IS may be on the wane in Iraq and Syria but for Iran, the threat is still strong, centred on Kurdish communities along the Iraq-Iran border where militants have operated in recent years.
The locals even have a nickname for the area, "Tora Bora", after the mountain hideout Al Qaeda leader Osama bin Laden fled to after the United States invaded Afghanistan in 2001, a senior Iraqi security official in the border region said.
In late January, three Revolutionary Guards were killed in the Bamo region fighting 21 IS militants who had sneaked in from Iraq.
Three militants detonated suicide vests and two others were killed in the clash, the Guards said.
Days earlier, Iran’s intelligence ministry found a weapons cache in the town of Marivan on the Iranian side of the border that included TNT, C4, electronic detonators, grenades, ammunition clips for AK-47 machine guns and rocket propelled grenades.
The clash and discovery indicate that IS still has the ability to penetrate the tightly controlled security net of the Islamic Republic, which has largely managed to avoid the devastation wrought by the group in neighboring countries.
"Today (IS) does not control a country ... in order to assert that they exist, they may carry out an attack any day," Hossein Dehghan, a former defence minister and now an adviser to Supreme Leader Ayatollah Ali Khamenei, said in a recent interview with the semi-official Tasnim news agency.
Halabja, the largest town on the Iraqi side, is most often remembered for a chemical attack ordered by then-president Saddam Hussein in 1988 which left thousands dead.
The presence of extremist militants in the area around the town is not new: at the city's entrance hang portraits of Iraqi Kurdish security forces, known as Peshmerga, killed in the battle against IS.
Prior to the US-led invasion of Iraq in 2003, Abu Musab Al Zarqawi, theextremist largely blamed for stoking a civil war between Iraq’s major sects, led a group in the area called Ansar Al Islam, which merged with IS in 2014.
Many of the Iranian and Iraqi Kurds now fighting with IS are part of a second generation of militants largely influenced by Zarqawi’s deadly legacy, Iraqi security officials and Peshmerga commanders familiar with the matter say.
IS militants have repeatedly threatened to carry out attacks in the Islamic Republic.
Hamai Hama Seid, a senior Peshmerga commander and member of the Iraqi Patriotic Union of Kurdistan (PUK) party, said Kurdish IS militants take advantage of their knowledge of the language and region as well as strong cross-border ties.
"There are definitely ties between the Iranian and Iraqi extremists on the two sides of the border," Seid told Reuters in the Iraqi border village of Tawila, only a few hundred meters from the Iranian border.
He added: "The militants exploited this area because it’s mountainous, difficult and wooded."
Many of the young men are poorly educated and have few economic opportunities, allowing extremist recruiters to flourish, Iraqi security officials and Peshmerga commanders say.
Iranian authorities say the arms cache found on the border was going to be used to attack civilians in public areas, a follow-up to the shocking assault on the parliament in Tehran and the mausoleum of the founder of Iran's revolution, Ayatollah Ruhollah Khomeini, last June that left at least 18 people dead and dozens wounded.
IS claimed responsibility for that assault and threatened more.
The Revolutionary Guards responded by raining missiles on the militants in Syria and arresting dozens of suspects in Iran.
The June attack was conceived by an Iraqi militant using the nom de guerre Abu Aisha, a senior commander in a unit of IS fighting in Iraq and Syria made up exclusively of Kurds, according to the Iranian ministry of intelligence.
The Tehran attackers fought in Mosul and Raqqa and trained outside Iran, the ministry said.
Photos posted online show Abu Aisha, a member of Ansar Al Islam prior to joining IS, beheading Peshmerga soldiers while wearing a traditional Kurdish outfit.
In the fall of 2016, a number of Kurdish IS militants led by Abu Aisha came to an Iraqi border village near Halabja to try to establish a base of operations which could carry out attacks in both Iran and Iraq, according to Iraqi security officials familiar with the matter.
Peshmerga killed Abu Aisha in December 2016, according to Iraqi security officials and Kurdish activist Mokhtar Hooshmand, who was jailed in Iran on national security charges from 2010 to 2012 and met dozens of extremists behind bars.
Afterward, Serias Sadeghi, who ran a bakery with his brother in Paveh, an Iranian town about 15 km (9 miles) from the border, took over as lead planner for the Tehran attacks, Hooshmand said by telephone from outside Iran.
Sadeghi knew Abu Aisha and had crossed back and forth into Iraq with him multiple times.
"Sadeghi was still very eager that this operation be carried out," Hooshmand said. "He played a key role."
During the attack on Khomeini's mausoleum, Sadeghi detonated a suicide vest, shooting up an orange fireball captured on amateur video.
The other four attackers were also killed.
Attempts to reach representatives from the Iranian Ministry of Interior were not successful. But documents show Iranian authorities were aware of the growing threat.