Islamic State Redux: Exploring ISIS-K, their conflict with Russia, and the prospect of new terrorist attacks

Long-anticipated terrorist attack

Aymenn Al-Tamimi, a researcher at the Middle East Forum:

“I believe that the Islamic State has long been interested in attacking Russia because it views it as a 'crusader' state, due to its support for the Syrian government and its relations with the Taliban. The current regimes in Syria and Afghanistan are seen as 'apostate,' and supporting these regimes, in ISIS's eyes, is akin to waging war against Islam. Moreover, there is a broader idea of fighting 'apostates' and 'infidels,' including Christians, who ultimately must either embrace Islam, become 'dhimmis' — second-class citizens in the caliphate — or die.

I wouldn't attach much significance to the timing of the attack. Perhaps there is some connection to the recent presidential elections in Russia — a desire to shatter the illusion of stability. What's much more important is the fact that such an attack was successfully carried out.”

Paweł Wójcik, an independent researcher specializing in Islamic State information resources and propaganda:

“Firstly, in January, ISIS announced the start of a new campaign against Christians and Jews worldwide, and Russia is considered a Christian country. Secondly, Russia intervened in the conflict in Syria ten years ago, and then fought against the ISIS affiliate Wilayah Caucasus, which carried out numerous attacks in different regions of the Russian Federation from 2016 to 2019. Thirdly, recently, and this is particularly important, Russia has been trying to reassert itself in central Syria, fighting for influence in the Sahel, and encountering the local ISIS affiliate — the Islamic State in the Greater Sahara.

There is no doubt that the Islamic State is behind the attack in Moscow. In the past, there were cases when Russian special services were suspected of organizing attacks in Russia, but now it's different — the Crocus attack clearly caught them off guard. I can also say that it was accompanied by the standard ISIS information campaign; similar propaganda materials were published after attacks in Iran, Afghanistan, or Indonesia. Additionally, ISIS's published photos of the militants serve as evidence.”

Israeli military expert David Sharp:

“The Islamic State now exists more as individual cells united by a common ideology. According to this ideology, Russia is one of the enemies of the Islamic State, along with the Taliban and certain branches of Al-Qaeda. In the past, ISIS militants have already taken action against Russia. Could their motivation have been further fueled by Moscow's alignment with the Taliban, with whom ISIS is in conflict in Afghanistan? It's a possibility we can't dismiss. Given the chance to strike Russia, they wouldn't hesitate, as it aligns with their ideology and strategy. They wouldn't shy away from striking the U.S. either. In Russia, they have both sympathizers and cells comprising individuals from Tajikistan and Uzbekistan.

I don't believe the attack on “Crocus” was timed to coincide with any specific event; rather, it was an opportune moment operationally. This reflects a long-term strategy, with typical actions targeting places with lots of civilians to maximize damage.”

Understanding ISIS-K

The ISIS faction in Afghanistan, known as Islamic State Khorasan Province (or ISIS-K), has been active since 2014. It claimed responsibility for the explosion at the Russian embassy in Kabul in September 2022 and has also threatened attacks on Russian soil. Initially composed mainly of Afghans who splintered from the Taliban, the group later saw militants from other countries, including former Soviet republics in Central Asia, joining its ranks. A 2023 report by the UN Security Council noted that ISIS-K includes citizens from Pakistan, Iran, Azerbaijan, Turkey, Russia, Tajikistan, and Uzbekistan.

Aymenn Al-Tamimi:

“The ISIS branch in Khorasan appears to have capitalized on the withdrawal of Western forces from Afghanistan and the Taliban's inability to completely suppress rival groups, allowing it to forge connections with militants beyond the region and engage in preparing terrorist attacks. The 'Central' ISIS group in Iraq and Syria is relatively weak and primarily focused on survival and continuing local conflicts. African branches have gained strength in recent years but seem focused on organizing rebellions in their own countries rather than preparing attacks in Europe or Russia. ISIS-K has already been implicated in attacks outside its region. I believe there is an increased risk of new attacks in Russia and other countries.”

Paweł Wójcik:

“Despite U.S. efforts to destroy the global ISIS network, the group has retained significant potential for attacks due to successful reorganization in recent years. It has allowed the most important branches to survive: in Somalia, Khorasan, Sahel, Greater Sahara, and possibly even in Southeast Asia. In recent months, the U..S has warned of an intensified threat to Europe Russia has already been attacked, and now we know that France, Germany, and Sweden are under constant pressure from jihadists.”

