The Islamic State in Afghanistan: A Jihadist Threat in Retreat?

What’s new? Since the Taliban takeover of Afghanistan in 2021, the Islamic State-Khorasan Province (IS-KP) has emerged as a major international security threat, orchestrating or inspiring attacks abroad following a Taliban clampdown on its home turf. Although its strikes have fallen in number in 2025, its offensive could resurge.

Why does it matter? Despite the recent lull, IS-KP might reactivate commanders willing to carry out attacks abroad or coordinate with other ISIS branches to launch them. Even a small number of high-profile operations – such as the March 2024 mass shooting and arson in Moscow – can cause numerous deaths and have major international repercussions.

What should be done? Coordination among security services has improved, particularly in intelligence sharing and rendition. There are strong reasons not to resort to military action, but more could be done in terms of collaborating with the Taliban and Syrian governments, redefining the global anti-ISIS coalition’s law enforcement role, and supporting Central Asian countries.

The Islamic State-Khorasan Province (IS-KP) has swiftly emerged as a leading jihadist threat to international peace and security, though of late its fortunes seem to be on the wane. Following the Taliban takeover of Afghanistan in 2021, IS-KP pulled back from an offensive in the country where it is based and shifted its focus abroad, increasingly targeting countries such as Iran, Russia and Pakistan, as well as attempting to strike both Europe and the U.S. While it retains only limited capabilities in the West, where it has faced a crackdown and relies on low-level recruits often drawn from minority communities, the group continues to pose a danger, especially as it learns to adapt to online surveillance and tightened law enforcement controls. While interstate coordination and intelligence sharing is improving – even among the Taliban, Russia and Western governments – more sustained collaboration is essential lest the group hatch new deadly attacks.

The first mention of IS-KP came in Afghanistan years before it transformed into an international threat, when the ISIS spokesman in Iraq and Syria announced its creation in January 2015. At the time, IS-KP and the Taliban agreed on the need to expel the U.S. forces stationed in Afghanistan. On priorities and other matters, however, differences between the two groups were stark. The Taliban struggled with IS-KP over leadership of the transnational jihadist movement as well as strategy, with the latter demanding that all jihadists pledge allegiance to ISIS in its global fight while the Taliban remained focused on the national battlefield. Unlike the Taliban, IS-KP also placed greater emphasis on attacking religious minorities and foreign civilians, including in Afghanistan’s neighbouring states. In the years just prior to the U.S. withdrawal in 2021, the Taliban and the U.S. surprisingly found common cause as each separately battled IS-KP in Afghanistan.

Since seizing control of the country, the Taliban have persisted with the crackdown on their rivals. After first adopting a harsh counter-insurgency approach, they refined their campaign over time, enabling themselves to kill or capture numerous IS-KP commanders in Afghanistan. Though IS-KP had conducted a handful of attacks abroad before the Taliban takeover, these rose steeply in number as the group’s leaders looked to compensate for their weakness on their home turf by doing damage elsewhere. Most notably, they launched large-scale, indiscriminate attacks on public gatherings in Iran and Russia, killing hundreds, though their attempts in Western Europe have so far been largely unsuccessful.

This shift toward foreign attacks aligns with broader changes within ISIS after the group lost its territorial strongholds in Iraq and Syria. Following the collapse of its so-called caliphate, ISIS has tried to restructure, decentralising its operations and handing more power to its branches, known as provinces. These provinces now operate with relative autonomy, guided by doctrines emanating from ISIS leaders. They also support one another through financial transfers, operational coordination and exchange of expertise. IS-KP stands out among these affiliates as the most outward-looking, with a unique position stemming from its strong links to the Middle East and ability to strike in Europe. A loosely knit network of IS-KP commanders still harbours international ambitions – sometimes independently, sometimes in partnership with other ISIS provinces. Even if the threat it poses, above all in Europe, pales in comparison to that of the jihadist movement a decade ago, the group has become a hub of ISIS’s evolving global strategy. 

More robust cooperation among states will be vital to continue containment of IS-KP or another ISIS branch that may seek to take its place. The group’s operations are largely driven by militants connected online. Fighting the group by military means – let alone renewing counter-insurgency in Muslim countries – is unlikely to be effective. Instead, law enforcement is essential, grounded in improved intelligence sharing, particularly with Central Asian countries, Pakistan and Türkiye. Engagement with the Taliban and Syria’s new government should also help disrupt ISIS networks. In parallel, the Global Coalition to Defeat ISIS — an alliance of 89 member states formed in September 2014 in response to the group’s rise— should adapt to the threat posed by more decentralised jihadist groups, including the possibility that IS-KP may be replaced or supplemented by other ISIS affiliates. Coalition members should improve mechanisms for tracking travel and financial flows and countering cross-border smuggling. They should also build the capacity of Central Asian countries to detect and disrupt IS-KP operations.

