American experts on the growing terrorist threat from ISKP

Last week’s terrorist attack on the Crocus City Hall music venue on the outskirts of Moscow, which killed over 130 people and injured over 140, is the deadliest terrorist attack in Russia since the Beslan school siege of 2004 and eerily reminiscent of the 2002 Moscow theater hostage crisis at the Dubrovka Theater, (both perpetrated by Chechen militants - author), US security experts say.

Islamic State (IS) claimed responsibility for the recent Moscow attack through its Amaq News Agency, including posting photos and videos of the alleged perpetrators. U.S. officials have pointed to IS Khorasan Province (ISKP) as the IS affiliate responsible for the attack, although extremists from its broader network may have also played a role. The Russian security services announced the apprehension of the four gunmen, whom they say are all migrant workers from Tajikistan.

If these details prove to be accurate, the Moscow attack not only illustrates ISKP’s capability and determination to conduct external operations but also demonstrates threats posed by jihadi networks in Central Asia — something that analysts and experts have been warning of as a growing threat since the 2021 chaotic U.S. withdrawal from Afghanistan.

ISKP has been successful in radicalizing and recruiting fighters of Central Asian background, including Uzbeks and Tajiks, to its ranks. ISKP’s current leader, Sanaullah Ghafari (aka Shahab al-Muhajir) is an Afghan national who is believed to be an ethnic Tajik. Ghafari is believed to be responsible for the planning and execution of the ISKP attack on the Kabul airport in August 2021, which killed 13 U.S. service members.

It remains unclear exactly how large ISKP is, though the group is suspected to have several thousand members.

The group’s focus on attracting fighters across Central Asia is apparent in its propaganda materials, which are often released in local languages, including Uzbek and Tajik, via social media channels such as Telegram. One of ISKP’s chief propagandists and recruiters is reportedly a Tajik citizen known as Abu Miskin. The material often celebrates high-profile attacks or peddles anti-Russian propaganda that also targets the Central Asian regimes, such as Tajikistan’s ruler, for corruption, being too close to Putin, and not being religious enough.

According to the UN Security Council’s most recent monitoring report, the Uzbek and Tajik factions of ISKP possess some of the most advanced operational and financial capabilities of the group, which continue to expand.

ISKP’s Central Asian jihadi networks also manifest in attacks targeting Central Asian countries. In the past years, ISKP has launched several rocket attacks targeting Uzbekistan and Tajikistan. In 2019, IS fighters crossed the border from Afghanistan into Tajikistan and attacked a border post on the Tajik-Uzbek border. ISKP has also been accused of being behind several prison riots in Tajikistan.

In recent years, ISKP has carried out several rocket attacks on Uzbekistan and Tajikistan. In 2019, its militants crossed the Afghan border into Tajikistan and attacked a border post on the Tajik-Uzbek border. ISKPhorasan is also accused of involvement in several prison riots in Tajikistan. It has also had notable success in other attacks outside Afghanistan, including the recent double suicide bombing in Iran during an event commemorating Major General Qassem Soleimani. As a result of this terrorist attack committed on January 3, 91 people were killed and more than 100 were injured.

While official IS statements did not attribute the attack to an Afghan branch, US officials said their intelligence provided “clear and undeniable” evidence that ISKP was the mastermind of the attack. Iranian officials said in a statement that one of the suspects, a Tajik national, was undergoing training at an IS facility in Afghanistan's Badakhshan province.

Just a few weeks later, on January 28, two men at a Sunday mass in Turkey carried out a terrorist attack in the Roman Catholic Church of Santa Maria in Istanbul. One of the men pulled out a gun, attacked one parishioner and killed another one. In CCTV footage, the attacker's gun appeared to jam and then the pair fled the scene. The suspects were reportedly citizens of Tajikistan and Russia.

The apparent geographic dispersion of ISKP’s targets is remarkable, as is its efforts to recruit from a wide range of nationalities. Kyrgyzstan's security services said they had arrested two suspected ISKP members who were allegedly involved in a plot to detonate an improvised explosive device in Jalalabad's central square and attack a church during New Year celebrations.

Similarly, in Tajikistan, the Ministry of Internal Affairs blamed ISKP for bombing the car of the head of the regional branch of the ruling People's Democratic Party of Tajikistan. A car caught fire outside his home, and an investigation conducted later determined the fire was caused by an improvised explosive device.

