The Enduring Duel: Islamic State Khorasan's Survival under Afghanistan's New Rulers.

• Author: Jadoon, Amira

A devastating suicide bombing struck an election rally in Pakistan's Bajaur district on July 30, 2023, killing over 60 and wounding well over 100 people. (1) The violent assault, which targeted the religious political party Jamiat Uleme-e-Islam-Fazal led by Fazlur Rehman, bore all the trademarks of a suicide attack characteristic of Islamic State Khorasan's (ISK's) operations and was subsequently claimed by the group. (2) The incident not only sent Shockwaves throughout Pakistan--a country already plagued by political and socioeconomic turmoil--but it dispelled any notions that ISK had been neutralized by the Taliban in the early months of 2023. Instead, it illuminated an undeniable reality: ISK still retained the ability to modify its operational strategy and tactics to withstand mounting counterterrorism pressure, and orchestrate deadly cross-border attacks in pursuit of its regional ambitions. The attack also revealed glaring vulnerabilities in intelligence gathering, border security, and detection around the movement of militants in both Afghanistan and Pakistan.

Despite years of internationalized counterterrorism and counterinsurgency efforts in Afghanistan and Pakistan, conducted largely within the framework of the U.S.-led war on terror, political violence and terrorism continue to plague the South and Central Asian region. As demonstrated by ISK's suicide attack in Pakistan, one of the most potent threats housed within the decentralized yet networked jihadi landscape is the persistent presence of the Islamic State's affiliate in Afghanistan, Islamic State Khorasan. The year 2023 marks the ninth year of operation for ISK as the organization continues to navigate rivalries with actors such as the Taliban, al-Qa'ida, and the Tehrik-i-Taliban Pakistan (TTP) (a) while simultaneously forging deep alliances with sectarian organizations like Lashkar-e-Jhangvi. In this complex milieu of violent non-state actors, ISK has risen and faltered more than once, but has continued to adapt to changing circumstances since its official emergence in early 2015.

This article provides an overall assessment of ISK's evolving strategy since September 2021 under the Taliban regime and situates the recent decline in its Afghanistan-based attacks within a broader strategic context that accounts for ISK's organizational characteristics as well as regional dynamics. The article focuses on four key factors that appear to have contributed to ISK's current trajectory and endurance, despite mounting pressure from the Taliban. First, the article discusses key shifts in ISK's operational activities, highlighting the expanding scope of its targets as well as key geographical shifts in its areas of operation. Second, the authors discuss notable changes in the magnitude and themes of ISK's media output and what these reveal about its growing regional ambitions. Third, ISK's growing international nexus is examined, which has raised serious concerns about ISK's capacity to strike across the region but also in the West. And finally, the article discusses the effectiveness of the Taliban's approach to combat ISK since the former's takeover of Afghanistan in August 2021. To conduct their analysis, the authors draw upon their previous research, (3) original datasets, (4) primary propaganda materials, and other secondary sources.

Overall, the authors' analysis indicates that since September 2021, ISK has grown more ambitious and aggressive in its efforts to gain notoriety and relevance across the South and Central Asian region. It has expanded the type of warfare it conducts, while also engaging in targeted assassinations of Taliban leaders. At the same time, the group's outreach and propaganda dissemination has reached unprecedented levels in terms of form, volume, and the number of languages--clearly in an effort to recruit from both the South and Central Asian fronts. And matching its words with deeds to motivate its diverse body of fighters and supporters, and to mobilize potential recruits, in 2022, ISK also claimed crossborder attacks in Uzbekistan, Tajikistan, (5) and Iran (6) while targeting Chinese (7) and Russian (8) nationals in Afghanistan in late 2022. Some Afghanistan-watchers remain convinced that the Taliban are capable of countering ISK, and indeed, efforts undertaken by the Taliban since September 2022 have yielded some success, as discussed in this article. However, the recent decline in ISK's attacks in Afghanistan in 2023 is likely to be an intentional strategic slowdown rather than a sustainable operational degradation. Regardless of any short-term shifts in ISK's attack tempo, as discussed in this article, ISK remains a resilient organization, capable of adapting to changing dynamics and evolving to survive difficult circumstances. Given ISK's recent attack in Bajaur, the crackdown on ISK in Afghanistan mostly appears to have triggered a strategic shift in ISK's focus across the border to Pakistan's northwestern region.

