The international influence of Islamic State Khorasan (IS-K), a branch of the Islamic State, has been on the rise.
The group has been linked to numerous attacks and planned attacks in 2024. The highest profile plots include a deadly attack on a concert hall in Moscow, foiled plans to disrupt three Taylor Swift concerts in Austria, and twin bombings in Iran.
Sky News has analysed new data from the Centre for Information Resilience (CIR) that shows a sharp rise in propaganda produced by the group, which is being disseminated in more languages than ever.
As the amount of propaganda has increased, reaching audiences far beyond Afghanistan‘s borders, so has the number of international attacks and planned attacks, posing a growing threat to Western security.
German officials recently said they have foiled planned IS-K attacks, as authorities in the country remain on high alert. In July, French officials said they uncovered several terrorist plots targeting the 2024 Paris Olympics. In the weeks leading up to the Games, IS-K’s propaganda channels had published several posters inciting supporters to attack various locations in Paris during the event.
An IS-K poster inciting violence at the Paris Olympics
Experts expect this trend of incitement to continue gaining traction and the UN has warned of IS-K’s heightened threat levels across Europe.
“The group is considered the greatest external terrorist threat to the continent,” Vladimir Voronkov, the under-secretary-general for the UN’s Office of Counter-Terrorism, said in a briefing in August.
The Afghan wing of Islamic State (IS), commonly known as IS-K, ISIS-K or ISKP, has emerged as the terrorist organisation’s most globally-minded affiliate.
CIR has also been observing a gradual diversification of IS-K’s media and propaganda, according to Ben den Braber, head of research for Afghan Witness, the team behind the new data.
“Recently, especially since the uptick in propaganda, we’ve seen a bigger focus on Central Asia and on Europe,” he said.
In addition to targeting its core audiences in South and Central Asia, specifically Tajikistan and Uzbekistan, the group has been gradually disseminating media in an increasing number of languages.
One recent poster produced by the group’s in-house media outlet announced the broadcast of their content in Urdu, adding to the array of languages it already publishes including Pashto, Persian, Tajik, Uzbek, Russian, Turkish, Azerbaijani, English and Arabic.
Poster shared by one of IS-K’s English-language propaganda outlets
Global ambitions
IS-K first emerged in 2015, when their primary focus was to gain territory in Afghanistan to help establish a caliphate, or a territory controlled by a single IS ruler.
The K in its name refers to Khorasan, a province in Afghanistan that historically encompasses parts of modern-day Iran, Central Asia, Afghanistan and Pakistan.
After US troops pulled out of Afghanistan in 2021 and the Taliban regained power, the number of attacks and influence by IS-K inside the country has been dwindling, according to data gathered by CIR’s Afghan Witness team.
The group has increased its strength since the US withdrawal and ramped up international operations, despite the Taliban’s campaign to crackdown on IS-K in Afghanistan.
“The threat posed by [IS-K] has grown with significant terrorist attacks outside of Afghanistan, notably in Moscow on 22 March, and with increased threat levels in Europe and other areas,” the UN Security Council recently wrote in a report.
The data backs this up. CIR has also documented a significant uptick in attacks and arrests of IS-K-linked individuals outside Afghanistan since 2022.
“The really interesting piece of this is not that the Taliban’s been able to limit attacks in Afghanistan,” said Colin Clarke, director of research at the Soufan Group, a New York-based security and intelligence firm.
“It’s been the adaptability of IS,” he added. “They made that transition seamlessly. And they’ve stuck with it.”
There was a noticeable shift in IS-K’s propaganda narratives after the Taliban regained power in Afghanistan, said Dr Amira Jadoon, assistant professor of political science at Clemson University and the author of a forthcoming book about IS-K.
“There’s still the vilification of the Taliban. But we see a shift towards talking about different issues and grievances of different communities,” she said.
Taylor Swift performs on stage in Edinburgh during her Eras Tour. Pic: PA
Aside from focusing their content on successful attacks and capitalising on local issues in key countries like Tajikistan and Uzbekistan to rally supporters, the group publishes propaganda that touches on wider global conflicts.
This is seen by scholars as a way for IS-K to capitalise on the feeling of hostility in the Muslim world, and to take advantage of anti-Western sentiment, exacerbated by the war in Gaza.
“The goal became here to show how [they] are such a broad platform that anyone can join,” said Dr Jadoon.
Shift in strategy
In August, a disrupted plan to attack three Taylor Swift concerts in Vienna was the latest high-profile international plot linked to IS-K. Austrian authorities say the main suspect had pledged allegiance to the group and had been consuming and sharing propaganda online.
The suspects in the foiled Vienna attacks intended to kill “tens of thousands” of people, according to the US’s Central Intelligence Agency (CIA).
