On Friday, terrorists attacked the Crocus City Hall outside Moscow leaving 140 people dead and 80 others critically wounded. Soon after, the Islamic State claimed responsibility for the attack. The terrorist group, which is headquartered in Iraq and Syria, has several branches, including in South and Central Asia. Press reports suggest the U.S. government believes the Afghanistan-based affiliate of the Islamic State, ISIS-Khorasan (ISIS-K), was behind the attack. The Biden administration has publicly noted that it had warned the Russian government of the terrorism threat in early March in line with the procedure of “Duty to Warn.”

People line up to lay flowers at a makeshift memorial near Crocus City Hall, where 140 people were killed March 22 night in an attack, outside Moscow on March 24, 2024. (Nanna Heitmann/The New York Times)
People line up to lay flowers at a makeshift memorial near Crocus City Hall, where 140 people were killed March 22 night in an attack, outside Moscow on March 24, 2024. (Nanna Heitmann/The New York Times)

USIP experts Mary Glantz, Gavin Helf, Asfandyar Mir and Andrew Watkins examine ISIS’ motivations to strike Russia, the Central Asian angle to the attacks, the impact of these attacks on the Taliban and implications for U.S. interests.

Why did ISIS, and ISIS-K in particular, strike Russia?

Mir: ISIS-K hasn’t explicitly accepted responsibility for the attack as yet — only ISIS core in the Middle East has, without indicating which regional branch carried out the attack. However, on Monday, the Afghanistan-based ISIS-K put out a 30-page pamphlet celebrating the attack and posturing in a way which suggested significant ownership of the attack. The statement is also critical of the Taliban. Its central theme is that Russia deserved the attack, which showed the Taliban’s failure to prevent international attacks from Afghanistan — noting pointedly that the Taliban had pledged to do so as part of the U.S.-Taliban agreement signed in Doha in February 2020. The statement also slammed the Taliban for sympathizing with Russia after the attack near Moscow, noting that the same Russian regime targeted Muslims in Syria in support of Bashar al-Assad’s regime. The statement also threatens that ISIS-K will not be limited to Afghanistan and will undertake more external attacks.

This message sheds light on the multiple motivations playing into ISIS-K’s calculus to strike, though further confirmation of ISIS-K involvement in the attack is necessary. For one, the statement shows that ISIS-K considers Russia fair game not only for being an “infidel” and “disbelieving” regime, as per ISIS’ doctrine, but also for its role in the Syrian civil war. Additionally, it underscores that ISIS’ targeting decisions do not stem solely from its resentment toward the attack targets, such as Russia. It shows the significance of competitive dynamics for ISIS-K with other militants in South and Central Asia, particularly the Taliban. ISIS-K wants to outperform rivals and show them in a poor light by carrying out more audacious attacks. Mass-casualty attacks are also intended to distinguish ISIS-K’s jihadi brand to rally resources and assert dominance over the global jihadi vanguard.

The combination of zealotry and hyper-competitiveness may explain why ISIS-K has tried to strike a dizzying array of targets, ranging from traditional areas of activity like Afghanistan, Pakistan and Central Asia to more novel regions such as Iran, Europe and now Russia.

Russian authorities captured four men from Tajikistan whom they accuse of carrying out the attacks near Moscow. Is there precedent for the involvement of citizens from Central Asian countries in ISIS violence? What might explain ISIS’ inroads in Central Asia?

Helf: The four men who were captured, apparently tortured and hauled into court are labor migrants working in Russia from Tajikistan, according to media reports. Video seems to show them, or men very similar to them, as the actual perpetrators. Reports from Tajikistan suggest they are simple labor migrants with no ties to Afghanistan or ISIS core. It is quite plausible that the attackers might be from Central Asia. 

Tajiks have been involved in a number of other ISIS-K attacks, including the January bombing in Iran of an event held to commemorate the fourth anniversary of the killing of Iranian Revolutionary Guard Corps commander Qassem Soleimani. The bombing resulted in the deaths of at least 93 people, including nine children, and left nearly 300 individuals injured. 

There are roughly 1.3 million Central Asian labor migrants in Russia — 350,000 from Tajikistan — and a large number of Central Asians who have adopted Russian citizenship. They send back billions of dollars each year in remittances, which are an important part of the Central Asian economy. But they are often mistreated by Russian authorities, discriminated against and live in harsh conditions. A decade ago, these migrants and their families, who are emotionally vulnerable and living in tenuous conditions, were a big target of recruitment by ISIS. Thousands joined ISIS and other terrorist groups in Syria and Iraq. Back then Russian and the Central Asian authorities largely turned a blind eye to this recruitment. This new wave of attacks, however, aimed at Russia itself, is a different story and the crackdown is likely to be severe. This could have a significant effect on Central Asian economies if the number of labor migrants allowed to work in Russia is drastically reduced.

Putin has blamed the Moscow attack on Ukraine. Is that at all credible?

Glantz: No. The U.S. National Security Council spokesperson said that ISIS had “sole responsibility” for the attack and that “[t]here was no Ukrainian involvement whatsoever.” Russia has also failed to provide any evidence of a Ukrainian link. Meanwhile, ISIS has claimed responsibility for the attack. Putin’s efforts to suggest Ukrainian involvement appear to be simply designed to divert blame and attention from his and his security service’s inability to protect the Russian population.    

