Explainer: ISIS-Khorasan in Afghanistan

In 2015, the Islamic State announced the formation of Khorasan Province (ISIS-K), a new affiliate based in Afghanistan. The group’s early recruits were former members of the Pakistani Taliban, the Afghan Taliban and other militant groups such as the Islamic Movement of Uzbekistan. ISIS-K promoted its vision of a global caliphate while disparaging the rival Afghan Taliban as “filthy nationalists” for limiting its ambitions to Afghanistan. By 2016, it had up to 6,000 fighters.

The group emerged as one of the most belligerent in Afghanistan. It attacked both Taliban and Afghan government forces. It also attacked U.S. and NATO forces as well as civilians, including religious minorities, aid workers and journalists.  

But ISIS-K in turn came under military pressure from the Taliban as well as Afghan government and NATO forces, which took an increasingly heavy toll. In July 2018, the Taliban defeated ISIS-K forces in the northern province of Jowzjan. More than 200 ISIS-K fighters surrendered to Afghan forces rather than be captured by the Taliban.

The ISIS-K stronghold in eastern Nangarhar province came under attack by Taliban and Afghan forces in 2019. In November, Afghan President Ashraf Ghani declared victory. “No one believed one year ago that we would stand up and remain in Nangarhar, and thank God that today we have obliterated Daesh,” he said. More than 1,400 fighters surrendered to Afghan or NATO forces between October 2019 and March 2020, the United Nations reported. In April 2020, Abdullah Orakzai, the ISIS-K leader, and two other high-ranking commanders were arrested by Afghan intelligence officials. 

Despite the string of losses, ISIS-K managed to mount 115 attacks—albeit much fewer—between April 2020 and March 2021, down from 572 attacks the same period between 2019 and 2020. The attacks were down by nearly 80 percent, according to a U.N. report.

On August 26, 2021, ISIS-K claimed responsibility for bombings in Kabul that killed at least 170 Afghans and 13 U.S. service members. The deadliest attack on U.S. troops in a decade proved that ISIS-K still posed a potent threat. The following are excerpts from U.N. and U.S. government reports on ISIS-K by mid-2021, followed by a timeline of major attacks and President Biden’s remarks on the Kabul bombings.

U.N. Security Council

The following is the 12th report of the Analytical Support and Sanctions Monitoring Team to the United Nations on June 1, 2021:

“The Islamic State in Iraq and the Levant-Khorasan (ISIL-K) remains diminished from its zenith, following successive military setbacks that began in Jowzjan in summer 2018. However, since June 2020, it has had an ambitious new leader, Shahab al-Muhajir (not listed), and it remains active and dangerous, particularly if it is able, by positioning itself as the sole pure rejectionist group in Afghanistan, to recruit disaffected Taliban and other militants to swell its ranks. Member States have varying assessments of the extent of ISIL-K and al-Muhajir’s links with the Haqqani Network. Meanwhile, the Al-Sadiq office is co-located with ISIL-K in Afghanistan, pursuing a regional agenda in Central and South Asia on behalf of the ISIL core.”

“Despite territorial, leadership, manpower and financial losses during 2020 in Kunar and Nangarhar Provinces, the Islamic State in Iraq and the Levant-Khorasan (ISIL-K) continues to pose a threat to both the country and the wider region. ISIL-K is seeking to remain relevant and to rebuild its ranks, with a focus on recruitment and training of new supporters potentially drawn from the ranks of Taliban who reject the peace process.”

“ISIL-K territorial losses have affected the group’s ability to recruit and generate new funding. Although the group is assessed to retain a core group of approximately 1,500 to 2,200 fighters in small areas of Kunar and Nangarhar Provinces, 27 it has been forced to decentralize and consists primarily of cells and small groups across the country, acting in an autonomous manner while sharing the same ideology. The core group in Kunar consists mainly of Afghan and Pakistani nationals, while smaller groups located in Badakhshan, Kunduz and Sar-e-Pol are predominantly made up of local ethnic Tajiks and Uzbeks. Recent reporting by Afghan security agencies referred to the disruption of a 450-strong cell of ISIL-K around Mazar-e Sharif in Balkh Province, suggesting that the group may be stronger in northern Afghanistan than previously assessed.