Please use Chrome browser for a more accessible video player
Swift terror suspect image released
Instances like this and the thwarted attacks in Paris during the Olympics, for example, make up a fraction of the planned attacks in Europe this year, which experts estimate to have been at least half a dozen to date.
Crocus City Hall following an attack on the concert venue outside Moscow. Pic: Reuters
The group is also responsible for several successful plots this year.
In March, gunmen attacked and set fire to Crocus City Hall, a concert venue in Moscow. The incident left nearly 140 people dead. Four men of Tajik origin were arrested.
While IS-K didn’t directly claim responsibility, they posted a video in one of their channels from one of the attackers’ phones while they conducted the rampage, and have implied in other posts that they were the ones behind the attack.
The violence in Moscow was also preceded by a string of anti-Russian messages on IS-K channels online.
“The propaganda is somewhat of a foreshadowing of the area of interest for the organisation,” said Mr den Braber of CIR.
After the attack, the group published a flyer with text that read “After Moscow, Who is the Next?”, along with images and the names of various large European cities.
A propaganda poster shared on IS-K online channels in April after the Moscow attack
At this stage, IS and its Afghan branch are trying to gain prominence on the international stage by generating media attention to recruit supporters and, crucially, raise money, according to experts.
In January, the group was linked to double suicide bombings at a memorial service in Kerman, Iran, which killed over 100 people, and a gun attack at a church in Istanbul.
“What they’re after is the media exposure. Why? Because another thing that’s changed in recent years is that IS lost its big donors,” said Dr Antonio Giustozzi, senior research fellow at the Royal United Services Institute.
Members of his research team are part of several IS-K Telegram channels and WhatsApp groups, and were told that the Iran attack helped IS-K raise quite a lot of money from donors, often sent using crypto.
An IS-K Telegram post from April calling for fundraising intimates the group was behind the Moscow, Iran and Istanbul attacks. Pic: Lucas Webber/X
“Their goal is to kill large numbers of civilians to garner attention,” said Mr Clarke, who runs research at The Soufan Centre.
“These kinds of terror plots are really intended to generate momentum for the group to make it a household name once again, and with that comes recruitment and donations.
“Taylor Swift’s arguably the most recognisable and famous pop star in the world. If they were successful in attacking that concert, similar to the way the Ariana Grande Manchester bombing took place, ISIS would have enjoyed weeks, if not months of unfettered propaganda, which helps buoy the group and give them momentum.”
Even foiled plots like the planned attacks on the Swift concerts in Austria, he said, are a win.
Read more:
What is IS-K and why would it target Russia?
UK should ‘absolutely’ be concerned about IS-K after Moscow attack
The Happel stadium after Taylor Swift’s three concerts in Vienna in August were cancelled. Pic: Reuters
Hard to track
As well as distributing content through their own media, content is shared widely on social media platforms like Meta, X and encrypted messaging apps like Telegram.
Experts say that IS-K encourages its supporters around the world to create their own propaganda that aligns with its position.
IS-K appears to be inciting attacks from afar. A lot of propaganda calls on self-radicalised supporters through online channels to carry out unsophisticated plots against civilians, rather than planning directed attacks, which are defined by sending highly trained individuals to hit specific locations.
“Self-radicalisation is one of the key threats with all this propaganda that they put out there,” said Dr Jadoon, who’s authoring a book about IS-K.
‘Incited’ or inspired attacks, Jadoon says, can be very hard to track. “If someone is just absorbing content and not really engaging in any way, then it makes it harder to detect,” she added.
“With directed attacks, there are more opportunities for law-enforcement to detect unusual activity on groups. There’s more chance there will be a paper trail.”
Another obstacle in tracking IS-K content and potential plots is the fact that social media platforms have strict censorship rules.
Mr den Braber says content moderation is the biggest difficulty for his team in keeping on top of different communication channels, adding that old IS-K chat rooms are taken down and new ones pop up every day.
Future plots
Keep up with all the latest news from the UK and around the world by following Sky News
Counter-terrorism experts say Western intelligence has a good penetration of these online networks and is disrupting them frequently and early.
But some warn that because agencies in the West are overburdened, something could slip through the cracks.
“There’s so much going on in the world so there are gaps in intelligence and law enforcement monitoring,” said Lucas Webber, senior threat intelligence analyst at Tech Against Terrorism, a UN initiative that tracks terrorist activities online.
“It’s going to be difficult to prevent one or more attacks slipping through at this point.”
The Data and Forensics team is a multi-skilled unit dedicated to providing transparent journalism from Sky News. We gather, analyse and visualise data to tell data-driven stories. We combine traditional reporting skills with advanced analysis of satellite images, social media and other open source information. Through multimedia storytelling, we aim to better explain the world while also showing how our journalism is done.