Focus on the Islamic State and Affiliates.

Since 2015, Islamic State (IS) and its affiliates have remained the world's deadliest terrorist group. The total number of IS attacks rose globally until 2022, but the number and overall intensity of attacks have declined in recent years, leading to a slight reduction in fatalities. While some chapters have declined, others, such as Khorasan chapter, have increased their activities substantially. IS has continued to expand its presence in the Middle East, Central Asia and sub-Saharan Africa. IS is no longer as centrally organised as it was at its peak in 2015, when it controlled territory in Iraq and Syria roughly the size of France. The destruction of its so-called caliphate by 2019 led to decentralisation and a shift towards low-cost, highimpact attacks. These tactics have allowed IS to sustain its operations despite military and territorial losses, demonstrating its adaptability. Today, IS operates through regional affiliates, each pursuing distinct goals tailored to local contexts, reflecting a broader trend towards networked jihadism. This decentralised model makes IS more difficult to contain, as it combines territorial control, ideological influence, opportunistic attacks and a strategy adapted for the locality. For example, Islamic State Sahel (IS-S) has focused on territorial expansion in border areas of Mali, Niger and Burkina Faso, while Islamic State-Khorasan Province (ISK) has pursued a more transnational agenda. Islamic State affiliates are active in multiple states and regions including Mozambique, the Democratic Republic of the Congo, Somalia, Egypt, Cameroon and Nigeria. IS continues to pose a significant security threat to the West, with both organised cells and lone-wolf individuals pledging allegiance to IS attempting mass-casualty attacks. In 2024, authorities foiled IS plots targeting the Paris Summer Olympics and Taylor Swift’s concerts in Vienna, among several others, highlighting the group’s ongoing global reach. Following the fall of Bashar al-Assad’s regime in Syria in December 2024, after more than 13 years of civil war, concerns over a potential power vacuum in the region have intensified. Alongside the Taliban’s return to power in Afghanistan in 2021, these shifts have added new layers of complexity to the geopolitical landscape in both the Middle East and South Asia. Additionally, the ongoing war in Gaza risks serving as a catalyst for radicalisation and recruitment, much like the conflicts in Iraq and Afghanistan did in the past. This section provides an analysis of IS and affiliates, and its impact on global security, examining the current ecosystem of IS. It also explores the group’s rise and fall in Syria and Iraq, the influence of its major regional affiliates, and the growing role of ISK, which has emerged as IS’s most internationally active branch. The evolving nature of IS marks a phase of terrorism that is increasingly resistant to traditional military strategies. Effectively countering this threat requires a comprehensive and adaptable approach, capable of addressing the group’s decentralised structure and rapidly shifting tactics.

Definitions of Islamic State (IS) vary. In this report, IS is defined as a global jihadist organisation that operates as a decentralised network of affiliates. However, not all IS chapters are categorised in the Terrorism Tracker. The attribution of attacks and deaths to Islamic State and its affiliates can be challenging to determine, due to the shifting nature of affiliations and the evolving dynamics of the group's regional branches. As IS originally rose to prominence in Iraq and Syria, the group tends to be most associated with – and sometimes treated as synonymous with – Islamic State of Iraq and the Levant (ISIL). But in the Terrorism Tracker, “Islamic State” is also used to denote events ascribed to the network that have been carried out outside of Iraq and Syria. The attacks replicate IS tactics; however, they cannot be linked to any one affiliate group. In 2024, for example, there were a total 22 countries around the world with incidents attributed to “Islamic State”. As shown in Figure 4.1, this section provides an overview of affiliate branches of IS: Islamic State Khorasan Province (ISK), Islamic State in Iraq and the Levant (ISIL), IS Sahel Province (ISS), IS West Africa (ISWA), IS Sinai, IS Libya, IS Somalia (ISS), IS Mozambique (ISM) and IS Central Africa (ISCA). Roughly 48 per cent of terrorism deaths in 2024 have not been attributed to any group. IEP has developed a machine learning model which apportions these deaths to various groups.2 Based on these findings IS is likely to be responsible for an additional 15,000 deaths between 2007 and 2024. IS and its affiliates were responsible for over 4,000 deaths in 2016, the peak of its deadly operations. Over the next three years, the number of deaths dropped substantially, reaching as low as 1,666 in 2019, and deaths have not exceeded 2,500 since then. Iraq has been the most affected country by IS attacks, with a total of 9,088 deaths since 2007, followed by Syria with 3,636 fatalities, and Afghanistan with 2,686 deaths. In 2024, deaths from IS attacks fell to their lowest level since 2019, dropping by 12 percent compared to the previous year. Syria recorded the most IS attributed deaths in 2024, with 708 deaths, followed by the Democratic Republic of the Congo (DRC) with 299 deaths, Nigeria with 159 and Russia with 148 deaths. While the number of IS deaths peaked in 2016, the number of attacks attributed to IS and its affiliates reached its highest level

in 2021. Between 2007 and 2014, attacks were relatively limited, with 21 incidents in 2007. However, 2015 marked a sharp increase, with 390 attacks recorded. Attacks rose to 815 in 2018 and remained elevated over the next several years, eventually peaking at 867 attacks in 2021. Attacks increased for the first time since the peak in 2024, when 559 IS attacks were recorded, six per cent more than the prior year. The rise in attacks despite declining deaths suggests a shift toward smaller, less coordinated operations, often relying on local sympathisers rather than centralised command. For instance, Islamic State West Africa (ISWA) recorded its highest number of attacks in 2020, with 90 incidents, before declining in subsequent years. ISK saw a significant surge in activity, peaking in 2021 with 189 attacks. Islamic State Sinai Province (IS-SP), although relatively less active, remained a persistent threat, with notable activity in 2016 and 2018. Figure 4.2 shows the total deaths associated with IS and its affiliates by country and regional groupings over the past two decades. The groupings are broadly associated with the main branches: • Iraq and Syria (ISIL dominated) • Central and South Asia, including Iran and Russia (ISK dominated) • Sahel: Chad, Cameroon and Nigeria (ISWA dominated), Mali, Burkina Faso, Niger (ISS Dominated)

