Islamic State Khorasan’s Westward Network Expansion Into Iran, Turkey, and Europe

The Islamic State attack on the Crocus City Hall music venue on the outskirts of Moscow, which killed at least 140 people and injured over 500 more, has prompted significant alarm among Western intelligence and security services about similar operations occurring in Europe and North America in the coming months. This concern is well-founded, given the aggressive campaign by the organization, its Afghanistan-Pakistan-based Islamic State Khorasan Province (ISKP), and pro-IS propaganda outlets threatening attacks and urging supporters to carry out acts of violence against the West – with a particular emphasis on sporting events.

In addition to ISKP’s lead role in the Crocus City Hall attack, the branch conducted a double suicide bombing in Kerman, Iran, on January 3 causing almost 400 casualties, and shot up a church in Istanbul, Turkey, on January 28. 

Since the Taliban takeover of Afghanistan in 2021, ISKP has pursued a regionalization and internationalization strategy in its propaganda production and militant operations. The latter part of this doctrine has led the branch to ramp up targets domestically against foreign diplomatic facilities and nationals, combined with the rapid acceleration of its external operation activities. The regionalization component of its campaign has largely been focused on South and Central Asia, but the branch has also been expanding westward and increasing its footprint and focus on Iran, Turkey, and Europe. This trend will likely continue and perhaps accelerate in the coming months and perhaps years, with considerable security implications across Eurasia and the broader West.

Iran

While considered an enemy of the Islamic State and ISKP since the organizations’ outset, ISKP in particular has made the Islamic Republic of Iran an operational and propaganda priority. Both the Islamic State and its Khorasan branch dedicate significant portions of their rhetoric toward maligning the “apostate” Iranian revolution and the government that followed. As a result of ISKP’s attention on the country, Iranian authorities have reported through state media multiple arrests over 2023 and 2024, allegedly interceding on plans for attacks, including within Tehran. 

On January 3, ISKP reportedly carried out the deadliest terrorist attack in Iran in decades with a dual suicide bombing outside the tomb of Major General Qassem Soleimani. Taking place during a ceremony to commemorate the late commander of the Quds Force, the attack left 103 people dead and wounded over 280 others. Since the bombing, Iranian and Taliban intelligence alleged that the individual perpetrators were from Tajikistan – a fertile recruiting ground for ISKP – while U.S. intelligence pointed to communication intercepts laying the blame on ISKP.

The following day, the Islamic State published martyr photos and details related to the two purported attackers. The Islamic State also included the attack in an infographic outlining the global death toll from January 1 to 10, as part of its “Kill Them Wherever You Overtake Them” campaign, a self-described reaction to the war in Gaza. 

Iran responded with a series of publicly lauded crackdowns, including the April 4 arrest of an individual identified as Mohammad Zakir, alleged to be a member of the Islamic State. BBC Persian later quoted authorities stating Zakir had “no connection” to the Islamic State. 

Within Iran, ISKP has targeted sites important to Shia Muslims and Iranian nationalism with varying degrees of success. In August 2023, a lone gunman walked into Shiraz city’s Shah Cheragh shrine, a Shia pilgrimage site, where he shot four people, killing one. This was a follow-up to the year before when, in October 2022, a Tajik national entered the shrine with an automatic rifle, killing 13 and injuring 40 pilgrims and staff on site. Like other operations, the Islamic State’s central media claimed the operation. Iran later publicly executed two Afghan men they claimed aided in the attack and were in contact with the Islamic State in Afghanistan – though the validity of the pair’s confessions is strongly disputed.

Attention from the larger Islamic State on Iran is far from a new occurrence. It has previously claimed a number of other attacks on the country, including a September 22, 2018 strike against a military parade, killing 25, roughly half of which were Islamic Revolutionary Guards Corps (IRGC) members. Iran blamed a different separatist movement for the attack. In its targeting of Iran, ISKP cites the country’s Shia majority, relationship with Russia, and its military interventions against the Islamic State, including direct military involvement and backing of anti-Islamic State militias in Iraq. 

The means used to fund ISKP’s Iran operations are not completely clear. ISKP typically funds its operations in and outside of Afghanistan through internal donations, funding from other Islamic State branches, informal hawala money transfers, and fundraising cryptocurrencies through its media affiliates. Analysis of the weapons for terror attacks, like the recent Crocus City Hall attack, indicates they were likely sourced locally. 

What is apparent is that ISKP’s Iran operations typically follow a pattern of using foreign nationals from Central Asia to enter the country to carry out operations. Relations between the governments of Iranian President Ebrahim Raisi and Tajik President Emomali Rahmon are generally considered to be warming after years of reported tensions between Tehran and Dushanbe. The countries relaxed their visa requirements for travel and held negotiations in 2023 around a series of other cooperation documents ranging from trade to transportation. Public statements from this time identified Afghanistan as a mutual area of concern.

