Expansion of the presence of the “Islamic State-Khorasan” contingent in Central Asia (based on materials from Eurasianet)

If it is definitively established that the Moscow atrocity was committed by “ISIS-Khorasan,” it will correspond to the rapid increase in the external operational activities of the group in recent times.

On the evening of March 22, footage of the attack began to emerge inside and outside the “Krokus City Hall,” a concert venue near Moscow, for which “Islamic State” (IS) immediately claimed responsibility. Four men, three of whom were armed with automatic weapons and the fourth with incendiary devices, attacked a hall filled with spectators awaiting a sold-out concert. As a result of the attack, at least 140 people were killed, including three children, and another 150 were injured. Reports indicate that the attackers escaped as the fire spread inside and the roof of the building collapsed, turning into a burning mass of debris. “Islamic State militants attacked a large gathering of Christians in the city of Krasnogorsk on the outskirts of the Russian capital, Moscow, killing and injuring hundreds of people and causing significant destruction to the venue before they successfully retreated to their bases,” stated a message published on the Islamic State’s media outlet Amaq news. This was followed by gruesome footage from body cameras worn by the attackers during the assault. The videos showed bodies scattered across the concert hall, fires, gunfire, and attempts at decapitation, as well as photographs of the men allegedly involved in the attack posing before the assault in front of an Islamic State flag.

Subsequently, Russian authorities identified the suspects: 25-year-old Shamsidin Fariduni, 19-year-old Muhammadsobir Faizov, 32-year-old Dalerjon Mirzoev, and 30-year-old Saidakrami Murodali Rachabalizoda. It is believed that all four are citizens of Tajikistan. Shortly after, new footage emerged, this time involving Russian military and law enforcement, allegedly showing the four suspects captured and bearing signs of torture. A comparison of these images and videos of the attack conducted by the Russian publication The Insider revealed common and unique features in the clothing of the captured and killed men and those shown committing the violence. In one video, an unidentified soldier is seen cutting off a suspect’s ear and forcing him to eat it. Photos of the four suspects’ court appearance show signs of physical violence. Reports indicate that all the men pleaded guilty.

Subsequently, “Islamic State – Khorasan,” the Afghan branch of IS, issued a threat to “all cruel Russians, including [Russian President Vladimir] Putin” for the torture of the suspects, promising that “you will all be killed along with your women and children.” The main representative of IS praised the attack in a statement published on March 28, commending IS-Khorasan for its assaults on citizens of Russia, China, and the USA. Sunday was declared an official day of mourning in Russia, and President Putin promised a swift response. In a televised address, he stated that the suspects had attempted to cross into Ukraine and that a “window” had opened allowing the attackers to cross the border, and that “terrorists will find refuge.”

John Kirby, an advisor to the U.S. National Security Council, told reporters that “there are no signs… that Ukraine or Ukrainians are involved.” Intelligence indicates that the responsibility lies with ISIS-Khorasan, which has experience successfully recruiting individuals from Central Asia, including Tajikistan, who make up a relatively small but increasingly active part of the organization’s external operations. The attack occurred just over two weeks after Russian state media announced a raid on an Islamic State cell in the city of Kaluga, southwest of Moscow, which was allegedly preparing to attack a synagogue in Moscow. The Federal Security Service (FSB) reported that two members of the cell were killed during the operation on March 7.

In footage allegedly taken from the raid, published by Russian media, FSB officers are seen inspecting two bodies, firearms, ammunition, and knives. On the same day, the U.S. Embassy in Russia warned of imminent plans “to target large gatherings in Moscow” and urged its citizens to stay away from large crowds, including concerts. During the same period, similar advisories were issued by Finland, Latvia, Estonia, Germany, and the United Kingdom. Following the attack and after the Al-Azaima Foundation, part of ISIS-Khorasan, and ISIS-supporting media “Al-Battar” threatened France, Italy, Spain, and the United Kingdom, both France and Italy raised their terrorist threat levels. On March 3, the FSB also reported the elimination of six Islamic State militants in the predominantly Muslim republic of Ingushetia.