 The ongoing transnational threat posed by IS remains a serious concern across various regions, including in the West. This is evident not only from successful attacks but also from numerous plots that have been foiled by security services in different countries. Figure 4.3 shows the foiled plots attributed to IS in 2024. While foiled plots and terror suspect arrests occur regularly, intelligence agencies rarely disclose them to the media. As a result, only publicly reported cases can be analysed, while many more thwarted attacks remain undisclosed. In 2024, there were 24 publicised plots linked to IS or affiliated groups. The most were recorded in Israel, with five plots, including one where four alleged members of IS were arrested with hundreds of explosives. The US followed with four plots, with one notably being planned by a former CIA security guard in Afghanistan who had planned to carry out a mass shooting on election day. The suspect told the FBI that he was communicating with individuals associated with ISK. In Germany, arrests occurred throughout 2024, including in Cologne, and in March 2024, following a threat to the Swedish Parliament. Similarly, Russian authorities apprehended suspects linked to a planned attack on a Moscow synagogue in March 2024. In addition to foiled plots, there have also been recent highprofile arrests of IS affiliated individuals in every part of the world. In mid-2024, several suspects were detained in Iran. Between June 2023 and March 2024, 2,733 suspects were detained in Türkiye, with 692 formally arrested for suspected links to IS.

In Central Asia, there has been an increase in ISK-related arrests and incidents, reflecting both the group’s focus on the region and heightened counterterrorism efforts by governments. For instance, in December 2023, two teenagers were arrested for plotting attacks in Jalal-Abad, Kyrgyzstan. A few months later, an ISK-linked car bomb exploded in Tajikistan's Kulob region. In June 2024, 15 individuals were arrested in Bishkek, Kyrgyzstan, for posting videos related to ISK weapons and explosive tactics.

Islamic State of Iraq and the Levant 

The emergence of Islamic State in Iraq and the Levant (ISIL), also known as Islamic State of Iraq and Syria (ISIS) can be traced back to the mid-2000s, when the group initially formed as al-Qaeda in Iraq (AQI). AQI was established by Abu Musab al-Zarqawi in 2004, shortly after the US invasion of Iraq. The group capitalised on the instability and sectarian violence in Iraq, positioning itself as a major player in the insurgency. By 2006, the group expanded its operations and changed its name to the Islamic State of Iraq (ISI), signalling its growing ambition to create an Islamic state. The group’s leadership, under Abu Bakr al-Baghdadi after Zarqawi's death in 2006, focused on establishing a territorial base in northern Iraq. Over the next few years, ISI claimed many terrorist attacks inside Iraq, including the attacks in Baghdad in August, October and December 2009, which, combined, killed over 480 people. However, ISI faced significant challenges due to limited resources and internal conflicts, while the Iraqi government and US forces mounted a strong resistance against its advances. Facing backlash from the community and increased pressure from US and Iraqi forces, the group weakened until 2011, when its involvement in the Syrian Civil War sparked a period of renewed growth. In 2013, under Baghdadi’s leadership, the group rebranded itself as Islamic State in Iraq and the Levant (ISIL). In 2014, it formally broke ties with Al-Qaeda. ISIL exploited the power vacuum in Syria to expand its influence into neighbouring areas, engaging in conflicts with tribal groups and militias in Iraq, and against Kurdish forces and various rebel factions in Syria. Strengthened by an influx of fighters from across the region, the group rapidly evolved, marking the early stages of its transformation into a global extremist organisation. In June 2014, ISIL captured Mosul and again changed its name to Islamic State (IS), declaring a caliphate and naming its leader, Abu Bakr al-Baghdadi, the “Caliph”. This declaration marked a significant turning point for the group, as it now claimed religious and political authority. The caliphate’s territory spanned parts of Iraq and Syria, totalling an area roughly the size of France at its peak. IS sought to implement a strict interpretation of Islamic law in the areas it controlled. In September 2014, the United States and a coalition of allies launched airstrikes against IS positions, while local forces, including the Iraqi military and Kurdish fighters, mounted a resistance against the group’s expansion. Despite the setbacks, IS continued to hold significant territory and maintained its control over large swathes of land in both Iraq and Syria for much of 2014 and 2015. In 2015, the group established a presence in Libya.

 Terrorism deaths attributed to IS peaked in 2016 at 4,240 reported fatalities. While the death toll has fluctuated over the years, it has generally declined since its peak, reaching 1,805 in 2024. Despite this reduction, IS remains a significant threat, as ongoing casualties in recent years demonstrate. Up until 2016, most IS deaths were concentrated in Syria and Iraq. However, since then, fatalities in other regions have increased, highlighting the expanding reach and influence of IS affiliates across different parts of the world.

The decline of IS began in 2016 as military efforts to reestablish Syrian and Iraqi governmental control of the countries’ territories gained momentum. In Iraq, the Iraqi military, supported by a US-led coalition, launched a series of offensives to retake key cities, culminating in the reclaiming of Mosul in 2017, a decisive turning point in the fight against IS. Similarly, in Syria, Syrian Democratic Forces (SDF), supported by the US, made significant advances, gradually pushing IS out of its strongholds, including Raqqa, which fell in 2017. By 2019, IS had lost most of its territory, and the group’s self-declared caliphate was effectively dismantled. Despite losing its territorial holdings, IS remained a significant threat through its insurgency activities, continuing to carry out attacks in Iraq, Syria and beyond. The group’s leadership adapted by going underground or fleeing to other regions, including parts of Africa and Southeast Asia. The decline of IS’s geographical caliphate did not mark its end; instead, the group transitioned to a more decentralised model, relying on cells and affiliates to sustain its violent campaign and spread its ideology. IS maintains a presence in northeastern Syria and parts of Iraq, while its regional affiliates, including IS-Sahel, ISWA and ISK, have gained increasing prominence. Since the end of IS’s territorial holdings in Iraq and Syria, attacks previously attributed to ISIL are now attributed to IS. The other regional branches of IS, such as ISWA, have seen a rise in activity in recent years, with the number of attacks increasing from two increases, with their attack numbers rising from a few incidents in 2015 to larger spikes in recent years, such as 189 attacks in 2021. This underscores both the persistence of the IS network and the shifting geography of its operations.

