Since the Crocus City Hall terrorist attack in March 2024, discussions about the growth of the Islamic State – Khorasan Province (ISKP) and its militant actions against Russia have intensified. Experts assert that ISKP’s growing influence represents a heightened threat to Russia’s internal security given its recent proficiency in external operations and its links to Central Asian communities in Russia. The group’s increased presence on Russian soil alongside other militant threats has placed Moscow in a precarious security situation, especially given that its intelligence and security efforts are focused on Ukraine.
While ISKP undoubtedly represents one of the fastest-growing militant groups in Russia, focusing exclusively on this group produces an incomplete picture of the many internal threats that Moscow is currently facing. The conflict in Ukraine continues to strain Russian military resources, resulting in a complex and continually evolving landscape of anti-Kremlin militant activities. The threat environment, once dominated by insurgent groups in the North Caucasus, has now diversified into a multitude of threats united by a deep-seated animosity toward Moscow, its foreign policy, and its imperial ambitions in Eurasia.
This policy memo outlines the internal threats confronting Russia, underlining the highly fragmented landscape of jihadist activities dominated by the Islamic State and its different branches as well as Ukraine-affiliated networks. It delves into their activities and composition, contrasting the highly professional activities conducted by the Ukrainian military in Russia with the disorganized nature of insurgent and jihadist activities. Despite facing a broader and more diverse spectrum of militant activities within its borders, Moscow maintains a critical advantage in that many of these groups seldom collaborate, instead opting to compete with or hinder one another. Even though the war in Ukraine has monopolized Moscow’s security resources, the fragmented landscape of militant activities in Russia has enabled the Kremlin to address the threat so far, with the exception of the Crocus City Hall attack.
Emergence of the ISKP in Russia
Although ISKP originated in Afghanistan in 2015, it quickly adopted anti-Russian propaganda due to Russia’s backing of the Taliban regime and its military involvement in regions like Chechnya and Syria. Since 2023, ISKP has significantly expanded its international operations, most notably in Turkey, Iran, and Russia. In March 2024, an ISKP cell near Kaluga was dismantled by the Federal Security Service.
The March 2024 attack on Crocus City Hall was the work of an extensive network of Central Asians affiliated with ISKP that was primarily operating from Turkey and actively recruiting within Russia. It is possible that this group also had prior ties with jihadist networks in Syria.
This attack demonstrated a level of preparedness and operational skills not seen in Russian-linked jihadist movements for over a decade. Although ISKP has called for attacks on Russian soil and targeted Russian interests abroad—most notably the Russian embassy in Afghanistan—this level of professionalism is highly surprising, especially considering ISKP’s limited networks and resources within Russia. Nonetheless, ISKP has sought to develop a proper network in Russia through fundraising and recruitment, bypassing the leaders of the Islamic State – Caucasus Province (ISCP) in the North Caucasus.
ISKP’s ability to conduct such operations from abroad and without support from established insurgent factions in Russia demonstrates how the terrorist threat is evolving. Perhaps more importantly, it showcases Russian security services’ lack of preparedness for such threats. In recent months, Moscow has claimed to have dismantled and targeted ISKP cells within Russia, more so than it has targeted other jihadist groups, such as the Caucasus Emirate or ISCP.
The Khorasan Province Versus the Caucasus Province: Same Strategic Goal, Limited Cooperation
In 2015, following the schism between the Caucasus Emirate and the ISCP stemming from ideological tensions in Syria, it appeared as though ISCP would become the primary transmission belt for the Islamic State’s terrorist threat to Russia. However, the organization—just like the Caucasus Emirate—never recovered from the outflow of its militants and supporters or Russia’s counterinsurgency in the region.
Most of the ISCP’s recent attacks—as well as those carried out by other jihadist groups—have been confined to the North Caucasus. In March 2024, for example, a group of militants linked to the Islamic State engaged in a two-day firefight with special forces in Karabulak, Ingushetia. The militants’ leader, Amirkhan Gurazhev, had previously sworn allegiance to the group. They had been active in Ingushetia for over a year, clashing several times with local police.
Similar clashes, albeit on a smaller scale, have occurred on a fairly regular basis in Dagestan over the last three years. Although no large organization has yet managed to unite anti-Kremlin militants there, Dagestan is a region in which ISCP has significantly increased its activities in recent years.
In Chechnya, meanwhile, ISCP’s main insurgent group was eliminated following the death of Aslan Byutukayev in a special operation in 2021. Since then, minor attacks have been carried out against Ramzan Kadyrov’s security forces, but the bulk of active ISCP insurgent forces have organized outside of Chechnya.
