Beyond Borders: The expanding threat of Islamic State Khorasan Province

The recent Islamic State (IS) attack in Moscow Oblast on 22 March has refocused global attention on the persistent threat posed by the transnational militant group. The attack – in which at least 145 people were killed – was claimed by Islamic State - Khorasan Province (ISKP), a branch of IS active within Afghanistan and parts of Pakistan. This is not the first time the group has staged attacks across borders; the organisation also claimed responsibility for the January bombings in Kerman, Iran that killed 96 people. These high-impact attacks are part of a broader pattern of ISKP activities beyond their primary area of operation over the last two years, which has included cross-border rocket attacks on Uzbekistan and Tajikistan; thwarted plots across Austria, Germany, Maldives, India, Qatar, and Turkey; and extensive recruitment and fundraising campaigns in countries further afield.

While these expansive operations might come as a surprise to casual observers, a Pentagon assessment leaked in April 2023 had already indicated that ISKP has been developing a cost-effective model for international attacks. This strategy leverages resources from outside Afghanistan, operatives in target countries, and extensive facilitation networks. The involvement of Tajik individuals in the Moscow and Kerman attacks and several thwarted plots in Europe, for example, demonstrate ISKP’s strategy of creating and leveraging connections among diaspora communities from former Soviet Union countries. ISKP’s transnational links, coupled with the Taliban’s less effective counter-terrorism efforts and weak state-level cooperation against ISKP, have all contributed to the group’s rise to international prominence.

How did we get here?

Following the withdrawal of international military forces from Afghanistan, the Taliban has emerged as the only force responsible for countering the ISKP threat within the country. Since returning to power in August 2021, the Taliban has adopted a heavy-handed approach towards ISKP, carrying out numerous security operations. These endeavours have notably limited the frequency of ISKP attacks within Afghanistan throughout 2022-23. However, despite this domestic decline, attacks and plots linked to ISKP outside of Afghanistan have escalated over the same period. While the Taliban’s tactic of targeting ISKP leadership and personnel has yielded some value, the approach has failed to comprehensively address the group’s extensive transnational networks. Ultimately, the Taliban does not enjoy international counter-terrorism support or intelligence sharing available to other governments and can do little to combat the group outside the country. Furthermore, there is some uncertainty over whether ISKP’s capabilities in Afghanistan have genuinely declined, or whether the group is simply pausing attacks amid counter-terrorism pressure – a tactic that has been used by IS branches in the past.

In fact, Western countries’ intelligence and military footprints in Afghanistan have receded significantly since August 2021, granting ISKP considerable breathing room. It appears unlikely that there will be any substantive changes to US counter-terrorism strategies in Afghanistan in the near term. Although heightened ISKP activities might occasionally trigger targeted US drone operations against the group’s leaders or key figures – as evidenced by the strike that killed Al Qaeda leader Ayman Al Zawahiri in Kabul in July 2022 – the prospect of deploying ground forces remains implausible as long as the Taliban remains in power. While countries that have friendly ties to the Taliban, such as Russia, Iran and Turkey, will likely continue to exert pressure on the regime to intensify its efforts against ISKP, significant counter-terrorism support from these countries does not appear to be forthcoming.

These factors leave ISKP with considerable operational freedom to continue to use Afghanistan as a safe haven for orchestrating international attacks.

Taking the lead

ISKP’s ability to target Russia and Iran and several foiled plots in Europe over the past year have alarmed Western policymakers, leading officials in countries like Germany and Belgium to identify the group as their primary terror threat. This concern persits despite a notable decrease in IS-related attacks in Western countries over the past six years, following the dismantlement of the IS caliphate in Iraq and Syria. Since then, IS branches have largely prioritised local operations, steering clear of attacks in the West, due to reduced capabilities and a desire to evade the robust security responses that could thwart their recovery efforts. Now, ISKP has taken the lead in expanding the group’s reach and returning to international attacks akin to those executed by IS proper at the height of the caliphate.

Although ISKP may struggle to orchestrate direct attacks in the West as effectively as IS core did between 2014 and 2017, its wealth of transnational networks remain a concern. ISKP is also committed to radicalising and inspiring individuals via online propaganda. Such efforts pose an elevated threat of lone actor attacks, which are often harder to predict and prevent due to the secrecy surrounding such plots.

Broadening threats

As ISKP continues to expand its operational reach, its potential targets around the world could diversify, posing unique security challenges. Key areas of concern include major public gatherings, critical infrastructure, and symbolic landmarks which could be targeted to maximise visibility and impact. Through such bold attacks, ISKP aims to outshine other militant groups, attract members from its rivals, and generate more funding and resources from its potential backers. This evolving threat landscape necessitates a vigilant and adaptive security posture towards ISKP from policymakers from Kabul to Washington, DC to the Kremlin.