Five years ago this month, an American-backed Kurdish and Arab militia ousted Islamic State fighters from a village in eastern Syria, the group’s last sliver of territory.

Since then, the organization that once staked out a self-proclaimed caliphate across Iraq and Syria has metastasized into a more traditional terrorist group — a clandestine network of cells from West Africa to Southeast Asia engaged in guerrilla attacks, bombings and targeted assassinations.

None of the group’s affiliates have been as relentless as the Islamic State in Khorasan, which is active in Afghanistan, Pakistan and Iran and has set its sights on attacking Europe and beyond. U.S. officials say the group carried out the attack near Moscow on Friday, killing scores of people and wounding many others.

In January, Islamic State Khorasan, or ISIS-K, carried out twin bombings in Iran that killed scores and wounded hundreds of others at a memorial service for Iran’s former top general, Qassim Suleimani, who was targeted in a U.S. drone strike four years earlier.

“The threat from ISIS,” Avril D. Haines, the director of national intelligence, told a Senate panel this month, “remains a significant counterterrorism concern.” Most attacks “globally taken on by ISIS have actually occurred by parts of ISIS that are outside of Afghanistan,” she said.

Gen. Michael E. Kurilla, the head of the military’s Central Command, told a House committee on Thursday that ISIS-K “retains the capability and the will to attack U.S. and Western interests abroad in as little as six months with little to no warning.”

American counterterrorism specialists on Sunday dismissed the Kremlin’s suggestion that Ukraine was behind Friday’s attack near Moscow. “The modus operandi was classic ISIS,” said Bruce Hoffman, a terrorism scholar at the Council on Foreign Relations.

The assault was the third concert venue in the Northern Hemisphere that ISIS has struck in the past decade, Mr. Hoffman said, following an attack on the Bataclan theater in Paris in November 2015 (as part of a broader operation that struck other targets in the city) and a suicide bombing at an Ariana Grande concert in Manchester Arena, England, in May 2017.

Islamic State Khorasan, founded in 2015 by disaffected members of the Pakistani Taliban, burst onto the international jihadist scene after the Taliban toppled the Afghan government in 2021. During the U.S. military withdrawal from the country, ISIS-K carried out a suicide bombing at the international airport in Kabul in August 2021 that killed 13 U.S. service members and as many as 170 civilians.

Since then, the Taliban have been fighting ISIS-K in Afghanistan. So far, the Taliban’s security services have prevented the group from seizing territory or recruiting large numbers of former Taliban fighters, according to U.S. counterterrorism officials.

But the upward arc and scope of ISIS-K’s attacks have increased in recent years, with cross-border strikes into Pakistan and a growing number of plots in Europe. Most of those European plots were thwarted, prompting Western intelligence assessments that the group might have reached the lethal limits of its capabilities.

Last July, Germany and the Netherlands coordinated arrests targeting seven Tajik, Turkmen and Kyrgyz individuals linked to a ISIS-K network who were suspected of plotting attacks in Germany.

Three men were arrested in the German state of North Rhine-Westphalia over alleged plans to attack the Cologne Cathedral on New Year’s Eve 2023. The raids were linked to three other arrests in Austria and one in Germany on Dec. 24. The four people were reportedly acting in support of ISIS-K.

American and other Western counterterrorism officials say these plots were organized by low-level operatives who were detected and thwarted relatively quickly.

“Thus far, ISIS-Khorasan has relied primarily on inexperienced operatives in Europe to try to advance attacks in its name,” Christine S. Abizaid, the head of the National Counterterrorism Center, told a House committee in November.

But there are worrisome signs that ISIS-K is learning from its mistakes. In January, masked assailants attacked a Roman Catholic church in Istanbul, killing one person. Shortly afterward, the Islamic State, through its official Amaq News Agency, claimed responsibility. Turkish law enforcement forces detained 47 people, most of them Central Asian nationals.

Since then, Turkish security forces have launched mass counteroperations against ISIS suspects in Turkey, Syria and Iraq. Several European investigations shed light on the global and interconnected nature of ISIS finances, according to a United Nations report in January, which identified Turkey as a logistical hub for ISIS-K operations in Europe.

