Afghanistan’s Terrorism Ecosystem: How Taliban Rule Is Sustaining a Regional Security Threat

Five years after the Taliban’s return to power in August 2021, Afghanistan remains a significant base of operations, sanctuary and networking for multiple terrorist organisations. The central security problem is not that the Taliban command every militant group operating from Afghan territory. Rather, Afghanistan has developed into a terrorism ecosystem base: a Taliban-controlled territorial environment in which different terrorist organisations obtain varying degrees of sanctuary, logistical space, training, ideological support, recruitment opportunities and operational freedom.

The most immediate manifestation of this problem is Tehrik-e Taliban Pakistan (TTP). United Nations reporting has repeatedly identified the TTP as operating from Afghanistan and conducting attacks inside Pakistan. The UN’s July 2024 assessment estimated the group’s strength at 6,000–6,500 fighters and recorded more than 800 attacks in Pakistan during the reporting period, stating that the group acted with Taliban acquiescence and, at times, support.

The UN’s February 2026 report (S/2026/44) assessed that the Taliban had given the TTP greater liberty and support, contributing to increased attacks against Pakistan. It also found that Al-Qaida continued to enjoy Taliban patronage and acted as a ‘service provider and multiplier’ for other terrorist groups, principally the TTP. Al-Qaida in the Indian Subcontinent (AQIS) remained active in Afghanistan, while Islamic State Khorasan Province (ISIL-K), despite sustained Taliban counter-terrorism operations, retained significant operational capability.

The latest UN Monitoring Team report, the thirty-eighth (S/2026/651), was issued on 10 August 2026. It confirms that Afghanistan remains a major concern for regional security, and that cross-border attacks between Afghanistan and Pakistan have escalated, driven by the high number of TTP attacks against Pakistan.

The problem is increasingly interstate rather than merely counter-terrorist. In September 2026, Pakistan carried out further air and drone strikes inside Afghanistan. Islamabad said its strikes on 24 September hit ten locations used to store and launch drones, after eight drones entered Pakistani airspace from Afghanistan. Kabul rejected the allegations and said civilians had been killed. Days later, the two sides traded conflicting claims over a border clash near Spin Boldak in Kandahar province.

For South Asia, the strategic challenge is therefore twofold: to prevent Afghanistan from becoming a durable base for transnational terrorism, and to prevent counter-terrorism from escalating into sustained interstate conflict.

How Afghanistan became a terrorism ecosystem base

Afghanistan’s importance to terrorism is not new. The country provided sanctuary to Al-Qaida under the pre-2001 Taliban regime and became the principal theatre of international counter-terrorism after the September 2001 attacks.

The post-2021 environment, however, has a different structure. The Taliban now exercise territorial control and possess functioning security institutions. The presence of terrorist organisations therefore cannot simply be attributed to state collapse or ungoverned territory. The critical issue is the selective nature of Taliban counter-terrorism policy.

The Taliban have conducted sustained operations against ISIL-K, their principal ideological and military enemy. As the de facto government, ruling most of Afghanistan since 2021, the Taliban have heavy military equipment, established administrative networks and tens of thousands of fighters. ISIL-K, by contrast, functions as an underground insurgency and terrorist network rather than a governing force. It can still carry out high-profile guerrilla attacks and suicide bombings, but it holds no official territory and faces severe pressure from Taliban security forces.

The Taliban’s approach towards other organisations is markedly different. The UN has repeatedly reported continuing relationships between Taliban authorities, the TTP and Al-Qaida. The resulting environment allows different organisations to perform different functions within the wider militant landscape:

• TTP: the most direct cross-border terrorist threat to Pakistan.
• Al-Qaida: ideological guidance, training and advisory capabilities.
• AQIS: an Al-Qaida affiliate with a South Asian orientation.
• ISIL-K: an adversary of the Taliban that also seeks to attack regional states.

The structure is therefore best understood not as a single terrorist hierarchy, but as a differentiated terrorism ecosystem operating within Taliban-controlled territory.

