Over the past three decades, various terrorist organizations have emerged and replaced each other on the international scene, gaining strength within their strongholds and then shifting their subversive activities to the outside world, planning and carrying out terrorist attacks abroad.

The list includes such actors as the Algerian Armed Islamic Group (GIA, which hijacked Air France Flight 8969 in 1994), al-Qaeda that became famous after 9/11, and the Islamic State (IS).

Today, the Islamic State’s Khorasan Province (ISKP) has adopted the same strategy in Afghanistan. Yet unlike many previous groups that relied on stable safe havens to gain more time and space for planning and training, ISKP has actually grown weaker in Afghanistan during the Taliban’s second year in power—while paradoxically expanding its external operations capacity.  

The current situation therefore indicates that Afghanistan under the Taliban has once again become a hotbed of transnational terrorist threats. Shortly after taking power, the current Taliban government established its internal security arm, the General Directorate of Intelligence (GDI), in October 2021. 

Yet the agency did not begin reporting arrests of ISKP members until July 2022. This gap partly stemmed from the Taliban’s desire to shore up its legitimacy by obfuscating reality and convincing the international community that the country was free of terrorist threats upon its takeover including through disinformation. For example, after U.S. Central Command issued a report in March 2022 noting that ISKP had grown under the Taliban, the GDI posted a tweet calling the news “intelligence propaganda.” A follow-up tweet continued this line of argument: “The khawarij [referring to ISKP] was an intelligence project of the occupiers [i.e., coalition forces] that completely disappeared after the end of the occupation, and currently [it] does not have a physical presence in any part of the country.” 

It is obvious that this was far from the truth, however, and the Taliban would soon have to contend with the reality of ISKP in Afghanistan. Since the GDI’s first reported ISKP arrest in July 2022, the Taliban has conducted thirty-six counterterrorism raids against the group. During this period, ISKP attacks inside Afghanistan have measurably decreased, based on official IS claims of responsibility.

In 2022-23, attacks decreased even more than they did in 2019-20, when the U.S.-led coalition and Afghan security forces took concerted action against ISKP and before the organization’s current leader, Shahab al-Muhajir, took the reins.

Armed Conflict Location & Event Data (ACLED), an organization dedicated to collecting, analyzing, and mapping crisis situations, recorded a total of 1,826 armed incidents involving ISKP during the reporting period from July 2022 to January 2024. Kabul was the province with the highest number of recorded incidents, followed by Takhar, Panjshir, Badakhshan, and Baghlan. The provinces that faced the highest number of incidents during the reporting period from July 2022 to January 2024 were Kabul (245), Takhar (177), Panjshir (154), Badakhshan (107), Baghlan (107), Kandahar (93), Nangarhar (90), Parwan (79), Balkh (68), Kapisa (65), Herat (54), Kunar (51), Ghazni (50), and Helmand (48). 

Notably, despite the significant terrorist threat and highly volatile security environment, there has actually been a decline in ISKP activity in Afghanistan. This trend can be entirely attributed to the Taliban's operations to counter the terrorist threat emanating from ISKP.

 

Alternatively—or in addition—it might reflect a deliberate ISKP decision to change its attack patterns. The August 28 issue of the group’s Pashto magazine Khorasan Ghag (Voice of Khorasan) included an essay claiming that the decline is due to Shahab al-Muhajir’s “strategic silence policy.” Although verifying such claims is difficult, internal documents leaked in spring and fall 2020 showed that the parent IS organization deliberately underreported its claims of responsibility for attacks in parts of Syria, whether for strategic purposes (e.g., sowing discord among enemies) or practical reasons (e.g., lack of internet access to post claims). Something similar could plausibly be happening with ISKP in Afghanistan, though it will be needed to analyse more data to make that determination.

n shifting from a local/regional focus to a more global posture, ISKP has pursued a two-pronged strategy. The first prong is an ongoing propaganda campaign. Unlike other IS branches, ISKP developed an independent media architecture via its al-Azaim Media Foundation, which produces content in Arabic, English, Farsi, Pashto, Tajik, Urdu, and Uzbek. Besides the Taliban, this content has taken aim at a wide range of foreign targets, from surrounding countries (India, Iran, Pakistan, Tajikistan, Uzbekistan) to Middle Eastern heavyweights (Israel, Saudi Arabia, Turkey, the United Arab Emirates) to enemies further afield (China, Europe, Russia, the United States).

