Author: Oliver Hair ASyI,
Threat Analyst
Read Time: 3 minutes
Tags: April 2024 MTU | fire as a weapon | Firearms | Islamic State | Islamist | Russia | terrorism | Threat Landscape
On 22 March 2024 at approximately 19:40, four individuals entered the Crocus City Hall in Krasnogorsk, Moscow, and conducted a Firearms and Fire as a Weapon attack (FaW). The perpetrators targeted an estimated 6,000 people at a rock concert and set fire to the venue. The roof of the concert hall later collapsed. Reporting suggests that there were at least 139 fatalities and more than 100 others were injured.
Four individuals were later arrested in the Bryansk region of Russia, around 14 hours after the attack. On 25 March 2024, three out of the four suspects pleaded guilty to terror offences in a Russian court. {1}Seven additional individuals have reportedly been arrested. {2} {3}Vladamir Putin, without evidence, stated that “radical Islamists” were aided by Ukraine and that Kyiv created a “window” of opportunity to cross the border into Ukraine. {4}
On 22 March 2024, Islamic State claimed responsibility for the attack via its Amaq news agency. Visual evidence posted by Islamic State includes graphic first-person videos of the attack and a photo of what it claimed to be the four attackers. {5} {6} {7} The US had previously warned Moscow of a possible “extremist” plot in Russia “to target large gatherings in Moscow”. {8}
Terrorism Threat from the Islamic State
- It is highly likely that Islamic State’s claim of responsibility for the attack is legitimate. The use of graphic first-person videos and the distribution of such content via official Islamic State media channels is consistent with attacks previously claimed by the group.
- Following its declared territorial defeat in 2017, it is highly likely that Islamic State has split into a number of disparate covert cells and autonomous affiliate groups. It is unlikely that Islamic State would regain a comparable level of strength to its peak (approx. 2014-2017) in the long term.
- It is highly likely that the 22 March 2024 attack was conducted by members of Islamic State Khorasan Province (ISKP), an affiliate of Islamic State based in Afghanistan. It is highly likely that the Afghan Taliban’s failure to effectively control the group in Afghanistan has enabled ISKP to become the group’s most capable affiliate outside of Africa.
- E.g., According to a July 2023 report to the UN Security Council, ISKP numbers approximately 4,000-6,000 members in Afghanistan, including both fighters and family members. {9}
- E.g., According to a January 2024 UN report, Islamic State launched a major recruitment drive throughout central Asian countries in 2023, including Tajikistan, where the 22 March 2024 perpetrators are believed to originate from. {10}
- E.g., In January 2024, ISKP claimed responsibility for two simultaneous Person Borne Improvised Explosive Device (PBIED) attacks in Iran at a memorial for Iran’s Revolutionary Guard Corps commander, Qassem Soleimani. There were 84 fatalities. {11} {12}
- It is almost certain that Islamic State maintain the intent to conduct attacks against the Russian state as a result of their role in the Syrian Civil War, two Chechnyan wars from 1994-2009, and the Soviet-era invasion of Afghanistan.
- E.g. In September 2022, ISKP claimed responsibility for a Person Borne Improvised Explosive Device (PBIED) attack against the Russian Embassy in Kabul, Afghanistan. There were six fatalities and at least 10 others were injured. {13}
Terrorism Threat to the UK
- It is almost certain that Islamist terrorism remains the predominant threat to the UK at this time and that terrorist actors currently operating in the Middle East and Central Asia maintain the intent to project, coordinate, and conduct terrorist attacks against the UK mainland.
- It is highly likely that there is a heightened Islamist terrorism threat throughout Western Europe and the UK at this time. It is highly likely that current tensions in the Middle East could lead to the radicalisation of individuals in the UK and Western Europe, and at worst, inspire individuals to conduct attacks.