Different IS provinces have adapted their strategies to suit their local contexts. IS-Sahel, for example, has focused on capturing and holding territory, while ISK has pursued a more transnational agenda. The internal dynamics of these provinces, along with the conflict environments in which they operate, have shaped their divergent approaches, making IS difficult to define. IS AND THE END OF WAR IN SYRIA The fall of President Bashar al-Assad’s regime in December of 2024 has precipitated a period of significant instability in Syria, creating a power vacuum that IS is actively seeking to exploit. Historically, IS has demonstrated a capacity to capitalise on political turmoil to expand its influence, and current developments suggest a potential resurgence of the group within the region. Following the collapse of Assad’s government, IS militants have intensified their operations in Syria. The group has reportedly gained access to new weapon supplies left behind by former government troops, bolstering IS’s operational capacity. This rearmament has coincided with an increase in attacks globally, including a notable incident on New Year’s Day in 2025 in New Orleans, where an assailant, inspired by IS, killed 14 people with a pickup truck. In response to the escalating threat, the US has conducted a series of airstrikes targeting IS positions in Syria. Between December 2024 and January 2025, US Central Command reported multiple operations aimed at degrading IS capabilities and preventing the group from exploiting the current security vacuum. IS is also leveraging the disarray among groups that formerly opposed the Assad regime to re-establish its foothold in Syria. The rapid overthrow of the government has led to internal discord within Hay'at Tahrir al-Sham (HTS), creating opportunities for IS to infiltrate and destabilise these factions. IS deaths in Syria surged to over 700 in 2024, with nearly 100 occurring in attacks following the fall of Assad. The Kurdish-led Syrian Democratic Forces (SDF), instrumental in the territorial defeat of IS in 2019, now face challenges from Turkish-backed groups and other insurgents. In early 2025, the leader of the SDF expressed concerns about IS militants regrouping in eastern Syria, taking advantage of the diminished centralised authority. The instability has exacerbated conditions in detention camps such as al-Hol and al-Roj in northern Syria, which house at least 40,000 IS fighters and their families. Reports indicate that these camps have become breeding grounds for the next generation of IS extremists, with children as young as eight displaying violent behaviour and being indoctrinated by radicalised family members. Camp administrators have raised alarms about deteriorating conditions and the potential for IS to exploit these environments for recruitment and radicalisation. The future of these camps is uncertain as they are dependent on US funding for Kurdish security forces who guard and maintain them. Changes to foreign assistance under the new US administration and a more isolationist position make the presence of US troops in Syria and their involvement in guarding the camps uncertain. Prison break attacks have occurred in the past, such as at the Hasakah prison in 2022, where over 300 people died during an assault on the prison and hundreds of IS fighters escaped. The current transitional phase in Syria presents a precarious environment where IS can potentially reassert itself. The group’s recent activities suggest a strategic effort to regroup and exploit security gaps. Addressing this threat necessitates a coordinated international response focused on stabilising the region, supporting effective governance structures, and preventing IS from capitalising on the current turmoil. Türkiye has emerged as a significant power broker in post-Assad Syria, expressing readiness to assist the new Syrian administration in managing IS camps and prisons. Turkish  Foreign Minister Hakan Fidan reaffirmed Türkiye’s commitment to supporting Syria in combating terrorism during a meeting with his Syrian counterpart Asaad Hassan al-Shibani. As shown in Figure 4.6, Türkiye’s influence in Syria as of 2022 was already at a level comparable to Russia’s, which was declining well before the fall of Assad. Similarly, China and Iran have seen declines, with their influence remaining below that of Russia and Türkiye.

ISLAMIC STATE WEST AFRICA 

Islamic State West Africa (ISWA) was formed in 2015 with an alliance between Nigeria-based terrorists and those in surrounding countries and regions, including the southern Lake Chad group, Boko Haram. ISWA operates in Nigeria and the southern Lake Chad Basin. In 2016, IS leadership publicly replaced ISWA leader Abubakar Shekau with Abu Musab al-Barnawi, leading to a split in the group. The faction loyal to al-Barnawi continued as ISWA, while Shekau's faction remained as Boko Haram. Unlike Boko Haram, ISWA focuses on targeting state and military assets while attempting to win local support by providing limited services, such as distributing food and protecting local populations. Additionally, ISWA collects taxes from locals which are used to fund the group, but also to provide health services and implement its own jihadist-based education system. However, ISWA is known to kill those who refuse to pay taxes and for targeting agencies providing humanitarian aid, depriving locals of necessities in governmentheld areas. The group has also massacred civilians who collaborate with local governments or disobey ISWA orders, as well as persecuting the Christian minority in its territory.28 The group has conducted several significant attacks, including the January 2020 attack on a Niger military base which left 89 soldiers dead. Later that year, ISWA fighters also attacked the town of Monguno in Nigeria, destroying many buildings, such as a UN humanitarian facility and a police station, resulting in the death of tens of people. By late 2019, ISWA had become an integral part of the IS’s global network, with the group being one of the most active IS affiliates outside the Middle East. The group has attempted to expand operations into neighbouring countries, aiming to exploit weak governance and regional instability. Despite this, ISWA has faced challenges in expanding its influence due to consistent opposition from regional military forces and rival groups. The group’s recorded activity has gradually decreased, and in 2024 was at its lowest levels since 2018. In 2021, Boko Haram leader Abubakar Shekau died after detonating an explosive device to avoid capture during an ISWA attack. Following his death, there were expectations that Boko Haram fighters might join ISWA. However, reports indicate that Boko Haram, under new leadership, has continued its operations independently. In late 2024, the conflict between Boko Haram and ISWA intensified. In December, Boko Haram forces launched coordinated attacks on ISWA strongholds, targeting critical camps and supply centres. The assaults resulted in substantial ISWA casualties and the seizure of valuable assets, including vehicles, weapons, and other resources. These actions compelled ISWA to withdraw from several strategic locations, causing considerable disruption to its regional operations. In 2024, Nigeria recorded 40 attacks attributed to ISWA, resulting in 158 deaths. This marks a decline from 288 deaths in 2023. The peak of ISWA activity in Nigeria occurred in 2020, when the country recorded 482 deaths. ISWA's activity in Burkina Faso led to deaths between 2019 and 2021, but there have been no attacks in the country since then. Niger recorded 20 deaths in 2024, a decline from 31 in 2023. In 2024, no deaths from ISWA were reported in the DRC, Benin, Burkina Faso or Cameroon. 

