Moscow attack likely involved more than 1 Isis branch, Russia in its 'crosshairs' for a long time

More than one branch of the terrorist group Islamic State (Isis) may have perpetrated the murderous attack on Moscow's Crocus City concert hall based on circumstantial evidence, according to security analysts.

The claim of responsibility by Isis should be taken at face value because it was issued through the group's usually reliable official media wing, they said.

"There is no question as to the authenticity of the statement, only as to how direct the connection is between Isis leaders and the actual assailants," said Evan Kohlmann, a New York-based terrorism analyst and CEO of Cloudburst, a cyber intelligence consultancy.

Do you have questions about the biggest topics and trends from around the world? Get the answers with SCMP Knowledge, our new platform of curated content with explainers, FAQs, analyses and infographics brought to you by our award-winning team.

Isis has previously claimed responsibility "for a handful of terrorist attacks by individuals who were clearly inspired by it specifically, but for whom there is not always clear evidence of a command-and-control relationship", Kohlmann said.

Russia has launched investigations into the attack in Moscow. Its FSB security service is pointing the finger at Ukraine's involvement, saying "all four terrorists" among 11 suspects behind the attack had contacts in Ukraine and were heading to the Ukrainian border when they were arrested. A spokesman for Kyiv's military spy agency dismissed claims of Ukrainian involvement, saying they "have nothing in common with reality".

Despite being defeated in Iraq and Syria by a US-led global coalition in 2019 and losing all the territory that comprised the so-called caliphate it established there in 2013, Isis remains a serious threat to global security.

Isis "rarely claims attacks it doesn't carry out", said Michael Kugelman, director of the South Asia Institute of the Wilson Centre, a Washington think tank.

"It's one of the only global terror groups with the capacity to pull off a sophisticated attack like this. And the group has had Russia in its crosshairs for a long time," Kugelman said.

In addition to the longstanding Russian military campaign in Syria targeting Isis with "everything from cruise missiles to ground troops", there have also been recent battles between Russian Wagner Group mercenaries and locally-based Isis militants in the Sahel region of Africa, Kohlmann observed.

The Sahel includes Burkina Faso, Cameroon, Chad, The Gambia, Guinea, Mauritania, Mali, Niger, Nigeria and Senegal.

Isis also has a track record of sending small squads of gunmen to massacre people gathering in large numbers in venues like concert halls, starting with the Paris terrorist attacks in November 2015.

Kugelman said the tactic of targeting crowded soft-target public spaces - in contrast to suicide bombings - was "patented" by Pakistani Lashkar-i-Taiba terrorists trained by al-Qaeda to carry out the Mumbai terrorist attacks in November 2008.

"One of the most haunting images" of the Mumbai attacks was the grainy footage of a heavily armed militant "walking slowly around and opening fire on cowering crowds of people", Kugelman said.

"We've seen the model applied many times since then" such as in Paris in 2015 and Brussels in 2016, he said.

But it is unclear for now which branch or branches of the Isis global network carried out the attack in Moscow because the terrorist group failed to identify the perpetrators in the claim issued through its Amaq News Agency.

Circumstantial evidence, however, points to Isis affiliates based in southern Russia and Afghanistan, respectively called Isis-Caucasia (Isis-C), and Isis-Khurasan (Isis-K), the analysts said.

Encrypted networks associated with Isis-C were activated when the attack began in Moscow on Friday, according to Iftikhar Firdous, editor of The Khurasan Dairy, an Islamabad-based security news and analysis platform.

The visuals shared by the attackers on Isis-C networks showed "three attackers directly shooting people in a hall", he said.

Kohlmann noted that Isis "drew a significant number of recruits" from Russia's South Caucasus region and Central Asian regions as well as various former Soviet republics in Central Asia, during the heyday of its erstwhile caliphate.

"Some were veterans of past conflicts" with the Russian government in the Muslim-majority republics of Chechnya and Dagestan, he said.

Russia's FSB security agency said it had killed at least six Isis-affiliated militants during clashes in Russia's adjacent southern Ingushetia region on March 2.

In a separate operation, the FSB said it eliminated a cell of Afghanistan-based Isis-k operatives on March 7 that was planning to shoot worshippers at a Moscow synagogue.

The tactics employed by the Moscow attackers, the March 7 bust, and an American warning earlier this month that Isis was planning an imminent terrorist attack potentially targeting a large public gathering in Moscow were three pointers which "strengthen the impression that this was an Isis attack", said Abdul Basit a senior research associate of the S. Rajaratnam School of International Studies at Singapore's Nanyang Technological University.

"Speculatively, the experts are saying" Isis-C is the "main perpetrator" but that it received "some help" from Isis-K, Basit said. From the interception of an Isis-K cell near Moscow on March 7, the affiliate appeared to have established a presence in the city, he added.

This may have prompted the group's operatives to wait for two weeks until the situation had calmed down, allowing them to "activate plan B", Basit said.

Isis-K's plots indicate that it is the "biggest global threat today" among Isis affiliates, the Washington Institute for Near East Policy said in a report published on Thursday.

Over the last 12 months, the Afghan affiliate spearheaded external operations, plotting 21 attacks in nine countries - far more than in each of the previous years stretching back to 2018, the institute noted.

Afghanistan-based operatives from Tajikistan have become "key nodes in Isis-K's terrorist nexus", having been involved in six of the attacks, it said.

But Isis poses nowhere the level of threat that it did when it had 20,000 fighters, controlled territory in Iraq and Syria roughly equivalent to the size of the UK and generated revenues of several hundred million dollars a year.

Isis has "suffered cascading leadership losses" in Iraq and Syria but its regional affiliates will "continue to expand" nonetheless, according to the annual US intelligence assessment published on March 11.

This threat was "mostly likely to manifest in small cells or individuals" inspired by violent extremist ideologies to conduct attacks," the US Office of the Director of National Intelligence warned.

Additional reporting by Reuters

This article originally appeared on the South China Morning Post (SCMP).

Copyright (c) 2024. South China Morning Post Publishers Ltd. All rights reserved.