What Moscow attack suggests about ISKP and emerging terror threats

ABOUT 14 HOURS after the March 22 terrorist attack at Moscow’s Crocus City Hall, Russia announced the arrest of four suspects, all Tajik citizens living in Russia. The men, who according to Russian security agencies were trying to flee to Ukraine, confessed to the crime in which at least 144 people were killed and 550 injured in the space of 20 minutes.

Later that day, the Islamic State (IS) claimed responsibility for the attack on proistelegramchannels,butdidnotlinkittoany affiliate. However, ‘IS watcher’ social media accountssoonstartedattributingtheattackto Islamic State Khorasan Province (ISKP).

Russian investigators put forward testimonies of the suspects and the forensics of their phones to point fingers at the

Ukrainian Special Services. The handler, whom the suspects identified by the nom de guerre Saifullo, had allegedly selected the target, supplied the weapons, promised them a million rubles each, and had given detailed instructions for them to reach the border with Ukraine, where they would be helped to cross over.

The claims about the ISKP and Russia’s accusation against Ukraine have raised important questions. Why did pro-is accounts claim the attack? Why was it attributed to ISKP? What kind of threats and concerns do they indicate?

First, was it the Islamic State?

The suspects did not raise jihadist slogans — and even though they could have caused greater damage, they did not stay to fight to the finish as security forces arrived on the scene. The gunmen demonstrated only an ability to shoot randomly with automatic weapons, and were not suicide bombers. According to Russian investigators, the attackers’ motivation was prima facie money.

Some pro-is accounts had claimed early on that the suspects had escaped. But they were caught hours later, suggesting that the handlers had limited access to the suspects beyond their getaway from the site. This modus operandi does not match with that of classic IS attacks on such targets.

Since the end of the “caliphate”, the IS and its affiliates have claimed several attacks, but the credibility of such claims have rarely been confirmed by investigators. IS watcher accounts and some data consortiums continue to document these claims and to attribute unclaimed attacks to the IS to suggest the strength and expanse of the operations of the IS. Many such claims are made by ‘lone wolves’ — either individuals or cells — who pledge allegiance to the IS to claim legitimacy for violent actions.

Why the attribution to ISKP?

On March 7, the US embassy in Moscow had warned of a possible non-specific attack in the Russian capital. Around the same time, Russia had claimed to have neutralised an ISKP cell consisting of two Kazakhs who were allegedly planning an attack on a synagogue.

After the Crocus attack, when claims were made on behalf of the IS, some watcher accounts started to attribute the operation to ISKP. This gained strength after some PROISKP accounts started issuing multi-lingual threats to Russia for torturing the suspects.

Over the last few months, ISKP has either claimed or has been blamed for more than 20 “external” attacks — which means attacks outside Afghanistan, where ISKP was born in 2015. However, these claims or attributions have not been backed by evidence.

Following the Taliban takeover, the ISKP claimed a major suicide attack at Kabul airport on August 26, 2021, in which 13 US troops and more than 170 Afghans were killed. Attacks on the taliban and soft targets such as the sh ia Hazara followed over the next 18 months, which earned the taliban rebuke from the us for failing to deliver on counter-terrorism assurances made under the Doha agreement.

By 2023, the Taliban appeared to have curbed the ISKP. The Global Terrorism Index, 2023 found ISKP responsible for only 7% of the total deaths caused by the IS and its affiliates worldwide. Despite its current low operational capability in Afghanistan, however, the ISKP has continued to publish multilingual propaganda threatening the Taliban, as well as countries in the region and the world.

It also appears that the propaganda has helped the ISKP recruit cadres for so-called “external” attacks, which is evidenced by the arrests this week in Afghanistan of two Tajik nationals who were recruited online while in Russia. These individuals were guided to Afghanistan as making the “Hijrah to IS territory” and from there to Quetta in Pakistan for training. One of the men was caught while crossing into Iran, and the other while on his way to Quetta.

What are the emerging threats and concerns after the Moscow attacks?

The Russian investigators have pointed a finger at the alleged “mastermind”, but that does not rule out the possibility of involvement of a mercenary group. A deeper questioniswhethertheisanditsaffiliatesareturning to mercenary recruitment, or have acquired mercenary interests by using their abilities, cadre, and propaganda machine.

The attack has presented a ‘quick-damage-and-withdraw’ model for urban warfare that may be used elsewhere. PRO-ISKP accounts have called for attacks on football stadiums in London, Paris, and Madrid during the ongoing UEFA Champions League. This may encourage lone wolves or radicalised individuals to carry out attacks. This week, the FBI arrested an 18-year-old who was on the radar for online IS radicalisation, who was enthused by the Moscow terror strike to carry out attacks on churches.

How do we then interpret the threat from the IS and its affiliates today? While claims by the IS and its affiliates cannot be taken at face value without investigating each case across countries, the excellent global counter-terrorism cooperation witnessed in the years after the 9/11 attacks does appear to be weakening. Mistrust among countries does not augur well at a time when multiple actors pose perhaps the gravest terrorist threat since the end of the IS caliphate.

Anju Gupta is a security analyst and a former Director General of Police