The Moscow and Iran attacks demonstrated more sophistication, counterterrorism officials said, suggesting a greater level of planning and an ability to tap into local extremist networks.

“ISIS-K has been fixated on Russia for the past two years,” frequently criticizing President Vladimir V. Putin in its propaganda, said Colin P. Clarke, a counterterrorism analyst at the Soufan Group, a security consulting firm based in New York. “ISIS-K accuses the Kremlin of having Muslim blood in its hands, referencing Moscow’s interventions in Afghanistan, Chechnya and Syria.”

A significant portion of ISIS-K’s members are of Central Asian origin, and there is a large contingent of Central Asians living and working in Russia. Some of these individuals may have become radicalized and been in position to serve in a logistical function, stockpiling weapons, Mr. Clarke said.

Daniel Byman, a counterterrorism specialist at Georgetown University, said that “ISIS-K has gathered fighters from Central Asia and the Caucasus under its wing, and they may be responsible for the Moscow attack, either directly or via their own networks.”

Russian and Iranian authorities apparently did not take seriously enough public and more detailed private American warnings of imminent ISIS-K attack plotting, or were distracted by other security challenges.

“In early March, the U.S. government shared information with Russia about a planned terrorist attack in Moscow,” Adrienne Watson, a spokeswoman for the National Security Council, said on Saturday. “We also issued a public advisory to Americans in Russia on March 7. ISIS bears sole responsibility for this attack. There was no Ukrainian involvement whatsoever.”

Russian authorities on Saturday announced the arrest of several suspects in Friday’s attack. But senior American officials said on Sunday that they were still digging into the background of the assailants and trying to determine whether they were deployed from South or Central Asia for this specific attack or if they were already in the country as part of the network of supporters that ISIS-K then engaged and encouraged.

Counterterrorism specialists voiced concern on Sunday that the attacks in Moscow and Iran might embolden ISIS-K to redouble its efforts to strike in Europe, particularly in France, Belgium, Britain and other countries that have been hit on and off for the past decade.

The U.N. report, using a different name for Islamic State Khorasan, said “some individuals of North Caucasus and Central Asian origin traveling from Afghanistan or Ukraine toward Europe represent an opportunity for ISIL-K, which seeks to project violent attacks in the West.” The report concluded that there was evidence of “current and unfinished operational plots on European soil conducted by ISIL-K.”

A senior Western intelligence official identified three main drivers that could inspire ISIS-K operatives to attack: the existence of dormant cells in Europe, images of the war in Gaza and support from Russian-speaking people living in Europe.

One major event this summer has many counterterrorism officials on edge.

“I worry about the Paris Olympics,” said Edmund Fitton-Brown, a former top U.N. counterterrorism official who is now a senior adviser to the Counter Extremism Project. “They would be a premium terrorist target.”

Few know better than the Taliban what a relentless foe the Islamic State’s affiliate in Afghanistan can be.

Much of the West considers the Taliban, which reclaimed power in the country in 2021, to be an extremist Islamic movement. But the Islamic State Khorasan, the affiliate that has been linked by U.S. officials to a terrorist attack in suburban Moscow on Friday, has slammed the Taliban government, calling the group’s version of Islamic rule insufficiently hard-line.

The Islamic State Khorasan, or ISIS-K, is one of the last significant antagonists that the Taliban face in Afghanistan. It has carried out a bloody drumbeat of attacks throughout the country in recent years, seeking to use the violence to undermine the Taliban’s relationships with regional allies and to portray the government as incapable of providing security in Afghanistan, experts say.

In the months after the Taliban seized power, ISIS-K carried out near daily attacks on their soldiers at roadside checkpoints and in neighborhoods that are home to the country’s Hazara ethnic minority. The following year, ISIS-K fighters attacked the Russian Embassy in Kabul, tried to assassinate Pakistan’s top diplomat to Afghanistan and sent gunmen into a prominent hotel in Kabul that was home to many Chinese nationals, seeking to undermine the Taliban’s promise of restoring peace.

