Dan Flanagan, Jayde Dorland Counter Threat Strategic Communication Team
Jennifer Loy, Chief Editor
April 4, 2024
Propaganda Network[1]
Introduction
On March 25, media organizations affiliated with the Islamic State Khorasan Province (ISIS-K) claimed responsibility for an attack on a Russian concert where over 130 were killed. The group claimed the attack was made to humiliate the Taliban-led Afghan government, destabilize its counter-terrorism efforts, and alarm Chinese and Russian investors.[2] US intelligence supports ISIS-K’s claims despite efforts Russian President Vladimir Putin’s claims tying Ukraine to the attack.[3] ISIS-K was formed in 2014 as the regional affiliate of the Islamic State of Iraq and Syria (ISIS). In 2018, membership was at its highest and has declined as Taliban and US forces dealt substantial losses to the group.[4] Months before the attack in Russia, ISIS-K released a series of anti-Russian propaganda where they condemned Russian intervention in Syria and the Taliban for diplomatic ties to Russia.[5] ISIS-K will almost certainly circulate images and videos of the attack to drive recruitment to the organization, propaganda will very likely focus on encouraging continued strikes against Russia. They will very likely justify actions against Russia through propaganda, likely accusing Russia of committing crimes against Muslim populations. ISIS-K will almost certainly continue its efforts to destabilize the Taliban government, very likely appealing to Afghanistan's population to rally behind their cause and reject foreign influences. ISIS-K will very likely adopt ISIS online propaganda tactics, utilizing social media platforms to gain ideological traction and facilitate radicalization.
Summary
ISIS-K was formed in 2014 by al-Qaeda, Tehrik-e-Taliban (TTP), and Afghan Taliban defectors and gained prominence in 2015 after ISIS experienced territorial losses in Iraq and Syria, causing the Islamic State to announce its formation of the Khorasan province and focus on Afghanistan as an ideal base to build a caliphate.[6] Sanaullah Ghafari, alias Shahab al-Muhajir, has maintained ISIS-K leadership since 2020. In June 2023, the Taliban allegedly targeted Ghafari in a counterterrorism intelligence operation. Despite statements from Afghanistan and Pakistan, they have released no corroborative evidence,[7] leading to the United Nations questioning the legitimacy of the claim.[8] A July 2023 report by the United Nations Security Council (UNSC) states that ISIS-K consists of 4,000 - 6,000 fighters and family members operating in Afghanistan. In 2021, the group was responsible for an attack on Afghanistan’s Hamid Karzai International Airport in Kabul, killing 13 American soldiers and 170 Afghan civilians. In January 2024, a twin suicide bombing killed nearly 100 during a memorial service for Qassem Soleimani in Iran.[9]
Following ISIS’ June 2014 offensive, both official and unofficial social media accounts promoted the group's military successes. In one instance, affiliates posted nearly 40,000 messages on Twitter in a single day after a series of skirmishes in Iraq.[10] The organization heavily relied on using popular social media platforms to distribute its propaganda, including Facebook, Twitter, Instagram, Ask.fm, and Tumblr, enabling the organization to amass at least 30,000 foreign fighters, of which 4,500 were from the West. Datasets spanning July 2014 to May 2015 found 75,946 pro-ISIS Twitter accounts, sharing some 4.5 million pro-ISIS tweets.[11]
At the global level, ISIS-K uses the internet, social media, and messaging apps extensively for recruitment. The group shares organizational updates on the Islamic State umbrella Amaq News Agency, which publishes in at least five languages,[12] and the ISIS-K-run al-Azaim Foundation, which publishes in Urdu, Hindi, Uzbek, Tajik, Bengali, Malayalam, Farsi, Russian, English,[13] Dari, Persian, Pashto, Uyghur, and Arabic. al-Azaim Foundation publishes books, videos, infographics, audio statements, and monthly magazines, namely the Pashto-language Khorasan Ghag and English-language Voice of Khorasan.[14] ISIS-K also owns Telegram, TikTok, Facebook, archive.org, and RocketChat channels, allowing audiences to view their messages in various languages.