Islamic State-Khorasan’s Reach Extends Far Beyond Afghanistan

Many media outlets have highlighted the Taliban’s strategic use of the internet for social control. But with internet use growing exponentially across the region, Islamic State-Khorasan is potentially even more destabilizing than the Taliban, given its potential to reaching an ever-widening audience.

Islamic State-Khorasan is a violent extremist group familiar to terrorist watchers: It has carried out scores of attacks in Afghanistan and Pakistan since first establishing itself in 2015. Islamic State-Khorasan also maintains a lively presence on social media and encrypted messaging platforms across South and Central Asia.

In a grim reminder of the threat posed by Islamic State-Khorasan, the Islamic State’s Afghanistan affiliate, a lone suicide bomber detonated roughly 25 pounds of explosives at Kabul airport on Aug. 26, killing 13 U.S. troops and up to 170 other people. The U.S. military responded less than 48 hours later with an unmanned airstrike in Afghanistan’s Nangarhar province, killing two suspected Islamic State-Khorasan members. A second airstrike targeting a suspected Islamic State-Khorasan suicide bomber followed in Kabul a day later—killing as many as 10 civilians .

In a grim reminder of the threat posed by Islamic State-Khorasan, the Islamic State’s Afghanistan affiliate, a lone suicide bomber detonated roughly 25 pounds of explosives at Kabul airport on Aug. 26, killing 13 U.S. troops and up to 170 other people. The U.S. military responded less than 48 hours later with an unmanned airstrike in Afghanistan’s Nangarhar province, killing two suspected Islamic State-Khorasan members. A second airstrike targeting a suspected Islamic State-Khorasan suicide bomber followed in Kabul a day later—killing as many as 10 civilians.

Islamic State-Khorasan is a violent extremist group familiar to terrorist watchers: It has carried out scores of attacks in Afghanistan and Pakistan since first establishing itself in 2015. Islamic State-Khorasan also maintains a lively presence on social media and encrypted messaging platforms across South and Central Asia.

Many media outlets have highlighted the Taliban’s strategic use of the internet for social control. But with internet use growing exponentially across the region, Islamic State-Khorasan is potentially even more destabilizing than the Taliban, given its potential to reaching an ever-widening audience.

Unlike the Taliban, which focus on Afghanistan, Islamic State-Khorasan exhibits regional and millenarian ambitions such as uniting Muslims across South Asia, Central Asia, and beyond. Islamic State-Khorasan’s hardline Islamist ideology, which makes the Taliban appear moderate, limits its mass appeal. Even so, the group’s attacks against U.S., Pakistani, Russian, and other countries’ security forces—skillfully shared on social media—may solidify its base and attract new recruits sympathetic to its harsh brand of political Islam. The group’s active digital outreach could likewise inspire organized or lone-wolf attacks not just in Afghanistan, but also in neighboring countries.

Because Islamic State-Khorasan doesn’t control much territory of its own, the group is heavily dependent on the internet, including social media, to coordinate planning, logistics, and recruitment, and to influence operations. Future efforts to deter attacks by Islamic State-Khorasan and its sympathizers will require monitoring and disrupting a wide range of digital platforms, channels, subscriptions, and interactions in multiple jurisdictions across several languages.

Islamic State-Khorasan’s modest territorial footprint in Afghanistan and Pakistan is bolstered by a widening digital presence across Central and South Asia. Originally an administrative division (or wilayat) of the Islamic State, the group’s membership is a mash-up of disaffected Afghan and Pakistani Taliban and members of the Islamic Movement of Uzbekistan; it later also poached militants from the Kashmir region, Tajikistan, and Turkmenistan. Islamic State-Khorasan’s online reach radiates as far as Bangladesh, India, Kazakhstan, and the Chinese province of Xinjiang.

