The Islamic State in Khorasan Province: Exploiting a Counterterrorism Gap

Last month, after four gunmen attacked Crocus City Hall in Moscow, killing more than 150 people, all eyes turned to the Islamic State in Khorasan Province (ISKP), the Islamic State’s so-called province based in Afghanistan. Soon thereafter, the Islamic State core claimed responsibility for the attack while ISKP heralded it without directly claiming it. Despite this ambiguity, ISKP has emerged as the most likely culprit. Unfortunately, the attack in Moscow not only represents an expansion in the group’s transnational capability, but it also highlights the difficulties countering the organization.

In an international environment replete with conflict and competition, ISKP should, in theory, be a rare opportunity for international counterterrorism cooperation. With transnational membership and ambitions, ISKP is a threat to all governments in the region, including the Taliban regime, Pakistan, Iran, Central Asian states, and India. Most of its attacks since its emergence in 2015 have been in Afghanistan and, to a lesser extent, in Pakistan, but the group—as well as/along with Islamic State core—has also conducted multiple attacks in Iran in recent years. To date, it has only launched small-scale attacks in Tajikistan and Uzbekistan, but it encourages violence there as well as in India. It is also an international threat. It has been behind multiple plots in Europe, and it seeks to develop the capability to strike in the United States as well as attack the United States’ strategic competitors, both China and Russia.

Though it is easy to dismiss Moscow’s false claims that the West and Ukraine supported the attack in Moscow last month, Russian president Vladmir Putin’s response reflects a broader problem with counterterrorism efforts against the group. Counterterrorism, particularly against the Islamic State, was once an area of cooperation even between countries with broader tensions. There was even a Global Coalition to Defeat ISIS. But in the current environment, governments increasingly view terrorist threats, particularly the threat from ISKP, through the lens of conspiracies and competition, rather than as a common problem.

ISKP is a wholly rejectionist group, meaning that it opposes all the governments in the region as well as the major powers allied with them. This stance is an anomaly in South Asia where most militant groups benefit from at least one government backer. Instigating so many enemies at the same time should be a losing strategy; it certainly was for the Islamic State core in Iraq and Syria. But there has not been such cooperation against ISKP. Instead, it has exploited three counterterrorism gaps to plot and conduct attacks in Afghanistan, the broader region, and beyond.

Conspiracies over Reality

First, ISKP benefits from governments’ tendency to misdiagnose the group. Instead of seeing ISKP as an organization that has embraced the Islamic State’s goal of overthrowing the current international order, many threatened governments see ISKP through the lens of their existing adversaries and rivals. Moscow fell prey to this fallacy, first by ignoring the U.S. warning of an impending operation and then by accusing the West and Ukraine of having a role in the attack.

But such unfounded conspiratorial analysis of ISKP is also common among the regional governments most threatened by the group. The Taliban and the Iranian government have both portrayed ISKP as a client of the United States. In India, ISKP is regularly dismissed as yet another proxy for Pakistan, while Pakistan sees an Indian hand behind the group. Unfortunately, the track record of government support for militant groups in the region has contributed to the erroneous tendency to see ISKP through this lens. 

These misdiagnoses have consequences. They can contribute to regional tensions and poorly conceived responses to ISKP attacks. For example, after ISKP struck Iran earlier this year, Tehran responded by launching missiles into Pakistan’s restive Balochistan province. Confusingly, Tehran claimed it was targeting Jaish al-Adl, a Sunni militant group that operates in Balochistan unrelated to ISKP. Pakistan responded with its own strike on Iran, though fortunately the two countries de-escalated tensions soon thereafter. 

Conspiracies about ISKP skew governments’ assessment of the threat, causing them to ignore warnings—as occurred before the attack in Iran in January and the attack in Moscow last month—and they also inhibit broader cooperation, as governments are unlikely to cooperate with others they believe are sponsoring the group.

The Limitations of the Taliban’s Counterterrorism Efforts

In the absence of international cooperation, the task of countering ISKP has largely fallen to the Afghan Taliban, which raises a second limitation. The Taliban rightly sees ISKP as a threat to its regime. Indeed, ISKP has long dedicated most of its ire toward the Taliban, despite its international objectives. After taking over Afghanistan, the Taliban regime initially adopted a heavy-handed approach to countering the group, which included crackdowns on Salafist communities. More recently, the Taliban has had some successes in targeting ISKP operatives, including killing a senior operative who was responsible for the group’s attacks in Kabul, conducting raids, and reportedly infiltrating the group.

But ISKP has given as good as it got. Its operations in Afghanistan reached an all-time high as the Taliban took over, and it maintained a higher tempo for an unusually long time. Though the group’s attacks in Afghanistan have been limited since late 2022, concluding that the group has been seriously weakened based on those trends is premature. ISKP has had an erratic attack pattern with sharp peaks and low valleys since its inception in 2015 (see Figure 1). It conducts waves of attacks that draw counterterrorism pressure, and then it temporarily launches fewer operations as it adapts to the pressure and losses. With over 3,000 members, it has ranged from an organization that held territory to a network of covert cells depending on the environment, but it has consistently posed a threat irrespective of its structure. Though it takes the group time to regenerate attack capability after losses, ISKP has repeatedly demonstrated its ability to do so, including under pressure from the United States.

