Examining Extremism: Islamic State Khorasan Province (ISKP)

By: Catrina Doxsee, Jared Thompson and Grace Hwang

The Islamic State Khorasan Province (ISKP) is a branch of the Islamic State active in Central and South Asia. This piece provides an overview of ISKP, including the group’s history, ideology, organizational structure, tactics, and targets. It concludes with an assessment that ISKP poses a significant threat within Afghanistan and will likely continue to perpetrate attacks against civilians and the new Taliban government—including against high-profile targets. This threat is exacerbated by the withdrawal of U.S. and partner forces, whose counterterrorism capabilities previously constrained ISKP activities.


ISKP emerged in 2014 with the defection of Tehrik-e-Taliban (TTP), al Qaeda, and Taliban fighters active in Afghanistan and Pakistan. In the wake of these defections, the Islamic State dispatched emissaries from Iraq and Syria to meet with local fighters, including a number of TTP commanders. In January 2015, these efforts were formalized when the Islamic State announced the formation of its “Khorasan” province. At the same time, Islamic State emir Abu Bakr al-Baghdadi appointed Hafiz Khan Saeed as the first ISKP emir. Khan Saeed had previously served as a TTP commander with responsibility for operations in Orakazi in Pakistan’s Federally Administered Tribal Areas (FATA), affording the newly formed ISKP deep Pakistani networks through which to recruit. Among ISKP’s early leaders who pledged allegiance were several TTP commanders responsible for areas of Pakistan’s FATA, deepening ISKP’s toehold in this strategic border area.

ISKP’s history since 2015 has been one of violent expansion and retrenchment, with periodic fighting against Afghan security forces, the Taliban, and international forces. In 2015, then-Taliban leader Akthar Mansour urged ISKP fighters to coalesce “under one banner,” alongside the Taliban. A war of words escalated into a Taliban campaign to recapture ISKP-controlled territory and degrade ISKP-aligned groups, such as factions of the Islamic Movement of Uzbekistan. Leaders in the Taliban’s Quetta Shura authorized additional offensives and deployed elite “Red Unit” commandos to fight ISKP beginning in December 2015. In Jowzjan Province, ISKP surrendered to the Taliban in the summer of 2018 following a sustained campaign. The relationship between the Afghan Taliban and ISKP, however, has not been uniformly hostile. Elements of the Haqqani Network, which has been integrated into the Taliban, have allegedly coordinated with ISKP on some occasions. For example, the Afghan Ministry of Defense claimed that at least one 2018 attack claimed by ISKP was in fact carried out by Haqqani Network fighters.

International actors have also played a role in various counterterrorism operations against ISKP. U.S. and former Afghan government forces conducted an aggressive campaign against ISKP forces in eastern Afghanistan, killing several of their mid- and senior-level leaders. Afghan forces captured ISKP leader Aslam Farooqi and several other commanders, such as Qari Zahid and Saifullah (also known as Abu Talaha), in Kandahar Province in March 2020. The Iranian military has also collaborated with the Taliban to secure Iran’s land border with Afghanistan and deny ISKP fighters freedom of movement.

In the wake of these setbacks, ISKP went through internal transformations while retaining the ability to carry out deadly attacks in Afghanistan. In May 2019, the Islamic State announced the existence of new provinces in Pakistan and India—areas which had previously fallen under ISKP’s geographic remit. In June 2020, the Islamic State appointed Shahab al-Muhajir as ISKP’s new emir following the capture of his predecessor, Aslam Farooqi. Al-Muhajir was previously an ISKP planner for attacks in urban areas in Kabul, and reportedly was once a mid-level commander in the Haqqani Network. Throughout 2020, ISKP successfully executed high-profile attacks despite controlling little territory. These included a May 2020 attack on a Kabul maternity ward that killed 24 people and an attack on Kabul University in November 2020 that left 22 people dead.

In June 2021, the United Nations estimated that ISKP consists of a core group of fighters numbering between 1,500 and 2,200 based in provinces such as Kunar and Nangarhar. These fighters are dispersed into relatively autonomous cells operating under the Islamic State banner and ideology. While these groups lack the capability, coordination, or local support to control significant territory, they retain the ability to launch individual attacks, such as the August 26 attack on Hamid Karzai International Airport in Kabul that killed approximately 170 Afghans and 13 U.S. military personnel.


ISKP is a wilayah (province) of the Islamic State, and Khorasan specifically refers to the historical region extending across parts of Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan, and Iran. ISKP adheres to the broader Islamic State’s ideology, which seeks to establish a global, transnational caliphate that is governed by Islamic jurisprudence. The Islamic State’s motto, “baqiya wa tatamaddad” (remaining and expanding), calls on other Muslims to migrate to the group’s fledgling caliphate. The caliphate, however, must be a “pure Islamic State” in which members must strictly observe sunna (the Prophet’s traditions). In 2016, the Islamic State issued a list entitled “Aqidah wa Manhaj al-Dawlah al Islamiah fi al-Takfir” (Islamic State Creed and Methodology of Takfir), which stated that anyone who rejects sharia law will be labeled as kafir (an apostate) and can be executed as a result.

