Terrorism and counterterrorism in the North Caucasus in 2024

Trends in sub-state violence and state responses

Executive summary

In 2024, the North Caucasus remained a focal point of terrorism-related activity in Russia, with at least 93 incidents reported across the region. This inaugural annual report provides an in-depth analysis of developments, offering critical insights into the dynamics of regional instability and security challenges in 2025.

Regional trends and hotspots

• Ingushetia and Dagestan emerged as the epicentres of instability, accounting for 41% and 24% of all incidents. Chechnya, at 12%, was also a notable area of concern.
• The security services were the primary drivers of activity, initiating 89% of all incidents. However, rebel attacks were more lethal, contributing at least 72% of reported casualties.

Key developments by republic

• Dagestan: In June, the republic experienced the largest terrorist attacks seen in the region in recent years, with coordinated assaults in Derbent and Makhachkala. These attacks contributed significantly to overall casualty figures and influenced subsequent counterterrorism activity in the republic.
• Ingushetia: Activity linked to the Batalkhadzhintsy brotherhood featured prominently. Counterterrorism activity often spanned multiple locations simultaneously, leading to the detention of individuals accused of plotting attacks.
• Chechnya: The republic was the focal point for a new security-related phenomenon: drone attacks, likely linked to Russia’s war on Ukraine. Several incidents resulting in casualties occurred at police checkpoints.
• Elsewhere: Karachayevo-Cherkessia briefly emerged as a security concern, while Kabardino-Balkaria also experienced major incidents. Detentions for alleged involvement in jihadist activities, terrorist plots linked to the Ukraine conflict, and historic participation in insurgency were a key feature of the counterterrorism landscape.

Implications for 2025

• Terrorism-related violence in the North Caucasus shows little sign of abating. While the absence of organised insurgent leadership and infrastructure limits the scope of the threat, evidence of increased coordination and a weakening of security service intelligence capabilities suggest the potential for higher-impact incidents in 2025.
• At the same time, the fragmented nature of violent resistance and the heavy-handed dominance of the security services continue to prevent the emergence of a unified or sustained insurgency.

However, the limitations of the information environment make it difficult to assess the true scale of the threat or predict future escalations with confidence. Changes in the level of violence may be the sole reliable marker of evolving instability in the region.

Overview

• Introduction: Armed struggle in the North Caucasus in 2024
• Ingushetia and Dagestan dominate regional picture
• Major Dagestani attacks shape and distort casualty figures
• Counterterrorism shapes security landscape in Ingushetia
• Low-level clashes at police checkpoints in Chechnya
• Varied terrorism-related activity across the rest of the North Caucasus
• Assessment and implications for 2025
• Appendix: Sources and methods

Introduction: Armed struggle in the North Caucasus in 2024

The North Caucasus has been a persistent source of political violence and instability since the collapse of the Soviet Union. What started as a nationalist-separatist struggle for Chechen independence gradually morphed into a jihadist insurgency that engulfed the entire region. At its peak, the insurgency posed a formidable challenge to Moscow’s authority, with significant consequences for the local population and the region’s social, economic, and political development. Over time, however, Russian counterinsurgency strategies and shifts in the global jihadist landscape combined to erode the foundations of armed struggle. The collapse of the Caucasus Emirate in 2015 and the Islamic State’s Caucasus Wilayah in 2017 marked the end of jihadist state-building projects.

Today, an organised insurgent infrastructure and recognised rebel leadership no longer exist in the region. Nevertheless, episodic violence – often inspired by jihadist ideology – persists, with both terrorism-related activity and state responses regularly reported by the media. As such, the region remains a key source of domestic instability for Russia, and understanding the dynamics of terrorism and counterterrorism is critical for evaluating contemporary security threats.

This report examines key developments in 2024, drawing on a unique incident database compiled from open-source media reporting (see Appendix). It analyses patterns of terrorism [1] and counterterrorism to identify important trends and assess their implications for regional instability.

[1] Much of the sub-state violence in the North Caucasus can be considered ‘insurgency’ rather than ‘terrorism,’ in so far as it targets the security services rather than civilians. However, the language of insurgency can create the misleading impression of organised armed struggle operationally linked to its historic manifestations. No analytic distinction is made in this report between terrorism and insurgency, reflecting the typical absence of such distinctions in underlying reporting, and ‘rebel’ is used as an inclusive term for various forms of anti-state activity.

