Afghanistan Annual Threat Assessment
In 2024, Afghanistan experienced a modest resurgence of the activities of the Islamic State of Khorasan (ISK), after a quiet 2023 in which the organisation reached its nadir since its inception in 2015. Nevertheless, the overall level of ISK activities remains modest, and it does not pose a strategic threat to the Taliban, nor is it capable of causing a major disruption. However, there are signs that funding to ISK is also resurging, mostly because of the organisation’s involvement in attacks abroad (Iran and Russia). Although Afghanistan also hosts several other jihadist organisations, only the Tehreek-e-Taliban Pakistan (TTP) and Al-Qaeda (AQ) have been showing significant levels of activity, aimed towards Pakistan.
In 2024, Afghanistan experienced a modest resurgence of the activities of the Islamic State of Khorasan (ISK), after a quiet 2023 in which the organisation reached its nadir since its inception in 2015. Nevertheless, the overall level of ISK activities remains modest, and it does not pose a strategic threat to the Taliban, nor is it capable of causing a major disruption. However, there are signs that funding to ISK is also resurging, mostly because of the organisation’s involvement in attacks abroad (Iran and Russia). Although Afghanistan also hosts several other jihadist organisations, only the Tehreek-e-Taliban Pakistan (TTP) and Al-Qaeda (AQ) have been showing significant levels of activity, aimed towards Pakistan.
Trends
A Modest ISK Resurgence
In the first half of 2024, ISK only claimed 13 attacks in Afghanistan, of which four were in its old strongholds of Kunar in the east and Badakhshan in the north-east.[1] Clearly, ISK is trying to avoid attracting the Taliban’s attention to the east/north-east and instead attempting to spread its action as wide as possible. In 2024, it claimed attacks in the central provinces of Bamyan and Daikundi, where it never operated before, and also carried out attacks in Kandahar and Ghor, where it rarely ventured before. In Kabul, where it had focused in the past, it carried out a relatively modest four attacks from January to June 2024. The bloodiest attacks have targeted civilians, especially Shias. The purpose of this distribution of attacks appears to be to advertise the spread of ISK activities and generate, through the media, the impression of a powerful organisation that can hit anywhere. In reality, the level of violence was modest, considering that most attacks were small guerrilla strikes or assassinations, although it was nonetheless an increase on 2023, when ISK was at its lowest ebb.
Another trend in 2024 was ISK’s growing involvement in terrorist attacks and plots abroad, including in Iran, Russia and Europe. ISK claimed the Kerman attack in Iran, and United States (US) intelligence sources claimed its involvement in the Crocus City Hall attack in Russia. Though ISK did not claim the latter attack, internal sources confirmed it was involved alongside the central organisation of the Islamic State (IS). Closer ISK cooperation with other branches of IS, not just the central structure but also the Turkish, Syrian and Iraqi branches, is another emerging trend.[2]
It may surprise that ISK, seemingly unable to seriously threaten the Taliban regime in Afghanistan, would want to dedicate energy and resources to long-range attacks. However, the explanation likely lies in ISK’s need to raise funds for its operations. The crisis it went through in 2023 had multiple dimensions, but the financial one was the most important. The central structure of IS, operating out of Syria and Turkey, was no longer able to bankroll ISK and its own fund-raising efforts were lagging. It was, in fact, the central IS structure that launched a large-scale terror campaign around 2021-2022, requesting the cooperation of its branches. The intent seems clearly to have been to relaunch the IS brand and demonstrate that the organisation is not yet defeated and is instead still able to deliver massive destruction.[3]
For at least two years, the campaign was largely a failure, with tens of foiled plots in Europe, Russia, Iran and Turkey, and only very few and modest successes in Iran. There were signs of support for this campaign wearing down within ISK during 2023, but the successes of early 2024 changed that. ISK sources have reported that after the Kerman attack of January 2024 and even more so after the March 2024 attack against the Crocus City Hall in Russia, funding levels have been recovering, even if they remain far from the high levels of 2015-2017.[4]