The group that calls itself IS-KP is one of ISIS’s main affiliates.[1] Emerging in 2015 in Afghanistan and Pakistan, a region already crowded with Islamist militants, its initial rivalry with the Taliban and al-Qaeda was driven not by disagreement over the cause of global jihad – which al-Qaeda also supports – but rather by competition for leadership of the jihadist movement.[2] The Taliban, who led the insurgency aiming to boot the U.S. military out of Afghanistan before seizing control of the country in 2021, refused to swear fealty to the ISIS caliphate and fought IS-KP to preserve their pre-eminence in the country.

At the time IS-KP was established, ISIS had already seized swathes of both Iraq and Syria, declared it had restored the Muslim caliphate, and started to forge alliances with local groups elsewhere to expand its sway.[3] Comprised at first of a mix of disenchanted Tehreek-e-Taliban Pakistan (TTP) commanders from rural Pakistan and Afghanistan, as well as educated urbanites and foreign fighters, IS-KP became the ISIS partner outfit in these countries.[4] The group also recruited members from the Islamic Movement of Uzbekistan (IMU) and commanders who had broken with the Afghan Taliban. For ISIS, establishing a branch in Afghanistan was crucial, due to the country’s symbolic significance for jihadists worldwide. Gaining a foothold there, or even supplanting the Taliban, was seen as a way to enhance ISIS’s credibility, enabling it to attract more jihadists to join its caliphate in other regions.

IS-KP and the Taliban sparred from the outset. At a time when the Taliban did not yet control Afghanistan, IS-KP claimed that the creation of a caliphate in Iraq and Syria meant that all other jihadist groups worldwide, including al-Qaeda and the Taliban, owed it their allegiance. Though both the Taliban and IS-KP opposed the Western military presence in Afghanistan, the latter also advocated jihad to establish a global Islamic state, whereas the Taliban were focused on setting up an emirate exclusively in Afghanistan. In the years that followed the group’s creation, IS-KP and the Taliban fought each other fiercely for control of the Afghan insurgency, especially in the eastern provinces of Kunar and Nangahar, with the Taliban largely keeping the upper hand.

To differentiate itself from the Taliban, IS-KP pursued its own priorities, notably by attacking Shia Muslims and extending operations beyond Afghanistan immediately after it emerged. Major incidents included a suicide bombing in Jalalabad, Afghanistan in April 2015, killing 33 people; an attack on the Pakistani consulate in Jalalabad in January 2016; a devastating bombing targeting Hazara Shia in Kabul in July 2016, killing 97; and the bombing of a Sufi saint’s shrine in Khuzdar, Pakistan, in November 2016, resulting in 55 deaths.[5]

IS-KP briefly gained in strength following the Taliban’s rise to power in August 2021, but since then Afghanistan’s new rulers have largely contained the group. After initially adopting a heavy-handed approach – including crackdowns on Salafis who were not necessarily aligned with the jihadist group – the Taliban fine-tuned their strategy. As a result, the Taliban have dismantled numerous IS-KP cells and killed key leaders.[1]

In the immediate, chaotic aftermath of the Taliban takeover, IS-KP proved adept at exploiting a temporary security vacuum – with hundreds of ISIS fighters escaping from jail. An attack by an IS-KP suicide bomber on Kabul airport, where tens of thousands had gathered to escape alongside the withdrawing international forces, killed 169 Afghan civilians and thirteen U.S. soldiers in August 2021.[2] That incident, alongside a string of other attacks in the early phase of Taliban rule, convinced the new authorities that IS-KP would pose the most serious threat to stability in Afghanistan after the war.

Lethal attacks launched by IS-KP in Afghanistan have been frequent, though death tolls have not generally been as high as those caused by the long-running Taliban insurgency against foreign forces. IS-KP has targeted foreign civilians in Afghanistan, including with strikes on Chinese and Russian nationals: examples include the December 2022 attack on a Kabul hotel hosting Chinese nationals and the May 2022 bombing near a Russian cultural centre in Mazar-i-Sharif.[3] In May 2024, the group attacked foreign tourists in Bamyan province, killing three Spaniards.[4] Before and after the Taliban takeover, IS-KP has also targeted international humanitarian workers, for whom it remains the main threat in the country.[5] 