Operational Activity, September 2021 - June 2023

Expanding Nature of Warfare

In the post-U.S. withdrawal environment, ISK has undertaken several types of attack operations that appear to be modeled on Islamic State Central's insurgency doctrine. (9) ISK currently views itself as engaged in the phase of destabilization (tawwahush), (10) where it seeks to gradually implement a system of control through politico-military operations that challenge the Taliban's declared monopoly on violence in Afghanistan. Most of these operations have multiple and often mutually reinforcing strategic logics--with the overarching goal of depicting the Taliban as a weak and incompetent governing entity. While the intensity of different types of operations has shifted over the last two years, each represents a key tool in ISK's terrorist insurgency toolkit. Table 1 summarizes six key types of ISK's operations (non-exhaustive), their accompanying logics, and related examples.

In the nearly two years since the Taliban's takeover, ISK's attacks increased immediately in the aftermath but then gradually declined, especially in 2023. ISK's suicide attack on the Hamid Karzai International Airport in Kabul on August 26, 2021 (24)--and the intense attack campaign that followed--left many international observers concerned about the ISK threat. (25) Many, including the Taliban, U.S. officials, and the former Afghan government, had deemed ISK to be a defeated organization with some remnants in early 2020. ISK's attack on the Kabul airport and the subsequent escalation in its attacks under the Taliban's rule alarmed regional states, as well as the international community.

ISK's revived attack campaign following the August 2021 Kabul airport attack initially focused on Nangarhar in Afghanistan, but soon spread to 15 provinces in the ensuing 12 months through to September 2022. (26) In the four months after the Taliban's takeover, ISK claimed 119 attacks in nine provinces, 62 (52 percent) of which occurred in Nangarhar alone. From September 2021 to September 2022, ISK claimed 274 attacks, averaging about 23 attacks a month. (27)

As discussed further below, ISK's rising levels of activity eventually prompted action from the Taliban, which would usher in important losses for ISK's networks and trigger a notable decline in the group's aggregate attack numbers toward the end of 2022. ISK-claimed attacks dropped from an average of 23 per month in the first year of Taliban rule to just four per month in the months between September 2022 and June 2023. Over this period, ISK claimed only 37 attacks in eight Afghan provinces, and the group claimed a mere 10 attacks in the first half of 2023, the majority (six) of which have been suicide attacks. The decline in ISK attacks can in part be attributed to the Taliban's increased targeted operations against ISK's hideouts and some of its top leaders since late 2022 (discussed further below). However, whether the lull in ISK attacks is a strategic slowdown or represents a lasting operational degradation remains uncertain. Other analysis of ISK's activity also indicates a decline in ISK's attacks in the second year of the Taliban's rule, in part driven by the Taliban's security operations. (28) (b) However, despite the recent decline in its attacks in Afghanistan, ISK has maintained its ability to strike high-profile targets including against foreign actors on Afghanistan soil, and conduct successful suicide missions in 2023. (29) Collectively, these trends indicate that ISK has intentionally pivoted to conducting fewer but high-impact attacks after exploiting the chaos that ensued in the months immediately after the Taliban's takeover.

Another relatively recent development in ISK's operations has been a strategic shift to targeting the citizens and diplomats of countries it considers crucial for enabling Taliban rule in Afghanistan. Notable examples include an attack on the Russian embassy in Kabul in September 2022, (30) and three months later, attacks on the Pakistani (31) embassy and a Kabul hotel frequented by Chinese nationals in December 2022. (32) Similarly, ISK claimed cross-border attacks in Pakistan, (33) Iran, (34) Tajikistan, (35) and Uzbekistan (36) from Afghan soil. The Islamic State-claimed attack in Shiraz, Iran, in October 2022 was the first ever attack in the country attributed to ISK, (37) and the suicide attack in March 2022 on a Shi'a mosque in Peshawar, Pakistan, was the group's bloodiest attack in the northwestern Pakistan province of Khyber Pakhtunkhwa since ISK's official formation in January 2015. (38) These attacks showcase the Taliban's failures to prevent Afghanistan from becoming a terrorist staging ground, as well as their inability to account for basic state security provisions as a new de facto governing authority. ISK's cross-border and anti-foreigner attack campaign also serves to further harden its reputation as a force seeking to 'purify' the country from...