U.S. and European counterterror officials are zeroing in on Islamic State masterminds of a terror campaign against Europe that continues despite military setbacks for ISIS in the Middle East.

On Tuesday, the U.S. State Department announced that it had put a suspected plotter of last November’s attacks in Paris on a list of specially designated global terrorists. The announcement came the day after French authorities said they had arrested seven suspects and foiled a plot directed by senior ISIS figures in Syria to carry out major coordinated attacks in Paris and Marseilles during the Christmas holidays.

Separately, French and Belgian counter-terror officials said this week they have identified a second ISIS figure involved in directing operations against both countries.

The State Department sanction targeted a Moroccan-born suspect named Abdelilah Himich, who grew up in France and fought in the French Foreign Legion in Afghanistan before traveling to Syria and joining the Islamic State, according to court files and counterterror officials.

Last month, ProPublica and the PBS program Frontline reported that U.S. intelligence officials believe Himich, 27, was part of an ISIS unit in Syria that directed the terror attacks against Paris and Brussels. Composed largely of youthful European fighters, the external operations unit oversaw a campaign in which up to 200 operatives were deployed to Europe using forged documents, encrypted communications techniques and support networks supplying arms, transport and safe houses, Western intelligence officials say.

“Abdelilah Himich, also known as Abu Sulayman al-Faransi, is a senior foreign terrorist fighter and external operations figure,” the State Department said in a statement today. “Himich created the Tariq Ibn Ziyad Battalion in 2015, a European foreign terrorist fighter cell that has provided suicide operatives for ISIL attacks in Iraq, Syria, and abroad; at one time the battalion numbered as many as 300 members. Himich was also reportedly involved in the planning of ISIL’s November 2015 Paris attacks and March 2016 Brussels attacks.”

U.S. intelligence believes Himich was a “conceiver” of the Paris attacks, according to U.S. counterterror officials. But details of his activities remain unclear, especially because several ISIS fighters use the same nickname as he does. While French and U.S. intelligence agencies agree that Himich is a senior foreign fighter, they differ about his degree of involvement in the Paris and Brussels attacks. Such discrepancies are not uncommon in intelligence circles, especially when it comes to murky underworld of the Islamic State.

“It’s possible he was involved, but we don’t have evidence that he played an important role in the Paris plot,” said a senior French counterterror official who requested anonymity. “We do know he led a battalion of foreign fighters in Syria. If the Americans have specific intelligence of his role in the Paris attacks, they haven’t shared it with us.”

The U.S. government uses terrorist designations to put international pressure on top suspects, block their assets and bar U.S. persons from doing business with them.

In recent weeks, U.S.-backed Iraqi military forces have hammered the Islamic State in its bastion of Mosul and elsewhere, damaging the group’s ability to deploy fighters to Europe and direct attacks in the West.

Nonetheless, the threat persists. French authorities are on heightened alert as the Christmas holidays approach. Over the weekend, French police arrested seven suspects in Strasbourg and Marseilles who had been under surveillance for months. French Interior Minister Bernard Cazeneuve said authorities dismantled a network directed by ISIS from Syria that was about to unleash attacks.

The raids prevented “a long-planned terrorist attack on our territory,” Cazeneuve told reporters in France on Monday.

The DGSI counterterror agency arrested six suspects in Strasbourg and one in Marseilles. At least two suspects were trained by ISIS in Syria last year and were sent back to France to await further orders, according to French counterterror officials. Some of the suspects were associates of three Frenchmen who killed dozens of concert-goers at the Bataclan theater last November, officials said.

The lengthy investigation first identified a terrorist financing network in France that used fraudulent loans and other swindles to send up to $20,000 back to Syria. French intelligence then monitored a French-speaking ISIS leader in the Syrian city of Raqqah who used long-distance communications to oversee two separate terror cells trying to acquire arms for attacks, the senior counterterror official said.

When a suspected Moroccan operative who had lived in Portugal traveled to Marseilles recently to advance the plotting, French authorities decided to dismantle the network, the official said. The plotters intended to carry out coordinated holiday attacks on public places in Paris and Marseilles, officials believe.

“It was a sophisticated operation,” the senior French counterterror official said. “It was all controlled and coordinated by ISIS from Raqqa. The two cells were compartmentalized. They had no contact with each other, just with the leader in Syria. It would have been a major attack like the one in Paris last year.”

Investigations in Europe have shed light on the workings of ISIS plots against the West. In addition to Himich, French and Belgian police have identified another suspected ISIS leader – a shadowy figure in Syria who directed the Paris plotters last year using encrypted communications and the alias Abu Ahmad.

Officials said the suspect is a 32-year-old Belgian named Osama Atar, according to European and U.S. counterterror officials. (The identification of Atar as the mysterious Abu Ahmad was first reported by Le Monde newspaper of France.)

