OPINION
The 22 March attack at the Crocus City Hall outside Moscow, claimed by an Islamic State affiliate and carried out by gunmen from Central Asia, killed 144 people. And yet according to Vladimir Putin, who continues to insist without evidence that Ukraine had a hand in the incident, “Russia cannot be the target of terrorist attacks by Islamic fundamentalists.” In reality, however, the mass casualty event near Moscow was part of a broader campaign to rebrand the Islamic State as the world's most dangerous terrorist organization, writes Antonio Giustozzi, a senior fellow at the UK’s Royal United Services Institute for Defense and Security Studies (RUSI) and an IS researcher. The attack by the Afghan offshoot of the Islamic State, known as IS-K (the Khorasan branch), serves more ambitious goals than settling scores with Russia for its participation in the war in Syria or its friendships with the Taliban and Iran. Russia has proven to be easy prey for radical Islamists because of its flawed law enforcement system and proximity to Central Asia.
Although the media have mostly been referring to the Khorasan branch of IS as the perpetrator, the attack was claimed by the central IS propaganda apparatus. The Khorasan branch (IS-K) is responsible for IS operations in Afghanistan, part of Pakistan, Central Asia, and Iran. It has little reason of its own to attack Russia. While it is true that the Russian government sees the Taliban government in Afghanistan as a potentially useful ally against jihadist groups such as IS-K, it has not provided any military help or civilian aid to the Taliban. The attack in Moscow could, if anything, represent an incentive for the Russian authorities to take its first steps in that direction, given also that the Taliban would certainly benefit even from modest levels of help in repairing and maintaining helicopters, or from the delivery of drones and other equipment that could be used to challenge IS-K in its mountain hideouts.
The actual role of IS-K
Indeed, the decision to carry out attacks against “large gatherings” in Russia appears to have come from the central leadership of IS, with IS-K simply acting in the role of supporting the operation. Sometime in 2022-23, IS-K was tasked by the central leadership to manage all Central Asian cells linked to IS, as the leadership based between Syria and Turkey was no longer able to keep a large “terrorist bureaucracy” operating around its direct control. Forced deeper and deeper into hiding by US airstrikes, Turkish repression, and attacks by the US-allied SDF and rival Hayat Tahrir as Sham in Syria, the IS leadership is on the run and can only afford to keep a lean apparatus around itself. IS-K, on the other hand, boasts hundreds of Central Asian members in northern Afghanistan, who can easily manage the dispersed cells of fellow countrymen in Central Asia itself, and also in Turkey, Europe, Iran, and Russia. IS-K is, for now, also safe from US airstrikes in Afghanistan, even if US drones flying over the country intercept a good portion of its communications. While IS-K runs the day-to-day management of these dispersed cells, IS remains in charge of determining the target profiles and the overall terror strategy and is also likely involved in funding attacks outside of IS-K’s traditional turf.
The relaunch plans of IS
While it is far from clear whether IS-K has any compelling reason for spending its meager resources on the projection of terrorist threats far and wide, it is a different story for the central leadership of IS. After a long string of territorial defeats, decapitation strikes against its leaders, and years of declining activity, a determined crackdown on its network in Turkey has presented the group with yet another near-existential threat. The move by the authorities in Ankara threatens the vital financial hubs that manage the books of IS central, along with its branches in Iraq, Syria, and “Khorasan.” At the current rate, IS networks in Turkey might well end up being largely dismantled within a couple of years. With the real estate and business investments of IS in Turkey threatened, the only option available for the group is to attempt a major relaunch. Lacking the human and financial resources necessary for recapturing territory, it has instead focused on what was intended to become its largest terror campaign ever.
Lacking the human and financial resources necessary for recapturing territory, it has instead focused on what was intended to become its largest terror campaign ever
Between 2020 and February 2023, at least 15 plots to carry out attacks in Turkey, Western Europe, and beyond were detected by US intelligence. In Europe and Turkey itself, yet more plots were detected after February 2023, and one attack did take place in Turkey in January 2024 against a church, causing one death. The Iranian authorities also regularly report foiled plots by IS, and two attacks were in fact carried out in Iran between 2023 and 2024. The Russian authorities also reported failed plots before the Crocus City Hall attack, including two in early March alone.
In order to successfully execute this relaunch, IS is willing to commit a significant portion of its dwindling financial reserves. Fundraising has not been going well for some time — 2023 was particularly bad — while capital kept in Turkey is gradually being depleted by asset seizures. IS also needs to continue spending money to keep its various branches in Africa, the Middle East, and South Asia afloat. The Moscow attack and the Kerman attack in Iran suggest that it is nonetheless ready to commit some millions of dollars at least to sustain the ongoing terror campaign. At the same time, IS is willing to sacrifice hundreds of its significant but not unlimited human resources, which consist of several thousands of committed cadres. Turkey alone claims to have detained hundreds of alleged members of various branches of IS during various waves of arrests.
Why Russia?
The Moscow attack should therefore be seen within the context of a wider campaign intended to make IS relevant again — both in the eyes of jihadist circles and of individuals and groups potentially interested in funding the organization. In this context, it matters relatively little what grudges IS might have specifically against Russia. One could say that the animosity is due to Russia’s role in the Syrian conflict, where Moscow’s forces inflicted serious damage on IS. One could also mention that Russia is an important ally of Iran, IS’s main bête noire. One might even consider the fact that in the jihadist circles from which IS seeks to attract recruits, the memory of the Chechen wars is still fresh. And it is also true that Russia and the Soviet Union are often lumped together as the enemy of the Afghan mujahidin in the 1980s. IS, however, seeks to organize attacks in many other places, including Germany, which played a negligible role in anti-IS operations.