Ingushetia and Dagestan dominate regional picture

Ingushetia, Dagestan contribute majority of regional violence

In 2024, a total of 93 terrorism-related incidents were reported across the North Caucasus, underscoring the region's persistent instability. The republics of Ingushetia and Dagestan emerged as the primary hotspots, accounting for 38 and 22 incidents, respectively — together accounting for over 65% of all reported incidents.

Other republics experienced comparatively lower levels of activity: Chechnya reported 10 incidents, followed by Stavropol Kray with eight, Karachayevo-Cherkessia with six, Kabardino-Balkaria with five, and North Ossetia with three. The location of one incident was not specified by available reporting.

Security services drive terrorism-related activity in the region

The security services were the primary drivers of regional violence in terms of the number of reported incidents, accounting for 85 out of the 95 recorded in 2024. These incidents included clashes with alleged terrorists initiated by security service actions, such as document checks and attempted detentions.

Security services dominated the reported activity across all republics, with Kabardino-Balkaria and Stavropol Kray exclusively reporting security service-led incidents. This highlights the importance of including state actors in any assessment of the broader landscape of terrorism and instability.

By contrast, ten terrorist attacks were recorded across the region, with Dagestan reporting the highest number (four incidents). Chechnya, Ingushetia, and Karachayevo-Cherkessia each experienced two attacks. While specific groups were rarely named in reporting, media reporting often framed incidents in the broader context of the region’s long-standing struggle against jihadist insurgency. None of the attacks were directly linked to Ukrainian actors, despite Ukraine-related plots featuring heavily in detentions and court cases elsewhere in Russia.

Terrorism-related detentions reported across the North Caucasus

Throughout 2024, Ingushetia and Dagestan reported the highest number of terrorism-related detentions – with 42 and 38 cases respectively – reflecting their status as focal points of counterterrorism activity. Kabardino-Balkaria ranked third with 26 reported detentions, followed by Chechnya (15), Stavropol Kray (12), Karachayevo-Cherkessia (7), and North Ossetia (1).

Detentions targeted a range of alleged terrorist threats, including:

• Individuals accused of planning attacks on behalf of jihadist groups or the Ukrainian security services;
• Individuals charged with providing logistical and financial support to alleged members of terrorist groups;
• Individuals implicated in historic insurgent activity, such as that led by Shamil Basayev and Emir Khattab in the Second Chechen War.

Arbitrary behaviour by law enforcement organs and a lack of due process makes it difficult to reach reliable conclusions about the degree to which detentions reflected the threat posed by terrorism. Independent media outlets frequently report on the torture of detainees, forced confessions, and planted evidence, and the security services have material incentives to exaggerate both their successes and the challenges they face.

Major Dagestani attacks shape and distort casualty figures

Terrorism-related incidents in 2024 resulted in estimates of between 82 and 122 casualties. The range reflect conflicting media and official accounts of the human costs of political violence, particularly for larger incidents.

When analysed from the perspective of number of casualties, rebel-initiated events accounted for a disproportionate share. Such incidents produced between 63 and 98 casualties, representing between 77% and 80% of the total figures. However, the 23 June attacks in Dagestan – the most lethal incidents of the year, which will be discussed later in the report – contributed a significant portion of this violence (between 46 and 72 casualties). Excluding these two attacks, the balance shifts, with security service-initiated violence responsible for an estimated 48-52% of casualties.

Media reports rarely attributed rebel-initiated violence to specific groups. Exceptions to this trend are discussed in the analysis of events within each republic.

Drone attacks emerge as new security threat focused primarily on Chechnya

A new dimension of political violence emerged in the North Caucasus in late 2024: drone attacks. The first reported incident occurred in Chechnya on 29 October, with four further attacks occurring in the republic by the end of the year. Two incidents took place in North Ossetia and one each in Dagestan and Ingushetia.

Most drone attacks did not result in direct casualties, with drones often being intercepted by air defence systems near or en route to their apparent targets. However, two exceptions highlighted the potential lethality of both successful and thwarted drone attacks:

• On 12 December, a drone strike hit the barracks of the Akhmat Kadyrov Special Purpose Police Regiment in Groznyy, lightly wounding four members of the security services.
• On 25 December, a drone was shot down over a shopping mall in Vladikavkaz, North Ossetia, resulting in one fatality and 10 injuries.