The TTP–Afghanistan nexus

The TTP is the central component of the Afghanistan–Pakistan terrorism threat. Although organisationally separate from the Afghan Taliban, the two share historical, ideological and personal relationships dating back to the Afghan insurgency. TTP fighters fought alongside the Afghan Taliban, and Taliban-linked networks have historically provided sanctuary and logistical support to Pakistani militants. The Taliban takeover transformed this relationship.

The UN’s 2024 assessment (S/2024/556) estimated the TTP’s strength at 6,000–6,500 fighters, with approximately 14,000 family members. It reported more than 800 TTP attacks inside Pakistan during the reporting period and identified TTP camps involving Taliban and Al-Qaida personnel. It also identified cooperation in suicide-bomber training.

The UN’s 2025 assessment estimated the TTP’s strength at approximately 6,000 fighters, located principally in Khost, Kunar, Nangarhar, Paktika and Paktia. It stated that the Taliban continued to provide the TTP with logistical and operational space and financial support. One member-state assessment cited by the UN reported monthly payments of approximately 3 million Afghanis (around $43,000) to the family of TTP leader Noor Wali Mehsud.

These figures are intelligence assessments rather than independently audited financial records, and should be read accordingly. Their significance lies in their incorporation into formal UN Security Council monitoring.

The latest reporting indicates that the relationship has not fundamentally changed. The UN’s August 2026 report records that on 28 April Al-Qaida’s official media arm, As-Sahab, published a statement supporting the Taliban and, for the first time, the TTP in operations against Pakistan. It also notes that Al-Qaida continued to provide ideological guidance, training and support to the TTP. The same reporting describes the TTP’s attacks as increasingly complex and as a direct driver of military confrontation between Pakistan and Afghanistan.

The reporting is not one-sided. The UN Monitoring Team also relays claims that Taliban leader Hibatullah Akhundzada warned TTP leaders to halt attacks on Pakistan. Pakistan viewed the move as insufficient and lacking the substance required to bring about any meaningful change on the ground.

From terrorist sanctuary to an Afghanistan–Pakistan security crisis

The TTP issue has transformed Afghanistan–Pakistan relations from difficult bilateral ties into an active security confrontation. Pakistan argues that the TTP uses Afghan territory to organise, train and launch attacks. The Taliban authorities deny harbouring terrorist organisations and maintain that militancy inside Pakistan is an internal Pakistani problem.

The disagreement has repeatedly escalated into military confrontation. Fighting in October 2025 was followed by a ceasefire, but Pakistan launched a new counter-terrorism campaign, Operation Ghazab lil-Haq, in February 2026. On 21 September 2026, following a major attack on the Police Lines in Kohat, Khyber Pakhtunkhwa, Pakistan carried out airstrikes in Afghanistan’s border region and said it had killed more than 28 militants. The UN mission in Afghanistan reported that the strikes in Kunar killed at least three civilians. On 24 September, Pakistan struck ten further locations after the drone incursions described above; Kabul said the strikes hit Kandahar, Paktia and Khost and killed four civilians.

Many of these accounts come from the parties themselves and are contested. Casualty figures, the nature of the targets and even who initiated individual clashes remain disputed.

The strategic danger is a self-reinforcing cycle:

Terrorist attack → Pakistani military pressure → Afghan rejection and retaliation → cross-border escalation → civilian casualties and displacement → further militant mobilisation.

Once this cycle becomes institutionalised, counter-terrorism ceases to be solely a law-enforcement or intelligence problem. It becomes a problem of interstate conflict management.

Al-Qaida and AQIS: the strategic depth of the threat

The TTP represents the immediate threat, but Al-Qaida gives the Afghan terrorism ecosystem greater strategic depth. The UN found that Al-Qaida’s position in Afghanistan remained broadly unchanged and that it continued to enjoy patronage from the Taliban authorities, supporting groups such as the TTP through training and advice.

This matters because Al-Qaida does not need territorial control to remain strategically relevant. Its value lies in ideological guidance, operational experience, training, facilitation and relationships with regional organisations.

AQIS is particularly significant for South Asian security. The UN reported that AQIS remained active in south-eastern Afghanistan, where the Haqqani Network exercised considerable influence, and that senior AQIS figures were reported to be in Kabul. The organisation was also assessed as increasingly focused on external operations.