ISLAMIC STATE - SAHEL

 Islamic State in the Sahel (IS-Sahel) emerged in 2015 under the banner of the Islamic State in the Greater Sahara (ISGS). Initially operating independently, ISGS was integrated into Islamic State West Africa (ISWA) in 2019. By 2022, the group restructured and established itself as the autonomous ‘Sahel Province’ of IS, focusing on consolidating territorial control. IS-Sahel is primarily active in the tri-border area of Burkina Faso, Mali and Niger, known as Liptako-Gourma, but has also engaged in sporadic activity in Algeria, Benin and Nigeria. It has faced an ongoing inter-Jihadist conflict with JNIM for control of territory. In 2024, IS carried out 16 attacks in Nigeria, 12 in Niger, six in Mali and one attack in Burkina Faso. IS-Sahel is known for its mass, indiscriminate violence against civilians. The group has carried out numerous attacks, including the March 2021 massacres in Niger's Tahoua Region, where over 140 civilians were killed. Since 2023, IS-Sahel has sought to shift away from its purely mass violence-based approach to one of territorial expansion and governance in the areas it controls, in part contributing to lower numbers of attacks in its areas of operations. By August 2023, IS-Sahel had reportedly doubled the amount of territory it controlled in Mali. In 2024, IS-Sahel appeared to prioritise territorial consolidation. Its control over vast areas along the Mali-Niger border has provided an operational safe haven, presenting a significant challenge for state forces attempting to counter its presence. Despite facing opposition from regional military forces and rival groups, IS-Sahel has demonstrated resilience and adaptability. Its ability to capture and hold territory has allowed itself to embed within the local populations. The focused recruitment of child soldiers is further designed to provide a long-term source of fighters and leaders. Its tactics have morphed from mass violence to siege-like tactics, controlling logistical routes and placing embargoes on towns they want to exert control over. Within its zones of control, the group has established governance infrastructure, including court systems which adhere to strict Salafist interpretations of Sharia law. IS-Sahel remains a formidable force in the region, with its operations posing a significant threat to the stability of Burkina Faso, Mali and Niger. 

ISLAMIC STATE CENTRAL AFRICA PROVINCE 

Islamic State Central Africa Province (ISCAP) emerged in 2017 and initially comprised two branches: one based in northern Mozambique and the other in eastern DRC. The Congolese wing of ISCAP originated from the Ugandan Islamist group known as the Uganda Muslim Freedom Fighters and the Allied Democratic Forces (ADF) in the 1990s. Over time, the ADF shifted its focus to the DRC due to military pressure and internal challenges. By 2017, the group pledged allegiance to IS, securing financial support and recruitment from across East Africa. In 2019, IS officially recognised the ADF as its Central Africa Province, enabling the group to expand its operations while maintaining allegiance to successive IS leaders despite significant leadership losses.37 Initially focused on Uganda’s government, the IS-affiliated faction in Congo shifted its attention to local economic activities, including mining and timber. Since aligning with IS, it has escalated attacks against both Congolese forces and civilians. Despite ongoing military efforts, the group remains a significant threat. In June 2024, an attack in Mayikengo resulted in at least 42 deaths, with perpetrators using firearms and machetes. The conflict in the DRC has worsened, with armed groups like the IS-linked ADF driving significant displacement. By mid-2024, over 2.4 million people had been displaced due to escalating violence between armed groups and government forces, with an estimated 200,000 internal displacement caused by the IS Congo conflict.

ISLAMIC STATE MOZAMBIQUE 

The Mozambique IS wing (ISM), locally known as Al-Shabaab though not related to the Somali group, emerged in October 2017 from a long-standing Salafist sect. Heavily armed fighters launched attacks on security forces in Cabo Delgado’s northern province, driven by growing tensions with local leaders. The group was designated a separate ‘province’ from ISCAP in 2022.

