IntelBrief: Islamic State Khorasan Province Poses a Unique Counterterrorism Challenge

• The Moscow terrorist attack perpetrated by Islamic State Khorasan Province (ISK) at the Crocus City Theater in late March demonstrated the intent and capabilities that many in the counterterrorism community have been growing increasingly concerned about.
• ISK’s media operations have grown more sophisticated over time, evolving considerably since late 2021 following the withdrawal of U.S. troops from Afghanistan.
• ISK also seeks to diversify its financial portfolio, which includes multiple illicit revenue-generating schemes, among them taxation, extortion, kidnapping for ransom, soliciting donations from Islamic State supporters abroad, and smuggling precious gems and timber.
• Compared to other Islamic State branches, ISK appears to cast a wide net in terms of recruitment, reaching out to militants from Central Asia and the Caucasus in an effort to broaden the group’s network.

The Moscow terrorist attack perpetrated by Islamic State Khorasan Province (ISK) at the Crocus City Theater in late March demonstrated the intent and capabilities that many in the counterterrorism community have been growing increasingly concerned about. ISK has been refining its capabilities across the board, from media operations to recruitment, financing, and building its external operations (EXOPS) planning network. Retired General Frank McKenzie, former Central Command (CENTCOM) commander, said just recently that ISK had a “strong desire” to attack the United States and warned that U.S. officials should take the group seriously in its stated objective to do so. The Taliban has been somewhat successful at limiting ISK within Afghanistan, so in response, the group has begun focusing on launching attacks outside of the country. Since the beginning of the year, ISK has launched high-profile attacks in Russia, Iran, and Türkiye. Numerous plots targeting Europe have been disrupted so far this year.

ISK’s media operations have grown more sophisticated over time, evolving considerably since late 2021 following the withdrawal of U.S. troops from Afghanistan. Through the Al-Azaim Foundation for Media Production, ISK has centralized its messaging, ramping up its threats against various countries, both in the region and abroad. This propaganda campaign is related to the group’s deliberate regionalization and internationalization strategy. Al-Azaim’s mandate has broadened beyond purely religious topics, including discussions of socio-political issues and grievances collectively held by ISK supporters in various regions worldwide. Al-Azaim produces videos in myriad languages and publishes Arabic, English, Farsi, and Pashto magazines. Al-Azaim has Tajik and Uzbek branches and targets Central Asians for recruitment. Online, the group has used a range of social media and tech platforms for its messaging, including Archive.org, Element, Facebook, Hoop, and Telegram, among others. ISK has also capitalized on regional issues to attract new recruits. Following ISK rocket attacks against Tajikistan and Uzbekistan, ISK propaganda released a steady stream of propaganda, celebrating the attacks and threatening more in the future. For a group that has been forced to operate clandestinely, ISK has shown an impressive ability to synchronize its propaganda and physical operations, achieving a strategic communication feat that bedevils most Western governments and militaries.

ISK also seeks to diversify its financial portfolio, which includes multiple illicit revenue-generating schemes, among them taxation, extortion, kidnapping for ransom, soliciting donations from Islamic State supporters abroad, and smuggling precious gems and timber. As terrorism financing expert Jessica Davis has noted, ISK’s revenues from taxation and extortion will vary with how much or how little territory the group is able to control or influence. Similar to other terrorist groups, ISK has attempted to gain control over mining sites to profit from talc, chromite, and other valuable resources. The United Nations has reported that ISK has received funds through Islamic State’s Al-Karra office in Somalia, which has served as a facilitation and logistical node in the organization’s global network. This ability to move funds around between various regional affiliates, despite intensive efforts by the U.S. and its allies to develop robust counter threat finance mechanisms, demonstrates Islamic State’s tendency to innovate, adapting to constraints and opportunities as needed.

Compared to other Islamic State branches, ISK appears to cast a wide net in terms of recruitment, reaching out to militants from Central Asia and the Caucasus in an effort to broaden the group’s network. ISK has made overtures to supporters in Europe as well, as it relentlessly pursues individuals whom it can inspire to launch attacks in Germany, France, Sweden, and elsewhere. The Discord Leaks revealed that ISK had plotted to attack “embassies, churches, business centers and the FIFA World Cup soccer tournament” when it was held in Qatar, and that it planned more than a dozen attacks by “developing a cost-effective model for external operations that relies on resources from outside Afghanistan, operatives in target countries, and extensive facilitation networks.” ISK boasts hundreds of skilled operatives and a robust roster of battle-hardened militants it can call upon. Approximately 5,000 fighters from Central Asia traveled to Iraq and Syria to join Islamic State at the height of its so-called caliphate, including approximately 1,500 from Uzbekistan, nearly 1,100 from Tajikistan, and an additional 863 supporters from Kyrgyzstan.

A combination of factors has led to a resurgence of Islamic State affiliates globally. In addition to its branches in South Asia and sub-Saharan Africa, there has recently been an uptick in the operational tempo of ISIS militants in Syria. As Syria watcher Charles Lister recently noted, there has been an increase in ISIS activity so far this year, with attacks increasing by 170 percent in Assad-held areas and monthly increases of 30 – 40 percent in northeast Syria in areas controlled by the Syrian Democratic Forces (SDF). The Al-Hol camp in northeastern Syria still holds approximately 44,000 people – 93 percent of whom are estimated to be women and children – while an additional 9,000 Islamic State fighters are being held in detention centers in the same region. Islamic State’s “Breaking the Walls” campaign demonstrates how these camps and prisons remain a focus of ISIS militants and have been described by some as a “ticking time bomb.” The deteriorating humanitarian conditions in the camp and mounting grievances among its inhabitants could pose to further radicalize Al-Hol’s population, particularly the large number of young people. The growing threat posed by Islamic State and its affiliates is occurring at the same time that the U.S. and its allies are shifting resources and manpower away from counterterrorism and toward great power competition with Russia and China, drastically making the terror threat landscape more ominous, especially as ISIS and its affiliates continue to mobilize in response to geopolitical events.