The Islamic State formed as an offshoot of al Qaeda that diverged ideologically, including in its belief in violence against Shia civilians. Although both groups advocate a violent struggle against the “far enemy” (the West), the Islamic State also emphasizes fighting the “near enemy” (apostates in the region). The Islamic State operates under a global offensive jihad to rid its territory of both foreign infidels—nonbelievers of Islam—and apostates and endorses violence against the local community if they object to the adherence to sharia and do not conform to Islamic State dogma. For example, ISKP has launched numerous attacks on members of Afghanistan’s Hazara Shia minority.

The Islamic State’s—and subsequently, ISKP’s—commitment not to compromise with the West initially attracted some former Taliban members outraged with negotiations in Afghanistan. ISKP condemned the Taliban’s peace negotiations with the United States in its March 2020 newsletter al-Naba, stating that the Taliban and the [U.S.] “crusaders” are “allies.” In 2021, ISKP propaganda specifically vowed retaliation against the Taliban for their peace deal with the United States. Furthermore, ISKP subscribes to the concept of tawhid al-hakimiyyah (the unity of governance) and rejects a Muslim leader who does not rule by the entirety of sharia law. ISKP refuses to acknowledge the Taliban as a legitimate Islamic leader and accuses the Taliban of being “filthy nationalists” for only appealing to a narrow ethnic and nationalistic base instead of committing to a universal Islamic jihad.

Organizational Structure

ISKP maintains a hierarchical leadership structure, led by an emir—currently Shahab al-Muhajir. ISKP’s senior leadership consists of a Shura Advisory Council, in addition to commanders at the provincial level and leaders responsible for various functional elements of ISKP’s bureaucracy, such as intelligence and logistics. While early leaders of ISKP largely hailed from the core group of TTP commanders who founded the group, this has since diversified, and al-Muhajir is believed to be of Arab descent—the first time ISKP has been led by a commander from outside the region. One 2016 analysis of the group found that a majority of mid-level ISKP leaders were former Taliban fighters. More recent examinations of the group’s leadership have found an even broader range of prior group affiliations, including former Lashkar-e-Taiba and al Qaeda in the Indian Subcontinent fighters. These fighters often have significant local knowledge and expertise in insurgent warfare, raising their tactical efficacy.

ISKP has found recruitment success through exploiting divisions between existing jihadist groups, offering cash incentives, and promoting battlefield gains by the Islamic State’s core group in Iraq and Syria. While there are some foreign fighters in ISKP’s ranks, this recruitment has been likened to a “trickle” rather than a windfall, and the destruction of the Islamic State territorial caliphate in Iraq and Syria did not spur a large influx of Islamic State fighters to Afghanistan. As a province of the Islamic State, ISKP maintains contact with Islamic State leadership in Iraq and Syria but also retains a degree of freedom in the conduct of its operations. For example, unlike other Islamic State affiliates in Asia, ISKP has rarely utilized women fighters in combat.

ISKP relies on several revenue streams to finance its operations. The U.S. Department of the Treasury assesses that ISKP raises funds through a combination of local donations, extortion, and financial support from core Islamic State leadership. Additionally, the Treasury concludes that ISKP held modest financial reserves as of 2020 while also relying on a significant network of hawalas—informal money brokers—in cities like Kabul and Jalalabad to transfer funds.

Tactics and Targets

Although its strength has declined since its zenith in 2018, ISKP continues to plan and conduct attacks in Afghanistan. ISKP fighters frequently conduct remote explosive and suicide bomb attacks against civilian targets and security and militant forces. For example, ISKP claimed responsibility for a May 14, 2021, explosion during Eid al-Fitr at a mosque on the outskirts of Kabul that killed 12 civilians and wounded at least 20. Other attacks on civilians have involved the use of firearms, beheadings, and violent abductions. On June 8, 2021, for example, ISKP gunmen opened fire on predominantly Hazara deminers in Baghlan Province, killing 10 and injuring 16 others. ISKP also engages in armed clashes with security forces, the Taliban, and other militant groups, though these became less frequent following ISKP’s defeats and loss of territory in 2018.

From January 2020 to July 2021, ISKP conducted 83 attacks, resulting in 309 fatalities. As shown in Figure 1, these attacks have primarily targeted civilians (35 attacks) and security forces (28 attacks), including NATO troops and Afghan military, law enforcement, and other security forces. Thirteen of the incidents since January 2020 were attacks or violent clashes against Taliban forces.

