In 2014, the jihadist group Islamic State (IS) announced it was expanding to the Khorasan region, whose historical territory included parts of modern-day Iran, Central Asia, Afghanistan, and Pakistan. Since then, Islamic State-Khorasan Province (IS-KP) has been responsible for scores of attacks against civilians in Afghanistan and Pakistan, as well as hundreds of clashes with US, Afghan and Pakistani security forces.

And now it appears that IS-KP may have had a hand in the murderous Easter Sunday events in Sri Lanka. The Islamic State group on Tuesday, without specifically mentioning the Khorasan branch, claimed a series of bombings that killed more than 320 people in the island nation.

“Those that carried out the attack that targeted members of the US-led coalition and Christians in Sri Lanka the day before yesterday are Islamic State group fighters,” said a statement released by IS propaganda agency Amaq. No details were given.

The investigation of the bomb attacks had focused quickly on the IS. In their aftermath, Sri Lankan cabinet minister and spokesperson Rajitha Senaratne named a local group, but also speculated about support from “international networks.”

As investigators in Sri Lanka and their counterparts in South Asia begin to sift through clues and intelligence, the IS-KP and remnants of the defeated IS army in Syria emerged as key suspects. “We don’t see that only a small organization in this country can do all that,” said Senaratne. “We are now investigating the international support for them, and their other links … how they produced the suicide bombers here, and how they produced bombs like this.”

A video that had surfaced on Monday night is believed to have been released by IS supporters claiming responsibility for the attack. It was credited to Al Ghuraba Media. It is not an official Islamic State channel, but Al Ghuraba serves as a platform for IS supporters.

Abu Bakr al-Baghdadi, the self-proclaimed caliph of the Islamic State, was last heard from in August 2018, in an audio recording titled “Give Good Tidings to the Patient,” encouraging his supporters to ignore territorial losses and carry out attacks wherever they might find themselves.

IS sympathizer

Investigators from India’s National Investigation Agency, a body that is exclusively tasked with carrying out terror-related investigations, said that six months ago they had chanced upon clues to an impending attack in Sri Lanka.

Investigators said they were interrogating a man they believed to be an “IS sympathizer” in Chennai, the capital of the southern Indian state of Tamil Nadu. The state has had historic links with Sri Lanka, whose ethnic Tamil minority migrated from there.

While investigators did not divulge the sympathizer’s name, they say they did pass on to their Sri Lankan counterparts the information he’d given. This could be the “foreign intelligence” that the Sri Lankan police chief was referring to when he sent out an alert warning of a possible bomb attack.

South Asia has seen linkages to the IS and specifically to the Islamic State-Khorasan Province. In Bangladesh, an attack in the Gulshan area in Dhaka was carried out by IS cadres. India has seen 80-odd people leaving to join the IS. The largest group came from the southern states of Kerala and Tamil Nadu and were believed to be living with the IS-KP in Afghanistan.

The IS-KP was formed in 2014 with Hafiz Saeed Khan chosen as its “emir.” Khan, a Pakistani national, was with the Teherik-e-Taliban Pakistan (TTP) before moving to head the IS-KP. The group congregated around Nangarhar province in Afghanistan, and at least 22 members from Kerala in India were last reported to be with this group. A few Tamils from India were also suspected of belonging to the IS-KP.

In 2017, following a spate of terrorist attacks in India, Indian intelligence began to focus on the IS-KP. The attacks in India were carried out by the Lashkar-e-Taiba (LeT) and the Jaish-e-Mohammed (JeM), two groups that were dominated by Pakistani Punjabis. However, by 2017, Indian and US intelligence began to discover links and communications between the Punjabi LeT and JeM groups and the IS-KP.

Last year, intelligence reports began to indicate that Maldivians and Sri Lankans were also heading to IS-KP for training after being radicalized online by IS cadres.

Security analysts now believe that Sri Lanka was targeted because it was a “very soft” target. “There has been a radical Islamic infrastructure that we were monitoring,” a senior security analyst told Asia Times. “The LeT also held some meetings that revealed that this infrastructure existed. Anti-Muslim riots last year exacerbated tensions and this could have led to the present attacks.”

Sri Lanka reached out to India seeking help with the investigation and, according to Indian government sources, is keen to interrogate the “IS sympathizer” who gave the first inputs about a possible attack six months ago.