The Moscow Terror Attack: ISIS’ Global Ambitions and the Challenge of Counterterrorism

The terrorist attack on Crocus City Hall in Moscow killed more than 130 people and wounded around 150. Islamic State in the Khorasan Province (ISKP or ISIS-K) claimed responsibility for the attack, which proves that the group has the operational capability to engage in such a large-scale onslaught. It also confirms ISIS-K's continuing efforts to expand its activities beyond the confines of Afghanistan and Pakistan. Accordingly, ISIS-K's growing ambitions pose a significant and geographically expanding security threat.

ISIS-K was established by the former members of al Qaeda, Taliban, and Tehreek-e-Taliban Pakistan in 2014 and declared its affiliation with the ISIS Core in 2015. Regionally,  ISIS-K aims to ‘purify’ Afghanistan by toppling the Taliban regime, overthrowing the Pakistani government, and targeting “the Iranian government for being a ‘vanguard’ of Shias." At a global level, the group seeks to target the West and Russia for their involvement in Afghanistan and Syria. Correspondingly, ISIS-K carried out 328 attacks and killed more than 3,000 people between 2018 and 2023, according to the GTTAC Records of Incident Database (GRID). Most of these attacks took place in Afghanistan and Pakistan. While ISIS-K primarily clashed with the Taliban, they were responsible for several attacks that targeted Afghan and Pakistani military forces and US military personnel. The group was also responsible for the Kabul airport attack in August 2021, killing 13 US service members and almost 100 civilians. On January 2, 2024, two bombing attacks launched by ISIS-K killed 95 people in Kerman, Iran.

While Russia has been no stranger to terrorist onslaughts, most of these to date have stemmed from Chechen rebels, such as the devastating terror attacks on Moscow Dubrovka Theater in 2002 and on a school in Beslan in 2004. In areas outside Moscow, ISIS-Caucasus groups were involved in around 40 incidents, mostly in the Chechnya and Dagestan regions, which led to around 80 fatalities in total between 2018 and 2023 (GRID, 2024). However, the terror attack on Crocus City Hall was the first time that the Russian capital was hit by an ISIS-affiliated group of this size, resulting in a significant and devastating casualty count on March 25th. It is stunning that the Russian intelligence apparatus failed to prevent one of the biggest terrorist attacks in Russia's history despite warnings from  US intelligence agencies.

The Kremlin's response to the terrorist attack has so far been problematic for several reasons. First, instead of making an effort to rally international support against terrorism, Putin blamed the West and Ukraine for the attack in a seemingly desperate attempt to rally domestic support for the war in Ukraine.

Second, it appears that the four men captured by Russian security forces were tortured, and the Kremlin did not shy away from letting the whole world know. By publicly sharing the pictures of the tortured men, the Kremlin might have wanted to use them to spur domestic outrage. However, from a counterterrorism perspective, such a tactic could backfire as images like these would reinforce victimhood and be seen as sacrifice by the members of terrorist organizations. This approach may validate what ISIS and like-minded groups have propagated for years, that Russia is one of their primary foes. Thus, the Russian government’s reflexive and emotional response could mobilize and motivate further actions by ISIS and its affiliates.

Third, the subsequent steps by the Kremlin and the discourse of Putin have led to xenophobic, anti-immigrant, and anti-Tajik sentiment and targeted migrants, primarily those from Central Asia and Tajikistan.

The Moscow attack has once again reminded us of the risks that foreign terrorist fighters (FTFs) pose. ISIS has been one of the most successful terrorist organizations, attracting thousands of FTFs from over ninety countries. The 2017 report of the Radicalisation Awareness Network (RAN) Centre of Excellence estimated that more than 42,000 FTFs from 120 countries traveled to Iraq and Syria to join terrorist organizations between 2011 and 2016. According to the same report, more than 5000 of these FTFs left from Europe, and on average, around 30 % of them later returned, a percentage higher in countries like the United Kingdom, Denmark, and Sweden. Around 9,000 of the new recruits stemmed from Russia and former republics of the Soviet Union, and, according to Putin, “10% of the 9,000 foreign fighters… had returned.”

