Turan Research Center

On January 27, 2026, Azerbaijan's State Security Service announced the arrest of three young men for plotting an attack on a foreign embassy in Baku. The timing was striking: Israeli Foreign Minister Gideon Sa'ar had concluded meetings with President Ilham Aliyev just one day earlier. While Azerbaijani authorities did not officially name the target, multiple Israeli outlets confirmed it was their embassy.

Azerbaijani security services attributed the plot to Islamic State-Khorasan Province, or ISIS-K — the Afghan offshoot that has executed some of the deadliest terrorist attacks of recent years, including the March 2024 Crocus City Hall massacre in Moscow that killed 149 people. The suspects had allegedly obtained weapons and finalized their plans before security forces intercepted them.

The announcement received modest international attention. It should not have. The incident represents either a significant expansion of ISIS-K's operational reach into the South Caucasus or — more likely — evidence of a strategic shift in how Iran conducts covert operations in the South Caucasus.

A Pattern of Threats

This was not an isolated incident. Israeli and Jewish targets in Azerbaijan have faced a troubling series of threats in recent months. Despite close ties between Jerusalem and Baku and low levels of societal antisemitism, foreign operatives have historically managed to recruit locals for terrorist attacks. In October, an Azerbaijani court sentenced an ISIS-K affiliate to thirteen years in prison for plotting a Molotov cocktail attack on a Baku synagogue. The Conference of European Rabbis, scheduled to convene in Baku in November, was canceled over security concerns; organizers declined to provide further details.

Historically, such threats emanated from a different source: the Husseiniyyun, an ethnic Azerbaijani Shia militia created by Iran's Islamic Revolutionary Guard Corps. While Azerbaijan's government is staunchly secular and a majority of the population is Shia Muslim, roughly a third adheres to Sunni Islam — a demographic reality that complicates assumptions about sectarian allegiance. The recent appearance of Sunni extremists allegedly operating at ISIS-K's direction marks a departure that demands explanation.

Two hypotheses present themselves. The first accepts the official attribution at face value: ISIS-K, emboldened by successful high-profile attacks, has expanded its ambitions to the Caucasus. The second posits that Iranian intelligence services recruited the cell, using the ISIS-K banner to obscure Tehran's fingerprints. An examination of both ISIS-K's recent trajectory and Iran's documented methods suggests the latter to be more likely.

Marginal, But Exploitable

Jihadist networks in Azerbaijan are not new, though they remain small compared to other Muslim-majority countries. Salafist communities took root in northern districts like Ismayilli and Sheki in the 1990s, later becoming modest recruitment hubs. When ISIS declared its caliphate in 2014, an estimated 200 to 300 Azerbaijanis — many of them Sunni radicals from these northern regions — traveled to fight in Syria and Iraq. The government responded with criminal code amendments and waves of arrests, and the country's strong secular identity and robust security apparatus have kept extremist networks marginal.

Yet ISIS-K's recent focus on Azerbaijan suggests even limited infrastructure can be exploited. In May 2025, Azerbaijani authorities extradited four nationals who had attended training camps on the Pakistan-Afghanistan border — an area strongly associated with ISIS-K activity — two others were arrested for financing. The December 2024 synagogue plot and the January 2026 embassy conspiracy indicate the group — or someone using its banner — has identified Azerbaijan as operational territory.

The Tajikistan Template

Iran's willingness to collaborate with Sunni extremists when geopolitical interests align is well-documented. Palestinian factions including Hamas and Islamic Jihad have received sustained Iranian support despite their Sunni affiliation. Tehran has maintained tactical relationships with the Taliban, providing limited assistance since the U.S. invasion in 2001 and expanding cooperation after the Taliban's return to power in 2021. Even Al-Qaeda senior leaders have received safe havenin Iran and been allowed to use the country as a base to organize terrorist activities.

But Tajikistan offers the most relevant precedent. Materials released by Tajik authorities reveal a systematic pattern of Iranian intelligence operations on Tajik territory, encompassing recruitment, proxy deployment, and the organization of terrorist attacks.

Consider the July 2018 ISIS attack in Tajikistan's Khatlon region that killed four foreign cyclists — two Americans, one Dutch national, and one Swiss citizen. According to testimony from the sole surviving detained suspect, key participants had undergone ideological indoctrination and military training between 2014 and 2015 in the Iranian city of Qom and at a camp in Mazandaran province. The attack's organizer had studied at religious institutions in Iran and received training at IRGC facilities before recruiting Tajik labor migrants in Russia on behalf of Iranian intelligence. The banned Islamic Renaissance Party of Tajikistan reportedly served as a convenient cover for these recruitment activities.

A pattern emerges from Tajik security files: the IRGC has used the ISIS flag to conceal Iranian involvement in terrorist operations. Using ISIS also gives access to Tajik extremists, as the country’s significantly smaller Shia population has been traditionally shaped by the pro-Western influence of Aga Khan. In 2018, Tajik security services prevented an attacknear the Russian 201st Military Base in Dushanbe, detaining thirteen individuals who had trained with Iranian instructors. Subsequent investigations revealed that the operation's coordinator had been recruited in Moscow by Iranian intelligence, trained near Tehran, and dispatched with twenty-two other Tajik nationals to carry out attacks on government officials and foreign installations. The method proved effective — ISIS received blame while Iran preserved deniability.

Risks and Rewards

This strategy carries obvious dangers. ISIS-K maintains a violent hostility toward Shia Islam and Iranian interests. The January 2024 bombing at General Qassem Soleimani's memorial in Kerman — which killed at least 95 people — demonstrated ISIS-K's willingness to strike at the Islamic Republic's symbolic heart. Deploying such groups as proxies risks catastrophic blowback.