[15] ISIS-K recruits from frustrated members of the Taliban and conservative youth who oppose Taliban governance.[16] ISIS-K has also targeted its propaganda at madrassas, schools, and colleges to boost recruitment.[17] The creation of the Voice of Khorasan magazine sought to broaden ISIS-K’s influence beyond its original audiences, which alongside other propaganda tactics, has encouraged travelers from Tajikistan, Uzbekistan, Kazakhstan, Azerbaijan, Bangladesh, Iran, Iraq, India, China, Philippines, Maldives, Turkey, France, and Russia to join the organization.[18] ISIS-K's significant focus on Central Asia has encouraged the financing and planning of attacks, with at least ten Tajik suspects currently being held for the organization of the Crocus City Hall attack.[19]
Currently, sub-Saharan African nations are popular points of origin for ISIS propaganda, with 60 percent of organizational material coming from this region. ISIS-aligned groups in Nigeria, the Democratic Republic of Congo, and Mozambique are responsible for the most distribution of propaganda. The Coalition’s Communications Working Group is working to foster collaboration among these countries to counter ISIS propaganda.[20] In 2013, the Center for Strategic Counterterrorism Communications (CSCC) launched a campaign called “Think Again Turn Away” to target ISIS members.[21] One video featured Osama bin Laden watching videos in the compound where he was killed; the video ended with the message, “I want to remind you what happens to terrorists who target us.”[22] In January of 2023, a pro-Taliban media outlet, al-Mersaad, was launched to combat ISIS-K propaganda; the outlet is active on social media and has a website.[23] Al-Mersaad published books, essays, and other writings to disrupt ISIS-K and is available in Arabic, Dari, English, and Pashto.[24] Al-Mersaad released an audio clip supposedly from Shahab al-Muhajir, claiming the group has suffered heavy losses, including the deaths of important members. Independent verifiers are unable to corroborate the claim and ISIS-K has yet to comment. Abdul Sayed, a jihadist researcher, noted discrepancies in the dialect used by al-Muhajir while confirming instances of Taliban efforts against ISIS-K.[25]
ISIS-K has capitalized on Afghanistan’s instability to insert itself on the global stage. One of its methods includes an individual, Sulaiman Dawood al-Kanadi, who claims to be in Canada and writes for the Voice of Khorasan magazine. During the summer of 2023, al-Kanadie wrote several pieces where he criticized Muslim men living in Western nations for adopting their lifestyles while participating in fundraisers for “Free Syria” or “Free Palestine” and not taking up arms.[26]
Analysis
Reports of an ISIS-K propagandist residing in Canada almost certainly assert the organization's objective to broaden its propaganda reach to English-speaking audiences. ISIS-K propaganda strategists very likely review the perceived previous successes of ISIS’ influence operations and the resulting influx of organizational recruitment to inform its actions. ISIS-K will very likely seek to encourage the radicalization of Muslims in Western countries to increase recruitment and create a transnational network of adherents willing to organize, fund, and orchestrate attacks, heightening the organization's prominence and ability to spread fear. Propaganda targeting Western nations will almost certainly exploit upcoming elections, attempting to instill government-directed distrust in citizens. Narratives will very likely capitalize on the Israel-Hamas conflict, focusing on Palestinian victimization to bolster arguments for the oppression of Muslims, depending on frequent global coverage of Gaza to reinforce campaigns. ISIS-K propagandists will very likely encourage radicalized individuals to remain in Western countries, mobilizing them to maintain propaganda efforts or prepare for attacks in the West. ISIS-K will likely suggest travel to organization-held territories for training purposes but is unlikely to encourage mass migration of adherents unless there is growth in its strongholds.