- On 24 March 2024, France raised its terror alert to the highest level and later announced an increase in the number of soldiers for its “Operation Sentinelle” unit, which deals with handling terrorist threats. {14}
- On 26 March 2024, Turkey revealed that 147 individuals had been arrested in a country-wide operation against people suspected of links to Islamic State. Turkey also reportedly confirmed that the four Russian attack suspects had visited Turkey weeks before the Moscow attack. {15}
- There is a realistic possibility that a reduction in the frequency of ISKP attacks within Afghanistan at this time could reflect a change in strategic direction for the group; prioritising external operations against Western targets. {16} According to General Michael Kurilla, the commander of US Central Command, ISKP “retains the capability and will to attack US and Western interests abroad in as little as six months and with little to no warning”. {17}
- There is a realistic possibility that the 22 March 2024 attack could reflect a growing transition from attacks conducted by lone actors to the use of small cells in the medium term. As tensions remain heightened throughout the Middle East, there is a realistic possibility that extremist networks throughout the Western Europe and the UK could have the intent and increased capability to mobilise small cells of terrorist actors for more complex attacks.
- At this time, it is highly likely that the predominant threat posed by global Islamist terrorist actors to the UK mainland is from online radicalisation of vulnerable UK-based individuals with the intent to inspire low sophistication attacks in the UK. Following the 07 October 2023 Hamas attacks in Israel, Islamic State have repeatedly demonstrated the intent to capitalise on the situation in Gaza in order to inspire individuals to commit attacks. {18}
- It is highly likely that any terrorist attack conducted in the UK at this time would be conducted by an individual or small cell using a low sophistication methodology. E.g., Bladed or Blunt Force Weapons, Vehicle as a Weapon, Fire as a Weapon, etc.
- There is a realistic possibility that terrorist actors in the UK could have the capability to conduct a high sophistication attack at this time. E.g., Improvised Explosive Device (IED). However, the complicated nature of plotting a high sophistication attack makes it likely that there will be greater opportunity for police and security services to disrupt such plots.
PHIA Scale
The “Probability Yardstick” (below) is a standardised instrument used to provide professional intelligence assessments. Judgements made using the yardstick are relative and reflect the analyst’s confidence in their findings and assessments.
-
- Almost Certain: An event is assessed to have a greater than 90% chance of occurring.
- Highly Likely: An event is assessed to have a 76% to 90% chance of occurring.
- Likely: An event is assessed to have a 55% to 75% chance of occurring.
- Realistic Possibility: An event is assessed to have a 40% to 54% chance of occurring.
- Unlikely: An event is assessed to have a 25% to 39% chance of occurring.
- Highly Unlikely: An event is assessed to have an 10% to 24% chance of occurring.
- Remote Chance: An event is assessed to have a less than 10% chance of occurring.
Time Spans
-
- Short Term: 0 – 6 Months.
- In the next 12 months.
- Medium Term: 12 months – 5 Years.
- Long Term: 5+ Years.
Author: Oliver Hair ASyI,
Threat Analyst
Read Time: 3 minutes
Tags: April 2024 MTU | fire as a weapon | Firearms | Islamic State | Islamist | Russia | terrorism | Threat Landscape
To receive regular updates about Terrorism Threat and Risk Management, please sign up to our newsletters now.
References
{1} – Two out of four Moscow concert hall attack suspects plead guilty in court | World News | Sky News{2} – What footage from the Moscow attack tells us about how it was carried out | World News | Sky News{3} – Moscow attack: Everything we know so far about concert hall terror suspects | The Independent{4} – Putin tries to pin Isis attack on the West and Ukraine{5} – Putin tries to pin Isis attack on the West and Ukraine{6} – Islamic State releases photo of alleged attackers in Russia shooting – Reuters{7} – Moscow attack: Debunking the false claims – BBC News{8} – Moscow attack: Did Russia ignore US 'extremist' attacks warning? – BBC News{9} – How ISIS-K leader forged one of Islamic State’s most fearsome groups – Reuters{10} – Islamic State ‘recruiting from Tajikistan and other central Asian countries’ | Islamic State – The Guardian{11} – Iran leader vows harsh response to deadly bombings that killed 84 – BBC News{12} – How ISIS-K leader forged one of Islamic State’s most fearsome groups – Reuters{13} – Two Russian embassy staff dead, four others killed in suicide bomb blast in Kabul – Reuters{14} – France to mobilise more soldiers for anti-terrorism unit – Reuters{15} – Moscow attack: Russia blames West and Kyiv for jihadist massacre – BBC News{16} – Eighteenth report of the Secretary-General on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat{17} – How ISIS-K leader forged one of Islamic State’s most fearsome groups – Reuters{18} – Eighteenth report of the Secretary-General on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat