One of the most important intelligence principles asserts that there is no such thing as a “friendly intelligence agency.” Despite collaboration or alliances between governments for information gathering, competitiveness governs these partnerships. As the boundaries between local and global conflicts become increasingly blurred, uncertainty prevails regarding many security events worldwide. This is especially true given the clear and impactful activities of non-state actors, along with the existence of a ready-made brand—such as ISIS—to claim responsibility for any global or local terrorist incident.

On March 22, 2024, the suburb of Krasnogorsk, northwest of Moscow, witnessed a terrorist attack targeting the Crocus City Hall, a music concert venue. Armed assailants opened fire on attendees during a music event before setting the hall on fire while civilians were still inside, killing at least 144 people and injuring more than 550.

Despite Russia’s history of witnessing armed attacks that left hundreds dead, this recent attack coincides with the changes in the Russian war in Ukraine, shifting from a limited military operation to the declaration that Russia itself is in a state of war.

Why Is Russia Targeted with Major Operations?

Since the events of September 11, the United States has redefined its counterterrorism concepts. It has improved methods and mechanisms for information exchange among government agencies and law enforcement bodies. Furthermore, the United States has gone beyond that by claiming its ability to neutralize all threats to U.S. national security worldwide. As a result, the U.S. invaded Afghanistan under the pretext of eliminating Al-Qaeda and its allies, and it also invaded Iraq based on allegations of internationally banned weapons. However, the quality of these operations has fallen short of the standards set by September 11.

On the other hand, Moscow continues to centralize its approach to counterterrorism and information about attacks. It often withholds information, but what stands out is that Russia occasionally faces qualitative attacks that result in a significant number of casualties. For instance, on October 31, 2015, a civilian passenger plane operated by the Russian company Kogalymavia exploded above the northern Sinai Peninsula. The plane was en route to Saint Petersburg, Russia. All 224 passengers and crew were killed. ISIS’s Sinai branch claimed responsibility.

Returning to the Crocus attack, conflicting reports emerged regarding the responsible party. The statement issued by the media arm of the terrorist organization ISIS attributed responsibility to its branch in Russia, although ISIS had not explicitly identified or claimed such a branch before. Previous attacks on Russia were attributed to ISIS in the Caucasus, referring to a broader region that includes parts of southern Russia and other countries like Armenia, Azerbaijan, and Georgia. However, several indications suggest that ISIS Khorasan (ISISI-K), active in South-Central Asia, primarily Afghanistan and Pakistan, is the actual entity planning and executing these attacks.

All of this implies that the global terrorism brand is reverting to use the “ink spot” strategy, wherein the terrorist organization announces multiple entities, each playing a specific role that can then be unified under a single name. This leads to the question: Does ISIS intend to return to the global stage through the gateway of Moscow, which is engaged in a tough struggle with the West over influence and dominance?

What stands out in the recent Moscow attack is that the four attackers meticulously planned their escape. Generally, assailants engage security forces and attempt to kill as many people as possible before being killed themselves. Yet these assailants did not and were subsequently arrested in the Bryansk region near the border with Ukraine. This raises questions about the tactics, operation instructions, and if ISIS itself orchestrated and funded the operation.

Additionally, the attack revealed new recruitment methods employed by ISIS. Russian investigation reports, which have been made public, include the confession of one of the assailants that he was recruited in exchange for monetary gain. The financial incentive may explain why the attackers sought to escape alive from the attack site.

The danger lies in that the Middle East region already hosts a significant number of recruits and mercenaries associated with private security firms, many of whom are military veterans and even pardoned prisoners who are now active in the battlefronts between the Russian and Ukrainian armies. Such individuals are likely targets for recruitment by terrorist organizations. Notably, the ideological and combat fervor that characterized early ISIS members and formed the basis for lone-wolf attacks worldwide seems to have waned.

On the other hand, Tajik passports found with the perpetrators of the Crocus City Hall attack indicate a direct link to ISIS-K. This suggests that ISIS is aiming to bolster its ranks among Tajik nationals whose leader, Thani al-Ghafar, hails from Afghan-Tajik origins. Furthermore, this underscores that ISIS is not welcomed among the pro-Taliban Afghan Pashtuns. This may imply that ISIS is attempting to reorganize its presence in Afghanistan far away from the center and the Pashtun majority.

Russia and the Weak Spots Dilemma

That Russia is subjected to an armed attack is never exceptional. Despite the new behavior of those who bombed the Crocus Theater, Russian territories have witnessed many armed and terrorist attacks in recent decades. Medical, educational, and cultural facilities, which have less security, were the major sites for these attacks.

• In June 1995, 195 Chechen gunmen stormed a hospital in Budennovsk, killing more than 100 citizens who refused to cooperate.
• In September 1999, more than 300 people were killed when residential buildings were bombed in Moscow, Buynaksk, and Volgodonsk.
• In 2002, Chechen gunmen stormed the Dubrovka Theater in Moscow in an operation that resulted in the death of all 40 attackers and 132 hostages.
• In 2004, gunmen attacked a school in Beslan in North Ossetia, where 1,100 children, teachers, and parents were taken hostage. This assault resulted in the death of more than 334 people, more than half of whom were children.

These attacks are in addition to others that targeted railway lines and subway stations in Moscow and the Moscow Domodedovo International Airport.

