World / Europe — The Israeli embassy Belgrade attack ended in seconds, with a teenage knife attacker dead outside a guard’s booth and a wounded Serbian officer standing over him, but its consequences will run for days: Serbia is now on a red terror alert, its highest level, in the middle of a change of government, and Israel is waking up from a deadlocked election to find one of its missions attacked for the second time in two years in the same European capital.
BELGRADE — The Israeli embassy Belgrade attack began just after midnight on Wednesday, October 28, 2026, and it was over almost as soon as it started. A single attacker armed with two knives charged a Serbian Gendarmerie officer guarding the Israeli Embassy in Belgrade, wounded him in the face, and was shot dead by the officer where he stood, Reuters and the Associated Press reported, citing Serbian officials and prosecutors. Serbia’s outgoing interior minister, Ivica Dacic, said police are treating the incident as a terrorist attack and raised the country’s security threat level to red — the highest level — ordering an increased police presence at key locations across the country. No embassy personnel were injured; the mission was closed at the time, Israel’s Foreign Ministry confirmed.
Track it live: Live war and conflict tracker
What makes this more than a grim overnight police story is everything around it. The attacker, according to Dacic, was a minor whose identity has not been established. The officer who killed him did so, the minister said, in self-defence, from inside a guard’s booth that the attacker had forced his way into. And the attack landed at the most politically exposed moment Serbia and Israel could jointly have produced: Serbia is being run by a caretaker administration days after the camp of its longtime leader lost an election it called itself, and Israelis went to bed after an election that produced no winner at all. A knife, a booth, a wounded guard — and two governments in transition now have to answer for the security of an embassy that has been attacked before.
What happened outside the embassy
The fullest official account comes from the Belgrade Higher Public Prosecutor’s office, reported by the Associated Press. A person dressed in black opened the door of the guard’s booth outside the embassy, charged at the officer inside with the knives, and threw one of them, striking the officer in the left cheek. The officer — identified by prosecutors only by the initials D.S. — fired several shots and killed the attacker on the spot. Dacic’s own emailed statement described the same sequence in the language of a ministry that had clearly been drafting it through the night: “One minor, of so far undetermined identity, who is reasonably suspected to be from Šabac, rushed at an officer of the Gendarmerie shouting ‘Allahu Akbar’ and attacked him with two knives.” Šabac is a town in western Serbia, roughly an hour’s drive from the capital.
The officer’s injuries were described by Dacic as a light wound to the face and head — serious enough to draw blood and to be photographed in the aftermath, minor enough that he remained the only person in this story who walked away from the booth. Dacic characterised the shooting as self-defence, and on the facts as prosecutors themselves have laid them out — an intruder forcing a booth door at night, a knife thrown into an officer’s face at close range, a second knife in hand — it is difficult to construct the alternative. The guard was alone, the attack was at point-blank range, and the interval between the door opening and the shots cannot have been more than a few seconds.
Police photographs from the scene, as reported by AP, showed the guard’s booth and the surrounding area sealed off with police tape, with officers in full gear nearby. Signal Post News does not publish wire-service photographs and has not independently photographed the scene; readers should treat descriptions of the cordon as what they are — the agencies’ reporting of the official response, not imagery this newsroom has verified frame by frame. What the photographs establish, if the reporting is accurate, is the scale of the response: not a patrol car and a notebook, but a full counter-terrorism perimeter around a diplomatic mission in the small hours of the morning.
The Gendarmerie — the Žandarmerija — is not a private security contractor or a municipal patrol. It is Serbia’s national gendarmerie, operating under the Police Directorate, and one of its stated missions is providing security to security-sensitive foreign embassies in Serbia, Israel’s among them. That matters for how this attack should be read. The attacker did not find a soft perimeter or an unguarded gate; he attacked the specific force Serbia assigns to exactly this threat, in the hardened position — a booth — built for exactly this moment, and he was killed by it. The system, at the point of contact, worked. Everything upstream of that booth — who the attacker was, what the agencies watching him knew, and whether anyone should have moved sooner — is where the hard questions now sit.
Serbia raises its terror alert to red
Dacic’s response went well beyond the embassy fence. Serbia’s security threat level was raised to red — the top of the scale — with an increased police presence ordered at key locations. In practice, a red alert of this kind means more armed officers visible at the places a follow-on attacker might choose: other diplomatic missions, government buildings, transport hubs, crowded public spaces. It means tighter checks, more patrols, and a public instructed, by the sheer visibility of the state, to understand that the government believes the threat environment has changed. For a capital that has spent two years filling its streets with protest marches, the sight of a heavier armed presence will not be neutral scenery.