“The ISIL core’s leadership in the Syrian Arab Republic views Afghan territory as a base for the spread of their influence to Central and South Asia as part of the realization of its “great caliphate” project. This has been supported by an active social media presence with a post-United States withdrawal period in mind. Following the decision of the United States and the North Atlantic Treaty Organization (NATO) to withdraw all troops from Afghanistan, the manner in which the Taliban approaches this transitional period and the extent to which they pursue an intra-Afghan peace process will determine the success of the ISIL-K strategy.

“Regionally, ISIL-K strategy is coordinated by the Al-Sadiq office, which covers the “Khorasan” region of Central and South Asia (including Afghanistan, Bangladesh, India, Maldives, Pakistan, Sri Lanka and the Central Asian republics). While infrequent, ISIL-K still maintains communications with ISIL core, but funding support to the Khorasan branch from the core is believed to have effectively dried up. 

“As noted in the Monitoring Team’s twenty-seventh report (S/2021/68, para. 60), ISIL-K is currently led by Shahab al-Muhajir (alias Sanaullah). Al-Muhajir was appointed by ISIL core in June 2020 via communiqué, following the capture by Afghan special forces of Aslam Farooqi (alias Abdullah Orokzai) (not listed), then head of ISIL-K, his predecessor Zia ul-Haq (alias Abu Omar Khorasani) (not listed) and other senior ISIL-K members. Prior to being appointed Emir, al-Muhajir served as ISIL-K chief planner for high-profile attacks in Kabul and other urban areas.

“Abu Omar Khorasani was reported by one Member State to have been both the leader of ISIL-K and the head of the Al-Sadiq office. According to that report, the two positions have now been separated: al-Muhajir was only appointed to lead ISIL-K, whereas Sheikh Tamim (not listed) took over the Al-Sadiq office. Tamim is reported to share good relations with al-Muhajir, with no tension evident between the two men or their respective missions. The regional structure which the Al-Sadiq office coordinates is replicated elsewhere in the world, with the ISIL directorate of provinces establishing and fleshing out a hub-and-spoke approach to the problem of the core’s inability to maintain its previous level of command and control. There is a direct analogy with the role of the Al-Karrar office, the hub co-located with ISIL in Somalia that coordinates the group’s activities in East and Central Africa.

“According to one Member State, al-Muhajir may also have been previously a mid-level commander in the Haqqani Network. That State assesses that he continues to maintain cooperation with the entity, providing “key expertise and access to [attack] networks” (see S/2021/68, para. 61). Thus far, the Monitoring Team is unable to confirm this, although several Member States report that fighters with relevant skills may migrate between terrorist groups in Afghanistan, based partly on which group has need of them and is able to pay them.

“Although some Member States have reported tactical or commander-level collaboration between ISIL-K and the Haqqani Network, others strongly deny such claims. Any relationship is based on personal connections and augmented by individuals moving among multiple terrorist groups. Authorized movement of personnel with a tacit understanding that both groups benefit from certain joint venture attacks is also likely, as such attacks project a weakening security situation that undermines public confidence in the Government and clearly benefits both ISIL-K and the Haqqani Network. In this manner, one Member State has suggested that certain attacks can be denied by the Taliban and claimed by ISIL-K, with it being unclear whether these attacks were purely orchestrated by the Haqqani Network, or were joint ventures making use of ISIL-K operatives.

“There are a number of attacks claimed by ISIL-K for which the Taliban have denied responsibility. These include the 12 May 2020 attack against the Médecins sans frontières maternity ward in Kabul, the 2 August 2020 attack against Jalalabad Prison, the complex attack on Kabul University of 2 November 2020, the rocket attack on Kabul city of 21 November 2020 that targeted the highly fortified Green Zone and Presidential Palace, the rocket attack of 12 December 2020 that targeted Hamid Karzai International Airport and the rocket attacks on Bagram Airfield of 9 April and 19 December 2020.