These attacks seek to convey the message that the Taliban are not truly Muslim and that its government is not enforcing Islamic law. Instead, IS-KP portrays the Taliban as a Pashtun nationalist movement that defends religious minorities and foreign countries, such as China, which, it claims, are hostile to Islam.[1] The group argues that the Taliban spent decades telling young men to fight international troops because Muslims must struggle against Western influence; but now, according to IS-KP, the Taliban shake hands with foreign diplomats and try to prevent jihadists from using Afghanistan as a base for international attacks. This propaganda is aimed at fomenting splits among Taliban commanders, in the hope of prodding some to join IS-KP ranks. The group also seeks to recruit ethnic minorities who feel excluded by the Taliban government.[2]

Having at first denied the presence of IS-KP in Afghanistan, the Taliban began by adopting a largely indiscriminate repressive response, targeting Salafi circles they accused of harbouring IS-KP militants, arresting preachers and identifying suspects based on their religious views.[3] The small Salafi community came under suspicion because of its doctrinal differences with the Taliban, particularly its more literalist approach to Islam, its reluctance to follow the Hanafi school of Islamic jurisprudence and its aversion to some of the Taliban’s religious practices.[4] Most importantly, Salafism is the religious approach embraced by ISIS, though most Salafis oppose the group.[5] In addition to cracking down on Salafis, Taliban forces reportedly carried out extrajudicial killings of suspected IS-KP members, especially in eastern Nangarhar province.[6] 

This heavy-handed approach backfired, however, not just alienating Salafis but also pushing many of them into the arms of IS-KP for protection. In the east, the brutal tactics undermined the Taliban’s efforts to gain control of mountains where they had previously failed to win public support when they governed in the 1990s, in part because of ideological feuds with residents of the same Salafi enclaves. Coercive methods were even less successful in the north, where many Salafis were allied with the Taliban; cracking down on them pushed away the few allies the new administration could count on among the ethnic Tajiks who make up the majority in that part of the country.[7] 

As new recruits flowed into IS-KP ranks, including young urbanites and members of ethnic minorities, the Taliban appeared to change tack. In 2022, they started experimenting with more sophisticated approaches. On university campuses, they made systematic efforts to suppress Salafi-leaning pan-Islamist teachings. But the Taliban differentiated between Salafi groups espousing political goals and others focusing on social change. Groups that pledged allegiance to the government and involved themselves in non-political work, such as preaching, appear to have been tolerated, albeit grudgingly. Other apolitical preachers, such as Tablighi groups, were not just tolerated but encouraged. But groups with political objectives – such as Hizb ut-Tahrir – have suffered crackdowns and, at times, been labelled covert supporters of IS-KP.[8] The Taliban also reached out to Salafi leaders, seeking to secure their loyalty despite doctrinal differences.[9]

Meanwhile, the Taliban have tried to counter accusations that they have forsaken piety, for example in reaching a limited accommodation with foreign powers, by bolstering their Islamic bona fides. They have emphasised their desire to build a “purely Islamic” political system in Afghanistan – including through harsh restrictions on women’s rights – while painting IS-KP as khawarij, or heretical extremists.[1] 

When such persuasion failed, the Taliban still used violence, albeit in an increasingly selective fashion. At the same time as trying to win over Salafis and others vulnerable to IS-KP recruitment, the authorities continued a lethal counter-insurgency campaign against the group from 2022 through early 2023, resulting in a high number of fatalities. Over the following months, however, the body count declined as Taliban strikes on IS-KP hideouts became more precise, killing several senior figures but few others.[2] The more effective targeting suggested that the Taliban’s intelligence gathering capacity had improved markedly; they may also have benefited from information provided by foreign states.[3] In quick succession, the Taliban claimed to have killed top IS-KP commanders such as Ejaz Ahmad Ahangar, head of the so-called Hind province; Qari Fateh Tufail, the group’s alleged intelligence chief and head of Kabul operations; Maulawi Ziauddin, head of the judiciary and a former interim leader; and Engineer Omar, deputy to the current leader, Shahab al-Muhajir.[4]

The group is down but not out in Afghanistan (see graph below). The loss of senior personnel was a severe blow, and by 2024 the number of IS-KP attacks had decreased sharply. But IS-KP is decentralised, agile and still able to do significant harm. One of its most notable attacks occurred a little over a year ago, on 21 March 2024, when a suicide bomber struck a New Kabul Bank branch in Kandahar, killing 21 people.[5] Meanwhile, a wave of high-profile arrests of IS-KP leaders in Pakistan – including Muhammad Sharifullah (linked to the attack on U.S. troops at Kabul airport), Abu Mundhar al-Tadjiki and Abu Yasir al-Turki (see Sections VI and VII) – as well as a Baloch rebel raid on an IS-KP training camp in Mastung, Pakistan suggest that the group has at least partly relocated to that country.[6]