Though the ISIS Core was defeated militarily in early 2019, ISIS adapted itself by transforming its territory-based hierarchical structure into a decentralized network, which had greater agility and was more resilient to intensive counterterrorism and surveillance efforts. In recent years, ISIS has gained new alliances and branches in Africa and Asia and extended its influence beyond its initial strongholds in Iraq and Syria. The GRID recorded more than 5,000 incidents involving ISIS-affiliated groups since the group was declared 'defeated' after losing all its territory in Iraq and Syria in early 2019. Its affiliates now span multiple regions, including the Sahel, the MENA region, and Asia. In particular, ISIS-DRC became the most active, leading to exacerbated instability in the Democratic Republic of Congo. ISIS-West Africa managed to control territory spanning from West Africa to the Lake Chad Basin, significantly impacting peace and security in countries such as Burkina Faso, Mali, Nigeria, and Niger. In fact, according to Jacob Zenn, Islamic State’s West Africa Province (ISWAP) has “become the most prolific Islamic State (IS) ‘province’ outside of Iraq and Syria."  Yet another group, ISIS-Mozambique, exploits regional grievances and, like its sister groups in the Sahel region, aims to control territory. 

Additionally, ISIS has forged new alliances in Asia, notably in Afghanistan, and ISIS-K has emerged as the most rising and capable branch. American officials have characterized ISIS-K "as the most dangerous threat to the United States in 2023.” Furthermore, ISIS-K has already been active in Central Asia owing to the network of foreign fighters from that region.

Meanwhile, ISIS Core and its affiliates continue their violent activities in Iraq and Syria, as well as in other regions where the social, political, and economic situations remain fragile. Data indicates that they are actively involved in violence in 35 countries, with 19 affiliated groups, since losing their last territory in 2019. ISIS has a strong presence on social media and connections with the network of foreign fighters in neighboring countries such as Turkey, which is one of the hotspots for returnee FTFs. 

Russia’s further response to the Crocus City Hall attack, particularly as it affects  Syria and Afghanistan, could provide an opportunity to help ISIS-K access a broader base of sympathizers. For example, if Russia—along with the Assad regime and maybe Iran-affiliated non-state actors—chooses to push for more military operations in Syria, this could mobilize more ISIS affiliates in the Middle East and Central Asia.

ISIS has the know-how to execute attacks such as the one on Crocus City Hall, which is reminiscent of the November 2015 Paris attacks, particularly the one on the Bataclan Theater. The notion that ISIS and its affiliates are confined to remote regions in Africa and Asia and no longer pose a significant threat to the West is false. Emboldened by the Moscow attack, ISIS and ISIS-K would seek to launch similar attacks, which may not require sophisticated logistics. In fact, in his testimony before the House Armed Services Committee, the commander of US Central Command, General Michael Erik Kurilla, revealed that ISIS-K would “attack us and Western interests abroad in as little as six months with little to no warning." His testimony was only a day before the Moscow attack, proving, unfortunately, that the assessment was valid.

Countering ISIS and its affiliates requires a more extensive effort involving multi-layered collaboration and partnership with the West and regional countries in Central Asia, the Middle East, and Africa.  Expanding counterterrorism capabilities in countries such as Uzbekistan is crucial to counter ISIS-K. The United States should be involved and engaged with these countries by prioritizing their needs and enhancing counterterrorism capacities.

An effective countermeasure against ISIS-K may require a 2.0. version of the Global Coalition to Defeat ISIS, which will entail remodeling the first version to include Central Asian countries if they are willing to join the coalition. The new version of global coalition should allocate resources to prevent ISIS’s propaganda and recruitment efforts.

ISIS Core is still the leading entity within the ISIS network, owing partly to its massive network of affiliates, including returnees or current FTFs. Therefore, the security threat of the returnee FTFs or those who are stuck in countries neighboring Syria and Iraq should be taken seriously by the host countries.  They should allocate more resources to track, identify, and thoroughly investigate ISIS's network of human, financial and logistical resources.

Benefiting from the fragile social, political, and economic landscape, ISIS has been able to survive, adapt, and expand into other regions in the world. Countering the ISIS threat and defeating the group requires more than military operations. It is now more important than ever to address the root causes of extremism, to actively engage non-governmental organizations and civil society activists, and to create and strengthen community partnership platforms.

The international community must not wait for another devastating terror attack before it applies preventive countermeasures.

 __________________________________ 

Orion Policy Institute (OPI) is an independent, non-profit, tax-exempt think tank focusing on a broad range of issues at the local, national, and global levels. OPI does not take institutional policy positions. Accordingly, all views, positions, and conclusions represented herein should be understood to be solely those of the author(s) and do not necessarily reflect the views of OPI.