Social media platforms frequently used internationally, particularly in the West, will almost certainly see an increase in ISIS-K-related media, very likely due to the low cost and ease of sharing content through this medium. ISIS-K propagandists will almost certainly create many accounts to share media and encourage its adherents to do the same, very likely to ensure the mass distribution of content and challenge moderators’ ability to remove all related posts. Propagandists will almost certainly use modification techniques on visual content, such as images and videos, and utilize their multi-language approach in written posts to evade detection from artificial moderators, requiring human teams to increase their vigilance and knowledge of evasion techniques. To bolster campaigns, propagandists will likely seek to create trending hashtags that will gain traction on platforms, relying on user interest to repurpose hashtags and increase the visibility of posts. ISIS-K will very likely depend on the various avenues to inject their messaging onto social media to encourage self-radicalization among audiences. Once ISIS-K has successfully radicalized individuals, it will very likely encourage new adherents to transfer their conversations to decentralized and less popular media platforms to ensure the continuation of organization-related conversations without disruption. These sites’ lack of security protocols, community guidelines, and use of encryption almost certainly increases their desirability for use by terrorist networks, strengthening communication and planning between members.
ISIS-K will almost certainly continue to expand the availability of propaganda networks in other languages, very likely increasing publications available in the Uyghur language. The organization will likely attempt to gain influence over the Uyghur population in Xinjiang, encouraging members to carry out coordinated attacks against Chinese authorities. ISIS-K will very likely identify Chinese-operated facilities in Afghanistan and other nations, such as Pakistan, deploying cells or working with other Islamic extremist groups to coordinate attacks. China will almost certainly increase security measures to protect facilities and personnel. They will very likely attempt to counter ISIS-K propaganda networks by infiltrating social media, blocking channels, and forming counter-propaganda channels. There is a roughly even chance China will attempt to dismantle ISIS-K propaganda networks through cyber operations, very likely deploying backdoor attacks to gain unauthorized access and hijack ISIS-K websites and media channels, disrupting propaganda capabilities.
Russia will very likely attempt to replicate US strategies to counter ISIS-K propaganda, likely producing content for the Taliban to distribute on their media outlets. There is a roughly even chance they will incorporate images and videos of the Crocus City Hall attack suspects and the injuries they have sustained during detainment, likely encouraging current members to cease activities. ISIS-K will very likely retaliate to Russian propaganda using images and videos of prisoners, almost certainly characterizing Russia as an oppressive regime that discriminates against Muslims. ISIS-K propagandists will very likely exploit such narratives for its benefit, using Russia’s brutality on the imprisoned as justification for its attack and reinforcing ideological themes of Muslim oppression. They will likely encourage Muslim populations in Chechnya and Dagestan to target Russian security forces, very likely attempting to execute a severe Russian response to embolden sympathetic groups.
The Taliban will almost certainly encourage the expansion of al-Mersaad and other pro-Taliban media outlets and platforms for content generation. They will very likely diversify content production beyond written publications, likely experimenting with audio, photo, and video manipulation to further propaganda campaigns against ISIS-K. The Taliban will likely examine the results of new propaganda campaigns, very likely identifying which are most effective in containing ISIS-K and increasing Taliban membership. The group will very likely make contact with Afghan youth and Central Asian minorities present in Afghanistan, such as Tajiks, likely attempting to exert influence on populations and crippling ISIS-K recruitment efforts. Propaganda efforts will almost certainly convey the Taliban’s superiority and successful military operations against ISIS-K; they will very likely call individuals living in ISIS-K-controlled regions to attack members and provide information to the Taliban.
Recommendations
Recent ISIS-K activities and the identification of organizational propagandists in the West indicate the group's objective of creating a global network of adherents willing to radicalize individuals, and plan, fund, and orchestrate attacks to achieve its organizational goals. ISIS-K is very likely using the former propaganda plan adopted by ISIS to increase organizational support and membership, using online spaces and social media to distribute pro-organizational content and text and media that reinforce its ideology. To broaden its influence over the Central Asia region, ISIS-K will very likely focus on topical issues related to the oppression of Muslim communities, such as China’s arbitrary detention of the Uyghur population, to initiate anti-government sentiments and mobilize recruitment.