More recently, ISIS-K’s attacks have grown bolder and stretched beyond Afghanistan’s borders: The group killed at least 43 people in an assault on a political rally in northern Pakistan in July. It killed at least 84 people in two suicide bombings in Iran in January. Now, U.S. officials say ISIS-K was behind the attack in Moscow, which killed at least 133 people.

In recent months, ISIS-K has threatened attacks against the Chinese, Indian and Iranian Embassies in Afghanistan. It has also released a flood of anti-Russian propaganda, denouncing the Kremlin for its interventions in Syria and condemning the Taliban for engaging with the Russian authorities decades after the Soviet Union invaded Afghanistan.

“ISIS-K has long been motivated by the logic of outbidding in its attacks,” said Asfandyar Mir, a senior expert at the United States Institute of Peace. “It seeks to outperform rival jihadis by carrying out more audacious attacks to distinguish its jihadi brand and assert leadership of the global jihadi vanguard.”

ISIS-K was established in 2015 by disaffected fighters of the Pakistani Taliban, an ideological twin and ally of the Taliban in Afghanistan. ISIS-K’s ideology spread partly because many villages in eastern Afghanistan and Pakistan are home to Salafi Muslims, the same branch of Sunni Islam as the Islamic State. The Taliban, in contrast, mostly follow the Hanafi school of Islam.

From its early days, ISIS-K has been at odds with the Taliban, fighting over turf in eastern Afghanistan and later denouncing the Taliban’s new government for not instituting what it views as true Shariah law. ISIS-K propaganda has sharply criticized the Taliban for working to establish diplomatic relations with non-Muslim countries, including the United States and Russia, describing the efforts as a betrayal of the global jihadist struggle.

Before the U.S.-led war in Afghanistan ended in 2021, American airstrikes and Afghan commando raids had contained ISIS-K mostly to eastern Afghanistan. But after the withdrawal of Western troops, the Islamic State’s reach expanded to nearly all of the country’s 34 provinces, according to the United Nations Assistance Mission in Afghanistan.

Since seizing power, the Taliban have carried out a relentless and often ruthless counterterrorism campaign to squash ISIS-K. Those efforts have prevented the group from taking any territory in Afghanistan and pushed many of its fighters into Pakistan, experts say. Taliban security forces killed at least eight of ISIS-K’s leaders in the country last year, according to U.S. officials.

The crackdown drew condemnation from human rights groups that claimed Taliban security forces were summarily executing and forcibly causing disappearances of people accused of being affiliated with the Islamic State in eastern Afghanistan, the group’s historic stronghold.

U.N. monitors also cautioned this year that the Taliban’s counterterrorism operations against ISIS-K “appear to be more focused on the internal threat posed to them than the external operations of the group.”

But even as ISIS-K cells have come under mounting pressure from Taliban security forces, the group has proved resilient and remained active across Afghanistan, Pakistan and Iran. Just a day before the attack near Moscow, the group carried out a suicide bombing in Kandahar, Afghanistan — the birthplace of the Taliban movement — sending a powerful message that even Taliban soldiers in the group’s heartland were not safe.

“The success by the Afghan Taliban didn’t change the degree of threat that the Islamic State Khorasan posed in Afghanistan,” said Riccardo Valle, the director of research at the Khorasan Diary, a research platform based in Islamabad, Pakistan’s capital. “It simply forced the Islamic State to shift its military tactics.”

Now, rather than staging small hit-and-run attacks on low-level Taliban soldiers and police officers, ISIS-K has turned its focus to major attacks in Afghanistan and beyond, experts say.

Its propaganda has also painted the Taliban as “betraying the history of Afghanistan and betraying their religion by making friends with their former enemies,” Mr. Valle said, referring to Russia.

While no country has officially recognized the Taliban government, Russia accepted a military attaché from the Taliban in Moscow this month. China accepted a Taliban ambassador to the country. Both moves were seen as confidence-building measures.

After the attack in Moscow, Abdul Qahar Balkhi, a spokesman for Afghanistan’s foreign ministry, said in a statement on social media that the country “condemns in the strongest terms the recent terrorist attack in Moscow” and “considers it a blatant violation of all human standards.”

He added: “Regional countries must take a coordinated, clear & resolute position against such incidents directed at regional destabilization.”

Zia ur-Rehman contributed reporting.