The threat of ISIS, also known as Islamic State, might have seemed to be waning as headlines turned to Ukraine, Gaza and the next US election. But last week’s attack on a Moscow concert hall reminded the world of the enduring danger of Islamist terrorism and the ambitions of what is known as IS Khorasan (ISIS-K) far beyond its camps in the mountains of Afghanistan.
Analysts believe the group has a growing focus on Europe – and point to events such as this year’s Paris Olympics as potential targets.
ISIS claimed responsibility for the Moscow attack. The fact that Tajik nationals were allegedly involved indicates ISIS-K was responsible; the group draws many members from central Asia and has a record of previous plots in Russia. US officials have also said there is evidence ISIS-K carried out the attack.
ISIS-K was created nine years ago as an autonomous ‘province’ of the Islamic State, and despite many enemies has survived and proved itself capable of launching attacks in Pakistan, Iran and central Asia. Before the Crocus City attack, it had planned others in Europe and Russia. The commander of US Central Command, Gen. Erik Kurilla, assessed recently that ISIS-K “retains the capability and the will to attack US and Western interests abroad in as little as six months with little to no warning.”
UN experts and others – including the Russian security services – estimate the strength of ISIS-K at between 4,000 and 6,000 fighters. Sanaullah Ghafari became the group’s leader in 2020 and, despite occasional reports of his demise, terrorism analysts believe he remains an effective leader.
Both the Taliban and the United States have sought – though not in concert – to expunge ISIS-K from its safe havens in eastern Afghanistan. But a recent analysis in Sentinel, the journal of the Combating Terrorism Center at West Point, said it “remains a resilient organization, capable of adapting to changing dynamics and evolving to survive difficult circumstances.”
Endurance and expansion
ISIS-K’s most infamous attack until now was the suicide bombing at Kabul airport in 2021 that killed nearly 200 people, including 13 US soldiers guarding the airport.
It has continued a campaign of suicide bombings and assassinations against the Taliban, which it regards as insufficiently radical and beholden to outside powers. Just last week, an ISIS-K suicide bomber detonated his explosive belt among Taliban militia in the Afghan city of Kandahar, inflicting dozens of casualties, according to local accounts.
But ISIS-K has also expanded its orbit. Amira Jadoon, who has written a book about the group, said that over the last three years ISIS-K “has grown more ambitious and aggressive in its efforts to gain notoriety and relevance across South and Central Asia, launching its most aggressive multilingual propaganda campaign and expanding the types of attacks it conducts.”
Last year the group executed a devastating bombing against an election rally in Baujur, Pakistan, in which more than 60 people were killed. It has also established a foothold in the restive Pakistani province of Baluchistan bordering Iran.
In January, ISIS claimed responsibility for twin suicide bombings in the Iranian city of Kerman, killing 90 people and injured more than 200. Jadoon, an associate professor at Clemson University, said that given its “proximity to the attacks, its highly sectarian attack strategy, and its diverse membership base, it is highly likely that ISK [as the group is also called] played a role in the Kerman attack.”
The threat to Europe
ISIS-K has ambitions far beyond south Asia, aiming to target Russia, western Europe and even the United States. European security agencies are paying heightened attention to the threat, even if ISIS-K’s capabilities are yet to match its ambitions.
Hans-Jakob Schindler, senior director of the Counter Extremism Project, notes that in July last year seven men were arrested in Germany suspected of planning high-profile attacks and being in contact with ISIS-K planners. All the suspects were from central Asia.
This month, two Afghan citizens were detained in Germany, accused of making “concrete preparations” to attack Sweden’s parliament in retaliation for a spate of Koran burnings in the country. One had joined ISIS-K last year, prosecutors asserted, and their plans were made “in close consultation with” ISIS-K operatives.
Christine Abizaid, director of the US National Counterterrorism Center, told Congress last autumn that so far “ISIS-Khorasan has relied primarily on inexperienced operatives in Europe to try to advance attacks in its name.”
