The Islamic State — the notorious group known for building a brutal regime in Iraq and Syria — has claimed responsibility for Friday’s terror attack at a Moscow concert venue that killed at least 139 people.

ISIS released graphic footage via its media apparatus, claiming that it was their gunmen who left more than 100 people injured at the Crocus City concert hall. And it likely is the case, despite Russia’s attempts to tie the incident to Ukraine. US intelligence officials linked the terror group’s outpost in the historical Khorasan region — which encompasses parts of Afghanistan, Iran, Pakistan, Turkmenistan, Tajikistan, and Uzbekistan — to the attack. Russian President Vladimir Putin acknowledged that Islamic radicals perpetrated the attack, but the Kremlin has still tried to link Ukraine to the incident.

“We know by whose hand the crime against Russia and its people was committed. But what is of interest to us is who ordered it,” Putin said in a video address Monday.

ISIS has always been somewhat rhizomatic, with offshoots connected to the main entity in Iraq and Syria.

For years, ISIS welcomed the emergence of affiliate groups that might have more local or regional goals, like ISIS-K and ISIS-West Africa, as long as they pledged allegiance to the caliphate ISIS had declared. But after ISIS suffered a major territorial defeat in Iraq and Syria five years ago, ISIS-K has since solidified its distinct political grievances, which center around its battle for power with the Taliban in Afghanistan. And because of its location in a fairly lawless region, the group can recruit and train without significant interference.

For ISIS-K and the larger group, attacking Russia is a logical outgrowth of ISIS’s territorial defeat, since Russia supports the Assad regime in Syria and helped it regain control of the land ISIS briefly held. ISIS-K also has grievances with Russia because of its 1979–1989 war in Afghanistan, as well as Russia’s slaughter of Chechen Muslims in its war there.

While it seems like ISIS-K holds some degree of responsibility, just how much the organization was involved in Friday’s attack is a lot less clear, according to Riccardo Valle, the director of research at the Khorasan Diary, which provides analysis on non-state and militant actors in the region.

“There are several hints, some stronger, some weaker, that could suggest the involvement of the Islamic State of Khorasan branch in the implementation of the attack,” Valle told Vox, “from providing financial support or logistic support, operational support, or could be also more limited involvement,” like using its Russian- and Tajik-language propaganda to encourage local ISIS cells in Russia to attack.

There’s a lot of noise around ISIS-K, and whether the Moscow attack means ISIS is “back” — meaning it has the ability to carry out attacks in Western countries and hold territory the way it did a decade ago. While it’s difficult to say what ISIS-K or the core group might do next, recent events show that the threat of extremism isn’t gone.

What we know about ISIS and its affiliates now

ISIS is an extremist group that follows a fundamentalist version of Sunni Islam and grew out of Al Qaeda’s Iraqi affiliate following the US invasion there in 2003. It gained prominence, though, in 2014 when it captured large swaths of Iraq and Syria. That was central to the group’s primary goal: to establish a global caliphate — traditionally understood as an Islamic political and religious state like the one that existed following the death of the prophet Muhammad, but which ISIS interpreted in a much more violent and repressive manner, especially when it came to women and religious minorities.

The nature of ISIS has always been somewhat diffuse; it has historically claimed attacks or groups, like a splinter faction of Boko Haram in northwestern Africa, often referred to as ISWAP, that pledges its allegiance to the broader organization, even encouraging lone wolf actors to increase its reach.

“It’s much more about ‘taking the fight to our enemies,’ rather than focused on particularly the nuances of Islamic theology,” Daniel Byman, senior fellow with the Transnational Threats Project at the Center for Strategic and International Studies, told Vox.

And that broad ideology incorporates political motivations as well as religious ones. So although according to ISIS, the US, Israel, Europe, Iran, and Russia are all “idolators,” or enemies based on religious affiliation, they’re also political adversaries. In other words, ISIS is predominantly interested in creating that global caliphate over which it maintains territorial, ideological, and political control.

Enter: ISIS-K.

The group was founded in 2014 or 2015 (around the same time as the core ISIS group rose to prominence) as something of an offshoot of the original group. It was also founded in opposition to the Taliban and made the case for a global caliphate, not a national emirate like the Taliban wanted — particularly, the control of the entire Khorasan region.

The historical Khorasan region is important to Islam, and particularly Islamic jihadist and messianic tradition, because of a teaching attributed to the Prophet Muhammad, which claims that Muslims will fight non-believers in the region at the end of the world.