ISM’s primary area of operation is the northern province of Cabo Delgado, though other provinces, such as Balama, Chiure and Macomia, also saw group development. It also conducts cross-border attacks in southern Tanzania. ISM's early years were characterised by violent activities, with frequent attacks on civilians. Between 2017 and 2019, the group was involved in 66 incidents, mostly targeting civilians in districts like Macomia, Mocímboa da Praia and Palma. In 2019, IS officially recognised ISM as part of ISCAP, strengthening the group’s resources and strategic focus. ISM increased its operations, targeting urban centres and key infrastructure, including a liquefied natural gas (LNG) project near Palma. By 2020, the group had taken control of Mocímboa da Praia and disrupted major transportation routes, pushing the state to respond with counterinsurgency efforts. Since 2021, international interventions by Rwandan security forces and the Southern African Development Community Mission in Mozambique have significantly disrupted ISM’s activities. Although the group initially resisted these offensives, its capacity for political violence has steadily declined since late 2022. ISM’s focus shifted from targeting civilians to state institutions and LNG sites. ISM also became distinct from ISCAP in 2022. By the end of 2023 and into 2024, ISM escalated its operations across northern and southern Mozambique, including in previously untouched areas like Chiure and Mecúfi districts in southern Cabo Delgado. In the first six months of 2024, the group carried out deadly attacks, including kidnappings and massacres, displacing over 200,000 people. Despite international efforts to reclaim territory, ISM exploited the region’s weak governance to regain strength. The group remains focused on capturing and controlling territory, following the same strategies used by other IS branches in Iraq, Syria, and Libya. In 2024, these branches carried out a total of 28 terrorist attacks in the DRC and 33 in Mozambique. 

ISLAMIC STATE – LIBYA PROVINCE 

The Islamic State – Libya Province (IS-LP) was established in 2014. It was formed mainly by Libyan fighters who had participated in conflicts in Syria and Iraq as members of IS. These fighters took advantage of Libya's instability following the 2011 civil war to consolidate its influence. The group was initially organised as the Islamic Youth Shura Council and later pledged allegiance to IS, officially becoming IS-LP. The group secured a stronghold in the city of Derna, which has a longstanding history of jihadist activity. IS-LP swiftly expanded its influence, with IS leadership recognising three provinces in country: Cyrenaica in the East, Fezzan in the South, and Tripolitania in the West. By early 2015, IS-LP had seized control of Sirte, Muammar Gaddafi’s hometown, implementing strict Sharia Law and using the city as a strategic base for operations. Additionally, the neighbouring towns of Nofaliya and Harawa were taken over by the group. The group orchestrated several high-profile attacks, including the January 2015 assault on the Corinthia Hotel in Tripoli, resulting in nine deaths.  In February 2015, IS-LP claimed responsibility for bombings in the eastern town of al-Qubbah, which killed at least 40 people. Additionally, the group conducted mass executions, notably the killing of 21 Egyptian Christians near Sirte in Early 2015.  IS-LP’s presence in Libya attracted international concern, prompting military interventions. By late 2016, a coalition of Libyan forces, supported by US airstrikes, expelled the group from Sirte. In January 2017, US airstrikes on an IS-LP base southwest of Sirte reportedly killed over 90 militants. Furthermore, in September 2019, US Africa Command (AFRICOM) claimed airstrikes carried out against the group resulted in the death of 43 IS-LP militants. Despite these setbacks, the group persisted, adapting its tactics to operate as a dispersed insurgency, particularly in Libya’s southern regions. As of 2020, IS-LP has mostly operated as a moving insurgency, instead of holding territory that risks being subjected to raids and attacks. In recent years, the IS-LP has experienced significant setbacks, including the loss of key leaders and a marked reduction in its operational capacity. Notably, there have been no recorded terrorist attacks attributed to IS-LP within Libya since 2022. While the group no longer holds control over territory in the country or carries out numerous attacks, the continued presence and activity of IS on an international scale present a potential risk of IS-LP's resurgence. 

ISLAMIC STATE – SOMALIA PROVINCE 

Islamic State – Somalia Province (ISS) emerged in late 2015, when Abdul Qadir Mumin, a former al-Shabaab cleric, pledged allegiance to IS along with approximately 20 other fighters. Operating primarily in the Galgala mountains of Puntland, ISS sought to expand its influence in the region. After being inactive for a year, ISS captured the port town of Qandala in 2016, marking its first significant territorial gain. The group held the town for over a month before being expelled by Puntland Security Forces in December of 2016. Despite its relatively small size compared to rivals al-Shabaab, ISS has conducted several notable attacks. In May 2017, the group claimed responsibility for a suicide bombing in Bosaso, Puntland's commercial capital, which resulted in multiple casualties. By late 2019, ISS was considered a significant part of the IS’s global network. Despite this status, the group struggled to expand its influence, facing consistent opposition from al-Shabaab, the Somali Armed Forces, and US military operations. In an attempt to broaden its reach, ISS directed its efforts toward Ethiopia, seeking to infiltrate the country and recruit additional fighters. These initiatives were consistently thwarted by Ethiopian security forces, who dismantled ISS operations and apprehended numerous militants, preventing the group from establishing a meaningful presence beyond.

In May 2024, a US airstrike in northern Somalia targeted Abdul Qadir Mumin, who was allegedly acting as IS’s global leader at the time. Although reports suggested he survived, the incident underscores ISS’s growing significance within the broader IS network. In late December 2024, ISS launched a coordinated suicide attack on a Puntland military base near Dharjaale in the Bari region. The assault involved 12 militants and two explosiveladen vehicles, resulting in the deaths of at least 22 Puntland soldiers. Puntland forces repelled the attack, killing several ISS fighters. In response to ISS escalating activities, Puntland authorities initiated a major offensive in January 2025, targeting ISS hideouts in the Cal Miskaad mountains. The operation led to the seizure of eight jihadist outposts and the deaths of several ISS fighters. As of January 2025, ISS continues to pose a security threat in Somalia, particularly in Puntland's mountainous regions. The group's resilience and integration into IS's global network highlight the ongoing challenges in countering militant Islamist factions in the Horn of Africa. 