The Counterterrorism Group (CTG) recommends social media users be vigilant of the content they are viewing online. Users should flag and report any suspicious material to alert platforms of policy-infringing content. CTG recommends users not engage with these posts as likes, shares, and comments inform the platform’s algorithm that such content will generate user interaction and distribute them to further audiences. CTG also recommends users avoid using trending hashtags If they believe it may reinforce the distribution of terrorist-related content. CTG recommends mainstream social media platforms reinforce their community guidelines and content moderation tools to counter the spread of terrorist propaganda online. Platforms should seek to refine their automated tools to boost effectiveness by adjusting their parameters to ensure tools are adapting alongside propaganda content trends. CTG recommends platforms initiate content-specific teams, who are aware of ISIS-K’s ideology, motivations, and tactics to bolster efforts and harden their approach to removing infringing terrorist content from their sites. Teams should comprise multi-language personnel, with a specific focus on the known languages ISIS-K distributes content in, to ensure there is no oversight of non-English language material. CTG also recommends social media platforms invest in updating their automated tools to moderate non-English content. CTG recommends the developers of less popular social media messengers and platforms reform their security features, community guidelines, and policies to mitigate their exploitation from threat actors. CTG recommends these platforms refine their procedures to challenge threat actors wishing to use their sites, including instating verification processes for new accounts, implementing content moderation tactics, and complying with takedown requests when initiated by users or third parties.
CTG recommends Western nations identify and share intelligence concerning high-profile persons who share ISIS-K propaganda. Agencies should reaffirm what constitutes speech freedoms and create clear guidelines for officers to follow so they do not revoke citizens of their rights. CTG recommends government officials work with social media platforms to refine what content is acceptable. They should share best practices in combating negative content alongside ongoing trends and evolving tactics used to disguise propaganda. CTG recommends China and Russia undergo a comprehensive threat analysis of personnel and facilities in Afghanistan and nations where ISIS-K is active. They should identify and update potential vulnerabilities to ensure the safety of regional interests. CTG recommends that China and Russia monitor ISIS-K activities on social media platforms and identify accounts representing imminent threats.
[1] Social media, generated by a third party database
[2] What is ISIS-K, the terror group allegedly responsible for the Moscow concert hall attack?, Politico, March 2024, https://www.politico.eu/article/islamic-isis-khorasan-concert-hall-attack-russia-terrorist/
[3] White House: Putin linking Ukraine to Moscow attack ‘nonsense,’ ‘propaganda’, The Hill, March 2024, https://thehill.com/homenews/administration/4561602-white-house-putin-linking-ukraine-to-moscow-attack-nonsense-propaganda/
[4] What is ISIS-K and why would it attack a Moscow concert hall?, Reuters, March 2024, https://www.reuters.com/world/europe/why-did-isis-k-attack-moscow-theater-2024-03-23/
[5] ISIS-K, Group Tied to Moscow Attack, Has Grown Bolder and More Violent, New York Times, March 2024, https://www.nytimes.com/2024/03/24/world/europe/isis-k-moscow-attack.html
[6] Examining Extremism: Islamic State Khorasan Province (ISKP), Center for Strategic and International Studies, September 2021, https://www.csis.org/blogs/examining-extremism/examining-extremism-islamic-state-khorasan-province-iskp
