After the Taliban Takeover: How Islamic State-Khorasan Are Exploiting the Online Ecosystem and Projecting the Threat

It has now been two years since the Taliban took over Afghanistan. Despite their claims to the contrary, foreign terror groups such as Islamic State-Khorasan (IS-K) have enjoyed greater freedom of manoeuvre and are exploiting online spaces.  

Despite what the Taliban claim, several foreign terrorist groups, including Islamic State-Khorasan (IS-K), have enjoyed greater freedom of manoeuvre since the former took over Kabul in August 2021. Here we outline how the group is exploiting the online ecosystem in an effort to boost international funding and recruitment.  

IS-K’s propaganda apparatus and prominent role in IS central online ecosystem 

With content published in more than 12 different languages, including English, Pashto, Uzbek and Tajik, IS-K has an exceptionally consistent and dynamic multilingual propaganda apparatus when compared to other official IS affiliates globally. This includes its ability to undertake multiple collaborations with both official and unofficial IS media entities, and to produce a wide range of media outputs independently of IS’ central media arms. 

Under the coordination of its primary media arm, IS-K propaganda production ranges from digital books, videos, audio statements, to publications such infographics, magazines, and editorials designed to claim attacks, comment on current affairs, and delegitimise ideological enemies. Regular publications include monthly English and Pashto-language magazines.  

By contrast with IS core’s highly centralised approach, IS-K implements a decentralised propaganda dissemination strategy, with various other IS-K-affiliated propaganda units operating under dedicated regional languages. 

Over the past year IS-K’s primary media outlet has significantly increased the volume and frequency of its messaging output aimed at Central and South Asian populations, particularly ethnic Tajiks and Uzbeks. These language units rely upon an extensive multilingual network operating on social media, messaging and file sharing platforms, archiving services, and dedicated websites. The media outlet has also increased its collaboration with other pro-IS media entities and plays a central role in amplifying the official propaganda produced by IS central in Iraq and Syria. 

IS-K advances several key narratives in its propaganda for the particular purpose of discrediting the Afghan Taliban’s legitimacy and formulating threats against other regional governments. The group also focuses a proportion of its propaganda, including output in English, on articulating threats against Europe and North America.  

The IS-K threat to the West 

Prior to the recent decrease in IS-K activity, amid the ongoing intensification of Taliban raids, intelligence reporting had warned about the group’s unwavering ambition to plan sophisticated operations outside its traditional area of operation, particularly in Europe and North America.   

In July 2023, nine individuals allegedly affiliated with IS-K, several of them coming from Central Asia, were arrested in a joint EU counterterrorism operation on suspicion of “funding a terrorist group with alleged links to IS” and “committing preparatory acts” for conducting a high-profile attack in Germany. A few months before, US CENTCOM commander Army General Michael Kurilla had warned that IS-K may be able to conduct external operations against Western or US interests abroad in under six months with “little to no warning” should the group prioritise such attacks. 

It is highly likely that, after suffering heavy losses in late 2019, which saw the group losing its headquarters in Nangarhar, IS-K was able to regain manpower through effective recruitment efforts and online propaganda strategies inside and outside Afghanistan. It has also been able to rebuild its core command and clandestine cells and reconsolidate its support zones in eastern and northern Afghan provinces. There is a realistic possibility that, during that time, the group also benefited from increased access to resources and facilitation networks outside Afghanistan, which had the likely effect of increasing its ability to inspire and enable directed external operations.   

Continued Taliban pressure is likely to constrain IS-K’s ability to plot and direct complex external operations in the near term. However, it is highly likely that radicalised individuals directly affiliated with or inspired by the group retain the intent and capability to conduct low-sophistication terrorist attacks against symbolic targets and public spaces in Europe. Also, as the Afghan and Central Asian diasporas continue to expand abroad, and most notably in Europe, IS-K is likely to continue to exploit recruitment opportunities to inspire attacks and plan operations against Western interests.  

TCAP alerts of IS-K content 

Since July 2021, Tech Against Terrorist has alerted 374 URLs, leading to official IS-K propaganda channels or content hosted on archiving sites and file-sharing platforms, via our Terrorist Content Analytics Platform (TCAP). At the time of writing in early August 2023, 211 of these (56%) had been taken down, while 163 remained online. This corroborates our findings that archiving platforms, which are heavily exploited by Islamist terrorists, are the least responsive to TCAP alerts out of all other platform types. 

As the group comes under increasing pressure from the Taliban in Afghanistan, IS-K’s capacity to project threats to the West is likely to remain conditional on its ability to raise funds, recruit sympathisers and inspire attacks through its online propaganda operations, particularly in target countries.

There is a realistic possibility that increasing its English-language propaganda output will improve the group’s capability to successfully inspire low-sophistication attacks and activate one of its several aspirational plots in Europe. In the event that the Taliban fails to address the threat posed by IS-K in the long term, the group is likely to continue to grow stronger, expand its operations to neighbouring Central and South Asian countries and further strengthen its ability to plan, finance and carry out attacks externally, including in Europe.