ISLAMIC STATE – SINAI PROVINCE 

Islamic State – Sinai Province (IS-SP), originally known as Ansar Bait al-Maqdis (ABM), emerged as a prominent militant group in Egypt’s Sinai Peninsula following the 2011 Egyptian Revolution. Initially focusing on attacks against Israel and the Arab Gas Pipeline to Jordan, ABM shifted its operations towards Egyptian security forces after the 2013 ousting of President Mohamed Morsi. In 2014, ABM pledged allegiance to IS, rebranding itself as IS-SP. IS-SP has been responsible for numerous high-profile attacks between 2013 and 2023. In October 2014, the group conducted a coordinated assault on Egyptian military checkpoints near El-Arish, resulting in the death of at least 26 soldiers. One year later, IS-SP claimed responsibility for the bombing of Metrojet Flight 9268, a Russian passenger plane which departed from Sharm El Sheikh, leading to the deaths of all 224 individuals on board the plane. The group continued its insurgency with significant incidents, such as the October 2016 attack on an Egyptian army checkpoint in Bir al-Abed, which resulted in the deaths of 12 soldiers. In July 2020, IS-SP militants launched an assault on the village of Rabaa, temporarily seizing control of several nearby villages before being repelled by Egyptian forces three months later, killing 77 IS-SP operatives. The following month, Egyptian and Bedouin forces killed Salim Salma Said Mahmoud al-Hamadin, a prominent IS-SP leader, during clashes just south of Rafah. IS-SP was at its most active and most deadly in 2017, carrying out 156 attacks that resulted in 501 fatalities. By 2024, its activity had significantly decreased, largely due to sustained military campaigns by the Egyptian Army in coordination with the Sinai Tribes Union. Additionally, reports suggest that Egyptian authorities have reached amnesty agreements with suspected IS-SP members, offering immunity in exchange for their surrender.

 ISLAMIC STATE KHORASAN PROVINCE

 Islamic State - Khorasan Province (ISK), also known as ISKP, is a regional affiliate of IS operating primarily in Afghanistan, Pakistan, Iran and parts of Central Asia. Formed in 2015, ISK pledged allegiance to IS's central leadership and aims to establish an Islamic caliphate in the historical region of Khorasan, which includes parts of modern-day Iran, Afghanistan and Central Asia. ISK has become one of the most active jihadist groups internationally in recent years. Since its formation, it has carried out numerous attacks beyond its bases in Afghanistan. In 2024, the group was responsible for two of the year’s deadliest terrorist incidents: the January attack in Kerman, Iran, which killed at least 95 people, and the March attack in Moscow, Russia, which resulted in at least 144 deaths.70 Since its inception, ISK has been linked to 634 attacks and 3,212 deaths. Recent activity has targeted the Russia and Eurasia region, with incidents rising from 11 in 2023 to 18 in 2024. Although the number of attacks remains lower than in subSaharan Africa, deaths attributed to the group increased from four to 199 during the same period. The threat of jihadism in Afghanistan and surrounding countries has been limited until recently. Since the various political and military upheavals that have impacted the region in the years since 2021, radical jihadism had persisted as a security concern until then but had remained a marginal issue, affecting only a small segment of the socio-political landscape. The departure of Bashar al-Assad from Syria in December 2024, coupled with the change of power in Afghanistan in 2021, has reshaped the regional security landscape. At the same time, a surge in international attacks and foiled plots linked to ISK has underscored the group’s growing transnational threat. This subsection examines ISK’s expanding influence and reassesses the broader jihadist threat both in the region and globally. From Inception to Formative Years (2015-2021) Foundation Jihadism in the Khorasan region has multiple sources and influences. The ideology gained prominence after the US-led operation that overthrew the Taliban in 2001, which led to increased jihadist activity in Afghanistan. The draw-down of Western combat forces in 2014 did not end the Afghan jihad but instead fuelled ongoing instability driven by internal conflicts and factional disputes. At the end of 2014, the first IS representatives arrived in Pakistan, distributing leaflets in Pashto and Dari. These leaflets called on local Muslims to pledge allegiance to al-Baghdadi and join IS's global jihad. Later that year, six senior members of Tehrik-e-Taliban Pakistan (TTP) also pledged allegiance to al-Baghdadi.

By January 26, 2015, the formation of "Wilayat Khorasan" (Khorasan Province) was officially announced by IS spokesperson Abu Muhammed al-Adnani. This followed six months of negotiations between IS leadership in Syria and Iraq and militant factions in Afghanistan and Pakistan. Among these groups were former TTP members, led by Hafiz Saeed Orakzai, who became ISK’s first emir. At the time, IS had already captured the Iraqi city of Mosul and the Syrian city of Raqqa, declared the establishment of a global caliphate, and received pledges of allegiance from other radical jihadist groups in various countries, such as Boko Haram in Nigeria. ISK was initially thought to have few connections with IS. However, by 2016, it was confirmed that the group had financial, strategic, and communication links with IS leadership in Iraq and Syria. ISK initially consisted of several thousand individuals opposing the government. The group was mainly composed of Pashtuns, the largest ethnic group in Afghanistan. According to the Afghanistan Analysts Network (AAN), ISK's core also included members of Pakistani Islamist groups who had fled military operations in northern Pakistan between 2010 and 2011. These individuals referred to themselves as ‘muhajerin’, meaning refugees or migrants. By the end of 2015, AAN reported that around 1,000 Pakistani migrants were members of ISK in Afghanistan's Nangarhar province. One of ISK's early strategic regional alliances was with the Islamic Movement of Uzbekistan (IMU), a terrorist group formed in 1998, primarily composed of Uzbeks and originally based in the mountains of eastern Tajikistan. Historically, the IMU has allied with both the Taliban and al-Qaeda. The group’s goal has been to overthrow the Uzbek government and establish an Islamic state in Uzbekistan, governed by the application of Sharia law. In August 2015, IMU leader Usman Ghazi pledged allegiance to IS leader Abu Bakr al-Baghdadi in a video, thereby establishing a close relationship with ISK. ISK shares core ideological elements with IS, including the goal of establishing a global caliphate governed by a strict interpretation of Islamic law. One of the components of their ideology is takfirism, the practice of declaring other Muslims who reject sharia law as infidels or kafirs, which they use to justify violence against Muslims.

