“Our battle today is one of attrition and stretching the enemy,” Baghdadi said in the April 2019 video, released just after the fall of the Islamic State’s last stronghold in Syria. “They should know that jihad is ongoing until the Day of Judgment.”
Friday’s bloodbath at a suburban Moscow concert hall is but the latest reminder of how effectively Baghdadi’s brutal vision is being carried out. While his self-proclaimed Middle East “caliphate” is in ruins, a constellation of Islamic State regional affiliates is gaining strength in many parts of the globe, fueled by a mix of traditional grievances as well as new ones, including the war in Gaza, counterterrorism officials and experts say.
Some Islamic State chapters or “provinces” in Africa now support large, well-equipped armies. Especially in West Africa and the Sahel region, they have repeatedly shown an ability to seize and hold territory and beat back government forces when they try to intervene, counterterrorism officials and experts say.
By contrast, Islamic State-Khorasan — the hyperviolent strain linked to the Moscow attack, known commonly as ISIS-K — appears to be increasingly specializing in external attacks. The group has dispatched terrorist operatives to Russia, Iran and Turkey while also plotting attacks against Western countries, including the United States, U.S. intelligence reports show. In two attacks just so far this year, in Iran and Russia, ISIS-K terrorists targeted large groups of civilians, killing nearly 250 people — assaults that were celebrated by the Islamic State’s propaganda organs as proof that the group is again on the ascent.
“For ISIS, these operations are its way of sending a message to the world that it remains a relevant, deadly threat,” said Rita Katz, an expert on violent extremist organizations and founder of SITE Intelligence Group, which monitors and analyzes social media postings by the Islamic State.
ISIS-K, the most operationally oriented group, is rapidly evolving by establishing cells and seeking recruits across Central Asia, specifically those who speak Tajik, Uzbek, Farsi and other local languages, she said. “Today it is a deadly and capable ‘province’ whose tentacles reach across Central Asia, including in regions of former Soviet states,” Katz said.
The Islamic State quickly claimed responsibility for Friday’s rampage through the Crocus City Hall concert venue in Krasnogorsk, a few miles west of central Moscow. U.S. counterterrorism officials say they believe it was ISIS-K, specifically, that recruited the four gunmen who fired automatic weapons at concertgoers before setting fire to the building, killing at least 139 in one of the deadliest terrorist attacks in the history of modern Russia.
More attacks may be coming, counterterrorism officials warn. In a development that has been largely overshadowed by the conflicts in Ukraine and Gaza, ISIS-K and other regional groups have been expanding in size and ambition in recent years.
In the past 12 months, the Islamic State has claimed responsibility for more than 1,100 attacks that killed or wounded nearly 5,000 people globally, according to a terrorism monitoring project launched last week by the Washington Institute for Near East Policy (WINEP), a think tank. An Islamic State group in Mali, in North Africa’s Sahel region, seized portions of two provinces last year, and other African affiliates have taken over towns in Somalia and in Mozambique’s Cabo Delgado regions, according to WINEP researcher Aaron Zelin.
Even in Syria and Iraq, where thousands of the group’s fighters dispersed after a four-year campaign by a U.S.-led military coalition, the Islamic State remains a potent threat, said Dana Stroul, the Pentagon’s deputy assistant secretary for the Middle East during the first three years of the Biden administration.
“The group remains capable of planning and executing small-scale attacks,” Stroul said. Islamic State leaders in Syria appear particularly focused on engineering breakouts at prisons and detention camps, she said, noting that such facilities in eastern Syria collectively house 9,000 seasoned veterans of the Islamic State’s terrorist army.
But it is ISIS-K that has emerged as the Islamic State’s main affiliate for conducting external attacks. Friday’s assault near Moscow comes two months after a pair of suicide bombers killed 100 people at a memorial ceremony in southeastern Iran, an attack also linked to ISIS-K.
The splinter group was founded in Afghanistan in 2015 and emerged as a violent antagonist to the country’s Taliban leadership after the 2021 U.S. withdrawal from Afghanistan. While the Taliban has succeeded in killing many of the group’s leaders, ISIS-K has adapted by establishing roots across neighboring countries that were once part of the Soviet empire.
For ISIS-K and its parent organization, the targeting of Russia is deliberate. Islamic State propaganda has railed against Russian President Vladimir Putin since Moscow intervened in Syria’s civil war in 2015, sending bomber aircraft and helicopters to attack rebel groups opposed to Syrian President Bashar al-Assad. The rebels included an array of Islamist militias, including Islamic State fighters and groups backed by al-Qaeda.