After the ISIS caliphate in Iraq and Syria collapsed in 2019, following the campaign by the U.S.-backed global coalition, the movement’s central leadership was seriously weakened.[1] A group of senior figures has continued to provide strategic guidance, but regional branches, known as provinces, have assumed greater agency by consolidating their local presence and strengthening cross-regional ties through the exchange of funds, fighters and operational expertise. IS-KP has played a prominent role in the movement, increasingly orchestrating high-level attacks abroad – a job once done mostly by leaders in Iraq and Syria – thanks to its Central Asian fighters and its experience of competing with other jihadists.[2] 

Following the loss of its territory in Syria and Iraq, ISIS has mutated. What remains of its “core” consists of a caliph – known only by a nom de guerre, Abu Hafs al-Hashimi al-Qurashi – and several officers, including a coordinator for the group’s provinces worldwide.[3] In its initial guise, IS-KP was a disparate collection of militants including quasi-independent commanders with few links to ISIS headquarters. But today ISIS has incorporated the heads of several major branches in its leadership, blurring the distinction between the core and the provinces.[4] IS-KP is one of these provinces, technically operating under the supervision of the al-Siddiq office, which is based in Afghanistan. 

The ISIS core leadership’s main mission now revolves around managing regional offices and establishing guidelines for how to create local Islamic states.[1] ISIS commanders also travel to countries such as Afghanistan to give instructions, offer military advice and make sure that local outfits are following the group’s overall strategy. Media production is also centralised. As a general policy, the ISIS core orders its provinces to create state-like structures to govern the population according to its interpretation of Islamic law, even if the group’s activities in the province are embryonic.[2] That said, different ISIS provinces, and even the same province over time, can promulgate vastly different policies, suggesting that these groups are able to take decisions independently. At the very least, they manage their military operations autonomously.

The emerging division of labour between the ISIS core and its provinces raises questions about the relative weight given to the organisation’s local and transnational objectives. Unlike al-Qaeda, which was formed to strike the West, ISIS’s primary objective is to establish an Islamic state in the here and now. In its early years, the group did not focus on striking targets abroad, though it did carry out a number of mass-casualty attacks from 2014 to 2016, after which its foreign offensive subsided under military pressure in Iraq and Syria.[3] Most ISIS provinces, including the large groups in the Sahel and Nigeria, now appear to be concentrating on their home ground. On occasion, they mount cross-border attacks, but not that far afield. IS-KP’s focus on the international front (see Section V below) is unique among today’s branches, resembling to some extent the offensive waged by al-Qaeda in the Arabian Peninsula against the West in the late 2000s.

Intense factional competition within Afghanistan and growing pressure from the Taliban have encouraged IS-KP to expand its operations outside the country’s borders. By showing that IS-KP is the sole group from Afghanistan fighting worldwide for Islam, the group aims to establish itself as a unique force in the jihadist landscape.[1] In particular, it uses its high international profile to compensate for its weakened standing in Afghanistan and lure fighters away from other jihadist groups in the region. Central Asian commanders are often involved in IS-KP attacks, recruiting the perpetrators from diaspora communities in nearby countries – such as Türkiye, Russia and Iran – as well as farther afield, notably in western Europe. These attacks are nevertheless hard to attribute to IS-KP alone given the mesh of transnational networks involved, possibly including other ISIS provinces.

In shifting its operations abroad, IS-KP has adopted a quite different command structure from the one used on the home front. In Afghanistan, the group is primarily an insurgency staffed by local Afghan recruits. But as the group has progressively moved more of its operational and logistical support outside Afghanistan to evade the Taliban, its make-up has changed.[2] Under commanders of Central Asian origin based not just in Afghanistan, but at times also Türkiye, Central Asia and Russia, IS-KP functions much more as a horizontal network.[3] These commanders predominantly recruit other Central Asians: their shared experience, cultural background and sometimes common language enable stronger cooperation.[4] They act autonomously, without having to follow the orders of IS-KP or ISIS leaders, and increasingly conduct attacks outside Afghanistan, especially in Iran and Russia, although they are finding it more difficult to cross borders undetected.[5] 

Most of the recruits are citizens of Tajikistan. Tajik militants have been involved in several attacks in Tajikistan. These include the killing of four Western cyclists in July 2018, and a skirmish with Tajik security forces in November 2019, which resulted in the deaths of fifteen militants. In May 2019, Tajik militants also staged a prison riot in Dushanbe that ended in the deaths of three guards and 29 inmates.[6] A plan to attack a U.S. military base in Germany in 2020, however, did not come to fruition.[7] IS-KP also claimed responsibility for rocket attacks in Uzbekistan and Tajikistan in April and May 2022, though the governments of both countries denied that any incident had taken place.[8]

Iran has been another target of IS-KP strikes, including on the Majles, or parliament, and the mausoleum of Ayatollah Ruhollah Khomeini in 2017, which resulted in at least seventeen deaths.[9] In August 2023, IS-KP struck the Shah Cheragh shrine in Shiraz, killing one person. The next year, the group carried out a larger attack in Kerman, deploying a double suicide bombing during a ceremony outside the tomb of Major General Qassem Soleimani, the slain head of the Revolutionary Guard’s elite Qods Force.[10] A total of 91 people were killed. 

