Introduction
Developments in Afghanistan following the Taliban’s return to power in 2021 have created the conditions for new configurations of relationships, alliances, and geopolitical rivalries in Central and South Asia. Among these developments, one of the most significant security challenges in Afghanistan is the issue of Islamic State’s Khorasan Province (ISKP) group, which before the fall of the previous government was regarded as the deadliest terrorist group in Afghanistan. Possessing organized networks and strongholds in eastern provinces, it posed a serious threat to both domestic and regional security. The Taliban, which had been engaged in conflict with this ideological rival since ISKP first emerged in 2015, launched its most extensive anti-ISKP campaign after taking power and, through large-scale military and intelligence operations, significantly reduced ISKP’s visible presence and territorial capacity within Afghanistan.

However, the fundamental question is whether this battlefield success signifies the end of the ISKP threat against the Taliban and Afghanistan. Available evidence suggests that despite its organizational collapse inside Afghanistan, ISKP remains a major threat to both the Taliban and Afghanistan. By examining the strategic evolution of ISKP, this article shows how the suppression of the group inside Afghanistan has pushed it toward building a decentralized, transnational, and nearly uncontrollable network, and what factors have contributed to this external reorganization, particularly within Pakistan.
 
The Taliban’s Suppression of ISKP
After the Taliban returned to power in August 2021, suppressing ISKP became the foremost security priority of the new government. The group was the only armed rival that challenged the Taliban’s legitimacy on ideological grounds while maintaining the capability to conduct large-scale attacks against military and civilian targets through its organized networks. Before the collapse of the previous government, ISKP had established major strongholds, particularly in Nangarhar and Kunar provinces, and through its covert networks in Kabul and other cities, it claimed responsibility for a substantial portion of Afghanistan’s deadliest terrorist attacks.
The Taliban, which had been fighting ISKP since its emergence in 2015, launched its most comprehensive anti-ISIS campaign after taking power in Afghanistan. According to available data, this campaign gradually evolved from broad, hardware-oriented military operations into more targeted intelligence and security measures. These efforts included the dismantling of key cells, intelligence penetration, disruption of financial channels, expansion of checkpoints, special operations in urban centers, and even the recruitment or surrender of certain ISKP members. The result of this strategy was a noticeable weakening of ISKP’s operational capacity inside Afghanistan, such that the number of attacks carried out by the group declined significantly, compared with the final years of the republic. Many commanders and operational networks were eliminated, and ISKP’s ability to control territory or conduct sustained large-scale attacks was severely restricted.

This success is not merely part of the Taliban’s official narrative; it has also been acknowledged to some extent by international organizations. United Nations reports have attributed the substantial decline in ISKP attacks inside Afghanistan largely to the Taliban’s continuous counterterrorism pressure. For this reason, the Taliban presents this achievement as its greatest security success since taking control of Afghanistan. Taliban military and security pressure forced ISKP to abandon its reliance on centralized structures and visible presence, turning instead toward covert networks, decentralized organization, more flexible operational models, and, most importantly, a geographic shift from Afghanistan to other countries.
As a result, although the Taliban has managed to seize the initiative on the battlefield and reduce ISKP from an organized insurgency to a weaker actor with a limited capacity for domestic operations, it has not succeeded in completely eliminating the group’s ability to regenerate, recruit new members, and adapt to changing circumstances.
 