David Sharp:

“The Islamic State had resources in the past decade when there was a quasi-state in the territories of Iraq and Syria, with large cities and millions of people under their control. During that time, ISIS gained many supporters among radical Islamists worldwide. Today, there is no unified territory controlled by ISIS, but there are regional branches controlling small areas, and there are underground groups united by a common ideology. They create problems for local authorities and other adversaries, including organizing some terrorist attacks. This is a decentralized network with many participants.”

Sergey Migdal, security expert and former Israeli police officer:

“After the US army withdrew from Afghanistan in 2021 and the Taliban came to power, all Western allies of the U.S. and humanitarian organizations left the country. One of the few countries that established relations with the Taliban leadership and maintained an embassy in Kabul was Russia. Then we saw how the Taliban were invited to the St. Petersburg International Economic Forum, despite the fact that formally the Taliban are still banned in Russia and considered an extremist organization.

It was this foreign policy of Russia that led to the terrorist attack in Crocus. ISIS now considers Russia the main supporter of the Taliban. It's not about an ideological inclination to kill infidels, Russians, or Slavs; it's about ISIS fighting the Taliban for power. The leaders of ISIS-K want to return Afghanistan to the 1990s and make the country a new central base for ISIS.

The second enemy of ISIS in the region, after the Taliban, is Shiite Iran, with which Russia maintains friendly relations, even supplying it with Su-35 fighters. Russia pursues such a foreign policy because it is willing to support any groups, including scoundrels, Islamists, and dictators, as long as they oppose the U.S. and the West, which supports Ukraine.

Islamic State Khorasan Province sees Russia as one of the barriers to its quest for power in Afghanistan. They believe that if Russia weakens, becomes preoccupied with other issues, and ceases to support the Taliban, they may have a chance of prevailing.

Another critical aspect pertains to the potential involvement of Tajiks in the terrorist attack. ISIS often leverages ethnic minorities for its operations. In forming the Afghan branch, ethnic Tajiks played a significant role, given the sizable Tajik population in Afghanistan, including those who fled the civil war in Tajikistan during the 1990s. Currently, the Tajik community in Afghanistan, which has absorbed tens of thousands of people from Tajikistan, maintains strong ties with Tajiks in Russia.

It's important to note that many Tajiks fled Tajikistan for Russia not only for employment opportunities but also due to the harsh policies of the Tajik government and security services, which vigorously combat any signs of what they perceive as Islamic extremism. Reports suggest that even sporting a beard as a young man can be perilous, as it might lead to suspicions of Islamist affiliations, resulting in detention and intense interrogation. In contrast, Russia allows individuals to wear beards, attend mosques, and access a wide range of online content. This presents an opportunity for ISIS-K to target individuals who are already devout and susceptible to radicalization.

The story recounted by the heavily beaten suspected terrorist in the forest is evidently a fabrication implanted during the briefing preceding the operation. Those dispatched to execute the attack are regarded as expendable, sacrificial pawns, serving to delay and complicate the investigation process. Notably, only in Russia are suspects promptly interrogated upon apprehension, with the interrogations subsequently made public; this practice is absent in the West, as it could impede the investigation.”

Is there any doubt as to who is behind the terrorist attack?

Despite all of the available evidence, the Russian authorities are attempting to link the Crocus attack with Ukraine. Alexander Bortnikov, the director of Russia’s Federal Security Service (FSB), has claimed that Ukrainian intelligence services had trained militants in the Middle East and were involved in preparing the attack. Security Council Secretary Nikolai Patrushev has also accused Ukraine of involvement, answering “of course it was Ukraine” when asked who was behind the attack. And Vladimir Putin himself has suggested that the terrorist attack might represent “a link in a series of attempts by those who have been fighting against Russia since 2014 with the hands of the Kyiv regime.”

Furthermore, the Kremlin's network of internet bots has begun spreading pseudo-journalistic articles alleging that the U.S., Ukraine, and the British intelligence service MI6 are behind the Crocus terrorist attack, dismissing Washington's data on ISIS responsibility as fake.

Last May, Meduza published an investigation claiming that the FSB was recruiting former ISIS militants and attempting to infiltrate them into units composed of Chechens and Crimean Tatars fighting in the war on the side of the Ukrainian Armed Forces.

Paweł Wójcik:

“The evidence of Islamist involvement in the terrorist attack is so compelling that Moscow, despite its desire, cannot completely dismiss this version. However, they will always blame Ukraine, no matter what happens. Moreover, acknowledging a purely jihadist attack now means admitting increased internal vulnerability and security problems, which the Russian authorities cannot afford against the backdrop of the ongoing war with Ukraine. Therefore, even if they acknowledge the involvement of Islamists, they will continue to accuse Ukraine, the U.S., and Britain.”

