Islamic State Khorasan Province activity in Afghanistan and Pakistan during January 2026: a factual monitoring-based account

In January 2026, the Islamic State Khorasan Province, commonly known as ISKP or ISIS-K, demonstrated continued operational intent in both Afghanistan and Pakistan through a small number of attacks and attempted operations. While the overall volume of incidents attributed to ISKP during the month remained lower than peak periods observed in earlier years, the nature of the attacks, their symbolic targeting, and the geographic spread underline the group’s enduring capability to conduct high-impact violence and to shape security narratives well beyond its immediate operational footprint. This article consolidates verified facts from international news agencies, human rights reporting, and regional monitoring platforms to present a neutral and evidence-based account suitable for public reference.

The most clearly documented and widely corroborated ISKP attack in January took place on 19 January 2026 in Kabul. A suicide bomber detonated explosives inside a restaurant frequented by foreign nationals, located within a hotel complex in the Shahr-e-Naw area of the Afghan capital. Afghan authorities confirmed that seven people were killed and several others wounded. Among the dead was at least one Chinese national. The Taliban administration’s interior ministry acknowledged the incident, and emergency medical sources confirmed the casualty figures shortly after the attack. ISKP claimed responsibility through its official propaganda outlet, stating that the attacker had deliberately targeted Chinese nationals. This claim was reported by multiple international outlets and aligns with ISKP’s established pattern of quickly publicising operations it considers strategically or ideologically significant.

The Kabul restaurant attack fits within ISKP’s broader operational history of targeting urban civilian spaces with high symbolic value. The choice of a venue associated with foreign nationals was consistent with ISKP’s messaging strategy, which frequently links local violence to global grievances. While independent forensic investigations by international bodies were not publicly available at the time of reporting, the convergence of official Afghan confirmation, hospital data, and ISKP’s own claim places this incident among the highest-confidence attributions to the group during the month. For monitoring and analytical purposes, the basic facts of the attack can be treated as reliable, with attribution confidence assessed as medium to high.

Elsewhere in Afghanistan, January also saw reports of ISKP-linked violence targeting civilian transport and densely populated areas in Kabul, particularly in neighbourhoods historically vulnerable to sectarian attacks. Human rights organisations and regional security monitors documented incidents involving passenger vehicles and public spaces in early January that resulted in civilian casualties. In several cases, ISKP issued claims of responsibility, framing the attacks within its ongoing campaign against minority communities. While these reports are credible in terms of the occurrence of violence and civilian harm, limitations on independent access and the lack of publicly released forensic details constrain full verification. As a result, attribution to ISKP in these cases rests primarily on the group’s claims and the consistency of the attacks with its known tactics, rather than on conclusive third-party investigations.

In Pakistan, one of the most widely reported violent incidents during the same period occurred on 10 January 2026 in Wana, South Waziristan. A religious scholar and local political figure was killed in a targeted explosive attack near a madrassa. Pakistani media outlets, both regional and national, reported the killing and identified the method as an improvised explosive device. While some analysts and militant-linked channels suggested ISKP involvement, there was no widely disseminated claim of responsibility through ISKP’s established media apparatus. Additionally, the security environment in Pakistan’s former Federally Administered Tribal Areas is characterised by the presence of multiple armed actors, including local militant factions, criminal networks, and rival extremist groups. For these reasons, while the killing itself is well supported by multiple local sources, attribution specifically to ISKP remains uncertain. From an analytical standpoint, the incident is best described as a confirmed targeted killing with contested perpetrator attribution.

Monitoring organisations also recorded at least one attempted or foiled attack in Afghanistan during mid to late January that was attributed by local security sources to ISKP. These reports typically described arrests or the disruption of planned attacks, sometimes accompanied by the seizure of explosive materials. However, public reporting on these incidents was limited in detail and often relied on single-source security statements. Independent confirmation, such as court records, photographic evidence, or corroborating international media coverage, was largely absent. Consequently, while such reports suggest ongoing ISKP intent and planning activity, they cannot be treated with the same level of confidence as completed attacks with verified casualties. For transparency, these incidents should be categorised as low to medium confidence in terms of both occurrence and attribution.

Taken together, the January incidents highlight several important trends relevant to security monitoring and risk assessment. First, ISKP continues to prioritise high-visibility attacks in urban centres, particularly Kabul, where even a single successful operation can generate disproportionate international attention. Second, the group’s willingness to target foreign nationals underscores a calculated effort to internationalise its local insurgency and to position itself as a global jihadist actor rather than a purely regional threat. Third, the ambiguity surrounding certain incidents in Pakistan illustrates the analytical challenges posed by complex conflict environments where multiple violent actors operate simultaneously and where propaganda claims may be absent, delayed, or deliberately misleading.

The humanitarian and civilian protection implications of these developments are significant. Attacks on restaurants, passenger transport, and religious or educational sites heighten the sense of insecurity among civilians and place additional strain on already limited emergency response systems. For foreign nationals, development workers, and humanitarian staff, such incidents reinforce the need for robust risk mitigation measures, particularly in urban areas previously considered relatively secure. From a broader policy perspective, the January events also demonstrate the importance of cautious public attribution. Overstating or prematurely confirming ISKP responsibility without sufficient evidence risks amplifying extremist propaganda, while underreporting credible threats may leave civilian populations inadequately informed.

From a credibility standpoint, international wire services such as Reuters and regionally focused outlets like Al Jazeera and Radio Free Europe or Radio Liberty provided the most reliable factual reporting on the confirmed Kabul attack, supported by official statements and on-the-ground sources. Human rights organisations offered valuable contextual analysis on patterns of violence and civilian impact, though their reporting is not designed to serve as definitive forensic attribution. Local Pakistani media proved reliable for confirming incidents such as the Wana killing but less conclusive regarding perpetrator identity. Regional incident trackers and security databases were useful for situational awareness but require careful cross-checking before being used as standalone evidence.

In conclusion, ISKP activity in January 2026, while limited in number, illustrates the group’s continued capacity to conduct lethal attacks, its strategic focus on symbolic targets, and the persistent challenges faced by analysts and the public in distinguishing verified facts from contested claims. The Kabul restaurant bombing stands out as the most clearly attributable ISKP operation of the month, while other incidents should be approached with measured caution and transparent acknowledgment of evidentiary limits. For readers, researchers, and policymakers, a fact-based and source-conscious approach remains essential to understanding the evolving threat landscape posed by ISKP in Afghanistan and Pakistan.