Islamic State (IS) has released a graphic video showing gunmen storming the Crocus concert hall near Moscow in an attack that killed at least 137 people. The footage corroborates the terrorist organisation’s claim of responsibility. The most likely culprit is the organisation’s offshoot based in Afghanistan. For years, IS-Khorasan Province (IS-K) – a branch of IS based in Afghanistan – has been fixated with Russia. It holds Moscow responsible for destroying its power base in Syria by backing president Assad, and accuses the Kremlin of having Muslim blood on its hands. President Putin is a regular target in its propaganda.

President Putin is a regular target in IS’s propaganda

IS said it carried out the attack on Friday in order to ‘deal a strong blow to Russia’. But make no mistake: IS-K poses a danger to the West too, and intelligence agencies are increasingly concerned that the group may try and mount an attack elsewhere.

The Moscow attack is not the first to be attributed to IS-K: in January, the group was linked with a bombing in Iran at a memorial to the Revolutionary Guards commander, Qassem Soleimani, in which nearly 100 people died. IS-K has also been blamed for a series of atrocities in Afghanistan, largely aimed at the Shia population, including one notorious gun attack on a maternity hospital in Kabul in May 2020.

IS-K emerged in 2015 out of a power vacuum in the Nangarhar Province in eastern Afghanistan, when tribes formerly associated with the Taliban declared allegiance to IS. This was when the Syrian-based group was at the peak of its powers. The group has since lost territory but has morphed instead into a more traditional terrorist group.

IS-K opposes the Taliban, considering it too forgiving of Muslims that IS regard as apostates, particularly the Shia minority in Afghanistan, called Hazaras, who they deride as ‘rafidah’. Most of their attacks have been inside Afghanistan but IS-K has wider ambitions. During the chaotic evacuation of Kabul, IS-K launched a suicide bomb and gun attack on the queues outside Kabul’s international airport that killed 13 US troops and 170 Afghans.

IS remains the group of choice for jihadists in the West, but Syria is increasingly difficult to access. Instead, a number of recruits in Britain have tried to get to Afghanistan. Last November, two brothers were jailed after filling out online application forms to join IS-K. Haleem Heyder Khan, 21, and his brother, Hamzah Heyder Khan, 18, both from Ward End, Birmingham, had researched how they could travel to Turkey and Iraq before deciding it was too difficult and switching their attention to Pakistan and Afghanistan.

The brothers got in touch with an IS recruiter who sent them forms to fill out in Arabic and a code to access messages on the encrypted WhatsApp messaging service. They purchased and packed clothing and equipment, conducted research into how they could travel to Afghanistan and obtained travel documents for Pakistan. Mark Payne, head of counter-terrorism policing at West Midlands Police, warned at the time that the two brothers were intent on becoming martyrs and could have been ‘redeployed back to the UK’.

MI5 has been concerned by the ‘ungoverned spaces’ in Afghanistan and surrounding areas since the collapse of the Western-backed regime in August 2021. The four men who have been charged in connection with the Crocus attack are reportedly from Tajikistan, a landlocked former Soviet state in Central Asia which borders Afghanistan. While Putin is desperate to point the finger at Ukraine, in doing so he is turning a blind eye to the Islamist threat to Russia.

On March 3, RIA, the Russian news agency, reported that six terrorists were killed in a counter-terrorist operation in Ingushetia in the Caucasus; on March 7, it said security services had uncovered and ‘neutralised’ a cell in Kaluga, south west of Moscow, whose members were planning an attack on a synagogue, both said to be run by IS. Those plots were foiled, but Moscow ignored warnings from the US ahead of the Moscow attack – and Putin’s focus on Kyiv means that the Russian security services are in danger of repeating their mistake.