significant date for the insurgency marking the anniversary of a 1993 arson attack on 36 schools in Yala, Pattani, Narathiwat, and Songkhla provinces. The tactic recurred in later years and marked the start of armed resistance against Thai institutions.

Later, on Saturday 22 August, a coordinated wave of attacks saw 51 incidents in a single night across the provinces of Narathiwat, Pattani and Yala. The attacks primarily involved small bombs, arson and property damage, and injured three civilians.

Peace talks with the BRN began in Kuala Lumpur, Malaysia, in 2020 and have been ongoing since. Talks were set to resume in June of this year; in July, the BRN released a statement blaming the continuing violence on the slow progress in negotiations, and talks due in September have been cancelled following the recent attacks. According to Deep South Watch, a monitoring organisation, the conflict in southern Thailand has caused 7,837 dead and 14,929 injured since 2004.

AI-generated distortion of the evidence

Following the publication of CCTV footage showing the attack, AI-“enhanced” imagery of the attackers circulated online, complicating the information environment and fuelling conspiracy theories. The AI-“enhanced” imagery emphasised the professional quality of the attackers’ equipment and depicted tattoos on the arms of one of them. This was highlighted as evidence against Islamist perpetrators, given the religious prohibitions against tattooing observed by many devout Muslims. The tattoos are an AI hallucination, a common consequence of AI “enhancement” of low-quality imagery, which creates plausible-looking visual information that was never present in the source material.

An army spokesperson addressed the situation and requested the public’s cooperation in using discretion when disseminating information, rather than spreading accusations.