STRATEGIC ASSESSMENT. Islamic State has claimed responsibility for a terrorist attack at a Moscow concert hall that left as many as 133 people dead and injured many others. U.S. officials have pointed to Islamic State Khorasan (IS-K) as the perpetrator, and IS released bodycam footage of the attack. Based on videos of the attack, the terrorists appeared to be well-trained, moving methodically as they shot their victims. One of the militants used an incendiary device to set the concert hall on fire. The attack was reminiscent of spectacular terror attacks conducted by Chechen militants in the 2000s, including the hostage crisis at Moscow’s Dubrovka theater in October 2002. Russia has long struggled with jihadist terrorism and has waged an on-again, off-again counterinsurgency in Russian republics such as Chechnya, Dagestan, North Ossetia, and Ingushetia over the years. Islamic State included many militants from the former Soviet Union among its ranks and Russian was the second most common language used in Islamic State schools during the height of the group’s so-called caliphate. IS-K has been fixated on Russia for the past several years, frequently criticizing Putin in its propaganda. IS-K accuses the Kremlin of having Muslim blood in its hands, referencing Moscow’s interventions in Afghanistan, Chechnya, and Syria.
Over the weekend, Russian President Vladimir Putin claimed that all four attackers had been apprehended. The militants are believed to be part of IS-K’s Central Asian network, which spans Tajikistan, Kyrgyzstan, and Uzbekistan and extends throughout the Caucasus. In line with the so-called “duty to warn,” U.S. intelligence officials provided a warning to Russia weeks before the attack after collecting and analyzing intelligence related to the Islamic State. However, Russian security services were unable to prevent the attack in what many have labeled an intelligence failure. In its aftermath, there has been an onslaught of disinformation, some pushed by the Kremlin itself, about the role of Ukraine in the attack, a claim for which there is no evidence. Putin could use the attack as a further pretense to consolidate control in Russia, coming just a week after its recent election, further solidifying the Russian dictator’s power and weeks after the death of outspoken Kremlin critic and Russian opposition figure Alexei Navalny.
The Moscow attack is another sign that Islamic State’s Afghan branch is rebuilding its external operations capability and remains perhaps the most potent of all Islamic State’s affiliates and branches that comprise its global network. The group has launched multiple terrorist attacks throughout the region, including firing rockets at both Tajikistan and Uzbekistan. IS-K has also targeted foreign interests within Afghanistan. In September 2022, an IS-K suicide attack struck the Russian Embassy in Kabul, leaving two employees and four Afghan civilians dead. In December 2022, IS-K attacked the Pakistani embassy in a failed effort to assassinate Islamabad’s chief diplomat. That same month, IS-K attacked a hotel in Kabul predominantly frequented by Chinese nationals, demonstrating the group’s intent and capabilities to after foreign targets. IS-K has also attempted to tap into extremist networks on its periphery, including in Bangladesh, India, the Maldives, Myanmar, and Sri Lanka. In early January, the group attacked a memorial to the late Islamic Revolutionary Guard Corps Quds Force (IRGC-QF) commander Qasem Soleimani in Kerman, Iran, killing 84 people. As with the attack in Moscow last Friday, U.S. intelligence also warned Iran of the threat in the lead-up to the Kerman attack. Later in the month, IS-K attacked a Roman Catholic church in Istanbul, killing one and leaving Turkish authorities scrambling to unravel an Islamic State network in the country.
IS-K has also been linked to a growing number of European plots, including one earlier this month where two individuals were arrested in Germany for planning a terrorist attack on Sweden’s parliament. The individuals are Afghan citizens and, according to Germany’s Federal Minister of the Interior, one of them is a suspected member of IS-K. This comes after a separate arrest on New Year’s Eve, where German authorities detained three men in the state of North Rhine-Westphalia over alleged plans to attack the Cologne Cathedral. That plot was linked to another three terror arrests in Austria and one in Germany that took place on December 24. The four individuals were reportedly acting in support of IS-K. In July 2023, Germany and the Netherlands coordinated arrests targeting an IS-K-linked network suspected of plotting attacks in Germany. German police halted a plan to attack U.S. and NATO military bases in Germany in April 2020. The four Tajik nationals were reported to be in contact with Islamic State officials in Afghanistan and Syria. Since the withdrawal of U.S. troops from Afghanistan in August 2021, which was punctuated by an IS-K suicide attack at Abbey Gate that killed 13 U.S. servicemembers, Western intelligence agencies have struggled to gain a clear picture of how jihadist networks are evolving in the country. The Taliban, unsurprisingly, has proven to be an ineffective counterterrorism force, and the Islamic State’s network has spread from Afghanistan throughout the broader region (TSC).