The reaction to drone attacks has as much potential to negatively impact security and geopolitical dynamics as the attacks themselves. This was demonstrated clearly on 25 December, when Russian air defence systems mistakenly struck an Azerbaijani Airlines plane, causing it to crash in Kazakhstan.

Drone attacks are arguably better categorised as security- rather than terrorism-related incidents. However, no perpetrators were explicitly identified in most cases, although the Ukrainian military was the most likely actor. Drone attacks are likely to continue in the future, given that they are relatively low cost, highly disruptive, and align with broader Ukrainian military strategy.

Major Islamic State attacks dominate developments in Dagestan

Twin attacks produce high casualty figures

On 23 June, the North Caucasus experienced one of the largest terrorist attacks of recent years, when armed assailants carried out simultaneous assaults on religious institutions and police in Derbent and Makhachkala.

The attack resulted in between 46 and 74 casualties, including between 21 and 28 fatalities. Among the reported dead were 15 members of the security services and the six perpetrators of the attack. Official accounts of the incident conflicted, resulting in discrepancies in the figures. A separate incident on the same day in Sergokala, where unidentified gunmen fired on a police car, wounding one, appeared unrelated to the events in Derbent and Makhachkala.

The investigation into the attack focused on the family of Sergokalinskiy Rayon Head Magomed Omarov, whose two sons and two nephews were identified as perpetrators. At least twelve more relatives were subsequently detained. Several other people were also later charged with aiding the attackers. Omarov lost his job and, along with another son, was detained on non-terrorism-related charges.

No group claimed responsibility for the attacks, though Islamic State-linked media outlets praised them. Local officials speculated that the attacks aimed to spread panic and fear, and some suggested links to Ukraine — albeit without evidence. An investigative media outlet claimed that, while the Kremlin refrained from directing the narrative, it possessed intelligence identifying the Islamic State as the culprit.

You can read more about these developments in this Event in Review article.

Security service activity targets alleged accomplices, plotters

The investigation into the 22 March attack on Crocus City Hall in Moscow (see Event in Review: The Crocus City Hall terrorist attack in Moscow (Mar 24)) had repercussions for Dagestan. On 31 March, the security services imposed a counterterrorism regime (KTO) on Kaspiysk and two districts of Makhachkala. Four suspects, including Tajikistani nationals, were detained on charges of aiding the Crocus City Hall attackers and planning their own attacks. Weapons and an improvised explosive device (IED) were seized in the operations.

Elsewhere, the security services claimed successes in efforts to prevent terrorist attacks. Key developments included:

• July: Two men were detained in Kurush in Khasavyurtovskiy Rayon and three in a separate operation in Kaspiysk. All were accused of planning attacks.
• October: Four people were detained in Derbent on charges of creating and financing an extremist group.
• December: The security services detained 12 people across multiple sites, including Serebryakovka in Kizlyarskiy Rayon, and Astrakhan, on charges of planning a terrorist attack. The authorities claimed that the men, who included an imam from Serebryakovka, were tied to an unspecified terrorist organisation, which at least one media outlet identified as the Islamic State.

The security services also detained five people in separate operations in March, June, and October on suspicion of historic involvement in insurgent activity.

Counterterrorism shapes security landscape in Ingushetia

Batalkhadzhintsy brotherhood in the spotlight

The Batalkhadzhintsy, a highly secretive Sufi brotherhood, emerged as a prominent focal point of terrorism-related activity in Ingushetia in 2024. The group, whose members follow the teachings of 19th Century Sheikh Batal-Khadzhi Belkharoyev, is often described as a “state within a state.” It has been in prolonged conflict with the Ingushetian authorities and designated as a terrorist organisation, yet simultaneously enjoys the support of Chechen leader Ramzan Kadyrov (for more details about the group, see this report).

Key incidents involving the Batalkhadzhintsy include:

• March: A member of the group was detained on charges related to a 2020 murder.
• April: Another member was detained on suspicion of illegal possession of weapons.
• October: A vehicle carrying employees of the Centre for Combatting Extremism in Magas was attacked, resulting in three fatalities. Media outlets attributed the attack to the Batalkhadzhintsy, and police later detained a member of the group as an alleged accomplice.
• December: Four members of the Batalkhadzhintsy were detained for allegedly aiding an accomplice in the Crocus City Hall attack.