Organizational and Operational Reconfiguration of ISKP
Although reports by the United Nations, the U.S. Special Inspector General for Afghanistan Reconstruction (SIGAR), and some Western research institutions continue to refer to the persistence of covert ISKP cells in parts of Afghanistan, these assessments are largely based on intelligence information and perhaps political motivations and do not fully correspond with available field evidence. Compared to the years before 2021 and the first two or three years afterward, visible signs of organized ISKP presence, territorial control, or extensive network activity inside Afghanistan have become far more limited. As previously explained, continuous Taliban intelligence and military operations have dismantled much of ISKP’s visible infrastructure, and significantly reduced its capacity to seize territory and conduct large-scale attacks within Afghanistan.
Therefore, it is possible that some existing estimates, influenced by the political considerations of certain international and regional actors, have portrayed the scale of ISKP’s internal threat as greater than the reality on the ground.
Nevertheless, a balanced assessment would suggest that while ISKP has suffered an organizational collapse inside Afghanistan due to Taliban pressure, the decline of its visible presence inside Afghanistan does not necessarily signify the group’s full collapse. Rather, it reflects ISKP’s forced strategic adaptation and geographic relocation. In this transformation, ISKP has shifted from the model of a territorial insurgency toward that of a decentralized and transnational terrorist network, with part of its command, support, recruitment, financing, and operational coordination capacities transferred outside Afghanistan.
Some evidence indicates that in recent years, favorable conditions have emerged for rebuilding parts of these capabilities, particularly along the Afghanistan–Pakistan border and in certain areas within Pakistan. Although Islamabad denies the existence of organized ISKP bases on its territory, some factors such as the movement patterns of ISKP members, known transit routes of its elements, the arrest of some ISKP affiliates in Pakistan, and the role of networks located across the border in supporting the group’s activities reinforce the hypothesis that the center of gravity of ISKP’s reorganization has gradually shifted beyond Afghanistan’s borders rather than remaining inside the country.
Cross-border attacks attributed to ISKP, including the operations in Kerman and Moscow, further confirm that this reorganization has not merely been a defensive measure for survival but has also enhanced the group’s operational capacity at the regional level. Consequently, the most important development following the Taliban’s suppression of ISKP should not be sought solely in changes to the group’s configuration inside Afghanistan, but rather in the gradual transfer of ISKP’s organizational and operational center of gravity to external networks. Although this development has reduced the group’s territorial power, it has simultaneously increased its flexibility and capacity to sustain terrorist activities, making the task of containing it more complex for the Taliban and other regional actors.
 
The Risk of ISKP Operationalization in Afghanistan Through External Direction
As explained earlier, one of the most significant consequences of the organizational and operational reconfiguration of ISKP has been the transfer of part of the group’s command, support, and operational coordination capacity outside Afghanistan. This development has challenged some of the Taliban’s security achievements. Although the Taliban’s extensive military and intelligence pressure weakened ISKP’s visible presence and territorial capabilities inside Afghanistan, the group responded by expanding its external networks and adopting a new operational model in which part of its planning, financing, recruitment, coordination, and operational support is conducted beyond Afghanistan’s borders. The attacks in Kerman, Moscow, and Kabul, as well as the discovery of some networks affiliated with the group in several countries, indicate the reorganization of its operational capabilities. Under such a model, the remaining covert cells inside Afghanistan can gain access to financial resources, secure communications, logistical support, and, in some cases, operational guidance through external networks without maintaining a centralized command structure within the country.
This situation is partly a reflection of the group's organizational restructuring, and its strategic operational shift from "focusing on territorial control" to "relying on transnational networks". Consequently, one of the emerging challenges facing the Taliban government is confronting a threat whose source is no longer confined to Afghanistan itself. Through networks based outside the country, ISKP retains the ability to organize, support, and in some cases direct operations against Taliban targets and interests.
From this perspective, the external reconfiguration of ISKP has not only contributed to the group’s survival but has also expanded the scope of its operational activities, making its complete containment considerably more complex for the Taliban.
 
The Reconstruction of ISKP outside Afghanistan's borders
As noted above, continuous Taliban military and intelligence pressure on ISKP has pushed the group to transfer its organizational and operational center outside Afghanistan. Assessments by security think tanks, as well as official statements issued by ISKP itself, support this theory.
According to some views, Pakistan’s territory is more likely than that of any other country to serve as the primary environment for rebuilding part of ISKP’s capabilities. The Pakistani government has consistently denied the existence of organized ISKP bases on its territory. However, various indicators—including the arrest of ISKP-linked individuals, known routes used for the movement of personnel, the activities of facilitation networks in border regions, and certain international assessments—suggest that the group has been able to exploit the complex and fragile security environment of Pakistan’s Khyber Pakhtunkhwa and Balochistan provinces to rebuild itself. Nevertheless, the fundamental question remains whether this process is merely the result of ISKP exploiting security gaps and governance weaknesses in parts of Pakistan, or whether elements within Pakistan’s power structure have directly or indirectly contributed to creating such an environment.