Even with the recent improvement, ISK is currently barely able to maintain its structure of 6,000-7,000 men, including support elements, almost all divided between Afghanistan and Pakistan. The structure is becoming increasingly decentralised and dispersed, presumably to deny the Taliban an easy target for the latter’s counterinsurgency operations. Part-time militias protect the areas of the far east and north-east, where ISK’s leadership operates from, but elsewhere the group now operates through underground cells of four to five members each.[5]
Despite its lack of resources, ISK appears to be trying hard to infiltrate the Taliban, playing on the latter’s internal rivalries, whether ethnic, personal or ideological. Not only ISK sources say that, but the Taliban’s intelligence has confirmed this and there have been various detentions of Taliban members accused of having linked up with ISK, especially in the north-east.[6]
ISK sources have also explained that one obvious finding of the group’s fund-raising campaigns of 2023-2024 is that the project of a jihad against the Taliban arouses no enthusiasm among prospective donors, who are mostly located in the Gulf monarchies. Hence, at least until ISK manages to develop its own sources of revenue through tax collection, a large-scale resumption of the jihad against the Taliban is not a serious prospect for the organisation. Terrorist attacks against foreigners (such as tourists like the three Spaniards killed in central Afghanistan in May 2024) and against Shia Afghans remain nonetheless on the agenda. Such attacks were repeatedly carried out during 2024, probably with the intent of undermining Afghanistan’s rather good relations with Iran as well as discouraging investment in and travel to the country, both of which generate revenue for the Taliban’s Emirate.[7]
ISK has also resumed efforts to expand in Central Asia, primarily through social media recruitment, with the long-term intention of kickstarting a militant campaign there, and also in Turkey, presumably with the intent of acquiring manpower for more plots in Turkey itself, Western Europe and Russia. There has been no visible activity in any of the Central Asian countries, but social media activity has undoubtedly increased, and ISK sources report efforts to deploy trained cadres to at least Tajikistan with the purpose of training and leading local recruits.[8]
Al-Qaeda and the TTP Intensify Operations against Pakistan
Two Al-Qaeda (AQ) organisations have for years shared Afghanistan – AQIS (Al-Qaeda in the Indian Subcontinent) and AQ Central. The latter has greatly reduced its presence in Afghanistan after Ayman al-Zawahiri’s death, but various sources among the Taliban mention the presence in Afghanistan of close relatives of AQ’s founder Osama bin Laden, whom AQ Central would be protecting.[9] Some elements of AQ Central are also likely tasked with liaising with the Taliban and with facilitating any movement of members of the leadership. These elements are not likely to be involved in plotting attacks beyond Afghanistan.
AQIS is almost exclusively busy supporting the Tehreek-e-Taliban Pakistan (TTP) in Pakistan, across the Afghan border, by providing training and advisors. It is not clear whether AQIS is able to support the TTP financially, but TTP sources confirm the presence of AQ advisors and medics with the combat groups. AQ is also confirmed to have active training camps in Afghanistan, which most sources believe are focused on training TTP members.[10] The TTP during 2024 has moved the bulk of its combat force to Pakistan, leading to a major deterioration of government control in southern Khyber Pakhtunkhwa. The TTP nonetheless maintains bases in Afghanistan, where its top leaders are also believed to be based most of the time.[11]
Other AQ-linked groups have been unable in recent years to carry out significant activities. The remnants of the Islamic Movement of Uzbekistan (IMU) and the East Turkistan Islamic Movement (ETIM), along with Jamaat Imam al-Bukhari and Jamaat Ansarullah, have continued to lose substantial numbers of members to ISK, and are isolated and unable to travel.[12]
Response
The Taliban Emirate’s Anti-ISK Measures