It is worth being precise about what a red alert is and is not. An alert level is a precaution and a posture; it is not evidence. It does not mean police have identified a second attacker, a cell, or a specific further plot, and nothing in Dacic’s statement claimed any of those things. Governments raise alert levels after an attack for three reasons that are all rational at once: to deter a copycat in the window when copycats are most likely, to reassure a public that has just watched a diplomatic mission attacked in its own capital, and to signal to allies — in this case Israel, whose diplomats Serbia is treaty-bound and professionally obliged to protect — that the failure, if there was one, is being treated at the highest level of seriousness. The alert tells you how the state wants to be seen responding. It does not, by itself, tell you anything new about the threat.
There is also a harder-edged reading, and a column should not flinch from it. The minister who raised the alert is a caretaker. Dacic serves in an outgoing administration that lost Sunday’s election and holds office only until a new government is formed — a handover this site covered as the student-led movement defeated the camp of longtime leader Aleksandar Vučić, in our report on Serbia’s election result. A red alert is, among other things, a demonstration that the caretaker state still commands the security apparatus, still takes decisions, and still owns the consequences. That does not make the alert wrong; after an embassy attack, most interior ministers in Europe would have done the same. It does mean the alert will be read politically as well as operationally, because in Belgrade this week, everything is.
What officials say about the attacker
Almost everything reported so far about the attacker comes from one source: Dacic himself. That is normal in the first hours of an investigation, and it is exactly why attribution matters more in this story than in most. According to Dacic, Serbia’s security agencies had been monitoring the attacker before Wednesday night. Dacic described him as a supporter of the Islamic State group, saying the attacker kept the black flag of the Islamic State on his Instagram account. Those are the minister’s claims, stated here as his claims. They are not findings of a court, not the conclusions of a published investigation, and not — at the time of publication — backed by any claim of responsibility from the Islamic State group or anyone else.
What is established is narrower and should be kept separate. The attacker was, by the minister’s and prosecutors’ accounts, a minor. His identity has not been established, and he is not named in this article, because there is no verified name to publish. He is reasonably suspected — again, the official formulation — to have come from Šabac. He acted alone at the scene, with two knives. He shouted a religious phrase as he charged, according to the minister’s statement. Beyond that, the honest inventory is a list of unknowns: no confirmed identity, no published evidence of contact with any organisation, no claim of responsibility, and no evidence made public so far of a wider network, a handler, or a second participant. A flag on a social-media account, if that is what investigators found, is evidence of sympathy as officials describe it; it is not, without much more, evidence of direction, membership, or a plot run by anyone other than the boy who died outside the booth.
The monitoring claim will, rightly, attract the sharpest scrutiny in the days ahead. If the agencies were watching him, the obvious questions follow: watching him how closely, on the basis of what, and with what threshold for intervention? Those questions are not accusations; they are the standard anatomy of every lone-actor attack in Europe over the past decade, in which the attacker so often turns out to have been visible to someone — a platform, a school, a local officer, an intelligence file — without any single pair of eyes holding the whole picture. Serbia’s incoming government, which did not appoint the officials now answering these questions, will inherit both the file and the argument about it.
Israel’s response, by contrast, was short and closed. The Foreign Ministry in Jerusalem confirmed what it called an “attempted terrorist attack,” said the attacker was neutralised by local police, and confirmed that no embassy personnel were injured and that the mission was closed at the time. That last detail — the late hour — is part of why the casualty list is one attacker dead and one guard wounded rather than something far worse: whoever planned to strike the embassy, in whatever sense a lone teenager plans, struck its armour rather than its people.
The second attack in two years
This is the second attack at Belgrade’s Israeli embassy in just over two years, and the precedent is uncomfortably specific. On June 29, 2024, an assailant shot a Serbian police officer guarding the same embassy in the neck with a crossbow. The officer, Miloš Jevremović, was seriously wounded — and still managed to shoot and kill his attacker. Dacic, interior minister then as now, said at the time that it was an individual act by a man ideologically linked to the Wahhabi movement, in a Serbian government statement that framed the attack, as Wednesday’s statement does, as the work of one man rather than an organisation.
Two attacks, two years apart, on the same mission, in the same city, both ending with a wounded Serbian guard and a dead lone assailant: the pattern is the story. After 2024, embassy security in Belgrade was reviewed and the Gendarmerie’s role in guarding sensitive missions was reaffirmed — the booth, the armed officer, the perimeter that Wednesday’s attacker ran into were all, in part, the product of that first attack. And the second attack tested the post-2024 arrangements and found them adequate at the fence and wanting, if the monitoring account is accurate, somewhere before it. A security posture can win the fight at the booth and still lose the argument about prevention. Belgrade has now had that argument twice.
Why this matters
Start with the calendar, because the calendar is extraordinary. Serbia voted on Sunday. The student-led movement that filled Belgrade’s streets for almost two years defeated the camp of Aleksandar Vučić, and the state is now in the in-between: an outgoing administration holding the police, the ministries and the alert levels, while a government that does not yet exist prepares to inherit them. Israel voted on Tuesday. As this site reported, exit polls left Benjamin Netanyahu’s bloc and Gadi Eisenkot’s bloc deadlocked, with neither anywhere near the 61 seats needed to govern — see our report on Israel’s election exit polls. Into that double vacuum — two countries, two unfinished transitions, one shared embassy fence — a teenager with two knives walked at midnight. Attacks do not need to be centrally directed to be politically consequential; they need only to land where institutions are already under strain.