Fitton-Brown – former coordinator of UN sanctions and threat assessment regarding ISIS, al Qaeda and the Taliban – agreed that so far the threat in Europe has been “naïve and embryonic” but warned that ISIS-K “has plugged into the central Asian diaspora, primarily in Russia and Turkey and to some extent in Germany.”
He regards the Moscow attack as a “breakthrough success” for the group, demonstrating a level of planning not previously seen beyond south Asia. ISIS claimed that the Crocus City Hall had been intensively reconnoitered.
A leaked US Defense Department assessment last year noted that “ISIS has been developing a cost-effective model for external operations that relies on resources from outside Afghanistan, operatives in target countries, and extensive facilitation networks.”
Following the Moscow attack, France – which hosts the Olympics this year – raised the terrorist threat level to the maximum. Prime Minister Gabriel Attal said thousands more soldiers were ready to boost its counter-terrorism force, adding: “The Islamist threat is real…We are constantly preparing for all scenarios.”
Jadoon said the risk of ISIS-K’s “brand resonating with individual sympathizers in Western countries cannot be overlooked.” She explained that as militants see it as “an inspirational and growing force, it may attract individuals from Western nations who are drawn to its ideology. This could lead to attempts by individuals to travel to conflict zones to join its ranks or carry out attacks in their home countries on behalf of the group.”
Hating Putin and the ‘Eastern Crusader’
Russia may be particularly vulnerable to ISIS-K. Ten years ago, then ISIS leader Abu Bakr al-Baghdadi denounced “the crusaders, their allies, and with them the rest of the nations and religions of kufr (infidel), all being led by America and Russia.”
A year later, ISIS’ franchise in Sinai claimed responsibility for the bomb that brought down a Russian charter jet flying from Sharm el-Sheikh to St. Petersburg, killing all 224 people onboard.
ISIS’ loathing of Vladimir Putin stems from the Russian role in Syria in support of the Assad regime and the brutal Chechen wars in the early years of the century. Russia’s support for authoritarian regimes in central Asia – which ISIS-K has described as Russia’s “puppets” – has deepened the animus.
ISIS-K has also derided the Taliban for “befriending Russians, the murderers of Chechen Muslims.” In 2022, an ISIS-K suicide bomber attacked the Russian embassy in Kabul, killing two employees.
Now it’s clear that the group is trying to establish itself inside Russia. Earlier this month, the Russian security service – the FSB – said it had that killed two ISIS-K operatives in the region of Kaluga who were planning an attack on a Moscow synagogue.
Fitton-Brown regards Russia as extremely vulnerable to further attacks, with its security services preoccupied by Ukraine and a vast pool of migrant workers from central Asia, at least some of whom have likely been radicalized. All those arrested since the Crocus City attack are Tajik.
Several previous ISIS-inspired or claimed attacks in Russia have involved Tajik, Uzbek or Kyrgyz nationals. In 2017 an Uzbek national carried out a suicide bombing on the St Petersburg metro, killing 15.
The attitude of the Russian government, both pre- and post- the Moscow attack, may not help it confront the threat. After the US warned in early March of the possibility of terror attacks at “large gatherings in Moscow, to include concerts,” Putin lambasted “provocative statements by a number of official Western structures…All this resembles blatant blackmail and an intention to sow fear and destabilize our society.”
Schindler at the Counter Extremism Project said that even if the FSB were aware of such plots, protective deployment of security forces at concerts would have smacked of contradicting the Kremlin – and would therefore have been unwise.
After the attack, Putin said it was carried out “by the hands of radical Islamists,” but was sponsored elsewhere, suggesting Ukraine had been involved, something strenuously denied by Kyiv and Washington. And according to the director of the FSB, Alexander Bortnikov, three countries were behind the terrorist attack: the US, UK and Ukraine.
The narrative from Moscow is that even if ISIS-K or individuals inspired by it step up their campaign in Russia, they’ll be seen as puppets of darker forces. That may distort intelligence-gathering.
For ISIS-K, the Moscow attack is a coup. Rita Katz, executive director of SITE Intelligence, said: “ISIS’ global support rests in no small part on its image as a capable organization, and this devastating massacre in Russia will only feed into that image.”