In line with Islamic State leadership in Iraq and Syria, Islamic State-Khorasan’s stated goal is to establish a caliphate, governed by sharia law, across a large swath of South and Central Asia. (“Khorasan” is an old Persian term for the region comprising Afghanistan, northeastern Iran, and the southern parts of Central Asia, but Islamic State-Khorasan operates in Pakistan as well.) Like other members of the Islamic State franchise, the group targets minorities it considers “apostate,” such as Hazara Shiites, Sufis, Sikhs, and moderate Sunnis.

It also views “crusaders” and other foreigners within the territories of the caliphate, including U.S. personnel in Afghanistan and Chinese, Pakistani, and Russian forces across Central Asia, as fair game. While the overall number of attacks has declined in recent years, Islamic State-Khorasan is hyper-violent. It is responsible for hundreds of strikes targeting U.S., Afghan, and Pakistani security forces and civilians, including 77 attacks in the first four months of 2021 alone.

Islamic State-Khorasan is also a sworn enemy of the Taliban. The group denounced the Taliban’s latest takeover of Afghanistan on the grounds that the latter’s version of Islamist rule is insufficiently orthodox. Islamic State-Khorasan casts its adversary as “filthy nationalists,” presumably because of the Taliban’s lack of commitment to forming a global caliphate. The recent suicide attack, then, is not just a humiliating blow against the United States, but also a targeted effort to discredit the Taliban’s ability to wield power and deliver security. The Taliban, predictably, have announced their intention to capture Islamic State-Khorasan leader Shahab al-Muhajir.

Although Islamic State-Khorasan’s operational focus is on Afghanistan and Pakistan, it also frequently lashes out in neighboring countries. For example, in early 2015, Islamic State-Khorasan affiliates tried to cross the Afghan border to enter Turkmenistan but were rebuffed by Uzbek and Turkmen forces operating with Russian military support. That same year, Islamic State-Khorasan and the Islamic Movement of Uzbekistan pledged allegiance to one another; a faction of the latter later broke off to forge an alliance with the Taliban and al Qaeda instead. In 2017, Islamic State-Khorasan declared jihad on Russia in response to the latter’s activities in Syria. And in 2019, the group claimed responsibility for an attack on the Ishkobod border post between Uzbekistan and Tajikistan. Just before the attack, Amaq News Agency—which is linked to the Islamic State—posted a video displaying what appeared to be Tajik fighters calling for the formation of a caliphate.

The precise size and composition of Islamic State-Khorasan are hard to discern. Group membership reportedly swelled to as many as 4,000 active fighters across Afghanistan in 2016. Throughout its short history, Islamic State-Khorasan has been an amalgam mainly of South and Central Asians, including as many as 1,000 to 1,500 fighters from the latter region. Its ranks were decimated beginning in 2018 due to U.S.-led airstrikes and raids. In late 2019, for example, more than 800 Islamic State-Khorasan members surrendered in Nangarhar province, including not only Iranians and Pakistanis, but also Kazakhs, Uzbeks, and Tajiks. Of the 60 suspected Islamic State-Khorasan inmates from Central Asia held in Afghan jails earlier this year, a sizable portion were from Kyrgyzstan, Tajikistan, and especially Uzbekistan.

A major reason for Islamic State-Khorasan’s resilience is its digital strategy.

Islamic State-Khorasan has shown incredible staying power. Repeated crackdowns by U.S., Russian, and Afghan forces failed to deter the group from recruiting younger, urban Afghans and members of disillusioned minority groups across the region. Far from withering away, the group has continued calling for international jihad in the former Khorasan region and expanded its brand to the post-Soviet states of Central Asia as well. Islamic State-Khorasan’s extremist credentials have made it attractive to some groups looking to enhance their reputation, while also making it antagonistic to competing groups, including the Afghan and Pakistani Taliban, Pakistani militant group Lashkar-e-Taiba, and original Islamic Movement of Uzbekistan. Despite its limited territorial control, there are real concerns that its eventual expansion in eastern and northern Afghanistan could create a bridgehead for destabilizing activities further afield, not least in the fragile secular states of Central Asia.