The Taliban almost crushed ISK in 2023, helped by the group’s financial difficulties. The Taliban were especially successful in the main cities, where ISK had invested considerable resources. However, once ISK adopted a low-profile approach and denied a target to the Taliban, the counter terrorism effort lost steam. Especially in the far east and the north-east, where ISK has its main bases, the Taliban have been wary of carrying out in-depth operations. These mountainous and often wooded areas are perfect grounds for guerrilla warfare – the Taliban know that very well, having fought there in the past. The Taliban lack any technology that could facilitate their tasks there, such as drones. The Taliban’s helicopter force is not battle ready, hampered by a lack of trained crews, lack of spare parts and lack of financial resources to support sustained operations. The Taliban are also worried about the negative reaction that a massive deployment of their army could create in these areas, where the population is mostly Salafi and has little sympathy for the Taliban.[13]
Moreover, during 2024, some of the counter terrorism and counterinsurgency policies adopted by the Taliban started showing signs of failure, such as their reintegration policy. While in 2021-2022 the Taliban managed to reintegrate hundreds of former ISK fighters who surrendered, in 2024 many of these individuals rejoined ISK or fled from their confinement areas, mostly due to the Taliban’s failure to follow up on promises of support.[14]
Unable or unwilling to crush ISK in its redoubts in the far east and north-east, the Taliban have to accept that they will not be able to inflict a conclusive defeat on ISK. Some Taliban, especially in the east and south-east, argue that ISK is a minor threat and that it would not be useful to commit large and scarce resources to fighting against it.[15] However, the regional powers, and even the US, are encouraging the Taliban to intensify efforts against ISK, especially now that ISK has been expanding its operations abroad.[16] For the Taliban leadership, a reasonable compromise between these diverging interests is to keep limited pressure on ISK, while asking for regional and international support to expand counter terrorism operations.
The Taliban rely mostly on the small but capable special forces of the security services (General Directorate of Intelligence, or GDI) for counter terrorism operations, with the police and local Taliban militias in a support role. The army is only engaged within the neighbourhood of its bases and is not deployed in counter terrorism. Budget constraints are also a factor in such decision-making: the Taliban’s Emirate struggles with limited funding and deploying the army would be a major financial burden.[17]
The Emirate’s Handling of AQ and the TTP
In principle, the Taliban’s agreements with foreign jihadist groups (excluding ISK) were still holding during 2024. The smaller groups, such as IMU, Jamaat Imam al-Bukhari, Jamaat Ansarullah and ETIM, appear to have been quite compliant, even if they resisted accepting these agreements initially.[18] The last one to be forcibly relocated to a remote area of the Taliban’s choice was Jamaat Ansarullah in 2024, following rapidly progressing negotiations between Kabul and Dushanbe over the normalisation of relations.[19] Thus, it took three years for the Taliban to impose their agreements on the smaller jihadist groups, a reflection of their cautious approach to the issue. Each of these groups had a significant share of members who stubbornly rejected compliance, and they all suffered significant defections to ISK.
The cases of AQ and the TTP are more complicated. They are also interlinked. The TTP is in clear breach of the Taliban requirement that it should not use Afghanistan as a base for operations abroad, except that the TTP has always refused to sign that agreement. The Taliban have not taken coercive action against the TTP, contrary to what they have done with the other smaller groups. Taliban sources suggest that their leaders are certainly worried about the prospect that the much larger TTP might suffer the same fate if forced to relocate away from the border, a policy that the Taliban have tried to apply in a non-coercive way, without any success.[20] With at least 15,000 fighters, the TTP could affect Taliban control in eastern Afghanistan in a significantly negative way.