Yet the benefits may outweigh the risks from Tehran's perspective. Iran has consistently used proxy forces to maintain distance from operations that could trigger international retaliation. By employing groups nominally opposed to Iranian interests, it achieves an additional layer of deniability. This consideration has grown more pressing as Iran's regional position has deteriorated.

Iran's strategic interests in the South Caucasus are substantial and under threat. The Aliyev government is secular, maintaining close relationships with both Turkey and Israel — a posture that alarms Tehran on multiple fronts. The deepening Azerbaijan-Israel relationship, encompassing weapons sales, intelligence cooperation, and energy partnerships, represents a security concern on Iran's northern border. More fundamentally, Azerbaijan's existence as a prosperous, secular homeland to the Azerbaijani people presents an uncomfortable example to Iran's large ethnic Azerbaijani minority: a vision of what might be possible without rule by religious ideologues.

The Armenia-Azerbaijan peace process, if concluded, would remove a source of regional instability that Tehran has historically exploited. Most significantly, the Trump Route for International Peace and Prosperity (TRIPP), backed by the United States, threatens to diminish Iranian influence and expand American engagement in a region Tehran considers its sphere of interest. As details of TRIPP emerge and agreements take shape, these strategic imperatives have become more pressing.

An attack on the Israeli embassy during a high-profile ministerial visit would have served multiple Iranian objectives simultaneously. It would demonstrate that Jews and Israelis are not safe even in allied countries. It would intimidate Azerbaijan and other Muslim-majority nations that maintain ties with Israel. And it would signal to the Azerbaijani population that their government cannot maintain basic security — all while the ISIS-K attribution shielded Tehran from direct accountability.

The Alternative Hypothesis

While unlikely, the possibility that ISIS-K acted independently cannot be dismissed. The group has demonstrated both the capability and intent to conduct high-profile transnational attacks. The March 2024 assault on Crocus City Hall, which left 149 dead and more than 600 wounded, established ISIS-K as the most lethal transnational terrorist threat in years. The Kerman bombing three months earlier had already demonstrated the group's reach into Iran itself.

ISIS-K has pursued a deliberate strategy of internationalizing its operations since the Taliban's 2021 return to power created a more permissive environment. The group has targeted interests from Pakistan, India, Uzbekistan, Tajikistan, China, and Russia, marking a calculated expansion beyond its traditional Afghanistan-Pakistan base. Just last week, an ISIS-K suicide bomber killed seven people, including a Chinese national, at a restaurant in Kabul — part of a sustained campaign against Chinese citizens in retaliation for Beijing's treatment of Uyghur Muslims.

Expanding to the Caucasus would fit this pattern. The group has cultivated relationships with Uyghur militant organizations and published propaganda in Tajik and other Central Asian languages. Its leader, Sanaullah Ghafari, is himself reportedly an ethnic Tajik. High-profile attacks generate recruitment, funding, and influence across the jihadist spectrum — commodities ISIS-K actively seeks.

Weighing the Evidence

Several factors tip the balance toward Iranian involvement. The target selection — the Israeli embassy during a ministerial visit — aligns precisely with Iran's documented priorities in Azerbaijan. The suspects were local Azerbaijanis, not the Central Asian migrants who typically execute ISIS-K operations abroad. Iran possesses established recruitment networks in Azerbaijan through the Husseiniyyun and related Shia networks. And the operational pattern mirrors the Tajikistan template: local recruits, ISIS cover, strategic benefit to Tehran.

The decentralized nature of organizations like ISIS-K makes them vulnerable to exactly this kind of exploitation. Iran does not need to coordinate with ISIS-K leadership in Afghanistan to recruit sympathetic individuals, provide training and weapons, and assign targets — all while allowing the recruits to believe they are serving the caliphate's cause.

None of this constitutes proof. Azerbaijani authorities have not released details of the investigation that would clarify the chain of command or expose any Iranian role. What can be said with confidence is that the incident deserves more scrutiny than it has received. If Iran has indeed adopted Sunni extremist cover for operations in the South Caucasus, the implications extend well beyond this single foiled plot. It would represent an evolution in Iranian tradecraft with significant consequences for regional security.

Policy Implications

For Azerbaijan, the incident underscores the complexity of its security environment. The country must contend not only with traditional Iranian pressure through Shia proxies but potentially with Sunni extremist cells that may or may not operate at Tehran's direction. Enhanced intelligence cooperation with Israel and Western partners becomes more valuable under these circumstances.

For the United States and its allies, the incident reinforces the importance of tracking ISIS-K's external operations while remaining alert to the possibility of state manipulation. The line between independent jihadist violence and state-sponsored terrorism has never been bright; it may be growing dimmer.

For Iran, the foiled attack — regardless of who ordered it — represents a setback. The Azerbaijani government has demonstrated the capability to detect and prevent such plots. The public attribution to ISIS-K, whether accurate or a diplomatic convenience, spares direct Iranian-Azerbaijani confrontation while putting Tehran on notice that its options for covert action are narrowing.

The three young men in Azerbaijani custody may have believed they were soldiers of the caliphate. They may have been pawns in a larger game they did not fully understand. The distinction matters less than the outcome: a plot disrupted, an attack prevented, and a reminder that in the murky space where terrorism and statecraft intersect, the most important questions often go unanswered.

Joseph Epstein is the Director of the Turan Research Center, a Senior Fellow at the Yorktown Institute, and a Research Fellow at Bar Ilan University's Begin Sadat Center for Strategic Studies.