Remote Visualization

Not only is the decline in attacks in Afghanistan likely only temporary, but it has corresponded with a slight uptick in violence in Pakistan (see Figures 2 and 3). The Islamic State boasts a province in Pakistan as well as Afghanistan, but it is unclear whether there are actually two distinct entities operating in the region. More likely, there is a connected network that ISKP has used to conduct its transnational operations and attacks in Pakistan while it adapts to the pressure in Afghanistan. 

Remote Visualization
Remote Visualization

In addition, the quantity of attacks in Afghanistan is not the best measure of ISKP’s threat. It has repeatedly hit targets that undermine the Taliban’s claims to be able to provide security for Afghans and foreign officials. In the two and a half years since the Taliban’s takeover, ISKP has succeeded in assassinating Taliban figures, striking multipleinternational targets in secure locations in Kabul, targeting Shia in the capital and other major cities, and even recently conducting an attack that penetrated the Taliban’s de facto capital of Kandahar.

Not only have ISKP’s attacks pierced the Taliban’s claims to be able to provide security, but they have undermined the Taliban’s ability to uphold its pledge in the Doha Accord to prevent its territory from being used to launch attacks on other countries. The inclusion of that clause was intended to pressure the Taliban to restrain its longtime foreign jihadist allies operating in Afghanistan. But those groups have not been the main threat emanating from Afghanistan since the Taliban takeover, except in Pakistan.

With a multinational composition that includes Afghans, Pakistanis, Central Asians, Uyghurs, and others, ISKP has long sought to engage in more transnational plotting. But it has only been able to fully realize those ambitions since the Taliban takeover. Even though the Taliban has allegedly infiltrated ISKP, it has proven unable to prevent ISKP from conducting external attacks. Instead, ISKP puts pressure on the Taliban by offering an alternative to disgruntled foreign jihadists who are frustrated by the limitations the Taliban has placed on their activities or its warm relations with multiple governments they oppose, like Russia or China. Such operatives can help ISKP develop its international reach.

The Taliban’s counterterrorism capability is unlikely to improve in ways that will weaken ISKP over the long term. Though the Taliban has received de facto recognition from numerous countries, including Russia, India, China, and many Gulf states, that acceptance has not come with counterterrorism assistance. India, China, and Russia, in particular, have engaged with the Taliban in part to encourage the Taliban to prevent threats to their countries, but they have not provided aid that would bolster the Taliban’s counterterrorism capability.

Moreover, the Taliban’s tensions with the Pakistani government have complicated efforts against ISKP. The Taliban has allowed the anti-Pakistani group Tehreek-e-Taliban Pakistan (TTP) use its territory to target Pakistan. The freedom of movement afforded to the TTP also allows ISKP to shift across the Durand Line to evade Taliban detection as well as conduct attacks in Pakistan.

The Limitations of the Current International Environment

Finally, counterterrorism efforts against ISKP are hindered by the broader international environment. The international appetite for counterterrorism cooperation diminished with the rise of strategic competition and as a result of the major conflicts that have broken out in Europe, the Middle East, and Africa.

Though ISKP is a threat to numerous governments, it is not the top priority for any. For example, Pakistan is consumed with its political and economic crisis and a growing threat from the TTP and Baloch separatist groups. Iran is focused on the war in Gaza and managing its client groups’ responses to that conflict. Though ISKP regularly threatens India, it has not been able to attack there yet, so India’s efforts against the organization are limited to disrupting plotsat home. Even the Taliban’s efforts against ISKP have waxed and waned during its rule as it grapples with governing the desperately poor country.

For its part, the United States has limited interest in counterterrorism action in Afghanistan since its withdrawal, though it has maintained some intelligence collection capabilities. Though the United States had sufficient intelligence to warn Iran and Russia of pending ISKP threats, both countries claimed—dubiously in the case of the intelligence shared with Russia—that the intelligence was not actionable. And the United States has not used its “over-the-horizon” counterterrorism capability against ISKP or even used it at all in Afghanistan since it killed Ayman al-Zawahiri in Kabul in 2022.

Unfortunately, these three limitations to counterterrorism efforts are unlikely to change. Governments will likely continue to misdiagnose ISKP as the product of their rivals. They will thus be hesitant to cooperate with one another and even heed warnings. The Taliban’s counterterrorism capability is unlikely to improve or be sufficient to weaken ISKP over the long term. And other priorities and conflicts will continue to overshadow ISKP.

Meanwhile, the threat from ISKP will persist. It will maintain its transnational network and ability to inspire plots. It will keep its foothold in South Asia. The group sets itself apart in the crowded militant landscape in the region with its willingness to target indiscriminately, even attacking girls at school and a maternity ward. And it has consistently been able to adapt to pressure and re-emerge as a threat. In its current state, despite some setbacks in Afghanistan, ISKP remains one of the Islamic State’s largest and most dangerous affiliates. But conventional measures of strength do not fully capture the threat from the group. Its ability to adapt, its willingness to target indiscriminately, and its transnational ambitions make it a threat beyond its size and well beyond Afghanistan.

Tricia Bacon is a senior associate (non-resident) with the Transnational Threats Project at the Center for Strategic and International Studies. She is an associate professor at American University’s School of Public Affairs and directs the Policy Anti-Terrorism Hub at the university.

Tricia Bacon
Senior Associate (Non-resident), Transnational Threats Project