ISIS-K has been fighting the Taliban since 2015 — a tension that really ramped up following the fall of Afghanistan’s elected government in August 2021 after the US withdrew.

It has repeatedly attacked ethnic Hazara in Afghanistan under the Taliban regime — both as a repudiation of the minority group’s Shia ideology, but also to prove the Taliban’s poor handle on security in the country and its lack of willingness to protect minorities. The Taliban is also, according to ISIS-K, “just the natural successors to the Afghan Islamic Republic, and hence they are basically [allies] of all regional countries and of the United States [who are] all united to fight the Islamic State in Afghanistan and globally,” Valle said.

But, again, given the group’s global focus, their conflict doesn’t stop with the Taliban.

Russia became another natural target, for example. That’s in part because the core ISIS group sees the country as responsible for its destruction, due to Russia and Iran’s role in propping up the Assad regime in Syria, especially as it regained control of ISIS’s former caliphate. (It doesn’t help that both the Assad regime and Iranian government are Shia.)

How to understand the ISIS threat now

What is clear, according to the experts Vox spoke to, is that ISIS is still well coordinated and capable of causing harm across the region.

Take the latest attack in Russia, which was pulled off in Moscow amid a war:

“All that points to some significant training,” said Colin Clarke, an analyst at the Soufan Center. “This wasn’t an example of an incident where some [random] radicalized Central Asians living in Russia were sitting around on their phones, imbibing ISIS propaganda, and they decided to launch an attack of their own.”

We don’t know exactly what the directives for last Friday’s attack might have looked like or how much the core group is instructing affiliates — so we might never know the breakdown of how exactly it happened. Russia has released photos of the alleged attackers, but the exact order of operations and planning is unlikely to come out any time soon, both because of the nature of Russian propaganda and the groups themselves.

More broadly: It’s difficult to tell how connected ISIS-K and other affiliates are to the core ISIS group, and to what extent the affiliates take direction from the core and coordinate with each other to carry out attacks.

“These groups are basically fluid, they are not armies, they are not states,” Valle said. “So they move in a fluid manner. So we cannot [distinguish] from one to the other so sharply; sometimes people work with different entities and networks.”

But in Afghanistan and parts of Pakistan where ISIS-K trains and operates, there’s very little ability for the Taliban — let alone the international community — to monitor or threaten the group.

“Afghanistan has been a free-for-all” since the US withdrawal in 2021, Clarke said. “The US probably still has decent signals intelligence … but probably almost no human intelligence. And that’s gonna lead to some blind spots naturally. And so I think we don’t know a lot about what’s been going on in Afghanistan, clearly.”

Though Western intelligence services adapted to the ISIS threat in the mid-2010s, Clarke noted that the world’s attention had turned away from those kinds of terror threats. “Now, it’s all about great power competition, China, artificial intelligence, all these other things,” he said. “There’s a certain sense of terrorism fatigue, after 20 years of the global war on terrorism, people don’t want to think about it. They don’t want to talk about it. They don’t want to prepare for it.”

But ISIS, and ISIS-K in particular, haven’t stopped training and planning just because the Western world stopped paying attention. The group’s bold and well-coordinated attack in Moscow, as well as the ISIS-K attack in Iran in January, indicate that at least some affiliates possess the capabilities, funding, and motivation to inflict significant casualties and serious damage on their perceived enemies.

And though the threat is diminished compared to the height of ISIS’s power in the mid-2010s, the overall terror threat is “in absolute terms, I would say it’s pretty high,” Valle said. Specifically, there is “risk that something similar or to a lesser extent — still dangerous — can happen also in Europe, and this is because in the last months of 2023 and the first months of 2024, several cells and local networks of militants were dismantled in Europe, in Austria, Germany, Netherlands, and the UK.”

Indeed, both Italian and French authorities ramped up security following the attacks in Moscow. Both countries have major cultural events upcoming — Holy Week celebrations in Italy and the Summer Olympics in Paris. ISIS-K has a pattern of attacking large cultural events, including mosques during prayers in Afghanistan and a memorial service for assassinated Quds Force commander Qassem Soleimani in Iran earlier this year.

But it’s important to note that European counterterror services are much more capable of detecting these kinds of threats than they were a decade ago. And US intelligence knew about the Iran and Moscow attacks before they happened, warning both countries of the threats.

None of that is to say that a terror attack on a Western country is impossible, but the US and Europe are better equipped for one than a decade ago.