Sergey Migdal:

“The revelation that the terrorist attack in Russia was carried out by ISIS surprised many, although it shouldn't have. Over the years, Russia's conflict with Ukraine has dominated headlines, while Islamist groups like Hamas or the Houthis, currently in the spotlight, have not clashed with Russia. However, the reality is that ISIS has long been an adversary of Russia and remains a persistent threat. In March, the FSB announced the foiling of a terrorist plot: members of Wilayat Khorasan were reportedly planning an attack on a synagogue in Moscow. This incident underscores Russia's awareness of the ongoing threat posed by such extremist groups.”

The likelihood of new terrorist attacks

On March 8, exactly two weeks before the attack on Crocus, the U.S. Embassy in Russia warned of potential terrorist attacks in the capital, emphasizing that the extremists would target “major events in Moscow, including concerts.” Notably, the terrorists struck Crocus just as a concert by the band “Picnic” was about to begin. However, they did so well after it was predicted they might, as the American statement suggested the attacks would occur within 48 hours of its release.

Experts interviewed by The Insider believe that new terrorist attacks in Russia are entirely possible, as radical Islamists have both the motive and the resources — as well as supporters, to carry them out.

David Sharp

“Nothing can be guaranteed, but new terrorist attacks are possible. There is a common base for radical Islamic terror in Russia. There is a sizable Muslim community, the majority of whom are law-abiding citizens, but among labor migrants and ‘new’ Russian citizens, there are supporters of radical organizations, with new ones constantly emerging. Moreover, some of them have combat experience in various countries: Syria, Afghanistan, Iraq. The Islamic State, like any other radical organization, has been conducting its propaganda.

Russia has already faced radical Islamic terrorism with ethnic elements. To a significant extent, it has been suppressed and localized in the Caucasus as a slow-paced confrontation. However, when there is a base and potential, and given that such attacks occur in many countries worldwide, similar incidents will recur. Overall, the question here is that more attention will be paid to combating Islamist underground activities after what happened, but this does not even depend on the effectiveness of intelligence agencies.

It is also important to note that bad examples are contagious for both individual activists operating outside organization frameworks and for the branches themselves. Look at how successful we were. Why not organize a new terrorist attack, whether in Moscow or Paris?”

Paweł Wójcik:

“New attacks are likely. ISIS has been carrying out attacks in Russia for at least eight years. There is no indication that they intend to change their modus operandi. As recently as March 28, an official spokesperson for the “central” ISIS group and the organization's weekly newspaper confirmed that Russia remains a target. Considering the inevitable repression against migrants from Central Asia in Russia, as well as wars in Syria, Mali, and Burkina Faso, we should expect new developments.”

Russia and the Islamic State: from coexistence to war

In the early years of the Islamic State's activity, Russian authorities entertained the idea of a peculiar coexistence with the group. As of 2017, Russian nationals were the largest group of foreign fighters inside ISIS, numbering 3,417 — for comparison, there were 3,244 fighters from Saudi Arabia, 3,000 from Jordan, and 2,926 from Tunisia.

Russia’s security services played a significant role in the process by offering local Islamists unhindered travel from Russia to Turkey. From there, they would journey on to Syria to join ISIS or other jihadist formations. According to Reuters, this process intensified particularly in the lead-up to the 2014 Sochi Olympics, as authorities feared attacks by militants during the games. The group itself was only recognized as a terrorist organization in Russia at the end of 2014, by which time it already controlled significant swathes of Iraq and Syria. Some Dagestani militants even pledged allegiance to ISIS, breaking away from the Caucasus Emirate.

At least one instance is known of direct cooperation between Russians and the Islamic State. This involves the company Stroytransgaz, owned by oligarch Gennady Timchenko, which from 2007 was constructing a gas processing plant at the Tuweinan field in eastern Syria. According to Foreign Policy, work was halted when in 2013 the facility was seized by Syrian rebels, together with the group Jabhat al-Nusra, which is affiliated with Al-Qaeda. However, after the Islamic State established control over the plant in early 2014, the group consented to allow construction to resume, and according to a Turkish official, Russian engineers were among the crew. For ISIS, the benefit of the deal lay in the fact that gas from the field was directed to a power plant under its control in Aleppo. The quasi-state's activities largely depended on the Syrian energy system, and the fees collected from the population in the controlled territories, including for utilities, constituted part of its income. The facility was finally handed over in 2015 — shortly before Russia entered into direct conflict with the Islamic State by taking up support for Syrian dictator Bashar Al-Assad.

