On the evening of March 22, footage began to roll out from in and outside Crocus City Hall, a concert venue near Moscow, of an attack quickly claimed by the Islamic State, or IS.

Four men, three of them armed with assault rifles and a fourth with incendiary devices, attacked an auditorium filled with spectators awaiting a sold-out concert.

The attack left at least 140 people dead, including three children, and 150 more injured. The attackers reportedly fled as the fires set inside spread and the roof of the building collapsed in a burning mass of debris.

“Islamic State fighters attacked a large gathering of Christians in the city of Krasnogorsk on the outskirts of the Russian capital, Moscow, killing and wounding hundreds and causing great destruction to the place before they withdrew to their bases safely,” read a message posted to the IS media outlet Amaq news.

What followed were brutal recordings from body cameras worn by the assailants during the attack. Showing bodies strewn about the concert hall, fires, shootings, and an attempted beheading, as well as photos of the men who allegedly committed the attack posing in front of an Islamic State flag before the attack.

The Russian authorities late identified the suspects as Shamsidin Fariduni, 25, Muhammadsobir Fayzov, 19, Dalerdzhon Mirzoyev, 32, and Saidakrami Murodali Rachabalizoda, 30. All four are understood to be Tajik citizens.

Shortly after, more footage, this time of members of Russian military and law enforcement, purport to show the four alleged perpetrators captured and showing signs of torture. A comparison of these images and footage of the attack by Russian publication The Insider found common and unique features in the clothes worn by the captured and killed men and those shown carrying out the violence.

One video shows an unidentified soldier cutting the ear off of a suspect and forcing him to eat it. Pictures from the four suspects' appearance in court showed signs of physical abuse. All men are reported to have pleaded guilty.

Subsequently, ISKP, or Islamic State Khorasan, the IS’s Afghan affiliate, published a threat to “all brutal Russians, including [Russian President Vladimir] Putin” for torturing the suspects, promising “you will be massacred all together with your women and children.”

IS’s top spokesman praised the attack in a statement issued on March 28 and praised ISKP for its attacks on Russian, Chinese, and American nationals.

Sunday was declared an official day for mourning in Russia, with President Putin promising a quick response. In a televised speech, he claimed the suspects were attempting to cross into Ukraine and that a “window” had been opened to allow the attackers to cross, and that the “terrorists had safe haven waiting for them.”

U.S. National Security Council Advisor John Kirby told reporters that there was “no indication … that Ukraine or Ukrainians were involved.”

Intelligence indicates that ISKP was responsible. ISKP has a history of successfully recruiting individuals from Central Asia, including from Tajikistan, who make up a relatively small but increasingly active part of the organization’s external operations.

The attack comes a little over two weeks after the announcement on Russian state media of a raid on an Islamic State cell in the city of Kaluga, southwest of Moscow, that was allegedly preparing to attack a synagogue in Moscow. The Federal Security Service, or FSB, said two members of the cell had been killed in the March 7 operation.

Footage purporting to be from the raid shared on Russian media shows two bodies, firearms, ammunition, and knives being examined by the FSB.

The same day, the U.S. Embassy in Russia issued a warning of imminent plans to “target large gatherings in Moscow” and asked its citizens to stay away from large gatherings of people, including concerts.

Finnish, Latvian, Estonia, Germany, and the United Kingdom issued similar advisories during the same period. In the aftermath of the attack, and after ISKP’s al-Azaim Foundation and pro-IS media outlet al-Battar threatened France, Italy, Spain, and the United Kingdom. Both France and Italy raised their terror threat level.

On March 3, the FSB also reported killing six Islamic State militants in the Muslim-majority republic of Ingushetia.

Khorasan Province Spearheading IS External Operations

If it is definitively determined that the Moscow atrocity was carried out by ISKP, it would be consistent with the rapid increase in the branch’s external operations activities as of late. There have been 21 plots disrupted in nine countries since last March, trumping eight from the prior year, and only three recorded between 2018 and March 2022. Despite the decline in insurgent activity inside Afghanistan itself, ISKP has continued to expand its propaganda reach and external operations capabilities. The branch has successfully struck inside Iran, the Maldives, possibly Turkey and Tajikistan, and now seemingly Russia. In addition, it has plotted against various extra-insurgent theater states such as India, Iran, Germany, Austria, the Maldives, Qatar, Turkey, Kyrgyzstan, and Russia. Moreover, the suspect profiles of the Moscow attack are not surprising given how ISKP has been tapping its Central Asian contingent for external operations in recent months.

