On May 5, unknown assailants conducted the latest attack on security services in the North Caucasus. As the sound of shots faded across Makhachkala, more questions than answers emerged about the attack. Most importantly, who was behind the attack, and why did they do it?
It took more than a week for the only surviving attacker to receive additional charges—still absent anything pertaining to terrorism or militantism. A day later, he was charged with conducting a terror attack. It took this long for such a decision by the authorities, with the evidence unknown.
That same day, on May 13, a reported terrorist plot against Makhachkala and Kaspiisk was thwarted. The cell allegedly had ties to a previously accused IS cell in a Makhachkala suburb whose existence was doubted by local experts.
Two weeks later, and an Islamic State cell had just been arrested in Nizhny Novgorod Oblast. Comprised of local and migrant recruits, the group’s handler (куратор) was reportedly from Poland.
Attacks in Russia are likely to continue. The recent Makhachkala attack further demonstrates the authorities’ lack of reliability about security and their inability to address a complex threat environment. While there is no evidence to connect this attack to Islamic State, the terror organization’s reach into Russia has become clear over a year after the Crocus City Hall attack. Considering these and other attacks, an appraisal of the current state of militancy and terrorism is needed.
Makhachkala’s latest attack
A lot of questions remain about Russia’s latest attack, such as how it started, the number of militants involved, their motivation, and how they should be categorized. As a long-time digital observer of many incidents in Dagestan and the North Caucasus, this attack was unique in the apparent disjointed reporting as events transpired. Either the sequence of public videos emerging was incorrect—videos that have otherwise proven correct with respect to the attack’s start—or the authorities are lying.
The key disputed aspect of the attack is how it started. Dagestan’s governor and administration claim a traffic stop turned violent. To the contrary, eyewitnesses say the attackers created an accident purposely to attract police. A few days after the attack, and the eyewitnesses appear correct.
While the MVD asserts there were only two militants, the evidence does not confirm that. Pictures of the deceased militants do not clearly match the photo of the those in the hijacked police car. Further, only two participating militants would not explain why the police were searching El’tav woods, which multiple channels reported. The surviving attacker faces new charges, which contradicts the authorities’ narrative that they killed both assailants.
Motivation remains unclear beyond a desire to attack the security services. One channel claimed the attackers had large debts and previously faced administrative discipline; yet, this same channel alleged the attackers and those last June were on psychotropic narcotics during their attacks. News channels were obviously confused, referring to the attackers as «prestupniki,» «boeviki,» or «vakhkhabiti,» seemingly based on the respective outlet’s ideological bias. None of the attackers were initially given terrorism charges.
The most suggestive evidence of any ties to a larger international terrorist organization are the knifing of a policeman—not altogether out of line with regional patterns—and the apparent training to shoot from the pavement. Such evidence is weak and circumstantial, and any larger plot has yet to be asserted in the charges.
One year after Crocus City Hall
Meanwhile, the network that conducted the attack outside Moscow has been realized to extend beyond Russia, but not towards Ukraine, despite Kremlin narratives. Dozens have been arrested for the Crocus City Hall attack, but few have been significant participants. Further, the true organizers of the attack have been detained—albeit in Pakistan.
The four attackers were natives of Tajikistan who were reportedly radicalized in Russia on a short time span. The dozen others arrested were only loosely connected to the terror plot, mostly being relatives, friends, or even more distant acquaintances who lent a car or apartment or allegedly had some prior knowledge of the attack.
More importantly, a logistics cell that facilitated the attack was arrested in Dagestan. While the precise details of those involved remain unclear, the group was comprised of three to five members, mostly Tajiks but also a local Dagestani. This group procured weapons, transportation, and finances for the attack. The weapons were reportedly acquired from two members of Ingushetia’s Batalkhadzhintsy brotherhood, although the group was essentially dissolved in 2022.
While the brotherhood’s past policy stances suggest they would never aid IS, their gun-trafficking operations have been long been reported on, although there is nothing to indicate they would have known who they were allegedly selling to. Most importantly, the Batalkhadzhintsy represent Moscow’s single means of connecting the Moscow attack to Ukraine. Ilyas Belkharoev, a member of the brotherhood’s controlling family, found shelter in Ukraine in 2015 after being targeted by Ingush authorities. It is noteworthy that, despite legitimate doubts over the authorities’ pursuit of the Batalkhadzhintsy connection to the Crocus City Hall attack, local independent media has corroborated their claims.
Finally, the true organizers of the attack were external operations planners for IS-Khorasan Province, arrested crossing over from Afghanistan to Pakistan. This trio represents the highest level of IS involvement in commanding the attack. Not only does this completely disprove the Kremlin’s narrative, which has not changed since the day of the attack, but it creates a significant setback to ISKP conducting attacks of a similar scale in Russia and beyond. That does not mean, however, that the threat has fully dissipated in Russia.
Appraising militancy potential in Russia
It is important to highlight that last year’s major attacks in Moscow and Dagestan did not happen in a vacuum. The Crocus City Hall attack was not the first Islamic State attack of 2024 in Russia, and neither the first major external operation for ISKP, nor the first to target Russia in recent years. Operatives of IS in Syria, Afghanistan, and elsewhere were targeting Central Asian and North Caucasus natives in Russia, across Europe, and in the United States. Finally, the North Caucasus has long faced sporadic militant attacks that have not been affiliated with any larger organization. Within Islamic State-tied plots, ISKP has typically targeted the Northwestern Caucasus, while the Northeastern Caucasus relies on older, stronger ties to Syria, although this is not exclusive. A networked approach to Russian militantism results in little clarity.
While there are larger trends, a specific long-term concern of the Russian authorities has understandably been IS cells in prisons. IS plots prior to and after Crocus City Hall resulted in the first IS jailbreak attempt in Rostov was the result of not just the treatment of the Croc City Hall suspects, but other prior IS plots. The torture of the Moscow attackers led to the attempt in Volgograd, with previously un-radicalized individuals pledging allegiance to Islamic State due to the torture of their kinsmen. A subsequent jailbreak plot in Nizhny Novgorod, inspired by Volgograd, was reportedly thwarted. Such plots, when they manifest, have proven to have limited success, although becoming a notable focus of IS propaganda.
The targets of attacks are a crucial, albeit indirect, determinant of responsibility and motivation. Over the past few years, plots by radicalized Central Asian natives have focused on soft targets. This has been particularly evident in the targeting of rail infrastructure in southern Russia. North Caucasus natives, on the other hand, have focused on security targets, even ignoring civilian bystanders during attacks. This targeting disparity further underscores that the Central Asia and North Caucasus populations are distinct radicalization targets, with different aims and rules of engagement.
The militant threats to Russia remain diverse, with no central origin, while targets remain seemingly differentiated by radicalization group. Despite the continued potency of such a threat, the security services remain seemingly inept, continuing to focus instead on a threat from Ukraine that does not exist along these networks.
