On 6 July 2026, as millions of black-clad mourners pour into the streets of Tehran to bid farewell to the Islamic Republic’s former supreme leader Ali Khamenei, they will not be looking over their shoulders for an enemy that is calling for their deaths. Their eyes will be fixed on the sky – scanning for Israeli drones or American missiles. But another danger could be walking among them – a lone operative, clutching a suicide vest, AK-47, or a home-made pressure cooker bomb, believing he is about to send a thousand ‘Rawafidh’ to hell.
The Islamic State Khurasan Province (ISKP) has spent years proving it can penetrate Iran’s security apparatus. In January 2024, two Tajik ISKP operatives carried out twin suicide bombings in Kerman during a commemorative ceremony for Qassem Soleimani, killing nearly a hundred people and wounding hundreds more. It remains the deadliest terrorist attack in the history of the Islamic Republic. Now, with Iran reeling from a devastating US-Israeli war, and preparing for the funeral of its late Supreme Leader Ayatollah Ali Khamenei, ISKP sees an opportunity to strike.
The convergence of these factors, namely a country exhausted by war, a security establishment stretched across multiple fronts, and a mass gathering of millions of mourners, represents what counterterrorism analysts call a ‘target-rich environment’. And the leadership of the Islamic State knows it, and their recruitment and radicalisation mechanisms have been hard at work. The Salman Farsi Foundation’s July 2 poster, calling on ‘lone wolves’ to attack during the funeral ceremonies, is part of a calculated, ideologically driven campaign that has been years in the making, and one that every counterterrorism professional tracking this group should take with the utmost seriousness.
A History of Penetration
To understand the gravity of the current threat, one must first appreciate ISKP’s track record inside Iran. The Kerman attack was not an anomaly but rather a proof of concept. Two bombers from Tajikistan, a country with which Iran shares cultural and linguistic ties, managed to infiltrate one of the most heavily secured events on the Iranian calendar. They struck at the very heart of the Islamic Republic’s revolutionary mythology, at a ceremony honouring the man who had been the architect of Iran’s regional proxy network. He was also one of the leading commanders to destroy IS territorially in Syria. The fact that Iranian officials initially blamed Israel for the attack only underscored how unprepared the regime was to confront the reality of a Salafi-jihadist threat operating from within its own borders.
Since Kerman, ISKP has only grown more ambitious. The group has linked itself to attacks or attempted attacks in Iran, Russia, Turkey, Tajikistan, Azerbaijan, and several countries in Europe. Its external operations targeting Iran throughout 2024 and 2025 demonstrated the group’s expanding transnational reach. The United Nations has warned that ISKP is now a significant regional threat, growing in numbers and strength, and increasingly able to operate outside of Afghanistan. The 2026 US counter-terrorism strategy also highlights ISKP as one of its priorities. This is not a group in decline, but rather an organisation that has learned to project power far beyond its Afghan base.
The Sectarian Imperative
What drives ISKP’s fixation on Iran is not merely strategic opportunism but deep ideological conviction. The group’s propaganda consistently frames the conflict in stark sectarian terms, portraying Shiites – whom it derogatorily refers to as ‘Rawafidh’, meaning ‘the rejectors’ – as apostates deserving of extermination. In its English-language magazine Voice of Khurasan, ISKP has articulated this worldview with chilling clarity.
In Issue 35, published under the headline ‘Sibling Quarrel’, the magazine advanced an elaborate conspiracy theory that the enmity between Iran and Israel is a contrived narrative, sustained by “orchestrated, mutually coordinated missile strikes” intended to foster the illusion of a protracted conflict. The article claimed that both Shias and Jews are historically linked and equally dangerous to the Islamic Ummah. “Rawafidhs are the donkeys of the Jews”, declared a pro-ISKP Tajik Telegram channel. This is the type of rhetoric that acts as a directive for action. By equating Iran and Israel as joint enemies of its version of a ‘true’ Islam, ISKP provides its followers with both ideological justification and operational motivation to strike at Shiite targets wherever they may be found.
Last week’s latest call to violence fits seamlessly into this narrative. The poster depicts a fighter with a machine gun surveying a crowd carrying Khamenei’s portraits – a visual summation of the group’s ultimate fantasy of a lone operative cutting down the symbols of Shiite power at the very moment of their greatest public visibility. The accompanying text urges jihadists to “achieve epic events” without consulting anyone, explicitly referencing previous IS-claimed attacks in Iran – the 2005 Baghdad bombing, the attack on the Iranian parliament and Khomeini’s tomb, the Ahwaz military parade, the Shah Cheragh Shrine attack, and the Kerman bombings. These are not mere random citations but are designed to highlight a curated history of violence in order to inspire emulation.