The group has been active in Russia and Türkiye as well. In March 2024, an attack at a Moscow concert hall killed 149 people.[11] It was the deadliest attack in the Russian capital since the 2002 Dubrovka theatre siege carried out by Chechens – and notably, the first on such a scale not linked to North Caucasian militants. IS-KP appears to have been behind the attack, although the ISIS core claimed responsibility while Russian authorities blamed Ukraine.[12] The Kremlin claimed that it foiled another attack on a Moscow synagogue soon thereafter.[13] Meanwhile, prison uprisings involving ISIS sympathisers have become increasingly common in Russia.[14] IS-KP has also struck Türkiye, attacking a church in Istanbul in early 2024, leading to one fatality, but its offensive there has paled in comparison to those in Iran and Russia.[15] 

Western Europe has not escaped the wave of violence unleashed by IS-KP. In 2017, an Uzbek militant killed four people when he rammed a truck into a crowd in Stockholm.[1] Other attacks seemingly inspired by IS-KP include the killing of two Swedish football fans in Belgium and the stabbing of a teacher and tourist in France in October 2023, with at least one attacker pledging allegiance to IS-KP.[2] The group threatened to strike during the 2024 Paris Olympics, while the singer Taylor Swift cancelled a performance in Vienna that August after U.S. intelligence services discovered that a militant inspired by IS-KP had vowed to kill attendees.[3] The group’s propaganda continues to incite violence against the West, featuring detailed instructions for attacks on crowded venues using methods including drones carrying explosives.[4] European countries, including Belgium, France, Germany and the Netherlands, have detained people linked to IS-KP on suspicion of planning attacks in Austria, France, Germany and Spain.[5]

To be sure, it can be difficult to discern whether IS-KP or ISIS have put their organisational weight behind these attacks. These groups form part of an interconnected web of militants marked by informal ties; they are not well-defined structures with clearly delineated roles and responsibilities.[6] The 2023 attack on Shah Cheragh shrine in Iran was claimed by IS-KP, but not the 2024 strike in Kerman, which was said to be the work of a previously unknown outfit called “Fars province”. Similarly, ISIS, not IS-KP, took credit for the 2024 Moscow attack. This ambiguity reflects a strategic decision by the ISIS core to assume responsibility for major attacks for which it has contributed resources and provided logistical support. IS-KP and other branches claim authorship of smaller-scale operations, which are directly conducted by lower-level commanders to maintain secrecy. Even so, European officials say around 90 per cent of the terrorist plots in Europe between 2022 and 2024 have been linked to IS-KP.[7]

Adding to the complexity is the fact that IS-KP commanders coordinate with other ISIS militants and provinces. These include ISIS commanders in Syria, who occasionally order IS-KP linked militants in the West to launch attacks, and in Somalia, who may provide financial support.[8] The group’s commanders, mostly of Central Asian origin, occasionally collaborate with other provinces, sharing plans and funds.[9] Little by way of a clear-cut hierarchy exists among them; attacks are staged based on opportunity, the international connections at hand and the significance the target is deemed to have.[10]

Western officials have singled out IS-KP as a particular danger to their countries.[1] U.S. General Michael Kurilla, head of U.S. Central Command, and the German and French interior ministers have all highlighted the threat posed by IS-KP, though the group’s transnational reach has different implications for the West than it does for Iran, Russia and Türkiye.[2] While IS-KP continues to be a menace, it faces major hurdles in recruiting, training and embedding operatives within Western societies on the scale that ISIS achieved in 2015-2016, when it orchestrated large-scale attacks in Europe. 

Russia and Iran are the two countries most vulnerable to IS-KP attacks. Plots to wreak destruction and kill civilians in these countries involve interconnected networks and older militants who travel back and forth from Afghanistan, receive direct instructions from IS-KP commanders, and conduct more complex assaults than in the West.[3] 

An example is provided by IS-KP commander Abu Mundhar al-Tadjiki, who was responsible for a range of plots outside Afghanistan. He helped organise the December 2017 attack on a Christmas market in Strasbourg, France; the January 2024 bombing of the commemoration of Soleimani in Iran; and the March 2024 attack in Moscow, causing a combined death toll of 248. Al-Tadjiki travelled widely within Central Asia to coordinate with his IS-KP network.[4] 