These data do not include the August 26 attack at Hamid Karzai International Airport that killed at least 183 people—the most in a single ISKP attack, which made August 2021 the deadliest month for the group since July 2018.

Like other Salafi-jihadist groups, ISKP has celebrated violent attacks against the West, but its attacks remained local. Figure 3 provides a heat map of ISKP attacks in Afghanistan since 2017, which have predominantly occurred in Kabul, the eastern provinces of Nangarhar and Kunar, and in and around the northern province of Jowzjan. Attacks in Kabul have primarily targeted civilians and security forces, while violence in Jowzjan has centered around violent clashes with Taliban forces. ISKP activity in Nangarhar and Kunar—which make up the group’s historic base of operations—has been more frequent and more diverse, including attacks against civilians, security forces, the Taliban, and other militant groups.

Source: ACLED, “Data Export Tool.”

Threat Assessment

In the immediate term, ISKP poses a threat to Afghan civilians and the fledgling Taliban government in Afghanistan. ISKP is likely emboldened by the success of its August 26 attack at the Kabul airport and will attempt to take advantage of the political instability and lack of counterterrorism efforts following the U.S. withdrawal to challenge Taliban control. ISKP will likely continue to plan and conduct attacks as well as expand recruitment efforts, but its success will depend on several factors, including the Taliban’s speed and success in establishing a government, local and regional counterterrorism efforts, and ISKP’s ability to manage its image among a population that it has historically struggled to recruit.

ISKP has historically fought other jihadist groups—particularly the Taliban—to expand its market share in the militant ecosystem. This competition has been buttressed by a long-standing propaganda effort to brand the Taliban as nationalists with narrow parochial interests in Afghanistan—contrasted with ISKP’s global aims. This struggle is likely to continue, with ISKP attempting to brand itself as an uncompromising fighter and parlay that narrative into a recruiting tool. The withdrawal of U.S. and partner forces from Afghanistan has also opened a power vacuum that could plausibly embolden groups such as ISKP to challenge the Taliban for power and territorial control, renewing their competition and potentially plunging the country deeper into civil war. As shown by ISKP’s historical target selection—including high-profile attacks against hospitals, schools, and airports—violence against civilians will be a probable component of this competition, further compounded by the Taliban’s disregard for human rights. If the Taliban are able to rapidly and competently consolidate control and establish a central government, ISKP’s competitive prospects could be limited, though ongoing violence would remain likely.

The reduction in the international counterterrorism and intelligence footprint in Afghanistan—and specifically, counterterrorism operations against ISKP—could also give the group strategic breathing room to regroup and increase its attack frequency. Previous analyses have found that counterterrorism operations and the resulting deaths of ISKP leaders have been a contributing factor in reducing the number of ISKP attacks in Afghanistan and Pakistan. Although the United States conducted a drone strike against an unnamed ISKP planner on August 27, 2021, the U.S. government lacks longer-term plans to continue counterterrorism efforts in the country or to maintain its current level of intelligence collection on local terrorist threats. The degree to which ISKP is able to regroup in the absence of Western counterterrorism efforts will also be impacted by how well the Taliban and other regional governments, including Pakistan and China, implement additional counterterrorism campaigns targeting ISKP fighters. The congressionally mandated Afghanistan Study Group, in its final report, assessed that the Taliban “would be challenged to contain [ISKP] without additional support.”

Furthermore, ISKP will likely attempt to preserve resiliency through its “replenishable and diverse recruitment pipeline” that draws large numbers of experienced militants from existing groups on both sides of the Afghanistan-Pakistan border. With the reduction in international counterterrorism pressure, ISKP’s recruitment pipeline could prove sufficient to inject a much-needed boost of fighter talent into ISKP’s ranks, cement the group’s durability, and increase violence levels. Nonetheless, ISKP has previously struggled to recruit within Afghanistan and Pakistan due to its lack of popularity as a foreign terrorist group, although there are some signs that ISKP has recently made limited local inroads, notably with younger urban Afghans. If ISKP is unable to expand its local base—and especially if the Taliban and other regional governments make a concerted effort to restrict its foreign recruitment efforts—ISKP may be constrained in its activity and growth.

Recent ISKP activity highlights the importance of maintaining robust counterterrorism and intelligence collection plans in the region despite the U.S. withdrawal from Afghanistan. Although ISKP does not directly threaten the U.S. homeland, it does pose an acute threat to U.S. regional interests and will likely contribute to instability and a growing terrorist ecosystem in Afghanistan in the near term.

Catrina Doxsee is a program manager and research associate with the Transnational Threats Project at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Jared Thompson is a research associate with the Transnational Threats Project at CSIS. Grace Hwang is a program coordinator and research assistant with the Burke Chair in Strategy and Transnational Threats Project at CSIS.

Jared Thompson

Jared Thompson

Former Research Associate, Transnational Threats Project