Islamic State-Khorasan: global jihad’s new front

The attack on the Crocus City Hall in Krasnogorsk on 22 March which claimed the lives of 139 individuals was another spectacular terrorist attack carried out by Islamic State-Khorasan (ISIS-K) in recent months.^[1] The previous attacks happened in Iran, Turkey and other countries, while those planned in Germany, Sweden and other locations were thwarted. These developments indicate that the organisation has modified its strategy, which until recently had focused on Afghanistan. They also suggest that ISIS-K has major potential for generating threats. A unique feature of the present situation is the rapid increase in the participation of citizens of post-Soviet Central Asian states (mainly Tajikistan). However this mainly results from circumstances within Russia itself, which foster radicalisation. The risk of new attacks prepared or inspired by ISIS-K should be viewed as high.

A historical perspective

Islamic State-Khorasan is a radical Islamic terrorist organisation which was formally established in January 2015 as one of the regional branches of Islamic State which operated in Syria and Iraq. Initially, it focused on organising transfers of fighters to Syria, who would subsequently form autonomous structures in Afghanistan. ISIS-K was founded on individuals and rebellious groups of Pakistani and Afghan radicals (including the Taliban). From the beginning of its operation, foreigners who fought in Afghanistan (such as Uzbeks from the Islamic Movement of Uzbekistan and the Islamic Jihad Union, Uyghurs, as well as volunteers from South Asia) and representatives of non-Pashtun Afghan ethnic groups (including Tajiks, Uzbeks and Balochis) have formed strong constituent groups of the organisation’s membership. Like other Islamic terrorist organisations of this type (for example al-Qaeda), ISIS-K operated a dynamic ecosystem of smaller autonomous groups and branches of other extremist organisations, and fought to take permanent control of them.

As regards ideology, ISIS-K strictly followed the line set by Islamic State’s HQ in Syria. It supports the creation and expansion of a global caliphate which should be governed according to radical (Salafi) rules and should engage in global jihad against the enemies of ‘pure Islam’. This group effectively encompasses all states, especially those of the Western world, primarily the US. The main targets of ISIS-K were usually the Afghan leadership and the coalition forces in Afghanistan, as well as institutions funded by them, such as schools for girls. Ideological adversaries, especially Shia Muslims, have also been frequent targets of the organisation’s attacks. The relations between ISIS-K and the groups linked with al-Qaeda (IS emerged following a rift in al-Qaeda’s structures) as well as the Taliban were tense from the start, and subsequently became extremely hostile. As for the Taliban, the source of the conflicts included both their rivalry for influence in Afghanistan and strategic issues. The Taliban were (and continue to be) interested in establishing an internationally recognised state; they have been involved in political dialogue with the United States and other countries.

For a major part of its existence, ISIS-K concentrated on the Afghan and Pakistani theatres of operations. In Afghanistan, the eastern and north-eastern parts of the country were its main strongholds. Over time, this area expanded to include the northern provinces, inhabited mainly by Tajiks and Uzbeks, and those bordering on post-Soviet Central Asia. These regions provided land, a recruitment base and income. Aside from subsidies received from the Syrian HQ and funding provided by foreign sponsors and earned from criminal activity, the basic methods for financing the organisation included collecting ‘taxes’ from the local population and seizing control of mines and roads. In its peak year of 2018, the number of ISIS-K members was estimated at several thousand fighters and their families. The organisation’s main form of activity continued to involve attacks on Afghan and coalition forces (such as the spectacular attack on Kabul airport in August 2021) and bombings (frequently carried out by suicide bombers) targeting schools, Shia mosques and other facilities in Afghanistan and Pakistan. Whereas ISIS-K was the most active radical and brutal organisation operating in Afghanistan, its activity outside Afghanistan and Pakistan, including in Central Asia, Russia (among migrants), Western Europe and Turkey, was not publicised. This mainly involved recruiting members and raising funds on a relatively small scale, and on maintaining communication channels with Syria (via Turkey).

Following the collapse of the Western-backed government of the Islamic Republic of Afghanistan in 2021, ISIS-K continued its actions against Shia Hazaras, schools etc.^[2], attacked international targets (such as the attacks on a Russian consulate in Kabul, the Pakistani chargé d’affaires, and a hotel in which Chinese businessmen were staying) and in 2022 carried out several rocket attacks on Uzbekistan and Tajikistan. Most importantly, however, it continued to wage war against the Taliban, which significantly reduced its potential for other activities. According to estimates, at present the organisation probably numbers several hundred fighters (this group may comprise around 4000 individuals in total including the fighters’ family members). Its influence in the eastern part of the country has dwindled significantly, although its position in northern regions remains unchanged; it has also attempted to consolidate its position in urban areas. There has been an increase in the upward trend of Tajiks, Uzbeks and foreigners participating in the organisation. However, its emir is Sanaullah Ghafari, an Afghan national of Indian origin, and its commanders are Afghan and Pakistani Pashtuns. The scale of coordination with the Syrian IS HQ is difficult to assess, although it does exist and is important. However, there is no doubt that it has decreased significantly since IS’s defeat in Syria around 2019.