Israeli missions abroad are recurring targets for a structural reason: they are the most accessible physical embodiment of the Israeli state in foreign capitals, guarded not by Israel but by host-state forces whose performance becomes, instantly, a measure of the host government’s reliability. That is why a wounded Serbian gendarme is also a diplomatic fact. Belgrade’s obligation to protect the mission is the easy part to state and the hard part to guarantee, and every attack reopens the question in Jerusalem of which capitals can be trusted with Israeli lives. Serbia, which has cultivated ties with Israel while balancing its older alignments, now has to answer that question for the second time in two years — this time with a caretaker minister signing the answers and an incoming government watching.
The analytical distinction that matters most, and that the red alert tends to blur, is between a lone-actor attack and an organised plot. A knife attack by a single minor requires no logistics, no money trail, no communications to intercept — which is precisely why such attacks are so hard to stop upstream and why the claim that the attacker was being monitored will dominate the inquest. An organised plot would imply the opposite failure and the opposite response. Nothing published so far supports the organised reading: one attacker, edged weapons, no claim of responsibility. Treating a lone actor as proof of a network would be an analytical error; treating the absence of a network as proof there is nothing more to learn would be a worse one. The investigation, not the alert level, is where that question gets answered.
Finally, the alert itself deserves to be understood as communication. To the Serbian public, red says: the state is awake. To Jerusalem, it says: your mission’s protection is now a whole-of-government priority, visibly. To any would-be imitator in the copycat window, it says: the next booth will not find this country unready. All three messages can be true and worth sending even if — especially if — the underlying threat has not measurably changed since Tuesday. States do not only manage danger; they manage the meaning of danger. Wednesday’s attack will be managed on both tracks for as long as the alert lasts.
What is confirmed — and what is only claimed
Because this story arrived fast and politically charged, the verification ledger is worth stating plainly. Confirmed by two independent wire services, Reuters and AP, and by Serbian prosecutors: one attacker, two knives, just after midnight on Wednesday; the officer wounded in the face; the attacker shot dead at the scene; the terror alert raised to red; the Israeli mission closed and its staff unharmed. Attributed official claims, reported as claims throughout this article: that the attacker was a monitored Islamic State supporter who displayed the group’s flag on Instagram; that he was from Šabac; that the shooting was self-defence in the legal sense. Not established at publication: the attacker’s identity, any organisational direction or membership, and any claim of responsibility. One early report claiming two attackers circulated in the first confusion; it is wrong — one attacker, two knives — on the consistent account of Reuters, AP and the Belgrade prosecutor’s office, and this article disregards it.
What happens next
The first task is a name. Prosecutors and police must formally identify a dead minor who arrived, on the official account, from Šabac with no established identity — and identification will unlock everything else: his school, his accounts, his contacts, and the factual basis on which the monitoring claim will stand or fall. The Belgrade Higher Public Prosecutor’s investigation will work the scene, the booth, the officer’s account and the agencies’ files in parallel, and its early statements have set a factual spine — the opened door, the thrown knife, the shots — that later reporting should be measured against.
The second question is duration. Red alerts are expensive in money, manpower and public patience, and caretaker governments are rarely eager to be the ones to lower them; expect the highest level to hold at least until the identification and the first prosecutorial findings are public, and watch for whether the incoming Serbian government, once formed, treats the alert as its inheritance or its predecessor’s theatre. The third watch is the embassy itself: a second security review in two years, conducted now by two governments at once, with Jerusalem entitled to ask what changes this time that did not change after the crossbow.
And behind all of it, the formation talks in Belgrade continue. A movement that won an election promising to rebuild Serbia’s institutions now meets its first security crisis before it has even taken office — as an audience. How the caretaker administration handles the investigation, and how the incoming one handles the caretaker’s handling of it, will be the first real test of a transition that, until a boy opened a booth door at midnight, had been remarkable mainly for its calm. Serbia raised its alert to red on Wednesday. What it does when the alert comes down will say more.
Sources
- Reuters, October 28, 2026: “Policeman kills knife attacker outside Israel’s embassy in Serbia” — the attack just after midnight, the officer’s account, the red alert and Dacic’s emailed statement. reuters.com
- Associated Press via Reflector, October 28, 2026: “Serbian police say assailant killed after attacking a guard outside the Israeli embassy in Belgrade” — the Belgrade Higher Public Prosecutor’s account of the booth, the thrown knife and the officer identified as D.S., and the scene photographs as reported. reflector.com
- Government of Serbia, 2024: “Terrorist attack in front of Embassy of Israel in Belgrade a one-man act” — background on the June 29, 2024 crossbow attack, the wounding of officer Miloš Jevremović and Dacic’s statement at the time. srbija.gov.rs