Although ISCP is active in the rest of Russia, attacks attributed to the group outside of the North Caucasus are typically spearheaded by a single actor rather than planned by the group. Such attacks generally involve stabbings. According to the Islamic State Select Worldwide Activity Map, there have been 22 attacks claimed by the Islamic State in Russia since 2017, most of which were likely coordinated in part by ISCP as well as online recruiters. However, none of these attacks exhibited the scope or logistical precision exhibited by the March 2024 terror attack—which, indeed, was claimed by the AMAQ news agency (Islamic State Central) rather than the North Caucasus branch. This dynamic sheds light on the currently limited operational capabilities and role of ISCP and its lesser importance within the Islamic State organization.
Parochial Jihadist and Nationalist Groups Based in Russia: An Idle Threat
The Caucasus Emirate’s last active militant network on Russian soil was dismantled in 2016, resulting in the organization entering a latent, developmental phase oriented toward rebuilding its recruitment and logistical networks. The ideological conflict in Russia between ISKP and the Caucasus Emirate has largely subsided, with the former having assumed the mantle of anti-Kremlin activities. While the Caucasus Emirate maintains activity in Turkey with support from associated ideologues and networks, it has been entirely rooted out of the North Caucasus. Some militants have regrouped in Ukraine, adopting a more nationalist agenda and collaborating with foreign fighter units against Russia.
Despite the waning influence of the Caucasus Emirate, ISCP faces competition in the North Caucasus from nationalist groups that oppose Moscow and operate in both Russia and Ukraine. The Chechen Republic of Ichkeria and other Chechen groups have recently managed to reinvigorate the Chechen national project. Although relatively small and tactically marginal, other militant organizations like the Ingush Liberation Army and the Imam Shamil Battalion in Dagestan have intensified their propaganda and recruitment efforts in Ukraine. This surge in momentum is partly fueled by growing decolonial and nationalist movements across the post-Soviet space, which have challenged Moscow’s imperial control. Overall, parochial jihadist and nationalist groups in the North Caucasus have struggled to recover from the decapitation of their networks in the mid-2010s and have faced significant difficulty regaining the upper hand against Moscow. This weak position has opened the door for other organizations to lead the fight against Moscow.
ISKP: The Next Jihadist Threat in Russia?
The apparent weakness of jihadist groups in the North Caucasus alongside the ISKP’s terrorist attack in Russia inevitably prompts questions about the organization’s status within the country. Although the Crocus City Hall attack seems to have stemmed primarily from a pre-existing Central Asian jihadist group based in Turkey (meaning that it is not indicative of a firmly established militant network), several contextual factors suggest that ISKP could establish a lasting presence in the region.
For years, experts on jihadist movements have warned about the radicalization of Central Asian migrants in Russia. Exemplified by the perpetrators of the March 2024 terrorist attack, the radicalization and recruitment of Central Asians in militant organizations is more frequent in Russia than in Central Asian countries, where migrants face a series of economic, social, and political vulnerabilities. Russian intelligence services have been slow to fully acknowledge the threat posed by radicalization in Central Asian communities, leading to issues in intelligence collection, infiltration, and general counterterrorism efforts. As a result of the war in Ukraine, Central Asian migrants have faced even greater hardship. Russian police forces have carried out raids on migrants’ workplaces, targeting them for forced recruitment into the war in Ukraine. Migrants are offered citizenship if they agree to join Russia’s armed forces—and are often threatened with deportation if they refuse. ISKP’s extensive Central Asian networks offer the group unique access to these communities, particularly amid the failure of ISCP and the Caucasus Emirate to recruit Central Asians or expand their activities beyond the North Caucasus.
Under the Radar: Networks Affiliated with Ukrainian Military Intelligence
This militant analysis would be incomplete without an assessment of Ukraine-affiliated networks active on Russian soil. Since the beginning of the February 2022 invasion of Ukraine, small-scale militant attacks across the Russian Federation have been organized, supported, or encouraged by Ukrainian military intelligence (the GUR). One can distinguish between two types of such operations: one broadly supported by the GUR in an attempt to exploit anti-Kremlin militants active on Russian territory and one consisting of professional efforts to target Russian military infrastructure.
The first one has gained notoriety due to the extensive propaganda produced by militant groups and the fact that the war moved into Russia’s bordering regions with Ukraine. In the Russian regions of Belgorod and Kursk, for example, anti-Kremlin militants launched a series of raids in May and June 2023 as well as March 2024. Comprising various foreign fighter contingents, such as the Russian Volunteer Corps (RDK), the Freedom of Russia Legion (LSR), the Siberian Battalion, and Chechen contingents, these raids have been used by the Ukrainian military to spread the Russian armed forces thin during, for example, its 2023 counter-offensive or its efforts to stave off Russian attacks. The GUR has played a minimal role in such attacks, simply providing the responsible groups with military hardware, including tanks, armored fighting vehicles, and drone support. Although playing a key propaganda role, these raids achieve minimal tactical or strategic successes. In fact, they have led to heavy casualties and equipment losses for foreign fighter units in Ukraine and have largely failed to create long-lasting insurgent factions within Russia.
