Despite Iran being considered an enemy of the Islamic State and ISIS-Khorasan from the outset, the group has specifically made Iran its operational and propaganda priority. Both the Islamic State and its Khorasan affiliate dedicate a significant portion of their rhetoric to vilifying the “apostate” Iranian revolution and the subsequent government. As a result of ISIS-Khorasan’s attention to the country, Iranian authorities have reported through state media numerous arrests in 2023 and 2024, presumably in connection with planned attacks, including within Tehran.
It is reported that on January 3, ISIS-Khorasan carried out the deadliest terrorist attack in Iran in decades, executing a double suicide bombing near the grave of Major General Qasem Soleimani. As a result of the attack, which occurred during a memorial ceremony for the late commander of the Quds Force, 103 people were killed and over 280 were injured. Following the explosion, Iranian intelligence and Taliban intelligence claimed that the individual perpetrators were from Tajikistan – a fertile ground for recruitment for ISIS-Khorasan – while U.S. intelligence pointed to intercepted communications, placing the blame on ISIS-Khorasan.
The next day, the Islamic State published photographs of the martyrs and details about the two alleged attackers. The Islamic State also included this attack in an infographic detailing the number of casualties worldwide from January 1 to 10, as part of its campaign “Kill them wherever you find them,” which is a self-proclaimed response to the war in the Gaza Strip.
Iran responded with a series of publicly sanctioned repressions, including the arrest on April 4 of a man named Mohammad Zakir, who was allegedly a member of the Islamic State. Later, the Persian service of the BBC quoted authorities stating that Zakir “has no connection” to the Islamic State. In Iran, ISIS-Khorasan has attacked sites important to Shia Muslims and Iranian nationalism with varying degrees of success.
In August 2023, a lone armed assailant entered the Shah Cheragh shrine in Shiraz, a pilgrimage site for Shia Muslims, where he shot four people, killing one. This followed an incident last year when in October 2022, a Tajik citizen entered the shrine with an automatic rifle, killing 13 and injuring 40 pilgrims and staff on site. As with other operations, this attack was claimed by the central media of the Islamic State. Later, Iran publicly executed two Afghans who were said to have assisted in the attack and were in contact with the Islamic State in Afghanistan – although the credibility of this pair’s confessions is heavily disputed.
Attention from the larger Islamic State towards Iran is by no means a new phenomenon. It has previously claimed responsibility for a number of other attacks on the country, including a strike on a military parade on September 22, 2018, which resulted in 25 deaths, about half of whom were members of the Islamic Revolutionary Guard Corps (IRGC). Iran blamed another separatist movement for the attack. By targeting Iran, ISIS-Khorasan references the Shia majority in the country, its relations with Russia, and its military intervention against the Islamic State, including direct military intervention and support for anti-Islamic militias in Iraq.
The funding sources used for the operations of ISIS-Khorasan in Iran are not entirely clear. ISIS-Khorasan typically finances its operations in Afghanistan and beyond through domestic donations, funding from other branches of the Islamic State, unofficial “hawala” money transfers, and fundraising in cryptocurrency through its media affiliates. An analysis of the weapons used in terrorist attacks, such as the recent attack on Crocus City Hall, indicates that they were likely of local origin.
It is evident that ISIS-Khorasan’s operations in Iran generally follow a pattern of using foreign nationals from Central Asia to enter the country for conducting operations. The relations between the governments of Iranian President Ebrahim Raisi and Tajik President Emomali Rahmon are generally considered to have warmed after many years of reports of tension between Tehran and Dushanbe. The countries have eased visa requirements for travel and held negotiations in 2023 on a number of other cooperation documents, ranging from trade to transportation. In public statements at that time, Afghanistan was identified as a zone of mutual concern.
Turkey
The relocation of ISIS’s operational center has turned Turkey into a stronghold for the group through ISIS-Khorasan. Residents of Central Asia have individually carried out attacks on ISIS-Khorasan, including at Istanbul Airport and attacks in Reyna, while ISIS-Khorasan is also expanding its recruitment efforts in Turkey.
ISIS-Khorasan primarily targets two groups of people in Turkey for recruitment: ethnic Central Asians fleeing from Syria and Iraq who arrived in Turkey between 2017 and 2019, and individuals from Afghanistan who have entered the country through illegal migration routes since 2021. Recruitment campaigns by ISIS-Khorasan typically occur around Istanbul, Izmir, and Ankara, as well as in areas of Istanbul such as Zeytinburnu, Başakşehir, and Esenyurt, where there is a high concentration of people of Central Asian and Caucasian descent.
On January 28, two masked men entered the Santa Maria Church, a Roman Catholic church in Istanbul. Drawing a gun, one of the attackers opened fire on the crowd gathered for Sunday mass. As a result of the attack, one person was killed and another was injured. Despite the findings of investigations conducted after the attacks in Santa Maria and Crocus, as well as attention to new recruits of the Islamic State from Central Asia, it is currently very difficult to identify ISIS-Khorasan cells in Turkey.