Instead, the Taliban have sought to mediate between the TTP and Islamabad, in the hope that an agreement might be reached. The first and second mediation efforts in 2021 and 2022 failed, despite two short-lived ceasefires.[21] In early 2024, the Taliban tried to restart their mediation, but after some informal contact and some initial TTP interest, the effort collapsed. The TTP leadership, faced with the risk of its hardline wing Jamaat-ul-Ahrar (JuA) splitting and with the general unpopularity of talks among the TTP’s rank and file, decided to abandon the idea of talks and instead go on the offensive.[22]
So far, the Taliban have been ignoring AQ’s activities as well. The TTP cause is very popular among the Taliban and more so in general among Pashtuns in Afghanistan, and hostility towards Pakistan runs deep after the expulsion of over 500,000 Afghans and a long series of border clashes.[23] Although some Taliban leaders retain links to Pakistan, it is certainly politically expedient for the Emirate to stay away from intervening in the TTP’s affairs.
Outlook
For now, ISK has little incentive to raise its head in Afghanistan again and launch a serious challenge against the Taliban, even if its recovery were to continue in 2025. Its incentives are to keep a low profile, recruit to refill its ranks and seek new sources of funding. It will probably have to refill its coffers and build reserves on top of expanding its ranks, before it is in a position to sustain an intense and prolonged confrontation with the Taliban. At the same time, the need to increase the funding levels is likely to remain a powerful incentive to participate in organising terrorist attacks abroad, especially in locations where these may attract extensive media coverage. Inside Afghanistan, it will likely continue to spread its network countrywide, to keep the Taliban off balance and to generate an impression of pervasive presence. Efforts to establish a presence in the Central Asian countries will also continue, although given the almost complete non-permeability of the border, this is going to a long-drawn process in any case.
Raising the profile of its attacks inside Afghanistan appears to be on ISK’s wish list, as exemplified by its killing of Spanish tourists in 2024. However, even that attack had little media resonance. ISK sources indicate that there is also an ambition to target senior Taliban figures, who are however well protected. In practice, therefore, the only realistic option for ISK, now that its role in attacks abroad has been validated by the first major successes, is to keep pursuing that path. In reality, ISK has not directly supported any of these attacks from Afghanistan, relying instead on members based in Turkey and on Central Asian cells that it coordinates remotely from north-eastern Afghanistan. The desire to do more in terms of attacks abroad clashes therefore with major logistical issues. ISK has also operated internationally under the orders of IS Central, which presumably has little interest in ISK gaining autonomy.
As for the TTP and AQ, there seems to be little that could stop them from using Afghanistan as a base for their campaigns in Pakistan’s Khyber Pakhtunkhwa province. If many Taliban were inclined to seek a solution to the problem, the expulsion of Afghans residing illegally in Pakistan in 2023-2024 has made it hard for anybody in Afghanistan to play a constructive role.
About the Author
Dr Antonio Giustozzi has a PhD from the London School of Economics and Political Science (LSE) and is currently a Senior Research Fellow at the Royal United Services Institute (RUSI). He is the author of several articles and papers on Afghanistan, as well as of six books, including The Islamic State in Khorasan (Hurst, 2018) and The Taliban at War (Hurst, 2019). Beyond Afghanistan, Dr. Giustozzi published articles on the conflict in Syria and jihadist groups in Central Asia. He can be reached at [email protected].
Thumbnail photo by Mohamed Nohassi on Unsplash
Citations
[1] See “ISKP: Attacks Against Taliban Officials in Ghor and Expansion of Area of Operations,” Afghan Witness, June 19, 2024, https://www.afghanwitness.org/reports/iskp%3A-attacks-against-taliban-officials-in-ghor-and-expansion-of-area-of-operations.
[2] See Antonio Giustozzi, “Jihad Reloaded: The IS Attack at Moscow’s Crocus City Hall Marks a New Global Campaign of Terror,” The Insider, April 5, 2024, https://theins.press/en/opinion/antonio-giustozzi/270564.
[3] Antonio Giustozzi, Crisis and Adaptation of the Islamic State in Khorasan (London: The London School of Economics and Political Science, 2024), https://www.lse.ac.uk/ideas/Assets/Documents/reports/2024-02-01-SpecialReport-Giustozzi-Khorasan-FINAL.pdf.