Western officials and UN reports say these networks use Türkiye as a hub for moving people and money.[5] Turkish officials deny it, however, insisting that their law enforcement responses, including the arrest of thousands of militants, have disrupted the group’s operations inside the country’s borders.[6] IS-KP has been either unwilling or unable to pull off a large-scale attack in Türkiye itself.[7]

Despite their success launching attacks elsewhere, IS-KP networks outside Europe are also under pressure. Abu Mundhar al-Tadjiki was apprehended in the spring of 2024 – thanks to coordination between Western countries and Pakistan – and his network has largely been dismantled.[1] Similarly, Iran and Russia have thwarted several plots, including the attempted Moscow synagogue attack mentioned above.[2] The U.S. also regularly gathers intelligence on regional plots, which it shares with both Iran and Russia, including before the IS-KP attacks of 2024 – though either crucial information was lacking or local authorities failed to act upon the tips.[3] In any event, the scale of the 2024 attacks forced these countries to bolster coordination and intensify their pressure on IS-KP.

European security services, for their part, distinguish between “autonomous” and “activated” threats, with the difference hinging on the role of IS-KP commanders abroad.[4] The first type of militant is usually a young adult or an adolescent who is inspired by IS-KP and may contact its commanders through social media. These individuals tend to feel socially excluded.[5] IS-KP’s recruitment of them tends to be more opportunistic than carefully coordinated. The recruits may be inexperienced, but IS-KP commanders calculate that only a few need to succeed in pulling off an attack in order for the organisation to accomplish its objectives.[6] Even so, their interactions with IS-KP commanders via social media help explain the high number of failed plots: the U.S. captures their communication via electronic surveillance and shares it with European partners, who are increasingly gathering this sort of intelligence as well.[7] 

The second, “activated”, type of militant tends to be of Central Asian origin, usually Tajik or Uzbek, or from the countries of the Caucasus.[8] In some cases, these militants are recruited when they are already settled in Europe; in other cases, they are dispatched to these countries. Either way, they tend to know little about their host societies and lack the contacts needed to establish networks through which to acquire weapons. They also live under the radar, making it difficult for them to organise large-scale assaults.[9] Some of them were involved in jihad before joining IS-KP, but not always.[10] As newcomers to the West, they generally do not interact with local, younger militants, with a few exceptions.[11] 

This recruitment strategy makes IS-KP’s present threat to the West distinct from what it was like when ISIS carried out large-scale strikes in European cities. At the same time as it was mounting those attacks, ISIS was also recruiting thousands of Europeans to fight in Syria. Once the recruits were in Syria, the group vetted the most promising of them for training, sometimes forcing them to carry out public executions.[12] As they often had backgrounds in petty crime, these recruits already had access to underground networks in Europe before joining ISIS, which allowed them to live clandestinely, obtain fake IDs and acquire weapons once they returned from Syria. They were dangerous indeed.

Today, next to none of the new recruits have travelled to jihadist battlefields or received training.[13] The recruits are often too young to have been in Syria when ISIS held territory there, and the individuals previously arrested for travelling to Syria are not – for the moment – involved in new plots.[14] Going to Afghanistan from Europe is nearly impossible, with only a few cases of people having tried to do so. That stands in stark contrast to the ease of entering Syria from Türkiye at the peak of the Syrian conflict.[15] IS-KP now advises its sympathisers to act where they are, rather than attempting a trip to Afghanistan.[16]

None of the above means there is no threat to Western countries. In 2024, U.S. authorities arrested people of Central Asian origin allegedly linked to IS-KP who were attempting to infiltrate the U.S. from Mexico. Their capture fuelled fears that attacks in the U.S. could be in the offing.[17] Militants from Central Asia have already tried to get to Europe through Ukraine, posing as refugees. Some had spent time in Syria beforehand.[18] There is also a risk, as witnessed on several occasions in Germany, of individuals whose asylum applications are rejected by authorities resorting to violence.[19] Their attacks tend to lack sophistication. Still, even if they are acting on the spur of the moment, the result may be lethal, bringing backlash.[20]

Another danger for the West is that IS-KP’s current rudimentary approach may not last. It might adapt to pressure and coordinate its Western sympathisers better. To an extent, it seems to be doing so: in July 2024, Belgian law enforcement detained three natives of Chechnya for planning terrorist attacks on behalf of IS-KP.[1] The group’s reliance on online communication, however, remains a major obstacle to developing networks that can escape Western state surveillance.

Furthermore, other ISIS provinces could mount international attacks. The provinces are already interconnected: IS-Somalia, in particular, functions as a financial hub, and others occasionally advise one another on how to mount attacks.[2] Other provinces also occasionally attempt to orchestrate attacks independently of IS-KP, as was the case in a strike on a mosque in Oman and several failed plots in Iraq and Syria.[3] Increased pressure on IS-KP could open opportunities for these other provinces to step into the breach.

