Aaron Y. Zelin is the Gloria and Ken Levy Senior Fellow at the Washington Institute for Near East Policy where his research focuses on Sunni Arab jihadi groups in North Africa and Syria as well as the trend of foreign fighting and online jihadism.
Brief Analysis
The jihadist group has been actively plotting against Iran for years, though the recent upsurge in threats from its Afghan branch may presage a new wave of cells and attacks inside the embattled Islamic Republic.
On October 26, the Islamic State (IS) conducted an attack in Iran for the first time since September 2018. Unfolding at the Shah Cheragh shrine in Shiraz, the shooting reportedly killed fifteen people and injured at least forty. Afterward, an IS statement claiming responsibility for the incident declared that its purpose was to “let the rawafidh [rejectionists, a derogatory term for Shia Muslims] know that the companions [of the Prophet Muhammad] have descendants who inherit revenge generation after generation.” This message was reemphasized a day later in the Sunni jihadist group’s weekly al-Naba newsletter, which included threats to conduct further attacks inside Iran.
Not a False Flag
A few days after the shooting, IS released a photo and video of the attacker, Abu Aisha al-Omari, taken before the incident. The image shows his face while the video shows him pledging baya (allegiance) to the leader of IS, undermining theories that the attack was a false flag operation conducted by the Iranian regime. And earlier today, authorities arrested an individual who aided him and was allegedly planning his own attack in the future.
The shooting also followed several months’ worth of concerted threats issued against Iran by Wilayat Khorasan, an IS branch based mainly in Afghanistan. Although IS has successfully attacked the Islamic Republic just three times in the past six years (including the latest shooting), this has not been for want of trying—since 2016, the Iranian regime has publicly announced that it has foiled eleven IS plots (see below).
As for the timing of the attack, IS statements suggest that it had nothing to do with the ongoing mass protest movement in Iran, despite falling on the fortieth day of mourning for Mahsa Amini, the young woman whose death sparked the uprising. Indeed, the group would hardly be inclined to support a movement born from staunch rejection of rules regarding women’s religious garb. Rather, its stated justifications for the attack have focused on pure sectarian hatred against Shia, whom IS adherents view as not real Muslims. In that sense, one cannot rule out the possibility that the attack’s timing had a tactical purpose, namely, to exploit the Shia theocratic regime’s potential instability amid the mass uprising.
Previous Claimed Attacks
The first claimed IS attack in Iran occurred on June 7, 2017, when two cells conducted simultaneous strikes in Tehran. One cell consisted of suicide bombers who detonated themselves near the mausoleum of regime founder Ruhollah Khomeini, with IS describing the target as a “pagan shrine.” According to Iran’s Ministry of Intelligence, the two perpetrators had previously fought for IS in Iraq and Syria.
The second cell consisted of gunmen who opened fire inside the parliamentary building in Tehran. In total, the twin attacks reportedly killed twelve people and wounded forty-six.
The group’s only other previously claimed attack in Iran occurred in Ahvaz on September 22, 2018, when gunmen fired on a military parade held to honor the army, the Basij militia, and the Islamic Revolutionary Guard Corps (IRGC). Twenty-five people were killed and another seventy injured.
Iran’s Domestic Fight Against IS
Iran has played a highly visible role in helping Shia militias and the Assad regime fight IS elements in Iraq and Syria, in parallel with the U.S.-led coalition’s much broader efforts to combat the group since 2014. Less well known are Tehran’s various efforts to thwart the group’s activities on Iranian soil:
June 2016: Authorities arrest ten IS members for plotting attacks in Tehran and other cities, seizing around 100 kilograms of explosives intended for use in car and suicide bombings. Two months prior, Iranian intelligence minister Mahmoud Alavi had noted that members of the group based in the IS “capital” of Raqqa, Syria, were planning to conduct attacks inside the Islamic Republic.
August 2016: Iranian security forces kill three IS cell members in Kermanshah. One of these operatives, Abu Aisha al-Kurdi, had allegedly served as the group’s “emir” in Iran. Authorities also confiscate a weapons cache and explosive belts.
February 2017: Eight IS cell members are arrested in Tehran for plotting to sabotage rallies marking the anniversary of the 1979 Islamic Revolution. Kalashnikov rifles and other equipment are seized.
