ISKP shifts focus to northern Afghanistan

ISKP attacks and Taliban counter-operations intensify in the north.

In 2025, Islamic State Khorasan Province (ISKP) claimed responsibility for six attacks in Afghanistan, five of which took place in the north, and one in Kabul.

• On 7 January 2025, ISKP claimed responsibility for a firearms attack in Baghlan-e Markazi district, Baghlan province, targeting two alleged pro-Taliban religious scholars, resulting in one fatality and one injury.
• On 17 January 2025, ISKP reportedly ambushed and killed Taliban member Hafiz Ahmad Javid Seerat in Nahrin district, Baghlan province, as he was returning home from duty. The group also allegedly seized his weapon.
• On 21 January 2025, ISKP claimed responsibility for the assassination of a Chinese national, referred to as “Lee”, working in Afghanistan’s mining sector in Takhar province.
• On 25 January 2025, ISKP claimed responsibility for killing an alleged pro-Taliban local elder in Pul-e Khumri city, Baghlan province.
• On 11 February 2025, a person-borne improvised explosive device (PBIED) attacker targeted customers outside of the provincial branch of the state-run Kabul Bank in Kunduz province, primarily Taliban members waiting to collect their salaries. According to the Taliban, the attack killed five people and injured seven others. ISKP later claimed responsibility for the attack.

Comparatively, AW data shows that in 2024, only two out of the 25 attacks in Afghanistan occurred in the country’s north.

To counter ISKP activities, the Taliban launched three operations against the group in northern Afghanistan in 2025.

• On 21 January 2025, Taliban arrested six alleged ISKP members in Sar-e Pul province, with the provincial police spokesman claiming that the individuals were linked to multiple attacks. The Taliban also released the alleged video confessions of two suspects.
• On 5 February 2025, Taliban-affiliated Al-Mersaad Media reported that the Taliban conducted a three-day coordinated operation across four northern provinces—Badakhshan, Takhar, Baghlan, and Samangan—resulting in the arrest of an unspecified number of alleged ISKP members. The Al-Mersaad report claimed that the arrested individuals were part of a network responsible for multiple attacks in northern provinces, including the killing of a Chinese national in Takhar.
• On 25 February 2025, Al-Mersaad Media reported on a Taliban special operation in Baghlan province, which allegedly resulted in the death of several ISKP members, including one believed to be responsible for the assassination of a Taliban member in the province on 17 January 2025. The report also stated that the confiscated weapon of the assassinated Taliban member was recovered from the killed ISKP militants.

This trend indicates a shift in ISKP focus towards activity in northern Afghanistan, with the Taliban likewise intensifying its counter-ISKP operations in the same region. While the exact reason behind ISKP’s shift in operations to the north remains unclear, several factors, including the possible existence of a specific ISKP network in the region, could be involved.

After losing its last territorial stronghold in eastern Afghanistan in 2019, ISKP shifted towards a decentralised strategy, operating through scattered networks which have the capacity to carry out attacks while decreasing the risk of detection, by each network operating in a specific area. For example, between January and August 2024, ISKP claimed responsibility for three attacks on minibuses carrying Hazara civilians in Dasht-e Barchi area of western Kabul. Between May and October 2024, ISKP claimed two attacks in Ghor province, one on the border between Daykundi and Ghor, and one in Bamyan. However, on 20 October 2024, the Taliban spokesperson made an announcement in which they alleged that the ISKP network behind the attacks in Ghor had been eliminated. No further attacks have been claimed in the region since.

Remarks

The recent increase in ISKP attacks in northern Afghanistan may be linked to the activity of a specific ISKP network rather than a broader strategic shift. In response, the Taliban has intensified counter-operations in the region, targeting suspected ISKP members. As the situation unfolds, it remains to be seen whether this trend of activity in the north of the country will continue.