By Benjamin den Braber and N. Faizi
The third article of our series “Spotlight on Extremism” looks into the perpetrators behind the Moscow Crocus City Hall attack as well as the responses from ISKP and reactions from their supporters online. This investigation was carried out by our Afghan Witness team.
The Centre for Information Resilience (CIR) has redacted most links and the names of channels due to privacy concerns and to avoid amplifying harmful content. Upon request, CIR can share any relevant data.
On 23 March 2024, CIR’s Afghan Witness (AW) project visually confirmed dozens of casualties following an attack at the Crocus City Hall in Krasnogorsk, Moscow Oblast, Russia. In footage of the incident analysed by AW, three perpetrators are seen using long rifles, directly firing at civilians, while a fourth individual, carrying a large bag, is seen assisting with reloading weapons. Soon after the attack, a statement released by Islamic State-affiliated Amaq News claimed: “The fighters stormed the hall, and three of them began shooting at the crowd, while the fourth fighter was busy setting fire to the hall using incendiary bombs that had been prepared in advance for this purpose.” The statement, however, did not attribute responsibility of the attack to the Islamic State Khorasan Province (ISKP),1 but rather to “soldiers of the caliphate in Russia.”
A day later, several individuals who claimed to be the perpetrators of the attack were detained. AW geolocated the arrest scene to Kommuna, Navlinsky district, Bryansk Oblast, located 140 kilometres from the Ukrainian border [53.079839, 34.554344]. In videos from the scene of the arrests, Russian officials can be seen cutting off the ear of one of the detained individuals and forcing him to eat it. Based on visual analysis, this man wore clothes that match one of the attackers from Crocus City Hall.
This article will shed light on the identities of the perpetrators of the attack; responses from Al-Azaim,2 an ISKP-affiliated media channel; and reactions from pro-ISKP group chats on Telegram. Although ISKP did not claim responsibility for the attack, Al-Azaim, as well as several pro-ISKP Telegram channels, all praised the attack.
A notable difference can be seen regarding reactions between Al-Azaim and pro-ISKP channels. Al-Azaim released a statement providing a justification for the civilian casualties that resulted from the Moscow attack, and called for more attacks to be carried out in Russia and Western countries. Pro-ISKP channels advised on security measures ISKP members or sympathisers should take following the attack; denounced the torture directed at the detained alleged perpetrators; and provided counter-arguments to criticisms received from the wider Muslim community.
Russia has long been viewed as a priority target by groups such as ISKP, who oppose the Kremlin’s support for Syrian President Bashar al-Assad’s regime and its ongoing civil war, as well as its prior military offensives in Chechnya and Afghanistan. More recently, Russian actors such as Wagner have taken a growing role in anti-terror operations in countries in Africa, particularly in the Sahel region, putting Russia in direct confrontation with IS Sahel Province. IS affiliates have previously targeted Russia in multiple attacks, as well as disrupted plots, including an ISKP attack targeting the Russian Embassy in Kabul in September 2022. In addition to the Moscow attack, and to Al-Azaim’s call for additional offensives, overall levels of support and positive reactions from the wider ISKP community demonstrate the growing threat posed by ISKP.
Detained perpetrators: who carried out the attack?
AW visually confirmed that the detained individuals’ clothing matched the perpetrators of the attack in Krasnogorsk (Figure 1). A video shared on a Russian Telegram channel showed that one of the perpetrators spoke colloquial Tajik while a translator assisted with the interrogation. He said that prior to the attack, he had been living in a hostel on Dmitrov Highway, with a person called Muhammad, for almost a month (15-20 days).
The other arrested men who were being interrogated were speaking in a poor Russian accent. In a video shared on a Russian Telegram channel of his first interrogation, suspect Faridun Shamsiddin, said: “I shot people. For money. They delivered the arms to us themselves. They were people who wrote to me on Telegram. I don’t know why they wrote to me. I was listening to a lesson. To a preacher.”