After the attack on Santa Maria, Turkey detained 51 individuals connected to the attack. Twenty-three people were deported and 28 were arrested. Following the attack on Crocus City Hall, Turkey conducted dozens of operations against ISIS in approximately 40 provinces and arrested a total of 363 people. According to sources in Turkish security services, the detainees are reportedly of Tajik, Uzbek, Caucasoid, Syrian, and Iraqi descent.
Turkish officials stated that those detained with links to ISIS-Khorasan were mainly citizens of Tajikistan, but among them were also Uzbeks, Turkmen, Uighurs, and Afghans, many of whom held different passports. For example, on April 6, during an operation related to the investigation of the attack on the Santa Maria church, 48 members of ISIS-Khorasan were detained. According to Turkish officials, 30 of them were Tajiks, Uzbeks, Uighurs, and Turkmen. Officials noted that nearly half of them had residence permits. According to a source familiar with the situation, two of the 30 detainees from Central Asia also hold Turkish citizenship.
The financing and recruitment network of ISIS-Khorasan in Turkey is closely interconnected in many ways. The arrested Shamil Khukumatov, who was detained in the summer of 2023, was responsible for organizing the flow of militants and money from Turkey to Afghanistan and ISIS-Khorasan operators from Afghanistan to Turkey. Before Khukumatov, the network led by Ismatulla Khalozai was engaged in financial and organizational activities on behalf of ISIS-Khorasan in 2021. The financial activities of ISIS-Khorasan in Turkey take several forms. While some funds are raised under threat, other money is collected through businesses. Capital from Turkey to ISIS-Khorasan usually flows through an informal “hawala” system, as well as through cryptocurrencies.
On February 6, the Istanbul Security Directorate detained 11 suspects with ties to the Islamic State living in Istanbul, including 11 from Russia, four from Uzbekistan, one from Kyrgyzstan, one from Azerbaijan, and one from Sudan, for financing ISIS-Khorasan. According to a source familiar with the situation, most of the funding is used in Turkey to recruit new members. ISIS-Khorasan cells, consisting of migrants from Central Asia, recruit people in need of economic support. At the same time, they raise funds outside the localities where the recruits live. Cells are quickly exposed when funding and recruitment are combined, as in some cases in Başakşehir.
ISIS-Khorasan was able to carry out the attack on Santa Maria on behalf of the Islamic State, despite counter-terrorism groups from the Istanbul police conducting operations six months prior to the attack on the church. During this operation, aimed at the Güvercintepe area of the Başakşehir district in Istanbul, where ISIS-Khorasan cells were actively present in Turkey, 12 individuals of Kyrgyz, Tajik, and Uzbek nationality were detained.
Media outlets linked to the “Islamic State” began publishing in Turkish when ISIS-Khorasan expanded its activities in Turkey. Issues of the ISIS-Khorasan magazine “Voice of Khorasan” from March 30 and April 11 were also published in Turkish. A source close to the “Islamic State” reported that the Turkish editions of the magazine “Voice of Khorasan” are translations by the Turkish media team of the “Islamic State,” Meydan Media.
Although ISIS-Khorasan has strengthened its finances, logistics, recruitment, and propaganda in Turkey, the Islamic State still defines the Turkish state as a taghut – a tyrant and enemy of Islam. Turkey is a target for militants from the Levant and other countries who come to join ISIS-Khorasan.
Europe
For many years, the West and Europe have been the main focuses of the Islamic State. However, since the beginning of the military campaign in the Gaza Strip, the Islamic State has called on its supporters to carry out attacks inside Israel, against Israeli embassies, and to “target Jewish presence worldwide, in whatever form it may take.” During the same period, ISIS-Khorasan’s propaganda directed this anger towards the West, emphasizing how many Western powers support Israel financially and militarily. As part of a broader campaign across the Islamic State, the group in its official weekly newsletter “Al-Naba” called for attacks on Western and Jewish populations. Offering a wide range of advice, the Islamic State simultaneously urged its supporters in the West to commit acts of violence in retaliation for the U.S.-led coalition’s war against the Islamic State and Western support for Israel.
ISIS-Khorasan continues to act as a leader in the Islamic State’s external operations and intensifies its efforts to incite violence against the West and Jewish populations. In its English-language magazine “Voice of Khorasan,” ISIS-Khorasan included educational infographics urging supporters to target Jewish communities, business interests, and residents of the West. In particular, it asks supporters to attack large gatherings of people, including concerts, universities, and tourist sites, with knives, Molotov cocktails, vehicles, firearms, and much more. The same issue also featured a full-page image praising a person who shot two Swedish football fans in Brussels and threatening “Tomorrow for the Crusaders” with promises of future attacks on the West.
