On June 18, 2026, Europol announced one of its most significant recent counterterrorism operations targeting Islamic State Khorasan Province (ISKP). The operation ran from June 1 to 5, 2026, focusing on ISKP-affiliated individuals of Chechen and Central Asian origin, identified through shared investigative leads. The collaboration and cross-verification of intelligence across continents enabled faster mapping of ISKP travel routes spanning Europe, South America, and the United States (US). According to Europol, ISKP remains a significant threat of jihadi terrorism, including its networks in Europe.
Europol responded swiftly to an urgent intelligence request via Secure Information Exchange Network Application (SIENA), which allowed authorities to arrest several suspects, though their identities remain undisclosed. Throughout the week of operations, over 100 gigabytes of information had been exchanged, enabling the full identification of several suspects and advancing multiple high-stakes investigations. The operation involved law enforcement agencies across Europe and the US, including Belgium’s Federal Judicial Police (Federale Gerechtelijke Politie), Czechia’s Czech National Police (Policie Ceské Republiky), Germany’s State Criminal Police Office Lower Saxony (Landeskriminalamt Niedersachsen), Finland’s National Bureau of Investigation (Keskusrikospoliisi), Italy’s Italian National Police (D.C.P.P.), Ireland’s An Garda Síochána, Spain’s Guardia Civil and National Police (Policía Nacional), and the US’ Federal Bureau of Investigation (FBI). The European Cybercrime Centre (EC3) supported Member States in cryptocurrency trails, while the European Financial and Economic Crime Centre (EFECC) provided expertise on financing networks. Specialised tools from the Europol Tool Repository by the Europol Innovation Lab were also deployed to enhance operational capabilities.
ISKP is a branch of the Islamic State (IS, Central) which remains active in Central and South Asia. ISKP emerged in 2014 with the defection of Tehreek-e-Taliban Pakistan (TTP), al Qaeda, and Taliban fighters active in Afghanistan and Pakistan. Due to these defections, IS (Central) dispatched emissaries from Iraq and Syria to meet with local fighters, including several TTP ‘commanders’. On January 26, 2015, Abu Muhammed al-Adnani, then IS’s public relations official in Syria, formally announced the formation of an Afghan affiliate known as ISKP. ISKP is a Wilayah (Province) of the IS, and Khorasan specifically refers to the historical region extending across parts of Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan, and Iran. ISKP adheres to the broader IS’s ideology, which seeks to establish a global, transnational caliphate that is governed by Islamic law.
The current and major operational shift of ISKP is demonstrated by one major incident that occurred on March 22, 2024: the Crocus City Hall terrorist attack in Moscow, Russia. This was one of the deadliest attacks on Russian soil, claiming 150 lives and injuring more than 600. The four attackers were Tajik nationals and were claimed by ISKP after the attack.
For European security agencies, the Crocus attack served as a strategic warning that ISKP had evolved beyond regional insurgency into a group capable of enabling complex attacks far outside its traditional base. In an audio statement released by al Furqan Media Foundation on March 28, 2024, IS spokesman Abu Hudhayfa al Ansari praised the attack, declaring that ISKP had “struck the Russian kafirun (infidels) and shed their blood.” ISKP’s media arm, the Al Azaim Foundation dedicated the Voice of Khorasan Issue 34 (published on April 8, 2024) to the attack, portraying it as a blow to “the pride of the kuffar” and a revival of global jihadist morale.
These public statements serve as evidence that IS supports ISKP around the globe. Russian internal security and counterintelligence service, the Federal Security Service (FSB), the successor to the KGB, has increasingly portrayed ISKP as a growing threat to the Commonwealth of Independent States (CIS), while advancing claims of foreign involvement in its expansion. At the 57th CIS Security Council session held in Samarkand, Uzbekistan, on 16 October 2025, FSB Director Alexander Bortnikov asserted that Western private military companies and foreign intelligence services were supplying resources to ISKP and facilitating the movement of militants from the Middle East into Afghanistan. He also claimed that ISKP sought to consolidate influence in northern Afghanistan near CIS borders, expand training camps, and recruit Central Asian and Russian nationals to destabilise the region. Bortnikov also warned that the group has intensified online propaganda in Tajik, Kyrgyz, Uzbek, and Kazakh, and aimed to exploit regional vulnerabilities, particularly the Fergana Valley, to advance its vision of a global caliphate.
In the latest development, on June 10, 2026, Europol announced that it supported the Belgian authorities in a complex counter-terrorism investigation, targeting an international network primarily composed of individuals of Chechen origin residing in Europe. The network was found to be deeply radicalised and actively engaged in supporting and financing IS activities. During the operation, Belgian counter-terrorism units uncovered a sophisticated infrastructure involving terrorism financing, cryptocurrency-based money laundering, and facilitation networks. On June 9, 2026, seven suspects linked with IS were convicted in Belgium, receiving prison sentences ranging from five to 15 years, alongside substantial financial penalties. While the case did not establish direct links to ISKP, it highlighted how financial and logistical networks operating in Europe sustain transnational ecosystems, potentially creating indirect pathways that may benefit regional IS affiliates, including ISKP.
Europol’s recent operation demonstrates strengthened global partnerships in counter-terrorism, highlighting cooperation through coordinated, intelligence-driven action. The necessity for such sustained transnational cooperation is further underscored by the March 12, 2026, verdict delivered by Moscow’s Second Western District Military Court in the case of the 2024 Crocus City Hall attack, which confirmed that the attack was carried out by ISKP-linked Tajik terrorists, highlighting the expanding operational reach of the ISKP’s Central Asian networks and the increasingly cross-border nature of the threat.