Security services conduct multi-site operations to prevent attacks

Ingushetia witnessed several large-scale operations across multiple locations, offering a potential indicator of the growing complexity of the terrorist threat in the republic. Key operations included:

• March: The Federal Security Service (FSB) imposed a KTO in Karabulak. In the ensuing special operation, six alleged Islamic State members were killed. Another man was detained separately, accused of providing support to the group.
• August: Raids in Nazran and Kantyshevo led to the detention of six individuals accused of planning attacks.
• September: Security forces detained seven people and killed one in operations in Magas and Nazran, alleging that the men were planning attacks and possessed significant weapons stockpiles.
• October: The security services conducted simultaneous searches in Magas, Nazran, and Ekazhevo, arresting four and seizing IEDs and ammunition.

Isolated incidents illustrate ongoing low-level instability

In addition to high-profile operations and Batalkhadzhintsy-related events, Ingushetia continued to experience sporadic, smaller-scale incidents in 2024. These included:

• January and October: Three individuals were detained in separate incidents for aiding a group involved in March 2023 attacks.
• March: One individual was detained in Alkhasty on charges of aiding insurgents.
• September: A man attacked police officers at a traffic post in Magas using a screwdriver, wounding one officer before being killed.
• In November and December, two individuals were detained for providing support to the Islamic State.

Security forces also uncovered numerous arms caches across the republic throughout the year, underscoring the ongoing threat posed by low-level insurgent activity.

Low-level clashes at police checkpoints in Chechnya

Security checkpoints primary location for incidents

Several violent incidents occurred at police checkpoints, highlighting their potential to provide security flashpoints. Key incidents included:

• February: Chechen security services killed police lieutenant-colonel Albert Atmurzayev, a Russian Interior Ministry officer, at a checkpoint in Groznyy during a document check. Separately, the security services claimed that they had attempted to stop a group of three men, who opened fire in response and were killed; two more were detained as their accomplices the following day.
• October: Unknown individuals carried out two separate attacks, on a traffic police post in Gudermes and on a National Guard (Rosgvardia) vehicle in Petropavlovskaya in Groznenskiy Rayon. Two policemen were killed in the first incident; one member of the security services was killed and another wounded in the latter. In both cases, the attackers managed to escape and large-scale raids and arbitrary detentions by the security services in response were reported.

Such incidents highlight the difficulties of assessing levels of insurgent activity: there is a notable lack of due process and limited evidence is presented to support claims that people killed are insurgents. Legitimate responses to security threats consequently become indistinguishable from summary executions and arbitrary behaviour by the security services.

Varied terrorism-related activity across the rest of the North Caucasus

Karachayevo-Cherkessia briefly emerges as a security concern

Karachayevo-Cherkessia witnessed a rare surge in activity in April and May 2024, with two linked attacks and several security service operations:

• On 22 April, an unknown group attacked a police unit in Karachayevsk, killing two members of the security services and wounding another. Five local men were identified as the suspected perpetrators. Two days later, the authorities reported the discovery of a car used by the men.
• On 28 April, the same five men used automatic weapons and an IED to attack a mobile police unit in Mara-Ayagy. Casualty figures ranged between six and 11, but included all five attackers and at least one member of the security services.
• In May, the authorities claimed that they had killed an alleged participant of an international terrorist organisation who had resisted arrest in Adil-Khalk. Later the same month, a court in Cherkessk arrested six men accused of membership of at-Takfir wal-Hijra; it was not clear when the men were detained, but social media reporting suggested it was a recent occurrence.

The spike in activity was relatively unusual, given that the republic was not a major site of operations even during the years when an organised insurgency existed in the North Caucasus. However, it did not appear to be indicative of a sustained threat: the group involved in events in April seems to have been entirely eliminated in the incident on 28 April. Other security service activity in the republic concerned detentions for historic insurgent activity.

Isolated but large-scale incidents occur in Kabardino-Balkaria

The most significant development in Kabardino-Balkaria occurred in April, when the security services imposed a KTO on Nalchik and surrounding areas after receiving reports of insurgents operating in the area. In an ensuing special operation, two alleged insurgents were killed after resisting calls to surrender.