Atar has a remarkable history. In 2005, the U.S. military captured him in Iraq on suspicion of fighting for al Qaeda. He was held in the notorious Abu Ghraib prison and the U.S.-run Camp Bucca detention center, where his fellow inmates included future Iraqi leaders of the Islamic State such as Abu Bakr al Baghdadi, according to Western counterterror officials.

An Iraqi court sentenced Atar to ten years in prison. But he won early release in 2012 thanks to a campaign by Belgian politicians and human rights advocates, who claimed that he was ill with cancer and had been unfairly treated. Now critics say their efforts freed a committed fighter who quickly returned to the fray.

“It has never been confirmed that he had cancer,” said Eric Van der Sypt, a Belgian federal prosecutor, in a telephone interview. “He joined ISIS in Syria soon after he was released.”

Investigators believe Atar played a central role in training and directing the ten-man attack team who struck Paris and killed 130 people, according to Van der Sypt and other officials. He then spent four months communicating from Syria via encrypted messages with the surviving operatives who planned their next attack from hideouts in Brussels. The fugitives directed by Atar included his Belgian cousins, Ibrahim and Khalid Bakraoui, officials said.

Atar gave the fugitives bomb-making instructions and helped them plan the suicide attacks they carried out against the Brussels airport and a subway station in March, killing 32 people, according to investigators. He used the nickname Abu Ahmad during the online exchanges, investigators say.

Atar’s photo has been identified by a captured ISIS operative in French custody, according to European counterterror officials. Atar remains a fugitive. Belgian police believe that he secretly returned to Belgium a few months after the Brussels bombings. Two more of his relatives were arrested in June on charges of plotting to attack an open-air “fan zone” set up in downtown Brussels for viewing of the European soccer championships.

“We are practically sure he was in Brussels in August of this year,” Van der Sypt said. Atar’s whereabouts now are unknown, he said.

If Atar is in fact Abu Ahmad, he left a detailed trail of communications recovered from a laptop discarded by the Brussels bombers. It has been more difficult to determine the precise identities of the other masterminds, such as Himich. Investigators believe Himich’s military experience helped him rise through the ranks of the Islamic State and join the external operations group.

Despite the differing analyses of French and U.S. intelligence agencies about his role, parts of Himich’s story are well-documented in French court records obtained by ProPublica. Investigators used intercepts, credit card receipts, interrogations of accomplices and other evidence to build a picture of his journey to Syria and life in the combat zone.

French investigators first became aware of Himich in early 2014 during the surveillance of suspects in Lunel, a picturesque town near Montpellier that has been a hotbed for radicalized young people to join the jihad in Syria.

The son of Moroccan immigrants, Himich went to high school in Lunel. He joined the French Foreign Legion on November 13, 2008—seven years to the day before the Paris attacks, according to court documents. He served with that legendary fighting force in Afghanistan, earning two medals, but then deserted in 2010. He did prison time for drug trafficking in 2012, according to court documents.

In February of 2014, Himich and four others prepared to journey to the Syria by purchasing supplies: camping gear, night-vision goggles, medicine. Himich used a U.S. passport stolen in Paris to rent a luxury BMW sedan, which the group drove to Syria via Italy, Greece and Turkey, according to court documents.

By Feb. 13 of that year, Himich called his girlfriend in Lunel to tell her he was with militants doing a three-week training course, according to the documents.

“Right now, we all have to be at the same level,” Himich said, according to a transcript of a phone call intercepted by French police. “Afterward, if it’s a question of who’s going to be the chief or what, I’m going to be the chief.”

The girlfriend, a French convert to Islam, joined him that May in Syria, where they married and had children. Himich soon became the emir, or leader, of a 50-man fighting unit. He was wounded by an exploding mortar during a battle in which “fire rained from the sky,” according to intercepted conversations among other militants quoted in the documents.

Himich oversaw the crucifixion of two traitors by the Islamic State and enlisted a pilot to give flying lessons to his trainees, the documents say. Intercepted conversations describe combat, the births of children to militant families, and the deaths of French jihadis, often with photos of the corpses sent to families in France.

The court documents do not make explicit reference to Himich’s role in plots against Europe. But a phone conversation intercepted in May, 2015, suggests that Himich may have lived in the same house in Syria as Fouad Aggad, one of the Paris attackers.

The transcript recounts a phone call between Aggad’s mother and his brother, who was incarcerated in a French prison. The two discuss what they’ve heard from Fouad Aggad about his life in the Islamic State.

Six months after the conversation, Aggad died in a gun battle with police during the massacre at the Bataclan nightclub in Paris.

Himich, meanwhile, had disciplinary troubles with the Islamic State this spring, according to French officials. French intelligence has learned that ISIS removed him from his command post in April and temporarily jailed him for some type of misconduct, according to the French counterterror official.

But French and U.S. intelligence officials still consider him alive and dangerous.