A major reason for Islamic State-Khorasan’s resilience is its digital strategy. Both Islamic State-Khorasan and its parent in Iraq and Syria have a lively online presence of supporters spanning Central Asia. The group’s significant Central Asian connection has been facilitated by a long tradition of battle-hardened foreign fighters moving between the region and Syria, but it also has much to do with the accelerating digital transformation.

SecDev, the digital risk consulting firm where we are both principals, has monitored social media and messaging channels linked to known violent extremist groups—including Islamic State-Khorasan—since 2019. Those channels can be disaggregated into three categories: 1) Official channels that appear to be overseen and administered by the groups themselves; 2) directly linked channels that are unofficial but seem to be strongly linked to these groups; and 3) indirect channels that are clearly independent but share violent extremist groups’ content and amplify their messages. Content is, for the most part, shared in the region’s languages and tailored to local audiences.

A deeper dive into the Islamic State-Khorasan digital ecosystem offers insight into the group’s tactics. Between 2019 and 2020, for example, SecDev identified roughly 90 Uzbek and Tajik social media channels connected to the Islamic State and its affiliates explicitly targeting Central Asian audiences. Of these, around 40 were connected to Islamic State-Khorasan, while nearly 50 were linked to the Islamic State more broadly. Most of these channels were directly connected to the two groups, even if only a few claimed to be official organization channels. By the end of 2020, the social media platforms had taken down some of the channels we identified, but around two-thirds were still publicly available. These attracted over 5,600 subscribers as of late 2020—over 1,700 subscribers to active channels and close to 3,900 subscribers to inactive channels.

Over the past few years, Islamic State-Khorasan seems to have concentrated its activities on a fairly narrow range of social media platforms and languages. The vast majority of activity took place via the encrypted messaging service Telegram, while a smattering of channels appeared across YouTube, Instagram, Facebook, and the Russian social media platform Odnoklassniki. Over 95 percent of Islamic State posts identified by SecDev were in Uzbek, with less than 5 percent in Tajik. A representative sample of the observed channels showed that roughly 35 percent could be classified as “violent extremist,” 41 percent as “extremist,” and 24 percent as “neutral.” Surely this is just the tip of the digital iceberg—a deeper dive into both the accessible internet and the dark web could expose a great deal more about how groups like Islamic State-Khorasan thrive, online and off.

With increasing numbers of Afghans, Pakistanis, and Central Asians on the internet, these challenges are likely to grow in the months ahead.

There is every likelihood that Islamic State-Khorasan will take advantage of instability in Afghanistan and widen its digital presence to expand its appeal and influence—including on alternative platforms. Besides using Telegram, for example, the Islamic State is reportedly turning to even less regulated apps such as Rocket.Chat messenger and Discord to share content. In what appears to have been an Islamic State publicity stunt, the U.S.-based GETTR social media platform, was flooded with Islamic State propaganda a few weeks after it was launched by an associate of former President Donald Trump earlier this year.

With an increasing number of South and Central Asians joining mainstream social media platforms, we can expect Islamic State-Khorasan influence operations to grow. While only 11 percent of Afghans used social media in January 2021, that was a 20 percent jump from 2020 numbers. Similar trends are evident in Central Asia.

Islamic State-Khorasan is a complex and fluid amalgam of extremist ideologies and actors. Its reach is spilling over from its traditional stronghold in Nangarhar and risks inflaming sectarian fissures as far afield as Tajikistan, Uzbekistan, China, and India. With U.S. and Afghan government forces out of the way, Islamic State-Khorasan will undoubtedly step up its anti-Taliban activities and focus on its core goals: delegitimizing and destabilizing governments, undermining faith in public institutions, and exacerbating sectarianism. The group and its affiliates also have a demonstrated capability to gather recruits and mobilize supporters via an expanding digital reach, tailored extremist propaganda, and a range of harmful digital content in a variety of languages across South and Central Asia. With increasing numbers of Afghans, Pakistanis, and Central Asians on the internet, these challenges are likely to grow in the months ahead.