The republic also witnessed two significant operations to detain people accused of terrorist activity:

• July: The security services detained 10 people in Tyrnyauz for membership of a “sharia” patrol that attempted to impose a conservative cultural code over the course of several years.
• September: The leader of an extremist group and 14 of his followers were detained at an unspecified location.

Few significant developments of concern in North Ossetia

All three incidents reported in North Ossetia were small in scale:

• April: The security services detained a man on terrorism charges, accusing him of planning to fight for Ukraine.
• July: a man allegedly opened fire on police who tried to detain him; he was hospitalised and detained as a result.
• October: The security services discovered a burnt-out vehicle that apparently belonged to the perpetrators of the attack on a security service vehicle in Ingushetia carried out the day before.

Terrorism-related detentions prominent in Stavropol Kray

Incidents in Stavropol Kray included a mix of jihadist- and Ukraine-related activity, with most cases involving detentions for planning terrorist attacks:

• March: The security services detained a local resident in Yessentuki, accusing him of being in contact with the Free Russia Legion, a designated terrorist group supporting Ukraine. Three Central Asian citizens were also detained at an unspecifed location on charges of planning a terrorist attack.
• July: Security services detained a Central Asian native in Yessentuki, alleging he was linked to the Islamic State.
• August: Two local teenagers were detained in Stavropol, accused of planning a terrorist attack on communications infrastructure. Another man was detained in the same city on charges of aiding the Free Russia Legion.
• September: Three people were detained in Georgiyevsk and Lysogorskaya on charges of planning a terrorist attack.
• October: A man was detained in Stavropol, accused of planning an attack.

Assessment and implications for 2025

Terrorism-related incidents will persist

Terrorism-related incidents are likely to persist in the North Caucasus in 2025: They are an entrenched feature of the region’s political and security landscape. No significant changes in underlying dynamics suggest a meaningful decline in levels of violence will be forthcoming.

On the one hand, a portion of the population continues to be drawn to jihadist and other anti-state ideologies, rejects the legitimacy of the Russian state, and is willing to resort to violence to advance its goals. While it is unclear how large this population segment is, its size is arguably immaterial to the persistence of a threat: low-level violence will persist for as long as a small number of actors hold these characteristics. Its size impacts the scale of the threat, not its existence.

On the other hand, the security services remain the main drivers of violence. Structural incentives – such as material rewards for inflating the terrorism threat and a preference for force-driven solutions – persist, while initiatives to address the root causes that analysts have long identified remain absent. Consequently, neither the motivations of key actors nor environmental conditions have shifted in ways that would significantly reduce terrorism-related activity in the short term. Dagestan, Ingushetia, and Chechnya were the focal points of violence in 2024 and are likely to remain so.

Increased coordination by actors points to elevated threat

Evidence from 2024 suggests a subtle evolution in the nature of the security threat facing the region. Increased coordination between violent actors marks a departure from recent years. The 23 June attacks in Dagestan, involving coordinated multi-site strikes, stand out as a stark example of this trend. So too did the March attack on Crocus City Hall, which had links to the region. Counterterrorism actions in Ingushetia and Dagestan also frequently targeted groups operating across multiple locations, signalling a more interconnected and organised threat than previously observed.

This development contrasts with patterns from the later years of organised insurgency, during which coordination across locations or multi-person high-casualty attacks became increasingly rare. An apparent declining effectiveness on the part of the security services in identifying and neutralising threats may partly explain this shift. Their ability to gather intelligence and disrupt planning at early stages appears weaker than in the mid- to late-2010s.

Limitations to the threat: Fragmentation and state control

Despite signs of increased coordination, the broader threat remains fragmented and constrained:

• Lack of unified leadership or infrastructure: There is no recognised insurgent leadership or infrastructure comparable to the Caucasus Emirate or Islamic State to unify anti-state actors or sustain a coherent campaign.
• Atomised resistance: Violent resistance to the state remains highly atomised, with small clusters of actors operating for a short period before being eliminated.
• State dominance: The security services maintain a pervasive presence, continuing to shape the region’s dynamics and acting as the primary source of reported violence. Even if they are less effective, they are not absent.