“During the first four months of 2021, the United Nations Assistance Mission in Afghanistan (UNAMA) recorded 77 ISIL-K claimed and/or attributed attacks. This was an increase over the same period in 2020, where the number of claimed/attributed attacks was far lower, at 21. The large increase in ISIL-K attacks for the first quarter of 2021 also corresponded to a similar increase in attacks by the Taliban during the same period. Overall, however, the number of ISIL-K attacks has continued to decrease annually. While 572 attacks were recorded between April 2019 and March 2020, the same period between 2020–2021 recorded 115, a decline of almost 80 per cent.”

“Member States assess that there has been a “trickle” of foreign terrorist fighters arriving in Afghanistan until now, not the significant influx that was anticipated of relocators from the collapsing ISIL “caliphate” in the period from 2017 to 2019. Individuals or groups with an extremist ideology, or those who are not willing to be controlled by the Taliban, may therefore still present themselves as recruits for ISIL-K. Even in a more positive scenario in which the Taliban clamps down on foreign extremists, the stabilization of the country will take time, providing opportunities to terrorists and warranting further international monitoring of the situation.”

U.S. Special Inspector General for Afghanistan Reconstruction

The following is the SIGAR’s Quarterly Report to the United States Congress on July 30, 2021:

“Civilian casualties continued to rise this quarter, including deadly urban attacks. In one of the worst incidents, on May 8, 2021, a car-bomb exploded along with two other blasts, killing 85 and wounding 275 students at Sayed–ul-Shuhada High School, a predominantly Shia girls school in Kabul. While no group claimed responsibility—the Taliban disavowed any involvement—U.S. officials believe that IS-K carried out the attack.

“RS [Resolute Support] reported 2,035 civilian casualties in April and May 2021, which included 705 deaths and 1,330 injuries. This total is nearly as high as the three months from January through March 2021 (2,149). According to RS, the top two causes of civilian casualties were improvised explosive devices and direct fire (e.g., rifle or machine-gun fire). As seen in Figure 2.31, these civilian casualties were nearly as high as the entire three month period last year (April–June 2020).

“RS attributed about 93% of this quarter’s civilian casualties to antigovernment forces (40% to the Taliban, 38% to unknown insurgents, 14% to IS-K, and less than 1% to the Haqqani Network), as seen in Figure 2.30. About 2% were attributed to progovernment forces (2% to ANDSF), and about 5% to other or unknown forces. These percentages are roughly similar to long-term trends reported by RS.”

U.S. Operation Freedom’s Sentinel

The following is an except from the Inspector General’s quarterly report to the Congress covering Apr. 1 to June 30, 2021:

“According to the DIA, ISIS-K is taking advantage of the political instability and violence in Afghanistan by using the opportunity to bolster its public support and recruitment efforts. This quarter, ISIS-K attacked minority sectarian targets and infrastructure to spread fear and highlight the Afghan government’s weakness. The attacks have increased ISIS-K’s public visibility and will help bolster its recruitment of disenfranchised Taliban members and other “educated extremists,” according to the DIA.

“In May, ISIS-K conducted a high-profile attack on a Sufi mosque and escalated its attacks on the Afghan government. According to the DIA, ISIS-K claimed credit for the destruction of nine electrical pylons and five fuel tankers, targeting infrastructure as part of a campaign of economic warfare. Additionally, ISIS-K targeted Shia bus passengers in Kabul and Parwan province, destroying 6 buses and resulting in approximately 64 casualties.”

Congressional Research Service

The following is an excerpt from a CRS report on “Terrorist Groups in Afghanistan” on Aug. 17, 2021:

“The Islamic State announced the formation of its Afghan affiliate in January 2015. ISKP (also known as ISIS-K) was once concentrated in eastern Afghanistan, particularly in Nangarhar province, which borders the region of Pakistan, formerly known as the Federally Administered Tribal Areas (FATA). There, ISKP was mostly comprised of former Tehrik-e-Taliban Pakistan (TTP, see below) militants who fled Pakistani army operations in the FATA after mid-2014.