How does the Moscow attack impact the Taliban?

Watkins: For the Taliban, any publicity that involves ISIS-K is bad publicity. Any major terror activity carried out by or connected to ISIS-K reflects badly on the Taliban, which prides itself on (controversial) claims of having brought stability and security to Afghanistan. The more ISIS-K manages to conduct international terror attacks, the more countries may question the Taliban’s effectiveness at containing security challenges emanating from Afghanistan.

Since their 2021 takeover, the Taliban have conducted a bloody campaign to hunt down ISIS-K. This campaign has degraded ISIS-K’s ability to operate inside Afghanistan: The group greatly reduced its activity in the country, abandoning earlier efforts to mount an insurgency against the Taliban. But ISIS-K has clearly adapted. It has transitioned to less frequent, more sensational attacks, and has moved key leaders and recruitment efforts out of Afghanistan.

Ironically, the greater a global threat ISIS-K becomes, the more that regional countries may view the Taliban as useful, and increasingly seek counterterrorism cooperation with their security forces. In spite of grave concerns about the Taliban’s effectiveness as a counterterrorism partner, many countries do not see a better alternative.

The greatest impact of the attack near Moscow on the Taliban may be the turbulence it creates within the Taliban’s own rank and file. The Taliban have tried to maintain much of the militant identity that held them together during 20 years of insurgency, and, as a result, may perceive ISIS-K’s spectacular acts of terrorism as competition for the claim to jihadist legitimacy. It is likely not a coincidence that in the wake of the Moscow attack, the Taliban released a rare audio message from the group’s emir (or supreme leader). In it, Mullah Hibatullah Akhundzada fiercely proclaimed the group’s intent to implement harsh interpretations of Shariah law, noting that women could be stoned to death for moral crimes. This should be understood in part as a defense of the Taliban’s jihadist bona fides, in a moment when ISIS-K seeks to claim the same.

What does the Moscow attack mean for U.S. interests?

Mir: The U.S. government has been worried about ISIS-K’s trajectory for the last few years, recognizing the group has an intent to strike U.S. interests overseas as well as the U.S. homeland. But the real question has been about ISIS-K’s capabilities and whether the Taliban will contain the threat and prevent it from carrying out external attacks. In 2023, senior U.S. officials assessed that the Taliban were managing to limit ISIS-K by killing high-level ISIS-K leaders and degrading the group’s external plotting capabilities. At one point, the White House announced that the Taliban had killed the mastermind of the complex attack during the U.S. evacuation from the Kabul airport after the Taliban takeover in August 2021. Now, after the Moscow attack, assumptions about the Taliban having the capability to manage ISIS-K stand challenged. Not only does the attack affirm that ISIS-K remains intent on striking beyond Afghanistan, but it also raises the concern that ISIS-K can enable operatives overseas and work around Taliban pressures to reach targets in the Western world. To mitigate the risk, the United States may need to mobilize greater resources to monitor the threat coming out of Afghanistan, and develop new options, including unilateral military options, while working more closely with regional actors.

Related Publications

What’s Next for the U.N.’s Doha Process on Afghanistan?

What’s Next for the U.N.’s Doha Process on Afghanistan?

Tuesday, July 16, 2024

At the end of June, envoys and representatives from more than 25 countries and international organizations gathered in Doha, Qatar, along with representatives from the Taliban under an U.N.-facilitated framework. This meeting was the third of its kind, widely referred to as “Doha 3,” and part of a process to establish a more coordinated and coherent global approach to Afghanistan’s challenges and the Taliban’s rule.

Type: Analysis

Global Policy

How to Support Female Entrepreneurs in Afghanistan

How to Support Female Entrepreneurs in Afghanistan

Tuesday, June 25, 2024

Potential areas of cooperation between the Taliban and the international community, such as private sector development and alternative livelihoods to now-banned opium poppy cultivation, will be on the agenda at a meeting of international envoys for Afghanistan hosted by the United Nations in Doha from June 30 to July 1. Discussions on women’s rights are not included, as the Taliban consider it an internal matter. This is ironic, given that the private sector is one area where the Taliban allow limited women’s participation.

Type: Analysis


As Taliban Poppy Ban Continues, Afghan Poverty Deepens

As Taliban Poppy Ban Continues, Afghan Poverty Deepens

Thursday, June 20, 2024

Afghanistan, historically the leading source of the world’s illegal opium, is on-track for an unprecedented second year of dramatically reduced poppy cultivation, reflecting the Taliban regime’s continuing prohibition against growing the raw material for opiates. The crackdown has won plaudits in international circles, but its full implications call for clear-eyed analysis and well considered responses by the U.S. and others. The ban has deepened the poverty of millions of rural Afghans who depended on the crop for their livelihoods, yet done nothing to diminish opiate exports, as wealthier landowners sell off inventories. The unfortunate reality is that any aid mobilized to offset harm from the ban will be grossly insufficient and ultimately wasted unless it fosters broad-based rural and agricultural development that benefits the most affected poorer households. 

Type: Analysis


View All Publications