Turkey

The Islamic State’s repositioning of its operational center has transformed Turkey into an outpost for the group through ISKP. Central Asians have individually carried out attacks for ISKP, including the Istanbul airport and the Reina attacks, while ISKP is also expanding its efforts to recruit in Turkey. 

ISKP mainly targets two groups of people in Turkey for recruitment: ethnic Central Asians fleeing Syria and Iraq and arriving in Turkey between 2017 and 2019, as well as people from Afghanistan who have been entering the country through illegal migration routes since 2021. ISKP recruitment campaigns generally take place around Istanbul, Izmir, and Ankara and in districts such as Zeytinburnu, Başakşehir, and Esenyurt in Istanbul, where there is a high concentration of people of Central Asian and Caucasian origin. 

On January 28, two masked men entered the Church of Santa Maria, a Roman Catholic church in Istanbul. Drawing a pistol, one of the attackers fired into a crowd gathered for Sunday mass. The strike left one person dead and another injured. Despite the results of investigations following the Santa Maria and Crocus attacks and the focus on the Islamic State’s new Central Asian recruits, it is currently very difficult to identify ISKP cells in Turkey.

After the Santa Maria attack, Turkey detained 51 people related to the attack. Twenty-three were deported and 28 were arrested. In the wake of the Crocus City Hall attack, Turkey carried out dozens of anti-IS operations in some 40 provinces and arrested a total of 363 people. The detainees are reportedly of Tajik, Uzbek, Caucasian, Syrian, and Iraqi origin, according to Turkish security sources.

Turkish officials said those detained who had links to ISKP were mainly Tajik nationals, but also included Uzbeks, Turkmen, Uyghurs, and Afghans, many holding different passports. For example, on April 6, 48 ISKP affiliates were detained in an operation carried out in connection with the investigation into the Santa Maria Church attack. According to Turkish officials, 30 of them were of Tajik, Uzbek, Uyghur, and Turkmen origin. Almost half of them, officials said, had residence permits. Based on information from a source familiar with the matter, two of the 30 Central Asian detainees also have Turkish citizenship.

ISKP’s financing and recruitment network in Turkey are closely interlinked in many respects. Shamil Hukumatov, who was arrested in the summer of 2023, was responsible for organizing the flow of fighters and money from Turkey to Afghanistan and ISKP operators from Afghanistan to Turkey. Before Hukumatov, a network run by Ismatullah Khalozai was engaged in financial and organizational activities on behalf of the ISKP in 2021.

ISKP’s financial activities in Turkey take several forms. While some funds are collected under threat, other money is collected through businesses. Capital from Turkey to ISKP typically flows through the informal hawala system as well as cryptocurrencies.

On February 6, the Istanbul Security Directorate detained 11 Islamic State suspects residing in Istanbul, including 11 from Russia, four from Uzbekistan, one from Kyrgyzstan, one from Azerbaijan, and one from Sudan, for providing financing for ISKP.

According to a source familiar with the issue, a large part of ISKP’s finances are used in Turkey to recruit new members. ISKP cells made up of Central Asian migrants recruit people in need of economic support. At the same time, they raise funds outside the communities where the recruits are located. The cells are quickly exposed when funding and recruitment activities are combined, as in some cases in Başakşehir.

ISKP was able to carry out the Santa Maria attack on behalf of the Islamic State, despite Istanbul Police Department’s counterterrorism teams carrying out operations six months before the church attack. In that operation, targeting the Güvercintepe neighborhood of Istanbul’s Başakşehir district, where ISKP cells in Turkey were heavily present, 12 people of Kyrgyz, Tajik, and Uzbek nationality were detained.

Islamic State-affiliated media began publishing in Turkish as ISKP expanded its activities within Turkey. The March 30 and April 11 issues of ISKP’s Voice of Khorasan magazine were also published in Turkish. A source close to the Islamic State said that the Turkish editions of Voice of Khorasan magazine are translations of the Islamic State’s Turkish media team, Meydan Media.

Though ISKP strengthened has its finance, logistics, recruitment, and propaganda in Turkey, the Islamic State still defines the Turkish state as a taghut – a tyrant and enemy of Islam. Turkey is a target for militants from the Levant and from other countries who travel to join ISKP.

Europe

The West and Europe have been major focal points of the Islamic State for years. However, since the military campaign in Gaza began, the Islamic State has urged supporters to conduct attacks inside Israel, against Israeli embassies, and “target the Jewish presence throughout the world, whatever the form.” Over the same period, ISKP propaganda has been channeling this anger toward the West, emphasizing how many Western powers support Israel financially and militarily. Part of a larger campaign across the Islamic State, the group called for attacks against Western and Jewish populations in its official al-Naba weekly newsletter. While offering a broad spectrum of advice, the Islamic State urged supporters in the West to carry out acts of violence as revenge for the U.S.-led coalition’s war on the Islamic State and Western support for Israel.