An Islamic State representative, Abu Khuzayfah al-Ansari, after a recent attack in Iran, called on listeners in an audio statement to seek targets “on the streets and roads of America, Europe, and the world” and to “burn them with grenades and incendiary projectiles, shoot them with bullets, slit their throats with sharp knives, and run them over with vehicles.”
Immediately after the attack on “Krokus City Hall,” the media production fund “Al-Azaim,” part of ISIS-Khorasan, renewed threats of similar attacks on the West, particularly from lone actors, directing them towards major sports stadiums, even featuring the Champions League logo next to “Krokus City Hall” alongside images of an armed fighter in a mask.
ISIS-Khorasan has also directly threatened the UEFA Champions League in Germany and the Olympic Games in France, which will take place later this year, while the propaganda outlet Hallummu urged its readers to attack “the stands and games at stadiums.” Other images from ISIS-Khorasan indicate potential attack locations, including the Emirates Stadium in London, the Metropolitano Stadium and the Santiago Bernabeu Stadium in Madrid, as well as the Parc des Princes in Paris. Other publications supporting the Islamic State refer to “the three entrances” at the Emirates Stadium and “the players’ arrival point” as possible attack zones, all aimed at creating as destructive a deadly public spectacle as possible.
The propaganda of ISIS-Khorasan is often disseminated through its official media and in collaboration with several pro-Islamic state media partners. In one of the images published after the strike on Russia, a lone figure examines several images of major European cities such as London, Paris, Rome, and Madrid. Above the cities is the caption: “After Moscow… Who’s next?” Other images are less specific but carry a clear message, including the latest page of the ISIS-Khorasan magazine, which features a militant in camouflage on a train with a box of explosives sitting next to him. In the background, a sign reads: “Welcome to Europe… Last call before departure.”
While much of the Islamic State and ISIS-Khorasan propaganda provoking attacks is ambitious, there is both precedent and motivation for such an attack, including the ISIS-Khorasan plot targeting the 2022 FIFA World Cup in Qatar. Since 2015, the Islamic State has carried out several attacks on major sporting events. These include November 2015, when Islamic State jihadists carried out a multi-pronged attack in Paris: suicide bombers detonated explosive vests near the Stade de France during a football match, while another group attacked a concert. In June 2016, two Islamic State supporters in Malaysia threw a grenade during a UEFA Euro game viewing. Most recently, on October 16, 2023, an Islamic State supporter shot at Swedish football fans in Brussels, claiming the violence was revenge for a series of public Quran burnings in Stockholm earlier that year.
Recently, militants reportedly linked to ISIS-Khorasan attempted to plan attacks in Europe during the December holidays. While many known plots have been thwarted by law enforcement, an attack on a Catholic church in Turkey continued in January. The plans of ISIS-Khorasan could potentially have been much deadlier than the already tragic outcome.
Threat Assessment
The reorientation of ISIS-Khorasan from operations focused on its operational base in Afghanistan and Pakistan to concentrating on external attacks and operational plots has led to a surge in both thwarted conspiracies and successful attacks attributed to or claimed by ISIS-Khorasan over the past year. According to data collected by Aaron Zelin and Ilana Winter, in the year leading up to March 20, 2023, ISIS-Khorasan was responsible for at least 22 plots or attacks in nine different countries, compared to eight the previous year. In addition to Russia, Iran, and Turkey, ISIS-Khorasan has previously been linked to attacks in the Maldives, Tajikistan, and Uzbekistan, while plots have been intercepted in Germany, the Netherlands, Qatar, Turkey, India, Kyrgyzstan, and Russia. Many of the recent plots were aimed at local places of worship during the Christmas and New Year holidays.
Among the mass arrests and thwarted plots, many were connected to cross-border planning conducted by alleged members of ISIS-Khorasan, indicating a transnational network supporting the group’s operations. While much of the propaganda directed at the West from ISIS-Khorasan’s English-language publications focuses on encouraging lone wolf attacks against known targets, numerous plots reportedly thwarted by authorities suggest that ISIS-Khorasan is also interested in carrying out targeted attacks in Europe.
Part of ISIS-Khorasan’s success in recruitment is attributed to its highly active propaganda apparatus. By offering original media in Pashto, Arabic, English, Turkish, and many other languages, ISIS-Khorasan’s publications have been translated into even more languages; more than any other branch since the fall of the Caliphate. Following successful attacks in Iran and Russia, waves of propaganda have celebrated the attackers and their actions in the interest of the Islamic State, continuing to target major powers such as Russia, Iran, and Europe.
Although several plots have been thwarted to date by security and law enforcement agencies, ISIS-Khorasan has demonstrated the capability, intent, and persistence necessary to carry out another successful attack. Recent attacks in Russia, Iran, and Turkey serve only as additional motivation to achieve this goal.
Based on materials from The Diplomat featuring international experts Peter Smith, Levent Kemal, and Lucas Webber