The fact that Shamsiddin mentioned listening to the lessons of a preacher is notable as AW has previously observed ISKP attempts to infiltrate Islamic reminder groups3 on different social media platforms. In these groups, ISKP is understood to interact with individuals interested in Islamic ideology, disseminate more hardcore ISKP propaganda, and lure individuals to private groups on Telegram. AW assess it is likely Shamsiddin was already present in (pro-) ISKP Telegram channels, where lessons are regularly disseminated.
The figure below highlights the similarities between the clothes of the attackers seen in a photo released by Amaq News, and photos of the alleged perpetrators at the time of their arrest. The figure also contains an image of Shamsuddin, who was photographed at the Crocus City Hall on 7 March 2024.
Figure 1: screenshot showing two men detained in Kommuna, matching clothing with two of the attackers, shown in an image released by IS-affiliated Amaq News. Faridoon Shamsuddin (top right) was also photographed at the Crocus City Hall on 7 March 2024 (top middle).
It is noteworthy that sources from Tajikistan have characterised the perpetrators as having no prior engagement with ISKP, and showing no signs of radicalisation.
ISKP’s response: threatening Russia and the West
On 25 March 2024, Al-Azaim Media issued a 30-page Pashto statement regarding the Moscow attack, titled “Mourning and fear of militias on Moscow attack,” describing it as retaliation against Russian strikes on IS targets in Syria. However, the primary focus of the message was to address a Taliban statement, in which Afghanistan’s de facto authorities accused Pakistan and Tajikistan of harbouring and supporting ISKP.
Figure 2: cover page of the 30-page Pashto statement, 'Mourning and fear of militias on Moscow attack,' published by Al-Azaim Media on 25 March 2024.
The statement delivered harsh criticism towards a condolence statement issued by the Taliban’s Foreign Ministry, which labelled the attack in Moscow a violation of human rights, and a defamation of Islam. A significant portion of the critique was directed towards the Taliban's reference to ISKP as a puppet of US and other Western intelligence agencies.
ISKP justified the civilian casualties resulting from the Moscow attack as reprisal for the deaths of IS members, along with their women and children, in Russian strikes in Syria. The statement further defended the killings, pointing out that Russian citizens’ taxes fund the Russian army, noting that Russian citizens celebrated their army’s strikes against IS; therefore, the killings were justified.
The statement also asserted that future ISKP attacks would not be confined to a particular region (E.g. Afghanistan and North-West Pakistan), but would extend to countries supporting the Afghan Taliban globally. Specific threats were issued against Russia, China, and Iran, cautioning that their good relations with the Taliban would not shield them from ISKP threats.
Al-Azaim later disseminated an image (in collaboration with pro-IS outlet Al-Battar), threatening attacks on Western countries (with Paris, Rome, Madrid, and London visible in the image). The outlet also shared a poster in Farsi, Pashto, Tajik, English, Russian, Turkish, and Uzbek, titled “Warning, to Putin and all the Russian savages.” According to the text on the poster, the purpose of the attack at Crocus City Hall was to avenge the Islamic State for the blood and suffering of captives and thousands of believers, so that Russians remember this painful and bloody blow for a long time. The poster also said that videos of the torture of the detained ISKP members had increased the thirst of thousands of “brothers” for Russian blood.
Figures 3 & 4: (left) an image threatening attacks on Western countries; (right) poster titled “Warning, to Putin and all the Russian savages” threatening more attacks against Russia.
Responses from unofficial ISKP chats: celebrating the attack and tackling criticism
Following the attack, ISKP-affiliated Telegram groups shared footage of Russian security forces searching the residences of the Central Asian “immigrants” in Moscow, including dormitories. An Uzbek pro-ISKP Telegram channel shared footage of raids and arrests of “migrants” during car and house searches. The chat also issued a warning that advised “brothers” in Russia to clean and hide their phones where they would not be found, encouraging members and sympathisers to take security seriously. Other ISKP channels encouraged followers to shave their beards. It is worth noting that most of the Tajik and Uzbek ISKP channels on Telegram went dormant the day of the attack, or over the following days.
Figures 5 & 6: warning posts by ISKP chats about increased security measures, raids on the houses of “migrants”, and requesting members take security seriously.