ISKP continues to emerge as a leader in the Islamic State’s external operations and has been intensifying its efforts to incite violence against the West and Jewish populations. In its English-language magazine, Voice of Khorasan, ISKP included an instructional infographic directing supporters to target Jewish communities, business interests, and Westerners. In particular, it asks supporters to target large gatherings of people including concerts, universities, and tourist sites with knives, petrol bombs, Molotov cocktails, vehicles, firearms, and more. The same issue also featured a full-page image praising a  man who shot and killed two Swedish football fans in Brussels and threatening “Tomorrow for Crusaders,” with promises of future attacks on the West.

Islamic State spokesman Abu Hudhayfa al-Ansari, after the most recent Iran attack, urged listeners in an audio statement to seek out targets “on the streets and roads of America, Europe, and the world” and to “burn them with grenades and fiery agents, shoot them with bullets, cut their throats with sharp knives, and run them over with vehicles.” 

Immediately following the attack on the Crocus City Hall, ISKP’s Al-Azaim Foundation for Media Production renewed their threats of similar attacks against the West, particularly from lone actors, directing them to major sports stadiums, even including the logo of the Champions League next to images of a masked armed fighter.

ISKP has also directly threatened the European Cup in Germany and the Olympic Games in France, both taking place later year, while the Hallummu propaganda outlet told its readers to attack the “bleachers and games in stadiums.” Other ISKP images named venues to attack including Emirates Stadium in London, the Metropolitano Stadium and Santiago Bernabeu Stadium in Madrid, and Parc des Princes in Paris. 

Other pro-Islamic State publications name the “three entrances” of the Emirates Stadium and the “players’ point of arrival” as possible areas for attack, all aimed at creating as devastating a deadly public spectacle as possible.

ISKP propaganda is often released through its official outlets and collaborations with several pro-Islamic State media partners. In one graphic released after the strike against Russia, a lone figure examines multiple images of major European cities like London, Paris, Rome, and Madrid. Above the cities, the text reads “After Moscow … Who is Next?”

Other images are less specific but contain a clear message, including the final page of ISKP’s magazine showing a camouflage-wearing militant on a train with a box of explosives sitting on a seat beside him. In the background, a sign reads, “Welcome to Europe … Last call before exit [sic].”

While much Islamic State and ISKP propaganda inciting attacks is aspirational, there is both the precedent and motivation to carry out such an attack, including ISKP’s plot targeting the 2022 FIFA World Cup in Qatar. Since 2015, the Islamic State has conducted several attacks against major sporting events. This includes in November 2015, when Islamic State jihadists carried out a multi-pronged attack in Paris with suicide bombers detonating explosive vests outside the Stade de France during a football match while another group attacked a concert. In June 2016, two Islamic State supporters in Malaysia threw a grenade into a viewing of the UEFA Euro game. Perhaps most recently, on October 16, 2023, an Islamic State supporter shot Swedish soccer fans in Brussels claiming the violence as revenge for a series of public Quran burnings in Stockholm that same year.

More recently, militants allegedly linked to ISKP reportedly attempted to plan attacks in Europe during the December holidays. While many of the known plots were stopped by law enforcement, the attack against the Catholic church in Turkey went ahead in January. ISKP’s plans had the potential of being much deadlier than the already tragic outcome.

Threat Assessment

ISKP’s retooling from operations focused within its base of operations in Afghanistan and Pakistan to a focus on external attacks and operational plots has resulted in a surge of both foiled plots and successful attacks either claimed or attributed to ISKP over the past year. According to data collected by Aaron Zelin and Ilana Winter, in the year leading up to March 20, 2023, ISKP was behind at least 22 plots or attacks in nine different countries, up from eight the year before. Besides Russia, Iran, and Turkey, ISKP has been previously credited with attacks in the Maldives, Tajikistan, and Uzbekistan, while plots have been intercepted in Germany, the Netherlands, Qatar, Turkey, India, Kyrgyzstan, and Russia. Many of the most recent plots intended to target places of worship over the Christmas and New Year holidays.

Of the broad arrests and disrupted plots, many involved joint, cross-border planning conducted by the alleged ISKP members indicating a transnational network of support for the group’s operations. While much of the propaganda directed toward the West from ISKP’s English language publications focuses on inspiring lone-actor strikes against prominent targets, the multiple plots reportedly prevented by authorities indicate that ISKP is also motivated to carry out a directed attack in Europe. 

Part of the success ISKP has had in recruitment stems from an extremely active propaganda apparatus. Offering original media in Pashto, Arabic, English, Turkish, and many more languages, ISKP publications have been translated into even more; more than any other branch since the fall of the Caliphate. The successful attacks in Iran and Russia have been followed by waves of propaganda lionizing the attackers and their actions for the Islamic State and continue to target great powers like Russia, Iran, and Europe.

While several plots to date have been foiled by security authorities and law enforcement, ISKP has shown both the capability, intention, and persistence needed to carry out another successful attack. The recent attacks in Russia, Iran, and Turkey only serve as further inducement toward this goal.