Islamic State-Khorasan: a new incarnation

The main reason for ISIS-K revising the operational logic it has applied thus far probably involves the significant decline in the organisation’s potential following the Taliban’s return to power in Afghanistan in 2021. The destabilisation of the situation in the Middle East following the outbreak of the conflict in the Gaza Strip (October 2023) seems to have provided an additional impetus for this shift. The former development has forced ISIS-K to seek support and build up its own position outside Afghanistan. The latter has created the prospect for mobilising Islamic radicals, their followers and sponsors.^[3] As a consequence, a revival of IS abroad (in the form of terrorist attacks) has been recorded, and this may improve its standing and attract the attention of donors and volunteers.

In recent months alone, according to its own declarations and the official line of its leadership, ISIS-K has carried out several large-scale attacks: in the city of Kerman in Iran during the celebrations of the anniversary of the death of Qasem Soleimani (3 January, 94 people killed)^[4] and an attack on a Catholic church in Istanbul (28 January, one person killed)^[5]. It also claimed responsibility for the attack on the Crocus City Hall in Krasnogorsk (22 March, at least 139 people killed)^[6]. Each of these attacks reflects the organisation’s ideological priorities: Iran is a Shia state; all of the countries attacked have been involved in fighting IS in Syria or Afghanistan and on their own territory; and all of them are considered pagans or heretical enemies of the caliphate.

The number of arrests of individuals suspected of having links with ISIS-K can be viewed as an indirect indicator of this organisation’s activity. Such arrests have been made, for example, in Iran (several instances in summer 2023), Germany (July/August 2023; later in December 2023, in connection with a planned attack in Cologne; and in March 2024, for a planned attack on the Swedish parliament), Russia (including the elimination of two Kazakh nationals accused of preparing attacks on a Moscow synagogue on the eve of the 22 March attack), and especially in Turkey (692 individuals suspected of having links with IS and ISIS-K have been arrested since June 2023,^[7] including 40 individuals following the attack in Krasnogorsk).

Doubts surrounding Islamic State-Khorasan

The attacks carried out by ISIS-K have sparked certain doubts as to whether the organisation was really responsible for them. According to the official narratives of Iran and Russia, the organisation’s activities may have been inspired by the US and Israel (the attack in Kerman) as well as the US and Ukraine (the attack in Krasnogorsk). In another scenario, it is Russia’s law enforcement agencies who should be held accountable for the latter attack; this is allegedly a manifestation of growing rivalry within the country’s elite. As regards the latest attack in Russia, the following aspects raise serious doubts: the ease with which it was carried out, the professionalism of the perpetrators during the attack, which contrasted with their striking awkwardness during their escape, the vague circumstances of their capture, the evidence compiled to prove the participation in the attack of individuals presented as terrorists, and the credibility of the testimony they gave as a result of their torture (which was filmed). Some of the alternative theories regarding the attacks are extremely political and bear the hallmarks of propaganda, while others are based on speculation which is difficult or impossible to prove definitively. None of these theories contains any arguments which clearly challenge the involvement of ISIS-K in the attacks in Kerman, Istanbul, and most importantly, Krasnogorsk, even if their involvement was minor. However, the details of these events remain unknown. The possibility that external actors’ secret services managed or channelled the organisation’s activity or supported it remains real. However, it is not easy to deny the increase in ISIS-K’s ambition and agency, or its political and reputational ‘success’ among radical Islamic groups.

The organisation’s moves in recent months suggest that it has shifted the burden of its activity to locations other than Afghanistan. This results from both its defeat in its fight with the Taliban and its intention to expand its personnel and financial base. Moreover, ISIS-K has demonstrated its ability to operate in highly diversified conditions (from Iran, through Turkey and Russia, to Western Europe) and established an effective model of reaching and engaging Central Asian migrant groups. Against the backdrop of IS’s functioning thus far, certain intriguing aspects involve the ‘lack of professionalism’ of the immediate perpetrators of the attacks (the rifles used by the Istanbul attackers reportedly jammed; both these attackers and those at Krasnogorsk were detained successfully) and the abandonment of the practice of suicide attacks (Istanbul, Krasnogorsk). This may suggest that the perpetrators were recruited in groups which did not belong to the core of these organisations, that their level of preparedness and ideological formation were lower, and that their motivation for becoming involved in the attacks may have been also financial (this issue was highlighted in the case of the Krasnogorsk attack). This probably comes within the context of ISIS-K’s personnel shortage and the group’s intention to boost its security (by means including reducing the risk linked with maintaining extensive structures and organising long-lasting training and indoctrination periods for the new recruits). This could also be significant in the context of expanding the recruitment base. It seems that each of these elements has fostered the development of ISIS-K and the consolidation of its position.