The biggest internal threat to the Kremlin remains pro-Ukrainian saboteur units, which have repetitively hit Russia’s military infrastructure and engaged in targeted assassination in Russia. These saboteurs destroyed and damaged attack helicopters in October 2022 in Pskov as well as SU-34s at Chelyabinsk Air Base in January 2024. Covert Ukrainian operations have involved the use of drones within Russia and attacks against Russian railways. They were also potentially involved in the attack on the Kerch bridge in October 2022. Several individuals involved directly in the war in Ukraine, such as militiamen Mikhail Filiponenko and Yevgeny Zhilin, propagandist Vladen Tatarsky, and Russian commander Stanislav Rzhitsky were assassinated by Ukrainian forces
The GUR—and, to a lesser extent, the Security Service of Ukraine (SBU)—have demonstrated their extensive ability to strike high-value targets. They have adopted a creative approach to covert operations in Russia and have been highly willing to invest important resources in the maintenance of Ukraine’s active networks in Russia. Up to now, the saboteur units have focused almost exclusively on hampering Russia’s military potential rather than targeting the regime itself or organizing a full-fledged insurgency. The GUR and its covert networks in Russia represent, at least in the long term, the greatest militant threat currently facing Russia. This network has achieved far more on an operational and strategic level than the Chechen Separate Special Purpose Battalion or the Freedom of Russia Legion.
Assessing the Internal Threat Faced by Russia: A Fragmented but Growing Threat
The war in Ukraine and Russia’s intervention in Syria have significantly altered the landscape of external and internal threats faced by the Kremlin. While past threats were largely concentrated in the North Caucasus region, Moscow now contends with a more diffuse and multi-faceted militant threat spanning various organizations.
Despite facing a heightened threat from a combination of multiple organizations, Russia benefits from dealing with a highly fragmented opposition. Although tactical collaborations do occur (e.g., transborder raids involving far-right and Chechen groups), a unified ideology among groups in opposition to Russia remains elusive. The only common thread binding these anti-Kremlin groups is a shared enemy and a readiness to temporarily set aside ideological differences to target that enemy. Even groups with ideological similarities, such as ISKP and ISCP, tend to compete for resources and recruits rather than forming stronger networks. While they don’t openly confront one another, they largely coexist parallel to one another.
At the same time, several contextual factors suggest an expansion of anti-Kremlin activities within Russia in the near future. A rising demand for manpower and resources stemming from the conflict in Ukraine has weakened Moscow’s capacity to combat terrorism and prevent covert operations within its own borders. Moreover, the highly fragmented nature of these networks hampers Moscow’s ability to gather intelligence and engage in counterterrorist efforts, making it difficult to target and eliminate these groups.
Given that many of these groups have foreign ties, Russia is compelled to strengthen its collaboration with Turkey and countries in Central Asia. This collaboration is crucial for sharing intelligence, coordinating operations, and addressing the transnational nature of these militant groups. However, navigating these partnerships while managing international political complexities and countries’ differing agendas presents additional challenges for Russia’s counterterrorism strategy.
The sheer scale of the March 2024 terrorist attack highlights the concerning ease of access to weapons and explosives within Russia. In recent months, there has been a steady flow of weapons being smuggled back into Russia for personal use or trafficking purposes by soldiers and private military contractors. Just as the two wars in Chechnya supplied North Caucasus militants with weapons and established routes through the South Caucasus, the ongoing conflict in Ukraine has presented a unique opportunity for insurgent cells to secure a steady supply of weapons with which to confront Russian security forces. In addition to weapons sourced from Russian soldiers, one must consider the arms used and smuggled by these units during their recurrent transborder raids. The example of the Pankisi Gorge between 2000 and 2012 illustrates how the proximity of militant safe havens significantly bolsters the resilience of insurgent and foreign fighter groups as well as smuggling operations. The evolving landscape of anti-Kremlin militant threats will inevitably compel Moscow to allocate more resources toward counter-intelligence and counter-terrorism efforts within Russia. This includes adapting intelligence-gathering methods to evolving conditions, especially within Central Asian migrant communities and countries across Central Asia and Afghanistan.
Jean-François Ratelle is an affiliated researcher and professor at the University of Ottawa.