[4] Interviews and contacts with ISK members in Afghanistan, April-July 2024.
[5] Giustozzi, Crisis and Adaptation of the Islamic State in Khorasan.
[6] Interviews with Taliban GDI officers; interviews and contacts with ISK members in Afghanistan, April 2023-July 2024.
[7] On the Taliban’s relations with Iran, see Vinay Kaura, “Iran-Taliban Ties: Pragmatism Over Ideology,” Middle East Institute, April 11, 2024, https://www.mei.edu/publications/iran-taliban-ties-pragmatism-over-ideology.
[8] Marlene Laruelle, “A New Recruiting Ground for ISIS: Why Jihadism Is Thriving in Tajikistan,” Foreign Affairs, May 14, 2024, https://www.foreignaffairs.com/tajikistan/new-recruiting-ground-isis; Lucas Webber, “Islamic State in Khorasan Province’s Increased Activity Threatens Central Asia,” Eurasia Daily Monitor, Vol. 21, No. 106 (2024), https://jamestown.org/program/islamic-state-in-khorasan-provinces-increased-activity-threatens-central-asia/; Colin Clarke, Lucas Webber and Peter Smith, “ISKP’s Latest Campaign: Expanded Propaganda and External Operations,” Global Network on Extremism and Technology (GNET), June 27, 2024, https://gnet-research.org/2024/06/27/iskps-latest-campaign-expanded-propaganda-and-external-operations/.
[9] The contacts took place in April-September 2024.
[10] Ibid. See also Ayaz Gul, “UN: Al-Qaida, Afghan Taliban Assist TTP With Attacks in Pakistan,” VoA, February 1, 2024, https://www.voanews.com/a/un-al-qaida-afghan-taliban-assist-ttp-with-attacks-in-pakistan-/7466250.html.
[11] Thomas Watkins, “Islamabad Needs More US Military Equipment to Fight TTP, Pakistan’s Ambassador Says,” The National, June 19, 2024, https://www.thenationalnews.com/news/us/2024/06/19/pakistan-us-ambassador-taliban/; interviews with TTP commanders, May-August 2024.
[12] Interview with a Taliban official in Badakhshan, July 2024; contacts with IMU members, January-July 2024.
[13] Giustozzi, Crisis and Adaptation of the Islamic State in Khorasan.
[14] Interview with a Taliban official, September 2024; contacts with former ISK members, September 2024.
[15] Interviews with Taliban officials, August 2024.
[16] “The Taliban’s Neighbourhood: Regional Diplomacy with Afghanistan,” International Crisis Group, Asia Report No. 337, January 30, 2024, p. 9; Dan De Luce, Mushtaq Yusufzai and Tom Winter, “The Enemy of My Enemy: Biden Admin Weighs Working With the Taliban to Combat ISIS-K,” NBC News, July 3, 2024, https://www.nbcnews.com/investigations/biden-admin-weighs-cooperation-taliban-counter-isis-k-rcna159789.
[17] Interviews with GDI officers, February-March 2024.
[18] Antonio Giustozzi, “Al-Qa’ida and the Taliban: Are They on Diverging Paths?” The RUSI Journal, Vol. 167, No. 4-5 (2022), pp. 12-24.
[19] Interviews with Taliban officials, July 2024.
[20] Ibid.
[21] Samina Ahmed, “The Pakistani Taliban Test Ties between Islamabad and Kabul,” International Crisis Group, March 29, 2023, https://www.crisisgroup.org/asia/south-asia/pakistan/pakistani-taliban-test-ties-between-islamabad-and-kabul.
[22] Interviews with TTP commanders, January-March 2024; contact with a Pakistani official, February 2024.
[23] Asfandyar Mir, “In a Major Rift, Pakistan Ramps Up Pressure on the Taliban,” United States Institute of Peace, November 16, 2023, https://www.usip.org/publications/2023/11/major-rift-pakistan-ramps-pressure-taliban.
