Afghanistan after 2021: how IS-KP and TTP are reshaping the militant landscape under Taliban rule

Author: Shukria Malek Zada

Since 2021, reports and open sources indicate that Afghanistan has shifted from a single-actor battlefield to a multi-group jihadist ecosystem. In this ecosystem, the Taliban function as de facto rulers, IS-KP (Islamic State-Khorasan Province) operates as the most outward-focused and internationally active branch, and TTP (Tehreek-e-Taliban Pakistan) uses the Afghan Territory as a rear base for a growing campaign against Pakistan. However, the Afghan Taliban denied such claims.

IS-KP appears degraded territorially but increasingly oriented toward external operations and online propaganda. At the same time, TTP has consolidated a large, loosely restricted presence inside Afghanistan with limited Taliban restraint.

Islamic State–Khorasan Province

After the fall of the Afghan republic in 2021, IS-KP has emerged as the most dynamic militant group operating from the Afghan territory, showing the most interest in orchestrating attacks abroad. Despite territorial setbacks and sustained Taliban pressure, it has adapted into a decentralised, networked organisation capable of conducting high impact attacks at home, as well as orchestrating operations in Iran, Russia, and parts of Central Asia. In its latest report regarding the situation in Afghanistan, the UN Security Council (UNSC)  reported the IS-KP/ISIL-K attacks have decreased in frequency and scale, and that minor clashes between the Taliban and IS-KP continue. 

IS-KP’s initial focus was fighting the Taliban for leadership of jihad in Afghanistan in a broader region, while insisting on allegiance to the Islamic State “caliphate” rather than a nationally bounded emirate. After suffering losses in eastern Afghanistan, the group has transitioned from a territory holding insurgent group into a decentralised, cell-based organisation that emphasises global jihad and attacks, such as bombings and suicide attacks targeting the Shia religious minority, and foreign nationals.

Estimates of IS-KP manpower vary across reports and are difficult to pin down because fighters blend across different groups. Several UNSC Member States estimate the IS-KP affiliates in the region having increased from 4,000 to 6,000 fighters, although others saw the group’s core strength to remain between 2,000 and 3,500.

The current leader of the group is reported to be Sanaullah Ghafari (alias Shahab al-Muhajir). In June 2023, Taliban’s General Directorate of Intelligence, also known as GDI, attempted to arrest him during a raid in Kunar, and Ghafari was reported dead by Pakistani intelligence officials. However, it was not confirmed by any other major sources, and the UN Monitoring Team reported that Ghafari had gone deeper underground.

The pushbacks by Taliban led the group to disperse from Kunar and Nangarhar, into newer hubs such as Badakhshan, Kabul, Herat, Nimroz, and across the border into Pakistan’s Balochistan. This has weakened its local presence, but widened the group’s geographical scope of external reach. 

Outside Afghanistan, IS-KP maintains a more horizontal, network structure, largely led by Central Asian commanders and fighters based in Afghanistan, Russia, or Central Asia, and recruiting from Central Asian, Russian, and European diasporas. The group’s modus operandi is to inspire “lone wolves” and recruit them via social media to carry out operations.

For example, a Tajik national who was arrested by Russian authorities, who reportedly pledged allegiance to ISIS publicly by sharing a video online, promoting extremism, and was planning on travelling to Afghanistan to join the ISIS ranks. This illustrates the group’s external operations methodology which is described as “activated” operatives or “inspired” lone actors who are recruited through different networks to carry out operations. 

This happens while in 2024, the Russian Ambassador to the UN, Vasily Nebenzya, mentioned that Taliban’s efforts are not enough for tackling the threat of terrorism. 

Reports describe IS-KP embedding fighters within TTP (Tehreek-e-Taliban Pakistan), TJP (Tehreek-e-Jaferia Pakistan), IMU (Islamic Movement of Uzbekistan), and Jamaat Ansarullah as a means of blending, training, and evading detection. This embedding supports movement and operational cover across multiple jurisdictions and geographies. The interconnectedness of the groups complicates efforts to assess IS-KP’s true operational strength within Afghanistan. 

When it comes to TTP, the UN Monitoring Team assesses that the group is now the largest terrorist group on Afghan soil, with an estimated 6,000–6,500 fighters based in Afghanistan. In a recent report, Pakistan’s Army Chief, Asim Munir, has claimed that 70% of the group’s fighters are Afghans, and warned the Afghan Taliban regarding the threat of TTP and harbouring their leaders in Afghan territory.

TTP attacks in Pakistan have increased sharply since 2021, including major operations planned or launched from Afghan territory. These attacks intensified in 2025, with TTP launching two suicide attacks between 10-11 November that killed 12 people, and resulted in major clashes between the Afghan Taliban and Pakistani government that continue to this day. 

Taliban Counter-Terrorism Posture and Militant Tolerance

After the transition of the Taliban from insurgency to de facto government, they have undertaken operations, raids, and targeted killings that have disrupted IS-KP’s core in eastern Afghanistan. However, reports and news regarding these targeted killings remain limited, and the UN described the Taliban response to the IS-KP threat “tactical rather than strategic.”

At the same time, the Taliban tolerate or support other militant actors, especially TTP and AQIS (Al-Qaeda in the Indian Subcontinent), whom they do not classify as terrorists but ideological affiliates: UN reporting notes that Taliban provided guesthouses, weapon permits, movement passes, and alleged monthly financial support to TTP leaders. The Senior Study Group report explains Taliban tolerance toward such groups as a combination of ideological affinity, strategic utility, and fear that over-pressure could push these groups toward IS-KP. 

Analysis

The available reports and evidence indicate that Afghanistan remains a permissive ecosystem for a diverse set of militant actors, whose activities have direct implications for regional and international security. IS-KP has demonstrated the ability to absorb tactical losses, disperse geographically, and redirect energy into external operations, making it a serious threat coming from the Afghan territory. 

TTP’s consolidation inside Afghanistan, along with expanding its operational tempo against Pakistan, signals an escalating risk that has already destabilised the Afghanistan-Pakistan frontier. This is a clear indication that Taliban’s selective enforcement posture – applying sustained pressure against IS-KP while tolerating or empowering other armed groups – creates structural vulnerabilities that these organisations can continue to exploit. 

If the current trend persists, Afghanistan will function less as a battleground and more as an enabling environment: a staging ground for cross-border militancy, a hub for extremist networking, and a symbolic rally point in global jihadist narratives. The threat environment, especially with the recent escalations between the Afghan Taliban and Pakistani Government, is best understood not as static but as evolving toward more complex, transnational, and hard-to-disrupt patterns of activity, underscoring the need for continued monitoring and multi-layered regional security response.