Key Activities and Operations

 In its early stages, ISK focused on establishing a foothold in Afghanistan for future expansion. The group initially avoided conflict with the Taliban and other groups in the region, refrained from local taxation, and limited confrontations with regional military authorities. Recruitment remained limited, with several hundred active fighters and a larger number of sympathisers. Initially, ISK received funding from IS in Syria and Iraq. However, as IS in Syria and Iraq struggled to consolidate control in Middle East, this support declined, and ISK began to rely more on other funding. The affiliates of IS in Central Asia were divided between those linked directly to IS leadership in Iraq and Syria (Tajikistan) and those aligned with ISK in Kyrgyzstan, Uzbekistan and Kazakhstan. ISK maintains a hierarchical leadership structure.88 The group has had seven emirs to date. As shown in Figure 4.8, under the leadership of ISK’s first emir, Saeed Khan, just one attack resulting in 83 deaths was attributed to the group. Abu Sayed took over as leader in April 2017, but his tenure was short-lived after he was killed in a US drone strike in July 2017. ISK became more active under the leadership of Saad Orakzai, a former TTP commander, who was killed in an airstrike in Afghanistan in 2018. The next ISK emir, al-Khorasani, was appointed by the local ISK leadership council but was demoted by IS in Iraq and Syria due to poor performance. Deaths from ISK attacks declined during his leadership from 814 in 2018 to 225 in 2019. Since 2020, ISK has been led by Shahab al-Muhajir, who was allegedly a commander in the Haqqani network, an Islamist insurgent group in Afghanistan. Since al-Muhajir took power, ISK has organised several high-profile attacks, including the 2021 Kabul airport attack. Due to the ongoing conflict with the Taliban, over 500 deaths were attributed to ISK in both 2021 and 2022. The lethality of the group’s activities declined in 2023, but deaths rose again in 2024, primarily due to international attacks, such as at the Crocus City Hall in Moscow

US forces in Afghanistan began targeting ISK fighters at the end of 2015. In 2016, a joint US and Afghan counterterrorism operation killed ISK’s first leader Hafiz Sayyid Khan and several fighters, further diminishing the group’s territory. Taliban attacks also contributed to this decline. In 2017, the US dropped a powerful bomb on ISK positions in Nangarhar province. By mid-2017, the group’s territorial control was limited to just three districts in Nangarhar province, with ISK deaths later peaking in 2018.

Evolution after Taliban’s Takeover in 2021

 Regionalisation and Internationalisation 

In 2021, the power dynamics in Afghanistan shifted when the Taliban regained control of the country, following the withdrawal of US and NATO forces after nearly two decades of military presence. During the US withdrawal, ISK conducted an attack on the Kabul Airport. The bombing killed at least 175 people, including 13 US service members, and left hundreds more injured. The attack is believed to have been orchestrated under the leadership of the current emir, Shahab al-Muhajir. Al-Muhajir was reported killed by Taliban in 2023, but he survived with injuries and continues to lead the group. ISK rejects the Taliban's legitimacy as an Islamic group and denies its rule over Afghanistan. According to a resolution passed by the Taliban in 2022, Afghanistan operates under an Islamic system of governance, and any armed opposition to this system is deemed rebellion and corruption. Consequently, the Taliban considers ISK's actions illegal and against national interests. Therefore, assisting ISK or maintaining ties with the group in Afghanistan is prohibited. However, despite the declared hostility between ISK and the Taliban, their relationship is complex. Researchers suggest that it is influenced not only by ideological differences but also by competition for influence within the same ideological space and, ultimately, the struggle for power. A few months after the Taliban took control of Afghanistan, ISK expanded its influence across nearly all provinces. The group continues to use suicide bombers, ambushes, and targeted killings. These attacks often focus on civilians and religious or ethnic minorities. Human Rights Watch reported that in the year following the Taliban's takeover, ISK killed or injured 700 members of religious minorities in Afghanistan.  Since 2022, ISK has primarily focused its attacks in northeastern and southern Afghanistan, continuing to target key locations and infrastructure. The group remains active, engaging in violent activities as it attempts to regain influence and challenge local authorities in these regions, which border Pakistan and Tajikistan on the north. Operating on the north-eastern border area of Afghanistan, ISK targets neighbouring Pakistan. In 2018, total ISK-related deaths in Pakistan peaked, with 236 fatalities. The impact of ISK activity in Pakistan has declined since, with 75 deaths in 2023 and 15 in 2024. Total IS attributed attacks in the country in 2024 stood at 25, similar to the 24 attacks reported the previous year.

In recent years, ISK has shifted its operational focus, with a decline in the number of attacks claimed or attributed to the group globally but an expansion of its geographical reach. This shift may be an attempt to highlight the Taliban’s limited control over border security and attract new recruits from the region. It could also be driven by the Taliban’s efforts to suppress ISK following the group’s takeover of Afghanistan or a broader strategic adjustment within ISK. ISK’s propaganda magazine Khorasan Ghag (Voice of Khorasan) reported in late 2023 that the decline in attacks since 2021 was part of a ‘strategic silence policy’ aimed at reducing the group’s visibility within Afghanistan. Figure 4.10 shows the proportion of ISK attacks within and outside Afghanistan since 2016. Prior to 2022, ISK attacks were primarily confined to Afghanistan. However, since 2022, attacks within the country have declined, while those outside its borders have risen to a comparable level. This shift may reflect a strategic adjustment by ISK, possibly as a survival tactic in response to being increasingly suppressed in Afghanistan. Faced with diminishing territorial and operational opportunities, the group might be redirecting its activities to regions where it encounters less resistance or can more easily rebuild its networks.