Although the Taliban claims that there is cooperation between the Pakistani government and ISKP and has even presented evidence in support of this allegation, there is no conclusive public evidence proving a direct and organized role by the Pakistani state in supporting ISKP. Therefore, this claim cannot yet be accepted as a fully established fact. Nevertheless, it can be examined as an analytical hypothesis—or perhaps as a developing phenomenon. Within this framework, it can be argued that certain actors within Pakistan’s security establishment may have refrained from completely suppressing ISKP in pursuit of some geopolitical considerations.
Some possible motives for Pakistan could include increasing pressure on the Taliban in response to growing tensions between Kabul and Islamabad, limiting the operational freedom of Tehrik-e-Taliban Pakistan (TTP), influencing the security dynamics of Balochistan, or using the ISKP threat as a tool in regional interactions. On a broader level, it may also be argued that geopolitical rivalries among regional and extra-regional powers have indirectly contributed to the continuation of ISKP’s activities. Although there is still no reliable and publicly available evidence proving that specific governments play a directing or supporting role, the pattern of ISKP operations may provide some clues as to which countries’ interests are being targeted and which countries’ objectives may ultimately be served.

In any case, the important point is that the transfer of a significant portion of ISKP’s capabilities outside Afghanistan has transformed the fight against the group from a purely domestic issue into a transnational security challenge for the Taliban government. If the hypothesis of support from the Pakistani government and certain other countries proves accurate, this challenge could represent a very serious and large-scale threat to the Taliban.
 
Conclusion
Following the Taliban’s return to power, the overall pattern of security developments indicates that the extensive suppression of ISKP inside Afghanistan has significantly reduced the group’s territorial capabilities and its capacity to openly organize operations within the country. However, it has not eliminated the threat altogether. Indeed, it can be argued that Taliban military and intelligence pressure has pushed ISKP toward strategic reorganization, transferring a substantial portion of its command, support, financing, and operational coordination capabilities outside Afghanistan.

From this perspective, the most significant change in the nature of the ISKP threat is not the continuation of its extensive presence inside Afghanistan, but rather the externalization of its organizational and operational structure. This shift has largely removed the group from the Taliban’s direct sphere of surveillance and control while allowing it to preserve its capacity to regenerate operational capabilities.
Within the framework of this study’s hypothesis, Pakistan’s territory constitutes the most likely center of this external reorganization. This hypothesis is based on a range of indicators, including repeated Taliban claims regarding the presence of ISKP members and facilities inside Pakistan, recent Taliban attacks against alleged ISKP-linked targets across the border, international reports concerning the activities of ISKP elements in Pakistan, and the geographic and security characteristics of border regions that facilitate the movement and reorganization of armed groups.

The Pakistani government has repeatedly rejected these allegations. However, the coincidence of such evidence with escalating political and security tensions between Kabul and Islamabad strengthens the hypothesis that certain Pakistani security institutions may have directly or indirectly tolerated the presence and activities of ISKP in Pakistan, or at least overlooked them for some geopolitical reasons. Using ISKP as a tool to increase pressure on the Taliban, restrict the operational freedom of Tehrik-e-Taliban Pakistan, influence security dynamics in Balochistan, and preserve leverage in relations with the Taliban government are among the conceivable motivations behind such an approach.
If this hypothesis is confirmed, the Taliban would face a threat fundamentally different from that of the past. Previously, ISKP was primarily an insurgent actor based inside Afghanistan and therefore a direct target of Taliban operations. Today, however, a substantial portion of the group’s decision-making, support structures, and capacity-regeneration mechanisms can operate outside the territory controlled by the Taliban government.

Such a situation reduces the Taliban’s intelligence and security advantages and confronts it with a challenge that cannot be managed solely through domestic military and intelligence tools. As a result, even if the Taliban succeeds in maintaining its security superiority within Afghanistan, the possibility of ISKP reviving its operational capabilities will remain as long as the foundations for its external reconstruction continue to exist.
Therefore, the principal threat posed by ISKP to the Taliban is no longer confined to its presence inside Afghanistan. Rather, it lies in the group’s ability to exploit external environments and resources, transforming them into bases for reconstruction and issuing threats. If successful, this process could significantly affect the security dynamics of Afghanistan and the wider region in the years ahead.