Assad ultimately prevailed, mostly due to military assistance from Russia and Iran, Syria’s closest ally. Islamist groups since then have repeatedly condemned Putin as having the blood of Muslims on his hands.
Many also remember Putin’s harsh campaign against Muslim Chechen separatists in Russia in the early 2000s. Chechen militants carried out three deadly suicide bombings in Moscow’s Metro in the 2000s, and staged a mass hostage-taking at a Moscow theater in 2002. Russia’s deadliest terrorist attack was carried out by Chechen militants who besieged a school in the town of Beslan in the northern Caucasus region in 2004, holding 1,100 people hostage. The siege ended in a violent assault that left nearly 350 people dead, many of them children.
More recently, ISIS-K appears to have assumed the mantle as chief avenger. In September 2022, ISIS-K claimed responsibility for a bomb attack outside the Russian Embassy in Kabul, which killed two employees and three other people. Last year, ISIS-K set up a Tajik-language propaganda network, ramping up efforts to recruit members in autocratic Central Asian states, which the group portrays as Moscow’s puppets. Multiple Telegram channels in Tajik, Uzbek and Russian transmit Islamic State propaganda and glorify Tajik militants who have taken part in attacks in Afghanistan, Iran, Tajikistan and Uzbekistan.
The four men accused of carrying out Friday’s attack were identified in Russian media as Tajik migrant workers, at least three of whom had Russian registration papers.
The attacks highlighted Russia’s continued vulnerability to attacks by Islamist militants. Russian officials have not attributed Friday’s attack to any specific group. Late Monday, Putin acknowledged that the weekend assault was carried out by “radical Islamists,” while asserting without evidence that Ukrainian operatives may have provided assistance — an accusation that Ukraine has vehemently denied. Since the arrest of the four suspects, images and video showing the perpetrators before and during the attack have been posted online by the Islamic State-linked media outlet Amaq News Agency, appearing to confirm their identity.
Despite the arrests, in an indication of Moscow’s ongoing concern, Putin on Saturday called leaders of Kazakhstan, Uzbekistan, Tajikistan, Turkey and Syria, all nations where Islamic State militants are known to operate or to recruit members. In recent years, Russia’s Federal Security Service also has reported multiple operations against Islamic State militants, including an ISIS-K cell in Kaluga, southwest of Moscow, this month, which was allegedly planning an attack on a Moscow synagogue.
At a meeting of security officials last October, FSB director Alexander Bortnikov warned that ISIS-K members now numbered more than 6,500 and could start launching attacks outside of Afghanistan “in the near future.” U.S. intelligence reports, some of them leaked last year on the Discord messaging platform and obtained by The Washington Post, also cited ISIS-K plots targeting European and Asian countries as well as “aspirational plotting” against the United States.
The leaked documents revealed specific efforts to target embassies, churches, business centers and the 2022 FIFA World Cup soccer tournament, which drew more than 2 million spectators in Qatar.
Neither the Islamic State nor ISIS-K have linked the Russian attacks to the ongoing fighting in Gaza. But the deaths of Palestinian Muslims during Israel’s retaliatory campaign against Hamas have prominently featured on social media platforms as incitement for new waves of terrorist attacks, including against Western countries.
While the Islamic State has historically opposed Hamas because of its Iranian ties, ISIS spokesmen have lionized Hamas’s Oct. 7 attack on Israel as a model for a low-tech terrorist campaign that produces high numbers of casualties and generates enormous media attention, according to Middle Eastern and European intelligence officials.
“Hamas has succeeded in being in the media for months now, and that has created a situation where other jihadist groups feel the need to prove to their followers and members that they can also hit strong countries,” said an Arab intelligence official, speaking on the condition of anonymity because he was not authorized to speak to the media.
A European intelligence official, who also spoke on the condition of anonymity to discuss sensitive information, said his government expected that aspiring terrorists, enraged by Gaza, will draw inspiration from the events at the Moscow concert hall. Likewise, he said, the attack could provide fresh encouragement for Islamic State factions competing with one another for money, recruits and recognition.
“We have unfortunately to prepare ourselves,” the official said, “for a scenario where there will be other attempts made.”
Dixon reported from Riga, Latvia. Warrick and Mekhennet reported from Washington.