Over the following days, several pro-ISKP Telegram channels picked up on Russian forces’ torture and misbehaviour towards the alleged attackers, during arrest and interrogation. A post from 26 March 2024 in a Pashto pro-ISKP Telegram channel claimed that Russian forces applied electric shocks to IS fighters’ genitals, and asked IS to take revenge.
Figure 7: A local pro-ISKP Telegram group in Pashto calls for revenge for the torture and misbehaving of Russian forces against ISKP detainees.
While ISKP and pro-ISKP communities hailed the attack on Crocus City Hall as one of the group’s deadliest attacks in recent years, ISKP Telegram channels have also been dealing with a number of criticisms from the wider Muslim community condemning and questioning the attack. In response, several ISKP channels posted counter-arguments.
A pro-ISKP channel, questioned Muslims’ condemnations of the attack, arguing that no Christian has said that Russian attacks on Muslims in Syria were harming Christianity; no Shia ever said Hezbollah, Iran, and Houthis’ actions earned Shiites a bad reputation; and no Jew sees Israel’s actions in Palestine as acting against Judaism. Despite this, the counter-argument claimed, those who consider themselves followers of Islam condemn ISKP’s actions, and claim that it is damaging the image of Islam.
Figure 8: screenshot taken from a pro-ISKP channel, denouncing Muslim critics of its recent attack in Moscow.
Another pro-ISKP channel responded to criticisms by the wider Muslim community by enumerating Russia’s anti-IS activities, including bombings of “women and children.” The channel also said that IS was the only group to act in retaliation for the killing of “innocent women and children.” A post added that Muslim critics were ignorant, and urged them to keep their criticisms to themselves.
Conclusion
Although ISKP did not claim responsibility for the attack, Al-Azaim, alongside several pro-ISKP Telegram channels, praised the attack. The only notable difference was that Al-Azaim called for further aggression, while the unofficial channels sought to provide security advice and challenge the criticisms received from the wider Muslim community.
ISKP has demonstrated increased efforts to commit attacks outside of its usual area of operations in Afghanistan, reaching as far as Russia. In recent months, AW has observed an increased focus by ISKP on Central Asia, Russia, and Europe. ISKP Telegram channels have discussed the recent increase in fires at Jewish-owned companies in Kazakhstan, Uzbekistan, and a foiled attack in Kyrgyzstan, as signs of the growing ISKP presence in the wider region. However, none of these incidents were officially claimed by ISKP.
Since the Crocus City Hall attack in Russia, IS(KP) supporting propaganda outlets have increased the production and distribution of posters threatening European cities and sports events, including the Allianz Arena in Munich; Emirates Stadium in London; the Santiago Bernabeu and Metropolitano Stadiums in Madrid; Parc des Princes Stadium in Paris; the United Nations; the 2024 Uefa Euro Football Championships in Germany; and the 2024 Summer Olympic Games in France. Simultaneously, (pro-) ISKP media has expanded their propaganda in Turkish, Uyghur, and Tajik languages, and started to use AI to create new propaganda.
The Moscow attack, as well as Al-Azaim’s call for additional attacks, demonstrate the increasing threat that ISKP poses. The positive reactions from the wider ISKP community (including both pro-ISKP and ISKP-affiliated channels) also show ISKP’s growing support, necessary for the group’s aimed growth in Afghanistan, Central Asia, and beyond.
Benjamin den Braber is Head of OSINT and Research at Afghan Witness and Eyes on Russia. He leads investigations into war crimes and the impact on civilian life in Ukraine, as well as research related to terrorism activities in South and Central Asia.
N. Faizi is an OSINT analyst who studied at the Defence Academy of the United Kingdom.
"Spotlight on Extremism” is a series of articles based on investigations our CIR analysts conducted into some of the extremist ideologies that are circulating online. The articles will cover multiple narratives, events and concepts related to the broader sphere of extremism with the aim of analysing the impact it has on societies and furthering an understanding of the concept.
1 One of the provinces of the Islamic State with activity in Afghanistan, Pakistan, Tajikistan, and Iran.
2 Al-Azaim is the main propaganda outlet for ISKP, and is considered a credible source for the group’s activities and intentions.
3 Social media groups that share Islamic content and reminders, often referencing the Hadith or Quran; general groups for people interested in Islam.
Comments