In sum, the threat from IS-KP, and ISIS more generally, is different from what it was in the past. IS-KP is not trying to replicate al-Qaeda’s war on the West in the 2000s, nor the one waged by ISIS a decade ago. Rather than attempting high-profile strikes on Western targets, IS-KP is pursuing bottom-up recruitment strategy, seeking to encourage as many attacks as possible, albeit each of them on a small scale. While Western intelligence has greatly improved, uncovering dozens of plots, the risk remains that the group will find a way to evade law enforcement.

IS-KP has so far been largely contained, despite the challenges it poses. Curbing the group’s activity has not required a revival of U.S.-led counter-insurgency campaigns in the Muslim world. Instead, it has rested on intelligence sharing and stronger cooperation among Western countries, Türkiye and some of their adversaries, notably Iran and Russia. A successful strategy will stay the course. The West should also look to deepen its limited cooperation with the Taliban in Afghanistan and consider a degree of collaboration with the new Syrian government, which also regards ISIS as an enemy.

In certain respects, efforts to combat jihadist threats have made notable progress. For a start, propaganda has become far less visible on social media. Despite the growing role of bots spreading disinformation and far-right influence on social media such as X, getting access to ISIS material remains difficult. Though committed militants might still find ways to obtain information and propaganda – indeed, in some cases they even manage to connect with IS-KP commanders online – these efforts require much more effort and skill than when newcomers to jihadism could easily interact with ISIS militants on Twitter and Facebook in 2012-2014.[1] The U.S. monitors communications on these social networks, especially Telegram, which helps foil IS-KP strikes.[2] Constant vigilance will nonetheless remain essential: ISIS is exploiting new social media platforms, for instance TikTok, and sometimes uses artificial intelligence to produce videos.[3] Some Western countries – particularly in Europe – are advocating for building back doors into these platforms, which would allow security services to view unencrypted communications upon request.[4]

Stronger measures to thwart armed attacks have also been introduced. European cities have adopted new security measures, including cameras, reinforced safety infrastructure in squares and stricter controls on the sale of explosive materials.[5] Former U.S. President Joe Biden’s controversial “over the horizon” policy can also claim to have notched successes by using better targeted drone strikes against people planning to attack the West, in place of the much more indiscriminate strikes of the previous decade.[6] These include the killings of al-Qaeda leader Ayman al-Zawahiri in August 2022; Bilal al-Sudani, a prominent ISIS financier in Somalia, in 2023; and several prominent ISIS figures in Syria and Iraq.[7] The U.S., however, cannot pursue this policy on its own. It needs local partners who can provide grassroots intelligence.[8] 

Where intelligence sharing has been possible, it has generally worked. The absence of major IS-KP attacks over the past year can largely be attributed to greatly enhanced international coordination. Multilateral cooperation among Russia, Iran, Pakistan, Türkiye and the U.S. led to the arrest of Sharifullah, a key figure behind the 2021 Kabul airport attack, as well as the dismantling of networks responsible for the 2024 Kerman bombing in Iran and the mass shooting and arson in Moscow. After arresting a network of IS-KP commanders, Pakistan extradited Sharifullah to the U.S., Abu Mundhar to Russia – for his links to the Moscow attacks – and Adil Panjsheri, accused of involvement in the Iran attacks, to Iranian authorities.[1] Meanwhile, Western security services have stopped nearly all IS-KP plots, and IS-KP has not managed to mount a large-scale attack in a Western country since it expanded its operations outside Afghanistan. The U.S. has even shared intelligence with Russia and Iran despite tensions with Moscow and Tehran.[2] 

Even so, more could be done to strengthen the exchange of information in particular cases. Collaboration between Türkiye and its foreign counterparts has helped counter ISIS, but communication remains hindered by mistrust, technical constraints and differing security priorities. Western officials have criticised Türkiye for what they perceive as lack of action on shared intelligence, while Türkiye contends it does not receive timely or adequate information, exacerbating frustrations on both sides. Strengthening cooperation through operational agreements with Europol, reforms in mutual legal assistance processes and engagement in EU agencies like Eurojust could enhance trust and effectiveness in combating ISIS-linked activities.[3] The arrest of the Turkish militant Abu Yasir al-Turki in June, following contacts between Turkish and Pakistani security services, suggests that cooperation between those two countries is improving.[4]

No less important is the question of whether and how to collaborate with the Taliban in Afghanistan and the new authorities in Syria. The Taliban have acted swiftly against IS-KP. They have gathered information on IS-KP’s transnational networks, including the names of militants, details of illicit money flows and instructions from IS-KP leaders to subordinates. Some collaboration already occurs with certain Western countries. The Taliban helped foil a plot to attack World Cup matches in Qatar in 2022.[5] Still, Taliban and U.S. officials have privately expressed frustration with their information-sharing relationship, which is constrained by lack of trust on both sides.[6] Collaboration between the Taliban and Russia, on the other hand, is likely to deepen following Russia’s decision to recognise the Taliban government.

