It should have been no surprise that the terrorist group known as ISIS was behind Friday night’s massive attack on a concert hall in Moscow, killing 137 people and injuring at least 100.

The surprise is that this sort of thing doesn’t happen more often.

ISIS, also called the Islamic State, was believed dead and gone in 2017, after U.S., Iraqi, and Kurdish forces defeated its final holdout of armed men in a ferocious battle around the Iraqi town of Mosul. The terrorist group—which, for the previous few years, had ruled as many as 12 million people in a self-declared “caliphate” spanning much of northwestern Iraq and eastern Syria—was obliterated as a political and military power, but a few thousand of its fanatics survived.

Many Western articles and analyses painted ISIS as an especially violent offshoot of al-Qaida bent on wiping out or overthrowing territories held by “apostates” of all sorts—Christians, Jews, and rival Shiite Muslims. But the group also singled out Russia as a particularly virulent enemy.

Since the fall of 2015, Russian President Vladimir Putin has been helping Syrian President Bashar al-Assad fight off all opposition factions in a gruesome civil war, sending him not just bombs and ammo but fighter planes flown by Russian air force pilots. ISIS fighters have been among the targets of these bombing raids—and they have sought revenge.

Bruce Hoffman, a counterterrorism expert at the Council on Foreign Relations, told me Monday that since the caliphate’s collapse in Mosul, many ISIS survivors have been animated most of all by the crusade against Russia.

Not long after Putin began his deployment, ISIS militants in Egypt claimed responsibility for planting a bomb on a charter flight to St. Petersburg, killing 224 passengers, all of them Russian tourists returning home. In 2017 an ISIS suicide bomber blew up a subway car in the St. Petersburg metro system, killing 16.

The metro bomber was from Kyrgyzstan, one of the former Soviet Union’s Central Asian republics. The four men arrested after this past Friday’s concert-hall killings were from Tajikistan, another former republic in the same region. The fact is no coincidence. The majority of this region’s citizens are Muslim. Many of them resent Russia for its tyrannical grip from Soviet times (animated, in the case of its hold over Muslim areas, by white-nationalist racism). Some residents of these countries have been further radicalized by Islamist terrorist groups, which flourished with the rise of al-Qaida and ISIS. And according to Hoffman, many of those who were radicalized and who had been recruited to fight for the caliphate fled back home just before or after the fall of Mosul.

The concert-hall killing in Moscow was planned and carried out by a branch of the terrorist movement called ISIS-K. (The K stands for the Khorasan region, which overlaps parts of Afghanistan, Pakistan, Iran, and Turkmenistan.) ISIS-K has been fighting the Taliban in Afghanistan; it regards the Taliban leaders, who took over Afghanistan in 2017 after U.S. forces withdrew and the Kabul government collapsed, as insufficiently militant.

Still, the group has stepped up terrorist activities outside its home area.

In January, two ISIS-K suicide bombers killed 84 Iranian Shiites who were attending a memorial service for Qassem Soleimani, the leader of Iran’s terrorist operations throughout the Middle East, on the fourth anniversary of his assassination. The success of that attack might have encouraged the Moscow attack a little over two months later.

In the first decade of this century, after the Soviet collapse and its own withdrawal from an earlier war in Afghanistan, the Kremlin was very concerned about the rise of radical Islam in the Central Asian republics. For that reason, even Putin, for a while anyway, was keen to help the United States after the Sept. 11 terrorist attacks—sharing intelligence about al-Qaida and urging Central Asian leaders to let the U.S. military use their airfields to service and resupply our own invasion of Afghanistan.

However, after Putin’s annexation of Crimea in 2014 and especially since Russia’s outright invasion of Ukraine in 2022, contacts between Washington and Moscow have broken off.

Twice this month, in accordance with a long-standing policy known as “duty to warn,” U.S. intelligence officials notified their Russian counterparts of a report that ISIS-K was planning a terrorist attack in Russia. Putin waved away the warning as “an attempt to frighten and destabilize our society.”

By coincidence, shortly after the Americans’ first warning, Russia’s Federal Security Service stopped an impending attack on a Moscow synagogue. It is possible that Putin or his aides thought that this was the attack in the U.S. duty-to-warn notice (which, in any case, did not contain any details about when or where a terrorist strike might take place).

Russian intelligence and security forces were probably also shorthanded, as the vast majority of them have been diverted to—or distracted by—the war in Ukraine. Large concert halls are particularly ripe targets—and the Crocus City Hall in Krasnogorsk, the northwestern district of Moscow where this attack took place, is a vast mall that includes a hotel, restaurants, and a few music venues. It would be very difficult for even the most fully staffed and scrupulous security team to check every person and every bag entering its main doors.

Nonetheless, it was clear Putin was caught off guard. He remained silent for several hours after the attack. When he finally emerged, he spoke on a televised broadcast for a mere five minutes, made no mention of ISIS, and came close to blaming the incident on Ukraine. First, he likened the perpetrators to “Nazis,” a term he often uses to describe the officials in Kyiv. Second, he said that, whoever they were, they were fleeing toward Ukraine, where they would be received with open arms. (Ukraine denies any involvement in the attack. ISIS-K has openly claimed responsibility.)

It is not known whether the four men arrested were the only ones who took part in the attack—or even whether all four of these men actually did. After confessing to the crime, they appeared in Russian court in a clearly beaten state, some with bruises and swollen faces, one sitting unconscious in a wheelchair.

Will the attack damage Putin politically? Some think so. It is the deadliest terrorist attack in Russia in 20 years. Many Russians have ceded to Putin’s domestic oppression, even to his war, reasoning that at least he has kept the country safe and strong. The concert-hall attack delivers a sucker punch to that notion—especially when viewed alongside a spate of attacks on Russian oil refineries, railway depots, and other high-profile targets, launched either by Ukrainians who surreptitiously crossed the border or by Russian saboteurs.