The evidence does not establish an imminent AQIS offensive against any particular South Asian state. It does, however, show that Afghanistan continues to host an organisation whose strategic orientation extends beyond Afghan territory. That makes Afghanistan relevant to the security calculations of India, Pakistan, Bangladesh and other regional states, even when they are not the immediate targets of militant operations.

ISIL-K and the limits of Taliban counter-terrorism

An assessment that portrayed Afghanistan simply as a Taliban-controlled sanctuary for terrorism would be incomplete. ISIL-K presents the opposite case. The Taliban regard it as an existential ideological and security threat and have conducted extensive operations against it. According to the UN, those operations, alongside counter-terrorism measures by neighbouring states, have significantly constrained the organisation.

However, ISIL-K has not disappeared. The UN continues to assess that it has significant combat and operational capabilities, including the capacity to replace fighters through recruitment and to pursue external operations. The European Union Agency for Asylum (EUAA) similarly describes it as operating through a fractured framework of covert, semi-autonomous cells across the country.

This illustrates the central paradox of Afghanistan’s security environment. The Taliban are simultaneously suppressing one terrorist organisation, supporting the TTP, maintaining relationships with Al-Qaida, and attempting to control an increasingly complex militant environment. Taliban action against ISIL-K therefore cannot, by itself, be read as evidence that Afghanistan no longer poses a terrorist risk.

Regional security implications for South Asia

The implications extend beyond Afghanistan–Pakistan relations.

Pakistan faces the most immediate threat, because the TTP can exploit Afghan territory to sustain attacks on Pakistani security forces and state institutions. The Taliban’s growing diplomatic engagement with India, which Islamabad views with concern, adds to Pakistan’s threat perception.

India faces a different but significant risk, despite growing diplomatic relations with the Taliban as an attempt to counter Pakistan. Afghan-based terrorist networks could provide ideological, logistical or training support to organisations with South Asian ambitions.

Bangladesh faces potential exposure through transnational jihadist propaganda, recruitment and networking, which are gaining ground faster than is generally perceived.

China is concerned about militant organisations operating near its western frontier, and about the security of Chinese nationals and infrastructure in Pakistan and the wider region.

The 2024 UN assessment already warned of growing cooperation among the TTP, the Taliban and Al-Qaida, and of its potential consequences for Pakistan and other regional states. The latest reporting confirms that the wider regional threat remains significant.

The principal concern is not one organisation moving across every border. It is the diffusion of personnel, expertise, ideology, financing and operational techniques among interconnected militant networks. Afghanistan provides the territorial environment in which that diffusion can occur.

The human and strategic cost

Cross-border counter-terrorism also carries substantial humanitarian consequences. Escalation between Pakistan and Afghanistan has produced civilian casualties and disrupted border commerce. UN reporting has previously documented how border closures and confrontation with Pakistan disrupted trade and imposed significant costs on the Afghan economy.

This creates a strategic dilemma. Pakistan has a legitimate security interest in preventing attacks launched from Afghan territory, yet military responses risk civilian harm, bilateral escalation and further destabilisation of a region still struggling with the aftermath of decades of war. The regional objective should be to contain terrorist networks without creating a permanent Afghanistan–Pakistan military confrontation.

A sustainable South Asian counter-terrorism strategy

Regional engagement with the Taliban should be measured against observable actions:

• restrictions on terrorist leaders;
• dismantling of training infrastructure;
• disruption of terrorist financing; and
• prevention of external attack planning.

Pakistan, India, Bangladesh, China and the Central Asian states share overlapping interests in identifying terrorist financing, movement, recruitment and communications networks, even where their broader political relations remain difficult. Military hotlines, border-level communication and third-party facilitation could also reduce the risk that individual attacks trigger uncontrolled interstate escalation.

Counter-terrorism should focus not only on fighters but also on financial intermediaries, procurement networks, facilitators and logistical infrastructure. Most importantly, civilian protection should be treated as a strategic counter-terrorism objective. Civilian casualties and displacement can generate political grievances and create recruitment opportunities for militant organisations, so operations require strict adherence to international law and effective civilian-harm mitigation.

[Image Credit: AlJazeera]