Ashley Jackson is co-director of the Centre on Armed Groups. She and her team have spent the past year interviewing more than 100 ISIS-K fighters and commanders in Afghanistan and Pakistan. Her decade-long on-the-ground work looks into militant groups in the region.
The Islamic State in Khorasan (ISIS-K) claimed responsibility for Friday’s deadly massacre at a concert hall in Moscow, releasing graphic footage of the attack.
Three days after ISIS-K, an offshoot of the Islamic State, claimed responsibility for an attack that killed more than 130 people — one of the worst terror attacks in Russia in decades — Russian President Vladimir Putin addressed the country.
Putin, who has built his authoritarian regime on a strongman image, hinted Russia’s relationship with Hamas and stance on Israel’s war in Gaza meant the country would not be an ISIS target.
He asked: “Are radical and even terrorist Islamic organizations really interested in striking Russia, which today stands for a fair solution to the escalating Middle East conflict?”
Putin avoided potential questions about the Kremlin’s security failings, particularly given the U.S. Embassy in Russia warned that Islamic militants were planning to attack Moscow earlier this month, and was forced to namecheck ISIS-K.
Here’s what we know about the group.
What is ISIS-K?
The Islamic State Khorasan Province (ISIS-K), an Islamic State group affiliate, emerged in late 2014 as a breakaway faction of the Pakistani Taliban.
Geographically, “Khorasan” refers to a historical region that includes parts of present-day Iran, Afghanistan, and broader Central Asia.
The group found a foothold in areas of eastern Afghanistan that had long been safe havens for other jihadist groups, including al Qaeda, and gained recruits among disaffected Afghan and Pakistani Taliban. They orchestrated a brutal ISIS-style campaign of violence against the population, which included beheadings and other grotesque acts.
In January 2016, the U.S. government declared ISIS-K a global terrorist organization, coupled with a concerted campaign by American and Afghan forces, alongside a sustained Taliban offensive against ISIS-K.
Yet ISIS-K gained new life — and a new modus operandi — in 2020, after the appointment of a new leader, Shahab al-Muhajir. Instead of trying to take territory, Shahab focused on two things: expansion to and recruitment in Central Asia, and mounting major attacks in Kabul and on predominantly Shia targets and other religious minorities.
The group gained even more international notoriety for a suicide attack on Kabul airport on August 26, 2021, killing 13 U.S. soldiers and 170 Afghans trying to flee following the Taliban takeover.
After the Taliban assumed control of the country in August 2021, ISIS-K ramped up attacks.
In 2022, the Taliban orchestrated a crackdown on the group, successfully limiting ISIS-K attacks in Afghanistan. Data from the Armed Conflict Location Event Database (ACLED) suggests ISIS-K attacks declined by about 94 percent between January 2022 and April 2024.
Is it the same as the Islamic State (IS)?
Not exactly.
Within the Islamic State command structure, ISIS-K is considered a “province” (hence “Khorasan Province”) reporting to IS command.
In practice, ISIS-K is a franchise operation granted significant autonomy by the IS leadership. As with any franchise, the IS brand gives ISIS-K name recognition, credibility and access to funding and resources. But its global and ideological ambitions exist alongside very local grievances and objectives, in this case, toppling the Taliban to establish their own version of an Islamic state.
ISIS-K operations and objectives inside Afghanistan and Pakistan are different from its global rhetoric and the international operations for which the organization claims credit.
These are not planned and executed by the rank and file in Afghanistan, who are concerned with the Taliban. Increasingly we see more Central Asian jihadists or actors abroad implicated in these attacks.
The line between what is IS and ISIS-K is often blurred when it comes to claiming responsibility for attacks. This conveniently magnifies media attention to both entities.
There is also the possibility that, like many militant groups in the region and IS affiliates, they claim credit for attacks that they outsource to others or have little to do with organizing in the first place. This is a low-cost, high-impact means to spread their message and gain recruits. But it also makes it incredibly difficult to gauge how dangerous they actually are, and how best to defeat them.
Why did the group attack Russia? What are its ambitions?
On March 25, ISIS-K media outlets issued a rambling claim they executed the attack in Moscow but it was thin on evidence. It claimed the Moscow attack was meant to embarrass the Taliban government, undermining its counter-terror pledges and to discourage Chinese and Russian investment in Afghanistan.
ISIS-K made similar claims after its September 2022 attack on the Russian embassy in Kabul.
ISIS-K’s ambitions are to establish an Islamic State in Central Asia.
Where and how does it recruit?
Inside Afghanistan, its ranks are mainly drawn from disgruntled Taliban as well as young, conservative Afghans who oppose the Taliban. Its younger recruits are increasingly multi-ethnic, drawing in disaffected ethnic minority populations. It increasingly recruits from disaffected Afghans and Central Asians, particularly from Tajikistan, as well as from among Central Asian migrants in Turkey and Europe.
In Afghanistan, its recruitment entails careful vetting and indoctrination. Abroad, it relies heavily on social media outreach and messaging apps. Its news outfit, Amaq, publishes in at least five languages and runs Telegram channels in as many, if not more.
ISIS-K also encourages self-initiated attacks in which they sometimes assist and almost always claim credit.
What might be next? What does the research and intel suggest?
ISIS-K has adapted, increasingly setting its sights on regional and international targets, which are strategic and designed to maximize impact.
The attacks they’ve claimed are highly opportunistic and diverse, ranging from a jailbreak in eastern Afghanistan to a memorial service in Iran for commander Qassem Soleimani to a Catholic Church in Istanbul.
It seems highly likely they will continue fighting on the Afghan front as well as claiming attacks abroad. It is important to remember that much of their war is waged through the media.
This is partly an attempt to stay relevant, lashing out at global targets to undermine Taliban claims that they can prevent terror groups from operating on their soil. Our research suggests the Taliban crackdown, which has limited the group in Afghanistan, has unwittingly incentivized its expansion in South and Central Asia — and beyond.
