by Lucas Webber, Senior Threat Intelligence Analyst at Tech Against Terrorism
The online activities of Islamic State Khorasan Province (ISKP)’s robust and expanding propaganda apparatus directly strengthen its operational capacity to inflict violence locally, regionally, and internationally. Accordingly, counterterrorism efforts must be heavily focused on disrupting and degrading ISKP’s broadening online footprint.
Following the Taliban's takeover of Afghanistan in August 2021, ISKP designated Al-Azaim Foundation for Media Production as its branch-level propaganda outlet responsible for implementing the digital aspects of its new transnational strategy, in which online propaganda and military actions are complementary and symbiotic.
ISKP’s vision is one of both regionalisation and internationalisation. This vision includes an expanded range of language-specific media arms and increased production and publication of content with messaging customised for multiple ethno-linguistic audience segments. It also involves intensifying efforts through propaganda institutions to incite violence, remotely direct plots, and simultaneously build support, recruit members, and raise funds through cryptocurrencies and other methods. The development and growth of ISKP’s external operational capability to stage attacks abroad, as well as the targeting of foreign nationals and interests inside Afghanistan and Pakistan, also form part of this vision.
ISKP has embraced "media jihad" as a core component of its operations and expanded its propaganda production capabilities and cross-platform distribution networks, while at the same time encouraging independent media production by its online followers. By collaborating with external propaganda entities and utilising pro-IS translation outlets, ISKP broadens its prospective audience. This approach not only amplifies the group's messaging but also helps to build support, recruit, and raise funds.
The group's propaganda efforts have been particularly focused on inspiring attacks overseas, which are typically targeted against foreign interests in multiple countries, including in Europe and, increasingly, North America, where recent arrests have disrupted a growing number of ISKP-linked plots. ISKP has likewise ramped up its guided or hybrid activity, which combines inspiration with operational guidance; the group’s operatives do not directly train and deploy an attacker, but instead virtual mentors provide would-be plotters with advice on selecting targets and weapons, as well as various other forms of support.
As with inspired and guided plots, external operations directly conducted by ISKP also commonly have online aspects, particularly in communication using encrypted applications and fundraising on social media platforms. ISKP’s Al-Azaim Foundation has explicitly stated that money donated by online supporters helps enable external operations. An online post published earlier this year included an image featuring a Monero cryptocurrency wallet address and encouraged users to donate by linking financial support with various high-profile attacks, including those in Moscow, Russia and Kerman, Iran, in 2024. The image was posted on several social media platforms and distributed through encrypted messaging applications, demonstrating how ISKP’s online operations directly facilitate major international terrorist attacks.
It is crucial for governments, agencies, law enforcement, policymakers, and tech platforms to understand that disrupting ISKP’s online propaganda and information warfare operations is just as important for successfully degrading the organisation as the kinetic disruption of local, regional, and international terrorist attacks. ISKP does not control territory, and its propaganda producers and operational personnel are dispersed across Asia and beyond. Its networks are therefore resilient and elusive. As such, countering ISKP's growing online media presence requires a multifaceted approach that requires coordination between governmental and private sector entities. Tech Against Terrorism continues to pursue the disruption of ISKP's online activities by identifying and reporting the group’s online media content through its Terrorism Content Analytics Platform (TCAP); however, more action is required across government and industry. There must be a greater coordinated effort by public and private entities to make it more difficult for the group to effectively exploit the online environment. The adaptability and resilience of ISKP's media strategies mean that such efforts must be comprehensive and coordinated to be truly impactful.