The following points are common aspects of most of the attacks that targeted Russia:

1- The attacks is often carried out by a group of gunmen who rely on taking hostages or random shooting.

2- The executing parties avoid attacks on official or security facilities, focusing instead on high-density civilian facilities.

3- Attacks against Russia aim to cause the largest possible number of victims among civilians.

4- The perpetrators often seek to destroy the attack sites either by bombing, arson, or other acts of destruction. In the last attack, the perpetrators set fire to the Crocus City Hall music venue, causing the theater’s roof to collapse.

Attach-Time Indicators

Several indicators preceded the attack, making predicting it be expecting its time. These indicators include:

1- There is a noticeable escalation in the attacks carried out by ISIS-K, especially in the Central Asia region, after such attacks witnessed a decline since 2018.

2- “ISIS Khorasan” focuses its attacks on the interests of Eastern countries more than on Western interests. It mainly targets China, Russia, and Iran. In 2022, ISIS-K claimed credit for an attack on a Kabul hotel popular with Chinese nationals. That same year, in September, ISIS-K claimed credit for a suicide bomb attack on the Russian Embassy in Kabul that killed eight people, including two diplomats. ISIS-K also carried out a double attack in Kerman on January 3, 2024, that killed 94 people at a gravesite ceremony marking the anniversary of Qassem Soleimani’s assassination.

3- The direct clash between Russia and ISIS escalated after the support Moscow provided to the African coastal countries led to a reduction in ISIS’s areas in Mali, Niger, and Burkina Faso.

4- In the heart of its main stronghold inside Afghanistan, the interests of ISIS-K collide with Russian, Iranian, and Chinese efforts to establish good relations with the Afghan Taliban movement.

5- On March 7, 2024, Russia thwarted an operation ISIS was planning to carry out against one of the Jewish temples in Moscow.

6- On March 3, 2024, the Russian National Anti-Terrorism Committee announced the killing of six members of the ISIS organization in an armed confrontation in the Russian city of Karabulak in the republic of Ingushetia, located in the North Caucasus of Eastern Europe.

ISIS Organization: An Executor of Façade?

Perhaps the most important matter concerning the attack in Crocus is that despite ISIS’s declaration of responsibility for it, senior Russian officials still insist on accusing Ukraine and some Western countries of being directly involved in the attack. Among these Russian officials is Alexander Bortnikov—the head of the strongest security institution in Russia, the Federal Security Service—who points to the involvement of Ukraine, the United States, and Britain.

Russian President Vladimir Putin indicated on March 23 that the perpetrators of the attacks were arrested while they were trying to flee towards Ukraine, where they had planned to “escape to cross the border.”

This opinion is based on several indicators:

- The parties that directly benefitted the most from the attack were the United States and European countries, which were most affected by the Ukrainian war, especially after the field progress of the Russian army and its control over the strategic city of Avdiivka.

- ISIS is an advanced Western intelligence tool that has proven its effectiveness and readiness for use when needed. This began to appear after October 7, 2023. After many years of the ISIS’s dormancy, it returned to the forefront of events by carrying out terrorist attacks in Niger, Iran, Turkey, Mali, and Syria.

- The United States rushed to exonerate Ukraine of responsibility and blamed ISIS solely as a part of a policy of exploiting the name of that organization.

- The attack came to complicate and amplify the security challenges in Russia, especially as it coincided with Putin’s victory in the elections. The importance of security and stability in the country plays a major role in supporting Putin’s popularity. In addition, it undermines Russia’s attempts to neutralize the domestic atmosphere and course of the war in Ukraine.

- The warning by the U.S. embassy in Russia in early March about the possibility of a terrorist attack in crowded places in major Russian cities is taken by supporters of the said opinion as evidence of U.S. involvement in the attack.

However, some other data and indicators contradict the Russian accusations against Ukraine and the West.

1- Western interests intersect with the goals of ISIS, especially in the political and military contexts. This intersection is not an indicator of cooperation as much as it indicates the complexity of the interactions between the different actors.

2- It is unlikely that the Western alliance with Salafi Jihadism will return, especially after the experience of supporting Arab mujahideen in Afghanistan in the 1990s against the Soviet Union. Although this alliance was in the interest of the West, its risks later rebounded on it.

3- The warning from the U.S. Embassy reflects an advanced level in the ability of American national security agencies to access information about ISIS activities, either through eavesdropping or algorithms. It does not necessarily mean that there is a cooperative relationship between the United States and ISIS, especially since Washington had previously warned Russian law enforcement agencies of imminent terrorist attacks and had secretly warned Iran of an ISIS attack that took place this January.

What After the Attack?

The attack indicates that ISIS-K is trying to reappear on a global scale and revive the “global jihad” that formed the basis of global Salafism, especially in light of the weakness of Al-Qaeda and the rest of the branches of ISIS to carry out bloody attacks on a global level. Therefore, the ISIS-K attack in Russia was very bloody and violent, which means that it may be preparing for other attacks, not only in Russia but also in Europe and the United States.

Given the difference in ISIS’s tools in recruiting fighters from ideological elements to the most professional, experienced, and trained mercenaries, it is likely that the potential upcoming attacks will be as bloody and impactful as the Crocus attacks.

Author: Hazem Salem Dmour General Manager / Specialized Researcher in International Relations and Strategic Studies