Then again, Putin has survived a plethora of plots, threats, and horrid situations that would have knocked many other dictators out of power or worse. He may survive this one as well, and may even exploit it—as he has done in the wake of terrorist attacks in the past—to intensify his campaigns against enemies domestic and foreign, imagined and real.

Putin’s grip on power is at once tenacious and vulnerable, just as Russia itself acts at times like a rapacious empire and, at others, like a ramshackle cogwheel spinning out of control and about to implode. The combination—when it comes to both the man and his fiefdom—can be dangerous.

What is ISIS-K, the terror group linked to the Moscow concert hall bombing?

When discussing the biggest threats facing the United States these days, U.S. intelligence officials invariably mention China and Russia, then often segue to cyberattacks, pandemics and climate change.

Islamic extremist terrorism, which animated American foreign policy and defense strategy for a decade and a half after the terrorist attacks of Sept. 11, 2001, has receded as a top-tier concern.

The attack that killed 133 people in a Moscow concert hall Friday is a reminder, however, that the terrorism threat still looms.

The group that claimed credit, an offshoot of ISIS called Islamic State in Khorasan, or ISIS-K, has eclipsed the once-fearsome core ISIS organization in Iraq and Syria as perhaps the most dangerous terrorist organization, U.S. officials and outside experts say.

“It’s becoming more of a regional actor,” said Daniel Byman, a counterterrorism specialist at Georgetown University. “It claimed responsibility for the attack in Iran in January, and now we have this devastating attack in Moscow.”

The Iran attack was a double suicide bombing that killed almost 100 people at a memorial for the Revolutionary Guard commander Qassem Soleimani. U.S. officials say ISIS-K also was responsible for the 2021 Abbey Gate bombing outside Kabul’s Hamid Karzai International Airport that killed 13 American service members and 170 Afghan civilians.

Although U.S.-backed fighters five years ago drove the core ISIS from its so-called caliphate in Syria and declared victory, the remnants of the group remained. ISIS-K is believed to be active in Afghanistan, Pakistan and Iran, and appears to have aspirations to attack Europe and the U.S., American officials say.

According to a July 2023 report to the United Nations Security Council, ISIS-K counts 4,000 to 6,000 members on the ground in Afghanistan, including fighters and their relatives.

To be sure, even if most of the U.S. public has largely stopped thinking about groups like ISIS, American defense officials have not. Gen. Michael Kurilla, who heads U.S. Central Command, told a House committee last week that ISIS-K “retains the capability and the will to attack U.S. and Western interests abroad in as little as six months with little to no warning.”

He also warned that core ISIS members are languishing in Syrian detention camps.

“Over 9,000 detainees across 27 different detention facilities in Syria,” Kurilla said. “We need to repatriate those detainees to either face prosecution or reintegration, rehabilitation, back into their societies.”

The good news, from the American perspective, is that the U.S. appears to have significant intelligence insights into the plans and intentions of ISIS-K. U.S. officials warned both Iran and Russia that ISIS-K was poised to attack in those countries before the fact. Putin rejected the warning, but the U.S. Embassy in Moscow issued a public statement warning Americans to stay away from concert halls.

“That’s pretty impressive,” Byman said. “It shows that U.S. counterterrorism capabilities remain an important factor. If they are trying to do something in Europe or the United States, there is at least a reasonable chance U.S. intelligence might be able to detect it.”

Still, American officials worry that, while they may detect planning that involves a number of terrorists, they cannot guarantee they will discover a plot that involves sending one or two people into the U.S., or one that involves a lone extremist who is already in the country.

Islamic State in Khorasan was founded in 2015 by breakaway members of the Pakistani Taliban. It includes people of Afghan and Pakistani origin, as well as Central Asians. The group is now at war with the Taliban government in Afghanistan, which puts it under pressure.

“I would say that ISIS-K poses a bit of a larger threat, but they are under attack from the Taliban regime right now,” Lt. Gen. Scott Berrier, head of the Defense Intelligence Agency, told senators earlier this month. “And it’s a matter of time before they may have the ability and intent to actually attack the West at this point.”

A number of ISIS-K plots in Europe have been disrupted, Byman said, including with a wave of arrests of people from Central Asia in Germany and the Netherlands in July.

In January, Turkish officials say two masked members of ISIS-K attacked and killed a person at a Catholic Church in Istanbul.

Russia, which invaded Afghanistan in the 1980s, crushed a rebellion in Muslim-majority Chechnya in the 1990s and backed the Syrian government against ISIS in the 2010s, has long been a target of jihadis, experts say.

“Many may think of ISIS as a group bent on hurting the U.S. and its Western allies and partners. And that’s wholly true. But in reality, ISIS casts a much wider net for its targeting,” said Michael Kugelman, director of the South Asia Institute at the Wilson Centre think tank in Washington.

“The whole world is in its crosshairs, including Russia, a country that ISIS has long viewed with contempt and threatened in its propaganda,” Kugelman said, adding that the terror group puts Russia in the same category as the U.S., an evil crusader state that invades and preys on Muslim states.

One of the newer motivations for ISIS to hit Russia is its close ties with the Taliban, a bitter enemy of ISIS. Two Russian embassy staff were killed in a 2022 attack claimed by ISIS in Kabul.

“So there’s a precedent at play,” Kugelman said. “In effect, Russia’s foreign policy is hard wired to trigger ISIS. That, combined with the prestige factor — ISIS can show off to other militant groups its capacity to inflict damage on a top global power — makes Russia an especially attractive target.”