If it is ultimately established that the Moscow atrocity was committed by ISIS-Khorasan, it would align with the rapid increase in the branch’s external operational activity recently. Since March 2023, 21 plots have been uncovered in nine countries, more than in the previous year, with only three recorded between 2018 and March 2022. Despite a decrease in insurgent activity within Afghanistan itself, ISIS-Khorasan continues to expand its propaganda efforts and operational capabilities. This branch has successfully struck Iran, the Maldives, possibly Turkey and Tajikistan, and now seemingly Russia. Furthermore, the organization has been preparing plots against various extra-insurgent states in the theater of operations, such as India, Iran, Germany, Austria, the Maldives, Qatar, Turkey, Kyrgyzstan, and Russia. Moreover, the suspicious characteristics of the attack in Moscow are not surprising, given how in recent months ISIS-Khorasan has utilized its Central Asian contingent for external operations.

There is also hostility towards Russia and an intention to strike at Russia, as in 2014 it was named the main enemy of the Islamic State, and the then-caliph Abu Bakr al-Baghdadi claimed that the movement’s opponents were “guided by America and Russia, mobilized by Jews.” Military intervention to support Bashar Assad, close ties with Iran, and Russian mercenaries sharing the battlefield with Lebanese Hezbollah in Syria position Moscow as the vanguard of Shia interests. The activities of the Wagner Group across Africa in the Sahel have further incited the anger of ISIS. Russia also holds an important place in the knowledge of the global jihadist movement as a historical enemy of Islam, having caused the Soviet invasion and occupation of Afghanistan and its wars in Chechnya. The Russian counterinsurgency campaign of “scorched earth” in the Caucasus included collective punishment and senseless violence, which ensured lifelong discontent among the citizens of Dagestan and neighboring Russian republics.

ISIS-Khorasan has particularly actively spoken about strengthening relations between Moscow and the Taliban and carried out a suicide bombing against the Russian embassy in Afghanistan in September 2022, shortly after calling on its supporters to “instill fear in the hearts of the sons of Putin and Russia” and “Kill them with cars and knives.” ISIS-Khorasan has also achieved significant successes in other attacks beyond its home province of Afghanistan, including a recent double suicide bombing in Iran during an event commemorating the death of Major General Qasem Soleimani. As a result of the attack on January 3, 2024, at least 91 people were killed and more than 100 were injured. Although the attack was not officially attributed to the Khorasan branch of ISIS, U.S. officials stated that their intelligence provided “clear and indisputable” evidence that ISIS-Khorasan was responsible. An Iranian official statement indicated that one of the suspects, a citizen of Tajikistan, had received training at an ISIS base in the Afghan province of Badakhshan. Just a few weeks later, on January 28, 2024, a Sunday mass in Turkey was targeted by two men who entered the Santa Maria Roman Catholic Church in Istanbul. One of the men pulled out a gun and began attacking one parishioner and killed another. The attacker’s gun appears to jam in silent footage from surveillance cameras, and the pair fled the scene. The suspects are reported to be citizens of Tajikistan and Russia.

The obvious geographical spread of ISIS-Khorasan’s targets is noteworthy, as are its efforts to recruit representatives from various nationalities. Using its own propaganda apparatus, the Al-Azaim Media Production Fund, propaganda is disseminated in several languages, including Tajik, Uzbek, and Russian. Kyrgyz security services reported that they arrested two alleged members of ISIS-Khorasan, stating that they were involved in a plot to detonate an improvised explosive device in the central square of Jalal-Abad and attack a church during New Year celebrations. Similarly, in Tajikistan, the Ministry of Internal Affairs accused the head of the regional branch of the ruling People’s Democratic Party of Tajikistan of the Khorasan wing of ISIS in Afghanistan of being responsible for a car explosion. The car caught fire near his home, and a subsequent investigation determined that the cause of the fire was an improvised explosive device.

French President Emmanuel Macron, following a recent attack in Moscow, stated that his country’s intelligence services have thwarted numerous plots by ISIS-Khorasan. He did not provide any details but reported from French Guiana that ISIS-Khorasan “has attempted several attacks on our territory in recent months.” After the attack on “Krokus,” French intelligence increased its focus on individuals from Central Asia, including citizens of Turkmenistan, Kyrgyzstan, and Kazakhstan. The stigmatization of Central Asian individuals by Russian officials will only exacerbate the discontent that ISIS exploits. ISIS-Khorasan has a unique opportunity to use such discontent to incite supporters to violence and attract new recruits from the region to support its insurgent activities in Afghanistan and Pakistan and to utilize them in its external operations.