Reading Between the Lines of Islamic State’s Moscow Attack

No sooner had Moscow’s rescue services retrieved the bodies of some 140 civilian victims and extinguished the fire that led to the collapse of the roof of the Crocus City concert hall in Moscow, than the Islamic State group announced - through its “Khorasan” branch – that it was responsible for the attack, the deadliest on Russian soil in years.

The March 22 operation, which also injured about 150 other people, was carried out by four highly trained armed men, all from Tajikistan. While the attack stood out for its scale, it was not the first attack by IS against Russian interests. Rather, it was a continuation and an escalation of the organization’s activities both on and beyond Russian territory.

For example, weeks earlier on March 3, Russian counter-terrorism sources had announced the killing of six IS members who were preparing an operation in Karabulak, a city in the Ingushetia region near the Georgian border. Videos have since emerged confirming that the men had pledged allegiance to IS. Three members of that cell were also reportedly responsible for several operations against the police and government targets and had killed traffic police officers in March 2023.

The Russian Federal Security Service (FSB) had also announced on March 7 that it had killed three IS members as it tried to arrest them. They had been planning an attack on a synagogue in the city of Kaluga, southwest of Moscow. This prompted the American Embassy, on the same day, to warn its citizens in the Russian capital against attending public gatherings. This indicates that US security services were aware of IS Khorasan’s escalating activity in Russia, and that by early March it had become convinced that there was a high likelihood the group would carry out an operation on the lines of the Crocus City attack.

IS Khorasan vs. Russia

IS Khorasan has been particularly active, specifically against Russians, Chinese and Iranians, since the American withdrawal from Afghanistan, a country that covers much of the historic region of Khorasan. Part of the motivation for this stems from the fact that Afghanistan’s de facto rulers the Taliban have started to improve relations with these countries, which is ideological anathema to their rival, IS Khorasan. The group has therefore waged a war against the Taliban, aiming to demoralize it and expose its vulnerability and incapacity to rein in security threats. Examples include the suicide bombing against the Russian Embassy in Kabul in August 2022 and the attack on a Chinese-run hotel in Kabul in December 2022, as well as attacks inside Iran, most notably the deadly operation at the tomb of assassinated senior Iranian commander Qasem Soleimani. By targeting the Taliban, IS also hopes to portray the group as an agent of Russia, China and Shiite Iran, and to mobilize Afghan domestic opposition to its rule.

This also gives context to IS-Khorasan’s increasing focus on Russia over the past two years. The jihadists’ Russian-language propaganda channels have repeatedly criticized Kremlin policy on Afghanistan, Chechnya and Syria.

The latest attack also comes in the context of a marked escalation by IS-Khorasan members beyond their usual strongholds. Since December 2023, dozens of suspected operatives from the group have been arrested in Germany, France, the Netherlands, Switzerland, Sweden, Denmark, Italy, Turkey and elsewhere. Those arrested were mainly from Central Asia (Afghans, Tajiks, Turkmens and other Muslims), nationalities that are heavily present in Russia, meaning they have easier access to Moscow than to other Western capitals, as well as some of these countries sharing borders with Russia – although the fighters suspected over the Crocus City attack reported traveled to Moscow via Turkey.

Did IS-Khorasan Act Alone?

The Crocus City attack came at a critical moment, just days after the election victory of President Vladimir Putin, who has staked much of his prestige on ensuring security on Russian soil. The operation was thus a blow both to Russia and to Putin personally, and appears to be a precisely timed political threat.

This has prompted speculation that other parties could have played a hidden role behind the operation. Putin has openly hinted that Ukraine or the West may have had a hand in the operation, and claimed that the perpetrators were on their way the Ukrainian border when they were apprehended – an accusation dismissed by Kyiv. Putin’s hints may be an attempt to link the attack to his main priority, the war in Ukraine, and to mobilize the Russian public behind it, regardless of who actually carried out the Moscow operation. It could also be another manifestation of a view common among Russian researchers on jihadist organizations (on that was frequently aired in the Russian media after the operation), that major international actors indirectly use IS as a hired killer, through complex intelligence operations aimed at directing and inciting it to specific ends.

Indeed, the group’s actions in Syria, Iraq and elsewhere reflect a lot of evidence of this. Moreover, Ukrainian President Volodymyr Zelenskyy and his new chief of staff Anatoliy Barhylevych have spoken repeatedly of their new strategy of taking the battle to the heart of Moscow. There have also been reports of Ukrainian intelligence officers carrying out secret operations, including the bombing of the Nord Stream pipeline that transported Russian gas to Europe, something Kyiv has denied.

All this has fueled suspicion. that the Moscow operation was somehow linked to a Ukrainian and Western message to Russia. It is not inconceivable that IS-Khorasan could be used as a tool in the conflict between the West, led by the United States, and Russia, along with Iran and China. However, proving such a theory would however require detailed monitoring of events, given the opacity of the situation.

Regardless of the truth, Moscow likely to accuse Ukraine and the West of involvement in the attack, whether through genuine investigations or by fabricating and falsifying evidence. It will likely use such efforts to stir up Russian public opinion against Ukraine and accuse it of supporting terrorism, with the aim of mobilizing domestic public opinion behind the Russian war in Ukraine.