The mass shooting and fire at the Crocus City Hall concert venue outside Moscow on March 22 was the deadliest terrorist attack Russia has seen since the 2004 Beslan school siege. The gunmen’s actions claimed at least 137 lives and injured 180 others. The four suspects currently in custody are citizens of Tajikistan. But Russian authorities are doing their best to connect the attack to Ukraine. Sources in Western intelligence, meanwhile, say it was the work of the Islamic State-Khorasan, a branch of the Islamic State also known as ISIS-K. Experts note that ISIS-K has declared Russia among its main enemies (along with the U.S. and China). Meduza breaks down what you need to know about ISIS-K and why the group has Russia in its sights.

What is ISIS-K?

ISIS-K, or the Islamic State-Khorasan, is a branch of the Islamic State that operates primarily in Afghanistan and Pakistan. Formally, the organization governs an ISIS province (wilayah, in Arabic) and reports to the ISIS caliph. Currently, this position is held by Abu Hafs al-Hashimi al-Qurashi, whose four predecessors were killed in U.S. operations.

According to ISIS ideology, its caliphate, or state, aims to span the entire globe. The organization has divided the world into provinces, some of which are headed by local Islamist movements that operated before ISIS came into existence (for instance, ones connected to Al-Qaeda). In fact, ISIS itself emerged when the Al-Qaeda branch in Iraq severed ties with the global Al-Qaeda leadership.

Similarly, the Afghan-Pakistani branch of the Islamic State, ISIS-K, emerged in 2015 as a local movement. Initially, the group was composed of several thousand opponents of Afghanistan’s pro-American government, mostly Pashtuns, who were disillusioned with the Taliban. ISIS-K immediately started engaging in armed conflicts with the U.S. army, the Afghan government, and, even more brutally, with the Taliban.

The Taliban’s ideology fundamentally differs from that of ISIS. The Taliban aim to establish a national Islamic State in Afghanistan, while ISIS supporters advocate for world domination and the defeat of all “infidels.” Islamic nationalism won out in Afghanistan (and neighboring Pakistan), and by 2018, the Taliban (with the unofficial help of U.S. air support) had virtually destroyed ISIS-K’s organized resistance in the eastern provinces. U.S. forces killed several of the group’s leaders and, according to experts, the organization’s numbers were severely depleted, going from several thousand to a few hundred people.

Sanaullah Ghafari, who took over ISIS-K’s leadership, shifted the group’s strategy from direct armed confrontations to increasingly ruthless acts of terrorism against the Taliban, religious minorities, and Americans. During the U.S. troop withdrawal from Kabul in August 2021, he allegedly orchestrated a suicide bombing at the airport gate through which refugees fleeing Taliban rule were trying to enter. The attack killed 182 people, including 13 U.S. servicemen.

ISIS-K later expanded its list of enemies to include Russia, among others. On September 5, 2022, an explosion near the Russian embassy in Kabul killed five people, including two embassy staff. ISIS-K claimed responsibility for the attack. In January 2024, more than 90 people were killed in twin explosions in Kerman in Iran. U.S. intelligence confirmed ISIS-K orchestrated the attacks. However, Taliban agents allegedly killed Ghafari in 2023, and it’s unclear who’s currently at the helm of ISIS-K. That said, judging by the Iran attacks, its strategy remains unchanged.

Why Russia?

Radical Islamists have long accused Russia of being a state that “oppresses Muslims” both at home and abroad. ISIS propaganda regularly mentions Russia’s past military campaigns in Afghanistan and Chechnya, and Moscow’s intervention in support of Bashar al-Assad’s government in Syria put an even bigger target on its back.

ISIS-K leadership has seen the initial success of ISIS leadership, which capitalized politically on the global struggle against “infidel empires” such as the United States, China, Iran, and Russia. Prioritizing “external operations” could yield far greater political and financial benefits (in the form of donations) than working with local resources.

There are also deeper reasons for the particular hostility towards Russia. In recent years, ISIS-K has been trying to expand the movement’s ethnic base — both in Afghanistan and beyond. In the northern regions of Afghanistan, where many ethnic Uzbeks and Tajiks live, its numbers are growing. ISIS-K regularly threatens Central Asian authorities, calling them “puppets of the Russian empire.” In this sense, the struggle against Russia is a fight for resources: primarily for radically minded supporters in Uzbekistan, Tajikistan, and neighboring countries.

Was ISIS-K behind the attack?

There’s still no publicly available indisputable evidence that ISIS-K organized the attack. However, ISIS has claimed responsibility, and sources told CNN that the U.S. is in possession of intelligence confirming these claims. The New York Times also reported that Washington considers ISIS-K to be behind the attack.

Ruslan Suleymanov, a Middle East expert, expressed skepticism to Meduza about whether ISIS-K currently possesses the necessary resources to organize such a large-scale terrorist attack on the outskirts of Moscow. However, the attack doesn’t appear to have been “high-tech” in nature: the perpetrators clearly had problems with their escape plan, as well as with weapons. (In a video from the attack, sparks are seen flying from the barrel of one of the machine guns, which could indicate that either the ammunition or the weapons themselves were in poor condition.)

Suleymanov said it’s also difficult to confirm whether messages on ISIS Telegram channels are authentic as the group’s accounts are regularly blocked, forcing it to create new ones. The posts about the Moscow attack come from ISIS-linked Amaq News Agency, not from ISIS-K directly. In one picture, the four alleged “participants in the operation” are shown with blurred faces against the backdrop of the Islamic State flag. Amaq later released a first-person body-cam video that clearly shows the attack on Crocus City Hall, corroborating the Islamic State’s involvement.