WASHINGTON – Five years ago in March, a US-backed Kurdish and Arab militia ousted ISIS group fighters from a village in eastern Syria, the group’s last sliver of territory.

Since then, the Islamic State in Iraq and Syria organisation that once staked out a self-proclaimed caliphate across Iraq and Syria has metastasised into a more traditional terrorist group – a clandestine network of cells from West Africa to South-east Asia engaged in guerrilla attacks, bombings and targeted assassinations.

None of the group’s affiliates has been as relentless as the Islamic State in Iraq and Syria-Khorasan, or ISIS-K, which is active in Afghanistan, Pakistan and Iran and has set its sights on attacking Europe and beyond.

According to officials from the United States, it was ISIS-K that carried out the attack near Moscow on March 22, killing scores of people and wounding many others.

In January, ISIS-K carried out twin bombings in Iran that killed scores and wounded hundreds of others at a memorial service for the country’s former top general Qassem Soleimani, who was targeted in a US drone strike four years earlier.

“The threat from ISIS remains a significant counterterrorism concern,” Ms Avril Haines, US director of national intelligence, told a Senate panel in March.

Most attacks “globally taken on by ISIS have actually occurred by parts of ISIS that are outside of Afghanistan”, she said.

General Michael Kurilla, head of the US military’s Central Command, told a House committee on March 21 that ISIS-K “retains the capability and the will to attack US and Western interests abroad in as little as six months with little to no warning”.

US counterterrorism specialists on March 24 dismissed Russia’s suggestion that Ukraine was behind the March 22 attack near Moscow.

“The modus operandi was classic ISIS,” said Professor Bruce Hoffman, a terrorism scholar at the Council on Foreign Relations.

The assault marked the third concert venue in the Northern Hemisphere that the ISIS group has struck in the past decade, Prof Hoffman said, after an attack on the Bataclan theatre in Paris in November 2015 (as part of a broader operation that struck other targets in the French city) and a suicide bombing at an Ariana Grande concert in England’s Manchester Arena in May 2017.

ISIS-K, founded in 2015 by disaffected members of the Pakistani Taliban, burst onto the international militant scene after the Taliban toppled the Afghan government in 2021.

During the US military withdrawal from the country, ISIS-K carried out a suicide bombing at the international airport in Kabul in August 2021 that killed 13 US service members and as many as 170 civilians.

Since then, the Taliban has been fighting ISIS-K in Afghanistan. So far, the Taliban’s security services have prevented the group from seizing territory or recruiting large numbers of former Taliban fighters, according to US counterterrorism officials.

But the upward arc and scope of ISIS-K’s attacks have increased in recent years, with cross-border strikes into Pakistan and a growing number of plots in Europe. Most of those European plots were thwarted, prompting Western intelligence assessments that the group might have reached the lethal limits of its capabilities.

Last July, Germany and the Netherlands coordinated arrests targeting seven Tajik, Turkmen and Kyrgyz individuals linked to an ISIS-K network who were suspected of plotting attacks in Germany.

Three men were arrested in the German state of North Rhine-Westphalia over alleged plans to attack the Cologne Cathedral on New Year’s Eve in 2023. The raids were linked to three other arrests in Austria and one in Germany on Dec 24. The four people were reportedly acting in support of ISIS-K.

US and other Western counterterrorism officials say these plots were organised by low-level operatives who were detected and thwarted relatively quickly.

“Thus far, ISIS-K has relied primarily on inexperienced operatives in Europe to try to advance attacks in its name,” Ms Christine Abizaid, head of the US National Counterterrorism Centre, told a House committee in November.

But there are worrisome signs that ISIS-K is learning from its mistakes.

In January, masked assailants attacked a Roman Catholic church in Istanbul, killing one person. Shortly afterwards, the ISIS group, through its official Amaq News Agency, claimed responsibility. Turkish law enforcement forces detained 47 people, most of them Central Asian nationals.

Since then, Turkish security forces have launched mass counter-operations against ISIS group suspects in Turkey, Syria and Iraq.

Several European investigations shed light on the global and interconnected nature of ISIS group finances, according to a United Nations report in January, which identified Turkey as a logistical hub for ISIS-K operations in Europe.

The Moscow and Iran attacks demonstrated more sophistication, counterterrorism officials said, suggesting a greater level of planning and an ability to tap local extremist networks.

“ISIS-K has been fixated on Russia for the past two years”, frequently criticising President Vladimir Putin in its propaganda, said Dr Colin Clarke, a counterterrorism analyst at the Soufan Group, a security consulting firm based in New York.

“ISIS-K accuses the Kremlin of having Muslim blood on its hands, referencing Moscow’s interventions in Afghanistan, Chechnya and Syria.”

The Russian authorities on March 23 announced the arrest of several suspects over the March 22 attack.

But senior US officials said on March 24 that they were still digging into the background of the assailants and trying to determine whether they were deployed from South or Central Asia for this specific attack, or if they were already in the country as part of the network of supporters that ISIS-K then engaged and encouraged.

One major event this summer has many counterterrorism officials on edge.

“I worry about the Paris Olympics,” said former top UN counterterrorism official Edmund Fitton-Brown, who is now a senior adviser to the Counter Extremism Project. “They would be a premium terrorist target.”

French Prime Minister Gabriel Attal said on March 24 that the country was raising its security alert to the highest level after the Moscow concert hall attack. NYTIMES, AFP