The problem of terrorists hailing from Central Asia

The present situation is exceptional due to the substantial representation of Tajiks among the ISIS-K attackers (aside from them, individual nationals of Uzbekistan, Kazakhstan, Kyrgyzstan and Turkmenistan have also been detained). The involvement of representatives of this region in radical movements is not new.^[8] On a relatively limited scale, Islamic radicalism has emerged in Central Asia in the past: for example, during the civil war in Tajikistan (1992–7); in connection with the activity of the Islamic Movement of Uzbekistan and the Islamic Jihad Union; and with other isolated terrorist attacks carried out in this part of the world (the most recent wave of which occurred in 2016). In 2011–9, between 2000 and 5000 individuals hailing from this region were involved in the activity of Islamic State^[9] and other similar organisations in Syria and Iraq. Residents of Central Asia carried out terrorist attacks in the US (2013), Turkey (2015, 2016, 2017), Sweden and Russia both (2017), and were involved in preparations for several prevented attacks in Germany. In Central Asia, radical Islam’s favourable cultural as well as socio-political background facilitated its development. This is because the movement seemed to be a remedy for those countries’ poor economic situation and the authoritarian nature of the local regimes. However, it never matured, and failed to win support from the majority of the local public. Other important elements which curbed its development included Central Asia’s strong social conservatism and the strong focus on this problem by the local regimes’ extensive security apparatuses.

The unique nature of this problem, which ISIS-K has skilfully taken advantage of, seems to involve the large-scale economic migration from this region, mainly to Russia.^[10] Paradoxically, it is there where Tajiks and other nationals are becoming radicalised. In Russia, access to radical content is less restricted, the elements of social control typical of Central Asian societies are absent, and extremism is fuelled by frustration linked to a feeling of alienation and the difficulties in adapting to the new environment. Another serious problem involves being discriminated against by the Russian authorities, law enforcement agencies and the local population. All this has intensified since Russia’s invasion of Ukraine. Migrants are being forced into miliary service in the Russian armed forces or sent to the occupied territories. Thus far, almost all the Central Asian attackers have been radicalised during their stays in Russia. A similar problem (albeit on a smaller scale) has occurred in Turkey,^[11] which is another popular destination for economic migrants (although most of these are representatives of the region’s Turkic nations). At the same time, Turkey has been exposed to an influx of extremists from Syria and Iraq, as well as from Western Europe. It seems that ISIS-K has deliberately targeted Tajik nationals and their Central Asian neighbours, as this group is alienated, frustrated and vulnerable to both a radical version of Islam and the prospect of immediate financial benefits. Alongside this, it is culturally and linguistically accessible to the organisation’s Tajik (and Uzbek) recruiters operating in Afghanistan.

Outlook

It should be assumed that the present increase in activity by ISIS-K (and IS as a whole) is both a manifestation of a deliberate adjustment of the organisation’s strategy and a reflection of the international situation (including the aggravation of the crisis in the Middle East) and certain social aspects (such as the problems faced by Central Asian migrants in Russia). The risk that the organisation may carry out further attacks should be viewed as high. This is particularly so in Russia, where – regardless of the doubts surrounding the attack in Krasnogorsk – the present circumstances are very conducive to an escalation of tensions, and could foster an expansion of ISIS-K’s operational space. Turkey is another country which is directly exposed to IS’s terrorist attacks. The elimination of ISIS-K from Afghanistan (which is theoretically possible but unlikely, and would require determination from the Taliban and informal support from external actors), alongside a complete dissolution of its foreign structures, would seem to be only a provisional solution, due to the systemic nature of the problem and the ability of organisations such as ISIS-K to transform. The activity of ISIS-K (and more broadly speaking, the increased activity of radical and terrorist groups) continues to create conditions for the secret services of various countries (in particular Russia) to manage and engage these groups for the purposes of their internal and international politics, and that significantly increases the magnitude of the challenges posed by the radicals.

The recent role played by terrorists hailing from Central Asia (in particular Tajikistan) is a factor which may potentially destabilise the situation in the post-Soviet states. What should be expected in Central Asia is increased control and repression linked to the threat posed by radicalism, as well as attempts by the Russian Federation to pressurise these countries into allowing it to increase its presence in these state’s security matters. However, a rise in the Russian public’s openly hostile attitudes towards the Central Asian economic migrants is potentially a more important challenge. This is because it may provoke tensions, inspire pogroms and ramp up the pressure which the migrants are already facing. This in turn may increase their alienation and frustration, and could further erode the authority of Russia and the Russian people in the Central Asian states.