“Arguably one of the Islamic State’s most successful affiliates, ISKP was “nearly eradicated” from its main base in eastern Afghanistan in late 2019 by U.S. and Afghan military offensives and, separately, the Taliban. An ISKP contingent in northern Afghanistan was similarly defeated in 2018. These territorial losses have forced the group to “decentralize” according to U.N. sanctions monitors, who assess the group has around 2,000 fighters primarily in the east but also in northern Afghanistan. A number of ISKP leaders have been killed in U.S. strikes or captured by Afghan forces since 2016. Still, U.S. officials have cautioned that ISKP remains a threat, and recent attacks attributed to the group indicate the same operational resilience it has demonstrated when pressured in the past. In addition to attacks against government targets, ISKP has claimed numerous large-scale bombings against civilians, mainly targeting Afghanistan’s Shia minority, including the May 2021 bombing of a girls’ school in Kabul.

“ISKP and Taliban forces have sometimes fought over control of territory or because of political or other differences. Upon taking power, the Taliban reportedly executed an imprisoned former ISKP leader in August 2021. Some have speculated that Taliban hardliners might defect to ISKP if Taliban leaders compromise on certain issues as they begin governing.”

ISIS-K Attacks in 2021

The U.N. Assistance Mission in Afghanistan (UNAMA) recorded 77 attacks either claimed by or attributed to ISIS-K from January through April 2021. ISIS was responsible for the deaths of at least 124 civilians during the first half of 2021, according to another UNAMA report. Major attacks in 2021 included:

May 8: A car bomb and two other explosions killed 85 people and wounded another 275 at Sayed ul Shuhada High School for girls. The attendees were predominately Hazara, an ethnic minority that follows Shiism. No group claimed responsibility. U.S. intelligence assessed that ISIS was responsible while Afghan President Ashraf Ghani blamed the Taliban.

June 8: ISIS gunmen killed 11 men and injured 15 others at a camp near Shaikh Jalal village in northern Baghlan province. The camp was run by the Halo Trust, a humanitarian organization focused on clearing land mines.

Aug. 26: ISIS carried out twin bombings outside Kabul airport that killed at least 95 Afghans and 13 U.S. service members. A suicide bomber and gunmen attacked the airport’s Abbey Gate. Another bomb went off near the Baron Hotel.  

President Biden’s Statement

The following is an excerpt of the president’s speech to the nation about the ISIS-K attack on Kabul international airport on Aug. 26, 2021:

“Been a tough day.  This evening in Kabul, as you all know, terrorists attacked -- that we’ve been talking about and worried about, that the intelligence community has assessed has [was] undertaken -- an attack -- by a group known as ISIS-K -- took the lives of American service members standing guard at the airport, and wounded several others seriously.  They also wounded a number of civilians, and civilians were killed as well.

“To those who carried out this attack, as well as anyone who wishes America harm, know this: We will not forgive.  We will not forget.  We will hunt you down and make you pay.  I will defend our interests and our people with every measure at my command.

“Over the past few weeks -- I know you're -- many of you are probably tired of hearing me say it -- we’ve been made aware by our intelligence community that the ISIS-K -- an arch-enemy of the Taliban; people who were freed when both those prisons were opened -- has been planning a complex set of attacks on the United States personnel and others.

“This is why, from the outset, I've repeatedly said this mission was extraordinarily dangerous and why I have been so determined to limit the duration of this mission.

“And as General McKenzie said, this is why our mission was designed -- this is the way it was designed to operate: operate under severe stress and attack.  We've known that from the beginning. 

“And as I’ve been in constant contact with our senior military leaders -- and I mean constant, around the clock -- and our commanders on the ground and throughout the day, they made it clear that we can and we must complete this mission, and we will.  And that's what I've ordered them to do.

“We will not be deterred by terrorists.  We will not let them stop our mission.  We will continue the evacuation.

“I've also ordered my commanders to develop operational plans to strike ISIS-K assets, leadership, and facilities.  We will respond with force and precision at our time, at the place we choose, and the moment of our choosing.

“Here is what you need to know: These ISIS terrorists will not win.  We will rescue the Americans who are there.  We will get out our Afghan allies out, and our mission will go on.”