In July 2025, the International Crisis Group (ICG) published a report titled "The Islamic State in Afghanistan: A Jihadist Threat in Retreat?" that examines the trajectory of Islamic State - Khorasan Province (IS-KP) and its evolution, especially since the takeover by the Taliban administration in August 2021. The report highlights the ISKP from being a primary domestic threat within Afghanistan since its formation in 2015 to its current evolution as a transnational jihadist actor and its capacity to strike globally. Further, the report talks about the Taliban's role in tackling the issue of internal security threats from ISKP through its various internal operations and counterinsurgency drives, which have weakened the ISKP on Afghan soil. However, its transnational operations and global outreach have made it one of the most active and concerning branches of ISIS.
The following are six critical takeaways from the report by the International Crisis Group that explain this transformation and its implications for global security.
1. IS-KP is weakened in Afghanistan, but not defeated
Since the Taliban takeover in Afghanistan in 2021, along with increasing internal threats from IS-KP marked a pressure on the Taliban administration to tackle the issue, IS-KP continues opposition to the Taliban over islamic rule in Afghanistan leads to a continuous conflict between them, however the Taliban have conducted aggressive operations to dismantle IS-KP networks across Afghanistan, leading to the killing of major leaders. A combination of improved intelligence, repression and crackdown on Salafis has allowed the Taliban to contain the group's expansion within Afghanistan. The frequency of IS-KP's attacks has dropped significantly in 2024. However, the group's decentralised and agile structure has still been able to pose a continuous threat and potential to do significant harm. IS-KP's recruitment process of ethnic minorities and urban youth, along with its shift towards small-scale operations, such as the March 2024 bank bombing in Kandahar, demonstrates a troubling adaptability. Its continued ability to regroup and operate autonomously poses a significant concern for both national and international stakeholders.
2. The IS-KP threat has gone global
With limited room to operate inside Afghanistan, IS-KP has turned its focus outside Afghanistan and attacks abroad. Targeting Iran, Russia, Türkiye and Europe, IS-KP has become one of the most internationally active branch of ISIS. The most devastating attack to date was the March 2024 attack on a Moscow concert hall, which killed 149 people. The group has also carried out multiple attacks in Iran, including the bombing at General Qassem Soleimani's tomb. These operations are mostly decentralised and carried out by radicalised youth, mainly Central Asian operatives. By carrying its operations abroad, IS-KP has compensated for its declining position in Afghanistan and positioned itself as a key player in ISIS's post-caliphate strategy.
3. IS-KP exploits online radicalisation and diaspora networks
IS-KP's reliance on digital platforms to recruit and radicalise individuals, especially among diaspora communities in Central Asia and Europe. The group has been utilising the social media platforms, including Telegram and TikTok, to disseminate its propaganda. Recruiters target individuals with minimal ideological training, often preparing them for small-scale attacks, which need less coordination but generate a larger psychological impact. This online ecosystem poses a significant challenge for intelligence services, as it involves decoding encrypted messages and addressing the issue of autonomous attackers whose links are not directly connected to IS-KP leadership, thereby complicating detention and prevention efforts.
4. International cooperation is working, but gaps remain
One of the most positive developments around the issue is international cooperation, such as increased intelligence sharing among rival powers, including the U.S., Russia, Iran, Pakistan and Türkiye. Joint operations and sharing of major information have led to the arrest or killing of key IS-KP operatives such as Abu Mundhar al-Tadjiki, who was associated with attacks in Iran, Russia and France. Pakistan's unprecedented level of cooperation by extraditing IS-KP militants to Russia and Iran. However, intelligence gaps persist, either due to a lack of trust, bureaucratic delays or differences in security priorities, as reportedly happened before the Moscow and Kerman attacks.
5. Military solutions alone would not work
The report by Crisis Group warns against reviving conventional military or counterinsurgency operations in Afghanistan. The Taliban's early indiscriminate targeting of Salafi communities, heavy-handed tactics and repression often backfired, pushing vulnerable groups into IS-KP's arms. Instead, the report recommended a law-enforcement approach, precision-based strikes, better policing, online surveillance and a drive of de-radicalisation among diaspora communities. Global and regional powers must also consider limited engagement with the Taliban administration and Syria's new government to dismantle and contain IS-KP support networks. The international coalition to defeat ISIS should shift its focus from the battlefield to tracking terror financing, smuggling and online radicalisation to contain decentralised jihadist threats.
6. IS-KP's evolving strategy poses a long-term challenge
IS-KP's current strategy of conducting small-scale attacks poses a different kind of danger from large-scale operations seen in the 2010s. Its emphasis is on creating an atmosphere of constant threat among states. The group's decentralised leadership enables adaptability and resilience. It has become a hub for coordinating financial networks in Somalia, serving as a training hub in Syria and facilitating outreach in Central Asia and Europe. The threat has shifted from mass casualty events to unpredictable violence, which is challenging to detect and harder to prevent.
Conclusion
The Islamic State Khorasan Province (IS-KP) has undergone a significant transformation since the Talibans's return to power in 2021, evolving from a domestic insurgent group opposing the Taliban's ideological framework into a transnational jihadist actor working as an ISIS branch. In comparison, the Taliban's internal operations and crackdown have weakened its capacity to act within Afghanistan. IS-KP has skilfully adapted, shifting its focus outward using digital platforms, diaspora networks and a decentralised structure for recruitment and planning attacks and to extend its reach globally. The shift in the group towards small-scale, symbolic, yet impactful attacks marks a new phase of jihadist activity.
About the author
Ayush Joshi is a postgraduate student in the Department of Politics and International Studies, Pondicherry University