The hostility toward and intent to strike Russia also exists, as it was named a top enemy of the Islamic State in 2014, with then-caliph Abu Bakr al-Baghdadi asserting that the movement’s foes are “being led by America and Russia, and being mobilized by the Jews.” The military intervention to prop up Bashar al-Assad, close relations with Iran, and Russian mercenaries sharing a battle space with Lebanese Hezbollah in Syria positions Moscow as the vanguard of Shia interests. Wagner Group activities across Africa in the Sahel have further drawn the ire of IS.

Russia also occupies an important place in the lore of the global jihadist movement as a historic enemy of Islam for the Soviet invasion and occupation of Afghanistan and its wars in Chechnya. Russia’s scorched earth counterinsurgency campaign in the Caucasus included collective punishment and wanton violence, ensuring a lifetime of grievances for citizens in Dagestan and the surrounding Russian republics.

ISKP has been particularly vocal about Moscow’s strengthening relations with the Taliban and carried out a suicide bombing against the Russian embassy in Afghanistan in September 2022, shortly after calling upon supporters to “cast fear into the hearts of the sons of Putin and Russia” and to “kill them with cars and knives.”

ISKP has also been notably successful in other attacks outside of its home province of Afghanistan, including a recent double suicide bombing in Iran during an event commemorating the death of Major General Qassem Soleimani. The January 3 attack left at least 91 dead and injured over 100 more. While official dispatches by IS did not attribute the attack to the Khorasan branch, U.S. officials stated that its intelligence provided “clear-cut and indisputable” evidence that ISKP was the culprit.

In a statement, Iranian officials said that one of the suspects, a Tajik national, trained at an IS facility in Afghanistan’s Badakhshan province.

Only weeks later, on January 28, a Sunday mass was targeted in Turkey by two men who entered the Roman Catholic Church of Santa Maria in Istanbul. One of the men pulled a pistol and proceeded to assault one parishioner and kill another. The assailant's gun appears to jam in the silent security footage and the pair flee the scene. The suspects were reportedly Tajik and Russian nationals.

The apparent geographic spread of ISKP’s targets is notable, as are its efforts to recruit across a variety of nationalities. Using its in-house propaganda apparatus, the Al-Azaim Foundation for Media Production, propaganda is spread in multiple languages including Tajik, Uzbek, and Russian.

Kyrgyzstan security services claimed to have arrested two alleged ISKP members and said they were involved in a plot to detonate an improvised explosive device in the central square of Jalal-Abad and attack a church during New Year celebrations.

Likewise, in Tajikistan, the Interior Ministry blamed a car bombing against the head of a regional branch of the ruling People's Democratic Party of Tajikistan on the “Horasan” wing of IS in Afghanistan. The vehicle caught fire outside of his home and an investigation later determined an improvised explosive device caused the blaze.

A series of arrests in Austria and Germany that began on December 22 aimed to disrupt a transnational “Islamist network,” which was determined to involve Tajik and Uzbek nationals. It is suspected that the group was planning to conduct attacks on behalf of ISKP during Christmas or New Year’s Eve in Vienna and Cologne.

Germany has also been the target and planning site of several plots over the past four years. Law enforcement revealed on March 19 that two suspects had been arrested after being instructed to carry out an attack against the Swedish parliament by ISKP. Authorities cited “concrete” plans for an assault in Stockholm and failed attempts to secure weapons. Seven other suspects from Central Asia were also reportedly arrested in Germany and two others in the Netherlands after a joint anti-terrorism operation on July 7. The group was planning “high profile” actions in Germany and had already acquired firearms. In 2020, four Tajik citizens were picked up after scouting U.S. Air Force bases in Germany. The men were reported to have already acquired firearms and ammunition.

French President Emmanuel Macron revealed after the recent Moscow attack that his country’s intelligence services had thwarted multiple plots by ISKP. He did not offer any specifics but said from French Guiana that ISKP had “carried out several attempts on our own soil in recent months”. Following the Crocus attack, French intelligence had increased its attention on Central Asians including Turkmen, Kyrgyz and Kazakh nationals.

The stigmatization of Central Asians by Russian officials will only fuel the resentments IS has been exploiting. ISKP is uniquely positioned to exploit such grievances to incite supporters to violence and attract new recruits from the region to bolster its insurgent activities in Afghanistan and Pakistan and employ in its external operations.