Germany has also been the target and planning location of several plots over the past four years. On March 19, law enforcement reported that two suspects were arrested after ISKP was ordered to attack the Swedish parliament. Authorities cited “specific” plans for an attack in Stockholm and failed attempts to obtain weapons. Seven other Central Asian suspects were also reportedly arrested in Germany and two others in the Netherlands following a joint anti-terrorism operation on July 7 last year. ISKP was planning terrorist attacks in Germany and the militants had already acquired firearms. In 2020, four Tajik citizens were detained after their attempt at reconnaissance of US Air Force bases in Germany. It was reported that the men had already purchased firearms and ammunition.

French President Emmanuel Macron said after the recent terrorist attack in Moscow that his country's intelligence services had thwarted numerous ISKP plots. He did not go into detail, but said ISKP had “made several attempts in our own country in recent months.” After the terrorist attack at Crocus City Hall, French intelligence services increased their focus on the natives of Central Asia, including citizens of Turkmenistan, Kyrgyzstan and Kazakhstan.

There have been 21 plots disrupted in nine countries since last March, trumping eight from the prior year, and only three recorded between 2018 and March 2022.

Despite the decline in insurgent activity inside Afghanistan itself, ISKP has continued to expand its propaganda reach and external operations capabilities. The branch has successfully struck inside Iran, the Maldives, possibly Turkey and Tajikistan, and now Russia.

In addition, it has actively plotted against various extra-insurgent theater states such as India, Iran, Germany, Austria, the Maldives, Qatar, Turkey, Kyrgyzstan, and Russia. Moreover, the suspect profiles of the Moscow attack are not surprising given how ISKP has been tapping its Central Asian contingent for external operations in recent months.

The growing Central Asian ISKP network, however, is nothing new in the history of Salafi-jihadist organizations. In the 1980s, many jihadists from Central Asia flocked to Afghanistan to fight the Soviet Union, including joining al-Qaeda (banned in Russia). The Taliban have hosted or collaborated with several Central Asian jihadist groups, including the Islamic Movement of Uzbekistan and the Turkistan Islamic Party, which have carried out many high-profile attacks in Central Asian countries.

As ISIS established its so-called caliphate, thousands of foreign terrorist fighters who traveled to Syria and Iraq came from Central Asia, including approximately 1,300 people from Tajikistan and 1,500 more from Uzbekistan. These figures do not include the many Central Asian jihadist groups linked to al-Qaeda that migrated from Afghanistan to the Levant around the same time.

As ISIS began to collapse, many foreign fighters left Iraq and Syria and fled to Afghanistan. Experts and analysts warn that these militants are battle-hardened and have operational experience that could be used to arrange terrorist attacks not only in the region, but also against Russia and the West. ISKP is a clear testament to that.

Central Asian jihadist networks in Afghanistan pose a threat to regional and global security. ISKP attempted several terrorist attacks in Europe last year and carried out terrorist attacks against Iran, Turkey and Russia in 2024. The head of US Central Command, General Kurilla, testified before Congress earlier this month, saying that ISKP ““[r]etains the capability and the will to attack U.S. and Western interests abroad in as little as six months with little to no warning.”

In addition, ISKP is increasingly targeting China and Chinese citizens in its propaganda materials to carry out terrorist attacks in Afghanistan and Pakistan. Earlier this week, a suicide bombing killed five Chinese nationals in northwestern Pakistan.

While the geopolitics of Central Asia dictate a delicate balance between Russia, China, Iran and the West, jihadist groups operating in the region have demonstrated their willingness to attack anyone who opposes them.

Key conclusions

The Moscow attack illustrates ISKP’s capability and determination to conduct external operations, but also demonstrates the threats posed by jihadist networks in Central Asia - something that analysts and experts have warned of as a growing threat since the chaotic withdrawal of US troops from Afghanistan in 2021 year.

The group's focus on attracting militants across Central Asia is evident in its propaganda materials, which are often published in local languages, including Uzbek and Tajik, through social media channels such as Telegram.

Central Asian jihadist networks in Afghanistan pose a threat to regional and global security: ISKPhorasan attempted several terrorist attacks in Europe last year and carried out deadly terrorist attacks against Iran, Turkey and Russia in 2024.