[7] IS-K Leader in Afghanistan Reported Dead, Voice of America, June 2023, https://www.voanews.com/a/is-k-leader-in-afghanistan-reported-dead-/7130444.html
[8] “Seventeenth report of the Secretary-General on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat,” United Nations Security Council, 2023, https://www.securitycouncilreport.org/atf/cf/%7B65BFCF9B-6D27-4E9C-8CD3-CF6E4FF96FF9%7D/N2321007%20(1).pdf
[9] What is ISIS-K, the terror group linked to the Moscow concert hall bombing?, NBC News, March 2024, https://www.nbcnews.com/news/world/isis-k-terror-group-linked-moscow-concert-hall-bombing-rcna144952
[10] How Isis is spreading its message online, BBC, June 2014, https://www.bbc.com/news/world-middle-east-27912569
[11] “Examining ISIS Support and Opposition Networks on Twitter.” RAND Corporation, 2016, https://www.rand.org/pubs/research_reports/RR1328.html
[12] What is ISIS-K, the terror group allegedly responsible for the Moscow concert hall attack?, Politico, March 2024, https://www.politico.eu/article/islamic-isis-khorasan-concert-hall-attack-russia-terrorist/
[13] “The Enduring Duel: Islamic State Khorasan’s Survival under Afghanistan’s New Rulers,” CTC Sentinel, 2023, https://ctc.westpoint.edu/wp-content/uploads/2023/08/CTC-SENTINEL-082023.pdf
[14] ISKP Flexes Its Propaganda Muscles on Social Media, The Diplomat, January 2023, https://thediplomat.com/2023/01/iskp-flexes-its-propaganda-muscles-on-social-media/
[15] Media Jihad: Islamic State's Resurgent Propaganda Network, Tech Against Terrorism, March 2024, https://podcast.techagainstterrorism.org/1684819/14777447-media-jihad-islamic-state-s-resurgent-propaganda-network?t=0
[16] What is ISIS-K, the terror group allegedly responsible for the Moscow concert hall attack?, Politico, March 2024, https://www.politico.eu/article/islamic-isis-khorasan-concert-hall-attack-russia-terrorist/
[17] ISKP Flexes Its Propaganda Muscles on Social Media, The Diplomat, January 2023, https://thediplomat.com/2023/01/iskp-flexes-its-propaganda-muscles-on-social-media/
[18] “The Enduring Duel: Islamic State Khorasan’s Survival under Afghanistan’s New Rulers,” CTC Sentinel, 2023, https://ctc.westpoint.edu/wp-content/uploads/2023/08/CTC-SENTINEL-082023.pdf
[19] Russia arrests four more suspects linked to deadly Moscow concert hall attack, France24, April 2024, https://www.france24.com/en/europe/20240401-russia-arrests-four-more-suspects-linked-to-deadly-moscow-concert-hall-attack
[20] The Islamic State Five Years Later: Persistent Threats, U.S. Options, U.S. Department of State, March 2024, https://www.state.gov/the-islamic-state-five-years-later-persistent-threats-u-s-options/
[21] In a propaganda war against ISIS, the U.S. tried to play by the enemy’s rules, The Washington Post, May 2015, https://www.washingtonpost.com/world/national-security/in-a-propaganda-war-us-tried-to-play-by-the-enemys-rules/2015/05/08/6eb6b732-e52f-11e4-81ea-0649268f729e_story.html
[22] In a propaganda war against ISIS, the U.S. tried to play by the enemy’s rules, The Washington Post, May 2015, https://www.washingtonpost.com/world/national-security/in-a-propaganda-war-us-tried-to-play-by-the-enemys-rules/2015/05/08/6eb6b732-e52f-11e4-81ea-0649268f729e_story.html
[23] Analysis: IS struggles in Afghanistan on second anniversary of Taliban return, BBC Monitoring, August 2023, https://monitoring.bbc.co.uk/product/c204i5jh
[24] Has Afghanistan Turned into a Sanctuary for Jihadist Groups?, The Diplomat, September 2023, https://thediplomat.com/2023/09/has-afghanistan-turned-into-a-sanctuary-for-jihadist-groups/
[25] IS-Khorasan Leader in Alleged Audio Message Discusses Afghanistan Losses, Voice of America, April 2023, https://www.voanews.com/a/is-khorasan-leader-in-alleged-audio-message-discusses-afghanistan-losses-/7034359.html
[26] Mysterious writer behind ISIS-K propaganda calls himself 'the Canadian', CBC News, March 2024, https://www.cbc.ca/amp/1.7157370