 The Threat of ISK 

ISK's influence and activities unfold within a complex web of regional and global circumstances. With the group's growing international attacks and increased efforts to mobilise support across the region, understanding the shifting dynamics of foreign influence in Afghanistan is essential. These changes not only shape Afghanistan's internal stability but also impact the broader regional and global security landscape. Since 2021, ISK has caused more deaths outside Afghanistan than within it, indicating a shift in focus toward high-impact external operations rather than internal control. This trend suggests an expansion of the group’s global ambitions, as it seeks to target foreign interests, inspire attacks abroad, and extend its influence beyond Afghanistan. The relative decline in deaths within Afghanistan also reflects ISK’s struggle to maintain territorial control or consolidate power locally. ISK has carried out several large-scale attacks in recent years, drawing significant media and policy attention. One of its most significant attacks in Iran took place in late 2023 during a ceremony commemorating General Qasem Soleimani, who was killed by a US drone strike in January 2020. Multiple explosions targeted the memorial event in Kerman, killing more than 100 people. In 2024, deaths from ISK attacks increased. On March 22, gunmen stormed Crocus City Hall near Moscow, opening fire on civilians and detonating explosives. The attack caused a roof collapse and fire, killing 133 and injuring. ISK later claimed responsibility for the attack. Russian authorities arrested 11 suspects, including the main perpetrators.

Since the Taliban's takeover of Afghanistan, ISK has expanded its propaganda efforts, focusing on outreach, recruitment and fundraising across South and Central Asia.104 As shown in Figure 4.12, the number of propaganda pieces released by ISK has increased since 2022, with a notable rise in content produced in Tajik and Uzbek. While comprehensive data on propaganda in different languages remains limited, Figure 4.12 suggests that ISK has intensified its efforts to gain sympathisers and boost recruitment in Central Asia. ISK relies on financial networks to sustain its operations, with an estimated $2.5 million in funding accessed through blockchain transactions in 2023. In 2024, the group’s membership in the region was estimated to be between one and six thousand, with a strong presence near Tajikistan’s southern border provinces, including Badakhshan, Kunduz and Takhar. ISK continues to attract returning fighters from Syria and Iraq, with recruitment efforts bolstered by the Islamic Movement of Uzbekistan. ISK‘s multilingual media strategy uses Pashto, Dari, Arabic, Urdu, Farsi, Uzbek, Tajik, English, and more recently, Russian and Turkish, to target youth and marginalised groups through platforms such as Telegram and Al-Azaim

As shown in Figure 4.13, foreign influence in Afghanistan has declined since the Taliban regained power in 2021. This trend is evident for the four major powers who had the most influence in the country since 1999: the US, India, Russia and Pakistan. The only exception is Uzbekistan, which has maintained its influence, though its overall impact on Afghanistan remains limited compared to the declining influence of the US or Russia. This shift may weaken the ability of traditional powers to counteract ISK’s activities. With the Taliban’s focus on consolidating internal control, the potential space for other actors, such as ISK, to expand their influence may increase especially in regions with limited state authority. Additionally, the reduction in foreign presence means that ISK may face less direct military opposition from external powers, allowing them to operate more freely and potentially target foreign interests more aggressively beyond the country. Concerns over the stability of the Afghan border have existed for many years, particularly among neighbouring countries like Tajikistan, which view it as a critical security challenge in terms of radicalisation and organised crime. In this context, regional organisations have repeatedly emphasised the importance of reinforcing border security. For instance, in November 2024, the Collective Security Treaty Organisation (CSTO) announced the adoption of a Targeted Intergovernmental Program aimed at strengthening the Tajik-Afghan border, later supported by Commonwealth of Independent States (CIS) countries. However, local media in Tajikistan highlighted that similar promises of assistance were made by the CSTO as early as 2017, with little to no significant actions undertaken to reinforce the border since then. In 2024, the Taliban claimed that Afghanistan is safe and that there is no need for a security belt around the country, while also stating that drugs have been completely banned. Despite the ban, reports suggest that opium poppy cultivation in Afghanistan increased by 19 per cent between 2023 and 2024, with production shifting from the southwest to the northeast. Tajikistan faces significant threats from ISK, which has intensified recruitment, expanded training facilities, and increased attacks near the country’s border with Afghanistan. Tajiks were implicated in several major attacks and arrests in 2024. Domestic policies restricting religious practices, such as hijab bans, may inadvertently fuel radicalisation.

Regional discussions continue on countering these threats, alongside shifting Russian policies toward the Taliban. ISK’s attacks in Russia may be in part a response to growing Russian engagement with the Taliban. The growing strength of ISK in Afghanistan, driven in part by weaknesses in Taliban governance, poses a challenge for Russia and its Central Asian partners. As a result, there is increasing pressure to develop strategies to counter this threat. Simultaneously, between January and August 2024, Russian law enforcement thwarted 110 terrorist attacks and detained 1,050 people. This coincided with a significant increase in expulsions from Russia, after the ISK attack near Moscow, with over 80,000 migrants expelled in 2024, nearly doubling the 44,200 expulsions from the previous year. Additionally, in December 2024, President Putin signed a law that could potentially remove the Taliban from Russia's list of banned organisations. Meanwhile, members of the CSTO convened in Moscow to discuss the military-political situation in Afghanistan and the extremist threat posed by ISK. The situation in Afghanistan remains crucial for the future trajectory of ISK and its threat to other countries, including neighbouring states and major global powers. As the Taliban consolidates its control, the ability of ISK to operate and expand both within Afghanistan and beyond is a key point of international concern. Governments have expressed significant concern over the growing external threat posed by ISK, particularly in countries like the UK, where it is considered the most serious overseas Islamist threat. The European Union, Russia and Central Asian countries are strengthening security and counterterrorism efforts. Whether ISK expands its reach or is contained will be a key factor in shaping its ongoing international threat, keeping it at the forefront of global counterterrorism priorities.