The Strategic Vacuum
The US-Israeli war on Iran has created conditions that ISKP is uniquely positioned to exploit. When the war began, with joint strikes aimed at inducing regime change and targeting Iran’s nuclear and ballistic missile programmes, the Islamic Republic’s security forces were suddenly confronted with an existential external threat. Iranian forces are now stretched across multiple fronts, managing retaliatory operations and contending with the aftermath of months of internal unrest that had already strained their capacity. This has therefore created a significant security vacuum that groups like ISKP will likely exploit. We saw this happen in Iraq and Syria.
The funeral ceremonies for Khamenei, scheduled to begin with a farewell event in Tehran on July 4-5 and culminating in the main funeral procession on July 6, represent a security nightmare for Iranian authorities. Millions of mourners are expected to gather in the capital, creating precisely the kind of dense, vulnerable target that ISKP has historically favoured. Estimates place the number of expected mourners at thirty million. If threats groups are even able to attack 0.01% of this number, that would amount to around 3,000 civilians. The regime has mobilised its domestic media and deployed hundreds of thousands of armed forces personnel to secure the event, but the sheer scale of the gathering, combined with the regime’s already depleted security resources, makes comprehensive protection nearly impossible.
ISKP understands the value of striking during chaos. We saw this during its Abbey Gate attack on the Kabul International Airport in August 2021 during the chaos of the Biden’s withdrawal from Afghanistan. Amidst the disorder and pandemonium, ISKP’s Abdul Rahman al-Logari detonated his suicide vest, killing over 180 people, including around 170 civilians and 13 US servicemen. Iran remains in a state of disorder and chaos amidst the US-Israel attacks and fluctuating ceasefires. This gives ISKP a ripe target to strike.
Lone Wolves and the Remote-Control Model
What makes the current threat particularly acute is ISKP’s embrace of the ‘lone wolf’ model. The latest call explicitly targets “lone wolves and supporters in Iran”, urging them to act independently and without consulting anyone. This is not merely a tactical preference but rather a strategic adaptation – a continuation of IS’s directive for external operations. ISKP’s preferred method of attack increasingly involves remote guidance, enabling the group to direct operatives without the need for extensive physical infrastructure inside target countries. We saw this happen in the attacks in Kerman, Iran and Moscow, Russia, in 2024.
The group has also demonstrated a sophisticated understanding of digital mobilisation. Voice of Khurasan is disseminated across the internet, social media platforms, and messaging applications, featuring frequent calls for attacks and tactical advice on weapons and target selection. This digital ecosystem allows ISKP to radicalise and direct operatives with minimal risk of detection, making the traditional barriers to terrorist operations, training camps, logistics networks, communication chains, largely obsolete.
The Iran-Israel Sibling Narrative
The propaganda campaign that ISKP has waged against Iran since the Gaza war intensified in 2023 provides essential context for understanding the current moment. Shortly after Hamas’ October 7 attacks, ISKP’s al-Azaim Media Foundation initiated a campaign targeting both Iran and Israel through Voice of Khurasan. The magazine’s ‘Sibling Quarrel’ editorial expressed satisfaction at seeing two sworn enemies destroy each other, while simultaneously arguing that their conflict is a deception designed to distract from their shared hostility toward Sunni Muslims.
This framing serves multiple purposes. It justifies attacks on Shiite civilians by portraying them as legitimate targets in a cosmic struggle. It undermines any potential Sunni-Shia solidarity by insisting that Shias are fundamentally aligned with Israel against Sunni interests. And it positions ISKP as the only force capable of thwarting the dangerous schemes of both Iran and Israel, purging the Jews and Shias alike. The current war between the US-Israeli coalition and Iran only validates this narrative in the eyes of ISKP’s followers, reinforcing the message that the Islamic Republic is weak, divided, and ripe for destruction.
Given the importance of the Palestine issue to the Muslim world, IS understands that the more Iran rises against Zionist interests, the more it is supported by the general Muslim Ummah. Its propaganda is also designed to thwart this perception and instead paint an image of coordination and collaboration between the Islamic Republic and Israel.
A Threat That Will Outlast the Funeral
The immediate concern is of course the funeral ceremonies themselves. The poster explicitly frames the event as a “suitable time” for lone wolves to “teach them a lesson of blood, gunpowder, and steel in the heart of the Rafidha land”. The message is unambiguous – strike now, while the world is watching, while the regime is preoccupied, while the crowds are dense and the security forces are overstretched.
But the threat will not end when Khamenei is buried. The war with the US and Israel has fundamentally altered Iran’s strategic position, creating conditions that will persist long after the last mourner has left Khamanei’s resting place. ISKP has already demonstrated both the intent and the capability to strike inside Iran. The group’s anti-Shia ideology, its sophisticated propaganda apparatus, its embrace of the lone-wolf model, and its proven ability to penetrate Iranian security all point to a sustained campaign of violence that will outlast any single event.
For those tracking this threat, and for the Iranian security forces tasked with confronting it, the funeral is not the end of the challenge. It is the beginning.
