There are strong hints that the Islamic State Qawqaz Province (ISQP) – the IS branch in Russia, referring to the Caucasus region –has executed the attack.
The March 22 attack in Moscow, Russia, during a concert at the Crocus City Hall left more than one hundred people dead. In total, four attackers entered the building where people were gathered attending the concert and started to indiscriminately shoot on the crowd. Significantly, the individuals were in military gear and were armed with semi-automatic weapons, which allowed them to kill several people before leaving the scene.
Soon afterwards, one of the two Islamic State (IS) media arms, Amaq News Agency, officially claimed the attack, stating that militants affiliated with the Islamic State had carried out an attack against a “gathering of Christians”. The next day, Amaq issued a detailed statement showing also the pictures of the four attackers, stating that they entered the building armed with guns, knives, and explosives.
Amaq did not detail, however, the dynamics of the attack, nor mentioned which IS network (province) was responsible for the execution of the attack, leading to much speculation on social media and mainstream media regarding which IS province was actually responsible. This is because Amaq pretends to be an independent news outlet in favour of IS, hence it does not use core IS terminology, such as referring to IS provinces; rather, it uses normal terminology, identifying geographical areas and countries by their actual names. Nashir News, on the other hand, the other official mouthpiece of IS, uses core IS terminology, and it will detail which IS province executed the attack, providing additional background information. Regardless, there are strong hints that the Islamic State Qawqaz Province (ISQP) – the IS branch in Russia, referring to the Caucasus region –has executed the attack; hence, Nashir News most likely will refer to the attackers as individuals affiliated with ISQP. At the time of writing, Nashir News is expected to issue details soon, as Amaq has completed its publications.
However, there are also strong indications that another IS province might be involved, to a different degree, in the attack: Islamic State Khorasan Province (ISKP), which is based between Afghanistan and Pakistan. ISKP frequently exploits Central Asian affiliates to conduct devastating attacks in Afghanistan, Pakistan, but also abroad as part of its strategy.
A first indicator that ISKP might be involved is directly linked to past attacks occurred recently in the first months of the year. ISKP has repeatedly demonstrated international ambitions, whether to inspire attacks abroad from local supporters or actively coordinate attacks in other countries by providing different kind of aid to local cells. For instance, IS inaugurated 2024 with a devastating suicide attack which took place in Kerman, Iran. Iran’s investigations led to the conclusion that one of the two suicide bombers and the mastermind of the operation were Tajik nationals who travelled to Afghanistan via Turkey, where the bomber received training and instructions, respectively. Since then, Iran has initiated a crackdown on ISKP presence in the country, unveiling a network between Turkey, Iran and Afghanistan which involves Afghan and Tajik nationals.
Subsequently, on January 28, two armed individuals entered the Santa Maria Church in Istanbul, Turkey killing one Turkish citizen who tried to confront them and then fleeing the scene. They were subsequently tracked down and arrested by Turkish authorities. Subsequently, Turkey launched a vast crackdown on ISIS network in the country, arresting 47 people connected to the organization. Again, several hints indicated that ISKP might have provided aid, if not only inspired the attack. Subsequently, it was revealed that the two attacks in Iran and Turkey were both traced to the same cells.
There are currently leaked reports that at least one of the four attackers might be Tajik national; this could possibly mean that ISKP provided manpower to the attackers or might have suggested names of possible collaborators to local ISQP network. The latter has been recently damaged by Russian security forces operation in Karabulak, Ingushetia region, which led to the demise of six ISQP members, including a top-level commander. This might have left the province in need of help from the external. With ISKP as the most internationalized province, the latter might have extended its support.
Inspiration is the second hint that could suggest a possible involvement of ISKP in the attack. The group’s branch in Afghanistan has a long history of enmity with Russia.
First of all, ISKP has a long history of grievances towards Russia. Russia is perceived as the main supporter, together with Iran, of Assad's Syria, hence directly responsible for the collapse of the IS territory in the Levant and Iraq. Accordingly, Russia is also accused of committing atrocities against Sunnis in the Middle East, similarly to those committed during the Chechen wars. Secondly, ISKP accuses the Taliban of fostering ties with Russia. In ISKP eyes, this is a betrayal of the history of anti-Soviet jihad in Afghanistan and highlights how Russia is trying to eradicate ISKP from Afghanistan in collusion with the Taliban the same way Russia eradicated IS from the Middle East together with local Shia militias. Hence, there is a continuous pattern linking local and global dynamics involving Russia. Additionally, ISKP shifted from propaganda to action in 2022, when the group carried out an attack against the Embassy of the Russian Federation in Kabul, showing that the group does possess the intent to wage war directly against Russian nationals.
Furthermore, ISKP has been quietly observing the war in Ukraine as part of its attention in framing ideological narratives which involve super-powers (the US, China, and Russia) and their competition vis-a’-vis the jihadist group. Hence, ISKP has frequently urged in many of its publications supporters to take advantage of the conflict between the so-called Crusaders and carry out attacks. ISKP magazines such as Voice of Khurasan (English language); Khorasan Ghag (Pashtun language); and books specifically referring to Russia-Afghan Taliban ties frequently mention the need for Muslims in Russia to wage jihad in the country.
Specifically, one publication by ISKP dating April 2023 argued that Chechen Muslims who transitioned from Chechnya to Syria and joined the Islamic State to fulfilltheir war against Russia were rewarded with the inception of ISQP, which was meant to become a launchpad for attacks inside Russia andChechnya as well as in the West. While this goal might have been postponed for years due to the weakness of ISQP, the recent counter terror operation in Ingushetia coupled with ISKP interest in bringing the fight to Russia on its soil might have created the opportunity for ISQP and ISKP to collaborate.
Even if collaboration did not actually occurred, nonetheless, ISKP media warfare might have galvanized ISQP members to the extent that they felt compelled to act, especially after the Ingushetia operation.
While the Islamic State is expected to release soon more details on the attack, and most probably stating that it was carried out by ISQP, still, the possibility that ISKP might be behind the attack to a certain extent remains strong. It is worth noticing that ISKP is the most internationalized branch of the Islamic State; whether it has actually planned or provided aid for the attack or it has inspired it, the attack will surely make an appearance in next ISKP propaganda, sharing it worldwide.
(Riccardo Valle is Director of Research at The Khorasan Diary, a research and news platform)