The second prong consists of planning and carrying out attacks abroad—either directed, guided, or inspired. Although the Taliban has repeatedly claimed that Afghanistan will not be used as a base for such plots, the actual data indicates that the incident rate has only picked up since the group took power both in the neighboring countries and outside the region. 

 

For instance, ISKP elements continue to carry out pinpoint attacks in North-West Pakistan and have previously launched cross-border rocket strikes against Tajikistan and Uzbekistan. 

The group has also attacked targets in the Maldives in February and April 2020. They carried out two attacks in Shiraz, Iran in October 2022 and August 2023. IS did not claim the second attack, but Iran named ISKP as the culprit. 

In addition, at least fifteen other ISKP plots have been interdicted by law enforcement in India (3), Iran (4), Germany (3), the Maldives (1), Qatar (1), and Turkey (3). Four of these plots emerged before the Taliban takeover, but the other eleven unfolded under its watch: five in 2022 and six so far in 2023. 

These findings indicate that the Taliban’s so-called “counterterrorism” efforts are limited to its immediate security needs and not those of other nations—an approach that runs directly counter to the government’s stated goal of garnering international support and official recognition.

In December 2023, a series of counterterrorism operations in Austria and Germany led to the arrest of citizens of Tajikistan and Uzbekistan who were reportedly planning to carry out attacks on Christmas Eve and New Year's Eve in Vienna and Cologne.

In 2024, the most significant attacks by ISKP were armed attacks in Crocus City Hall near Moscow, in the Iranian city of Kerman, and in Kandahar, Afghanistan.

 

All of the above examples highlight the serious risks associated with ISKP ability to recruit supporters and coordinate attacks remotely. The situation also puts Washington in a difficult position. Many of ISKP's  plots have targeted close U.S. partners such as Germany, India, Qatar, and Turkey, yet authorities no longer have the same intelligence networks in place that they had prior to the withdrawal from Afghanistan. 

These trends indicate that the Taliban’s so-called “counterterrorism” efforts are limited to its immediate security needs and not those of other nations—an approach that runs directly counter to the government’s stated goal of garnering international support and official recognition. Thus, its approach directly contradicts its stated goal of gaining international support and official recognition by ensuring that Afghan territory does not become a stronghold for terrorist groups that pose a threat to other states.

 

One of the most striking aspects of ISKP’s external operations networks is that Tajik nationals were involved in many of its attack plots, financing schemes, and recruitment efforts, specifically in Germany, Iran, and Turkey. Yet Tajikistan has not publicly disclosed anything about ISKP activity on its own soil.  

The global threat emanating from ISKP’s base in Afghanistan is real, whether in the form of direct attacks, efforts to guide individuals online, or attempts to inspire them via propaganda materials. 

In assessing the global security situation and the place that IS-K occupies in this issue, special attention should be paid to the fact that, unlike in 2001, when the Taliban was allied with the problematic jihadist actor in question (al-Qaeda), the current leadership of the movement clearly regards ISKP as an enemy. Yet it is difficult to take the government’s security claims seriously when it insists that foreign countries face no threats from Afghanistan. 

Despite the decreased aggression level of ISKP at home, terrorist plots abroad have verifiably increased in the two years since the Taliban takeover, suggesting that the government is either unable or unwilling to contain such threats. This situation will only further harm the Taliban’s chances of gaining legitimacy on the world stage.