Russian military intervention in the Syrian civil war commenced in the fall of 2015 with strikes targeting territories held by Syrian opposition and jihadist groups not affiliated with ISIS — and often antagonistic towards the more radical organization. Major confrontations unfolded primarily in the provinces of Idlib and Latakia, where ISIS had been forced to retreat in 2014 following clashes with local rebels and jihadists. However, the threat posed by the Islamic State to the Syrian regime, a key factor prompting Russia's involvement, remained undeniable. Since 2014, ISIS had besieged regime forces in Deir ez-Zor, a major city in the east, and the capture of Palmyra (Tadmur) threatened strategically vital airfields like Shayrat and Tiyas (T4), along with cities including Homs and even the capital, Damascus. Furthermore, in 2015, ISIS claimed responsibility for bombing a Russian passenger plane over the Sinai Peninsula. Consequently, Russian airstrikes and ground operations, supported by local forces and the Russian Aerospace Forces, extended into territories controlled by ISIS.

In March 2016, the Wagner Group, backed by the Russian Aerospace Forces and pro-government factions, successfully expelled ISIS from the city of Tadmur and secured control over the ancient ruins of Palmyra, which had suffered significant damage during ISIS rule. Concurrently, a more ambitious offensive by Syrian regime forces towards the Tabqa airbase, aimed at reaching Raqqa — ISIS's de facto capital — faltered despite Russian airstrikes, and Syrian government troops were pushed back to their initial positions. Additionally, by the end of the same year, ISIS managed to force a weak Syrian garrison out of Tadmur, prompting the Wagner Group to “liberate Palmyra” once again. Subsequently, the siege of Deir ez-Zor was lifted, and the right bank of the Euphrates River was cleared, establishing a de facto demarcation line between President Assad's forces and the Syrian Democratic Forces, backed by an international coalition led by the United States.

Amidst the sieges of the major cities Raqqa and Mosul by Kurdish and Iraqi forces, with support from the Western coalition, the efforts of Russian-Assad forces against ISIS seemed more tangential. This partly explains why Putin's objectives in Syria, as discussed by Kremlin analysts (1, 2), were not fully realized. There was no repetition of the Yalta Conference of 1945, where the global landscape was reshaped amidst the fight against a common enemy. Furthermore, the involvement of the Wagner Group in these operations appeared to be driven more by mercenary motives. Entities linked to Yevgeny Prigozhin secured contracts from Syrian authorities for the “liberation” and development of oil and gas fields. Episodes tied to this involvement include a disturbing video depicting the brutal beating of a Syrian person with a sledgehammer at one of these fields, as well as direct clashes with American forces near the village of Kasham, stemming from attempts to redistribute ISIS's oil and gas resources.

However, the conflict between Russia and ISIS did not end there. The group maintained a presence in Syria and continued its fight against the Bashar al-Assad regime, still backed by Russian troops. Additionally, there were several instances of confrontation with Russian military personnel and mercenaries in Africa, with clashes continuing to this day. In 2019, Mozambican authorities enlisted Wagner Group fighters to combat the local ISIS branch in the northern part of the country — in exchange for contracts benefiting Russian companies. However, the private military company suffered setbacks, failing to coordinate effectively with local forces and proving ill-prepared for jungle warfare and dense urban combat. Nonetheless, operatives from the Wagner Group, and their successors, the state-supported Africa Corps, continue to engage in combat against ISIS and other jihadist groups in Northwest African countries Mali and Burkina Faso. In these regions, ruling military juntas have recently distanced themselves from France and turned to Russia for support. The Wagner Group has faced accusations of committing mass civilian killings during counterterrorism operations, which often serve as fertile ground for terrorist propaganda and recruitment efforts.

Another area of tension between Russia and ISIS lies in Central Asia. Russian security forces collaborate with law enforcement agencies in the Central Asian republics of the former USSR, most of which are Russian allies in the counterterrorism effort via their membership in the Moscow-led Collective Security Treaty Organization. Additionally, Russia maintains amicable relations with the Taliban movement, which seized power in Afghanistan in 2021 — a fact highlighted by ISIS-K propaganda. In September 2022, ISIS claimed responsibility for an attack near the Russian embassy in Kabul, which resulted in the deaths of two Russian diplomatic staff. The Russian mission was one of the few that continued operations following the Taliban's assumption of power.