The main aim of the terror campaign that IS is carrying out is not revenge or retaliation, but relaunching its brand, thereby showing that the once highly feared group is still powerful enough to strike anywhere.
The main aim of the terror campaign is not revenge or retaliation but showing that IS is still powerful enough to strike anywhere
Why did IS succeed?
Although the timing of the attack has aroused suspicions in Russia, IS has for years tried to strike in all of the countries mentioned above. The question is rather why IS scored one of its few successes in Russia, as opposed to somewhere else. The group’s January 2024 Kerman attack in Iran killed 96 people, but why did so many plots fail in Europe and Turkey? Some observers argue that the Russian security services are distracted by their focus on the Ukrainian threat following a number of assassinations of Russian nationalist figures that have been attributed to the Ukrainian special services (and which have been half-claimed by Kyiv’s shadow operators. There are also questions being raised about why the US warning of an impending attack was ignored (if it indeed was).
In fact, it is impossible to protect all venues and individuals from generic terrorist threats. No government has sufficient human resources to do that. The US warning issued in early March was generic, as the Americans had only intercepted an order to attack “large gatherings” sometime around Mar. 8-10, without any more specific details given. The only effective way to fight terrorism is to rely on intelligence and infiltrate terrorist organizations to the greatest extent possible. Indeed, the attacks prevented in Turkey and Europe were largely due to intelligence work, not to the effective protection of uncounted exposed assets.
The attacks prevented in Turkey and Europe were largely due to intelligence work, not to the effective protection of uncounted exposed assets
This also explains why Russia is in a comparatively weak position relative to Europe and Turkey. Ankara’s security services monitored the activities of IS inside Turkey for years before they decided to launch a very heavy crackdown. While IS was mostly active in Syria, the Turks had little reason to destroy the IS networks, but they nonetheless gathered information about the terrorist group and perhaps also infiltrated a number of its cells. When the Turkish government eventually decided to crack down on IS, the nation-state was ready to withstand the self-declared Islamic State’s violent retaliation.
Europe faced several IS attacks in 2015-20, and its police forces and security services invested significant resources in managing the threat, monitoring the terrorists’ communications, and perhaps also infiltrating its cells. The main advantage of the Europeans compared to Russia, however, is that in recent years IS has largely been relying on Central Asians (mostly Tajiks and Uzbeks) for its terrorist attacks. This seems to be due to the presence within IS of 1,500-2,000 Central Asians, several hundred of whom are highly motivated. IS increasingly sees these members as expendable. They are of little use in Syria and Iraq, where IS operates underground and does not have much need for foreign fighters. The Central Asians also find it increasingly difficult to operate in Turkey due to the ongoing crackdown. And in Central Asia itself, IS is still struggling to establish a foothold.
In recent years IS has largely been relying on Central Asians for its terrorist attacks, seeing them as expendable
By contrast, seasoned and motivated Arab members of IS are in short supply after years of bitter fighting to defend the territorial Caliphate, and those left are kept close to the leadership, which needs them for protection at its hideouts still flying the flag of the Caliphate in Syria and Iraq. The European contingent of IS members, which once had a high media profile, appears to have mostly dissipated. This leaves the Central Asians as a terrorist shock force.
The arrival of Central Asians in Europe is not very frequent and is mostly limited to officials, businessmen, and students, all of whom can be easily monitored. Suspicious arrivals are easily detected and acted upon. Infiltrating Europe with Central Asians is thus quite hard.
The contrary is true of Russia, home to a large — and largely Tajik — community of Central Asian labor migrants. Here, IS has a sizable constituency to recruit from and can also infiltrate new arrivals more easily. Notably, two of the Crocus City Hall attackers reportedly arrived from Turkey. Monitoring terror suspects is onerous in terms of human resources, and few governments can afford to keep more than a few hundred suspects under surveillance. Thus, chances are high that some plots might go undetected. Having to monitor the threat represented by the activities of the Ukrainian intelligence services is likely to have compounded the problem for Russia, even if it probably also resulted in additional human resources being allocated to this type of task.
More to come?
For this same reason, Russia remains exposed to the IS threat. There are reports that many Tajik citizens, fearing harassment and worse by police, security services, and society alike, are fleeing back to Tajikistan. That might reduce the potential recruitment pool for IS, but harassment and humiliation of the remaining labor migrants are only likely to favor the IS recruitment pitch. Indeed, the hostile attitude towards the labor migrants, together with their difficult social and living conditions, are the likely drivers that brought many Central Asians to join IS in the past. The majority of those within the ranks of IS today were recruited from among labor migrants in Russia, rather than in Central Asia itself.
Harassment and humiliation of Russia's remaining labor migrants are only likely to favor the IS recruitment pitch
In order to have the kind of impact it needs for reversing the negative trend of recent years, IS would have to carry out several more successful strikes not just in Russia, but even more urgently in Europe and Turkey. It would have to re-create the image of a strong organization, one deserving the attention of the few sources of funding that still seem to be interested in jihadism. The orders issued by the IS leadership list synagogues among the desired targets, and indeed, an attack allegedly foiled by the Russian authorities in early March was meant to hit one such religious building. IS is often reproached by other jihadists for having never invested any resources in targeting Israel, and this criticism has strengthened in the wake of the Gaza crisis. IS has no capacity to target Israeli assets as such, so synagogues and other Jewish targets are the best it can do to counter such charges.