It is not just the U.S. relationship with the Taliban that needs bolstering. A UN review of international engagement with the Taliban in 2023 called for further security cooperation with the regime in Afghanistan, including on border management and security controls. The UN Security Council endorsed the conclusions of the review, but follow-up has been weak.[7] Another important instruction from the Council, first in December 2023 and again in December 2024, called on UN terrorism monitors to resume their reporting visits to Afghanistan.[8] Before the Taliban takeover, the UN team’s public reports had served to keep regional and international bodies on the same page about risks emanating from Afghanistan. UN monitors should get back to work in the country.[9] Cautious steps in that direction started in October 2024, when the UN Monitoring Team met with Taliban intelligence officials in Abu Dhabi, but some UN counter-terrorism experts remain sceptical about resuming their activities on the ground in Afghanistan.[10]

Besides more engagement by the UN, the special coordinator for Afghanistan also called for deeper bilateral cooperation with the Taliban on security issues. Necessary steps include strengthening international borders and rehabilitating the Afghan central bank: improved border controls would help prevent militants from travelling, while restoring the banking sector to legal status would provide greater visibility of money flows. Indeed, the Taliban have expressed interest in formalising the financial sector and willingness to comply with international rules aimed at countering the financing of terrorism.[11] In general, the Taliban remain open to collaboration with their former enemies, building on the foundations of the 2020 Doha agreement with the U.S. that included Taliban commitments to fight terrorism. When the Taliban congratulated President Donald Trump on his election win in November 2024, the statement reiterated the importance of the Doha deal.[12]

Sharing information and collaborating against IS-KP, and ISIS in general, might be easier with the new Syrian government. Though it was listed as a terrorist group by numerous countries and the UN Security Council (and still is), Hei’at Tahrir al-Sham (HTS) – which is largely in charge of the new government – dismantled ISIS networks while it was running an autonomous enclave in north-western Syria.[1] Discussions are under way about how to work effectively with the new authorities and support them in addressing various security and governance challenges. Fighting ISIS is a priority they share with foreign countries.[2] They have an opportunity to collaborate with both the West and regional powers, not only to push for their own delisting but also to find common ground on an issue they agree upon. Just weeks after the change of government in Syria, the U.S. had already begun sharing intelligence, while in May President Trump announced he would lift all sanctions on Syria.[3]

Lastly, cooperation within the Global Coalition to Defeat ISIS – the alliance of over 80 countries formed in 2014 to fight the group – should continue to adapt to the jihadists’ evolution. The circumstances of 2014, when ISIS controlled large swathes of Iraq and Syria, are very different from those of today. Western countries’ focus has shifted from ground battles and airstrikes to combating ISIS’s decentralised network.[4] They need an approach that is more rooted in law enforcement, including enhanced collaboration on issues like tracking travel, disrupting financial networks and tackling cross-border smuggling.[5] Additionally, building the capacity of Central Asian countries to address new threats is crucial, given the region’s role as a transit and recruitment hub.[6]

As matters stand in mid-2025, IS-KP is at a low ebb. But its intent to strike has not faded. The group appears to be expanding its presence in Balochistan, as highlighted in a recent propaganda video.[7] In June, Taliban forces raided a facility in Kabul used for manufacturing explosives and suicide vests.[8] Although the group’s weaknesses are evident, it seems that the IS-KP remains committed to attracting foreign fighters and plotting attacks beyond Afghanistan’s borders.

Despite the threat posed by IS-KP, the West is unlikely to return to the post-9/11 era, when counter-terrorism dominated foreign policy. IS-KP – and ISIS more generally – is a threat that still has to be tackled, but European states, in particular, do not view it as their most pressing concern. They believe with some justice that they can largely contain it through online surveillance, physical security measures and intelligence sharing.[1] 

A series of mass-casualty attacks in 2024 in Iran and Russia nevertheless demonstrated the continuing dangers posed by the group, while boosting the case for enhanced cooperation between these states and the West despite the geopolitical rivalries that tear them asunder. While militants in IS-KP and ISIS continue to adapt, reconfigure their networks and seek out new ways to do violence, sustained, enhanced international collaboration to maintain pressure on these groups will remain paramount. The jihadist movement may be beating a retreat, but it can only be kept at bay if affected states are willing to work more closely together. 

Brussels, 16 July 2025