June 2017: Forty-one individuals are arrested in various provinces following the aforementioned mausoleum and parliament attacks in Tehran. Authorities reportedly seize “lots of documents and weaponry.”
June 2017: At least fifty people are arrested in Kermanshah province for allegedly plotting attacks against Shia religious centers. According to the provincial prosecutor, security forces seized suicide belts, electronic detonators, and other weapons from the detainees.
August 2017: The Intelligence Ministry detains twenty-seven individuals linked to IS for allegedly planning terrorist operations in various religious cities.
September 2017: IRGC forces arrest an IS member in Andisheh who had planned to conduct a suicide attack during the Ashura holiday. According to an IRGC commander, the suspect had previously fought for IS in Syria.
January 2018: The IRGC claims to detain sixteen IS suspects in northwest Iran after clashing with a group of fighters who had crossed the border from Iraq. Three IS members are reportedly killed in the clash, while two others flee the area.
July 2018: Minister Alavi announces that security forces in southwest Iran have arrested four IS suspects who were planning attacks. He also notes that the cell’s head has a brother who was killed while fighting for IS in Syria.
October 2018: Authorities arrest a member of the Iranian military following the aforementioned parade attack in Ahvaz.
February 2019: The Intelligence Ministry announces that it has busted two IS cells comprising thirteen individuals for plotting to attack Sunni clergymen in Iran’s Kurdistan province.
The lack of further attacks or security interdictions after February 2019 is not particularly surprising, since IS lost its last sliver of territory in Baghuz, Syria, that March. Dedicating resources to external operations became less of a focus for IS central once the need arose to rebuild its insurgency in its core territories of Iraq and Syria.
Recent Threats from the Afghan Branch of IS
Since its founding, IS has been virulently anti-Shia and anti-Iran. For instance, one of the main factors that led it to split from al-Qaeda back in 2013 was the latter’s reticence to attack Iran (reportedly because some al-Qaeda leaders were based there). The IS franchise Wilayat Khorasan has carried on this tradition inside Afghanistan since its founding in 2015, repeatedly targeting the country’s Hazara Shia community. The group tends to view Hazaras as an extension of Iran, since many members of this community are refugees originally from Afghanistan who were recruited by Tehran to join Liwa Fatemiyoun, an Iranian-backed Shia brigade that fought against IS in Syria.
The Taliban has attempted to reassure the Hazara community since taking power in Afghanistan last year, spurring IS to accuse the new government of being “protectors of shirk [polytheism].” Likewise, Kabul’s efforts to reestablish relations with Iran and the broader international community have been a talking point for both IS core and Wilayat Khorasan, with al-Naba newsletter derisively calling the Taliban the “Emirate of Embassies” in September.
The Afghan branch has also been more active in threatening Iran and other countries in the region over the past few months since creating its own media outlet, al-Azaim. In June, for example, issue eight of its Voice of Khorasan magazine warned that “very soon the blood of Iranian majus [a derogatory term for Zoroastrians] will be shed on their streets.” Similarly, the October 17 issue emphasized the pervasiveness of Iran’s plans to back different actors in the region—Baathists in Syria, Hamas in Palestine, and the Taliban in Afghanistan—with “manifestations of blatant kufr [unbelief].”
Meanwhile, IS central media outlets have increasingly been translating Arabic content into Farsi and establishing auxiliary Farsi accounts online to spread the group’s ideology and views on current events. These accounts have gone into overdrive since the October 26 attack.
Limited Policy Options
Given that Iran is one of America’s biggest adversaries, Washington has few options for addressing the above matters beyond continuing to condemn all IS attacks no matter where they take place. At the same time, U.S. officials should warn Tehran not to use the Shiraz attack as a pretext for further tarnishing or cracking down on the country’s legitimate protest movement, which has nothing to do with IS activities or ideology. Of course, even this limited option would be largely symbolic—Tehran is unlikely to listen to anything Washington has to say about its internal unrest, and many in the streets will not be satisfied with any outcome short of toppling the regime. Either way, IS views both the protesters and the regime as apostates.
Aaron Y. Zelin is the Richard Borow Fellow at The Washington Institute and founder of the website Jihadology.net.