The absence of an organized insurgent project or media presence promoting a counter-narrative further limits the ability of violent actors to rally widespread support or sustain operations over time. Even if violence were to increase significantly, this could still fall short of the reemergence of organised regional insurgency.

Challenges of the information environment

The restricted information environment adds another layer of complexity to efforts to evaluate the security situation in the North Caucasus:

• Reliance on official sources: Mainstream media rely heavily on official sources, which may selectively report or delay information. Several major counterterrorism actions in 2024 were only publicised weeks or months after they occurred.
• Constrained independent media coverage: There are few independent media outlets still operating in the region, and those that exist face significant obstacles in verifying and reporting developments.
• Absence of local insurgent media: Historically, insurgent media provided biased but still valuable insights into militant activities. Their absence eliminates a source of information on current and emerging threats.

The inherently clandestine nature of rebel activity further exacerbates these challenges. As a result, increased violence itself may be the only observable indicator of worsening instability, with little advance warning of significant changes.

Appendix: Sources and methods

This report is based on a unique database of incidents compiled from media reporting on security incidents in the North Caucasus. The full database, including all sourcing, will be made accessible to members of the Russian Security Research Lab (RSRL), an open-source intelligence (OSINT) hub that will launch in mid-2025. RSRL aims to provide high-quality resources and expertly curated data on terrorism and political violence; private military companies (PMCs); and state and state-linked security services in Russia and the North Caucasus.

Sources

The core of the database is comprised of reporting on the North Caucasus by:

• Caucasian Knot;
• Kavkaz Realii (Radio Free Europe/Radio Liberty);
• Izvestiya;
• Kommersant;
• The National Antiterrorism Committee (NAK).

Relevant reports are identified by manually reviewing all articles relating to each of the North Caucasian republics – found either by using relevant tags or by searching the name of each republic, depending on platform functionality – and compiling a list of all articles relating to security incidents. This is a deliberately inclusive approach, designed to avoid articles being missed because of variations in terminology used.

Each article is then manually processed into the database. This core material is supplemented by ad hoc reporting from a wide range of Russian- and English-language media that are routinely monitored for security-related developments.

Data collected

A wide variety of information is extracted from the reports and tabulated in a Notion database. This includes information on the timing and location of the incident; the type of incident; the perpetrator and target of the incident; and the weapons used. Various information on the number of people involved and affected by the incident is also recorded. Each incident is assigned a unique identifying number and a short description.

A typical entry in the database – covering only completed fields – is as follows (a full methodological codebook will be made available to RSRL members):

Certain fields of the database, such as that for sources, link to separate Notion databases containing further information.

For most fields, the information recorded directly reflects that provided by the source, rather than the assessment of the compiler. The most significant exception is ‘perpetrator type’: Classification is based on the character of the incident, e.g. an armed attack on a police checkpoint’ is designated as ‘rebel’, for the simple reason that failure to do so makes the database much less usable. Specific groups, however, are only identified if specified by a source. Where sources provide conflicting accounts, this is noted either in the relevant fields (for low and high casualty figures) or in the descriptive fields (incident summary and additional notes). Additional sources for events are only included where they provide information not already contained by existing sources.

Information quality and reliability

Each core source has been chosen for its consistent ability to provide valuable information. Caucasian Knot and Kavkaz Realii are both independent local media outlets that are widely regarded as highly reliable. Both also provide extensive coverage of the region and monitor other media sources, meaning that most significant events are likely to be covered. Kommersant and Izvestiya are among the national media outlets that most consistently cover major events in the region.

Their reporting tends to be biased towards the authorities, but they occasionally draw on their own sources (often within the security services) and highlight discrepancies among ‘official’ accounts. The National Antiterrorism Committee more directly reflects the official position and tends to only cover major incidents. Supplementary reporting draws on a broad range of state-sanctioned and independent media outlets to capture additional events or, more often, add details to reports from the core sources.

The database therefore draws on a variety of open-source information to construct as accurate a picture of terrorism-related incidents as possible. Nevertheless, it should be understood that the database is affected by the same biases that afflict the broader media environment: independent verification of events and claims is often extremely difficult and sometimes impossible. Certain types of activity, such as security service raids and arbitrary detentions in Chechnya, are systematically underreported.