To a degree, they are a franchise, rather like AQ were. There are groups of nasties all across central Asia and the Caucasus, and over time the same people/groups will have been affiliated with AQ, Taleban, and IS - for the 'head office' it makes them look like they've got a far wider geographic/societal spread than they have, and the local franchise it gives them access to training/expertise, cash, and the kudos of being part of IS/whatever.
Plenty of anti-Russian feeling from China to the Black Sea, lots of deeply unpleasant governments, and lots of clientism. Fertile ground...
Putin will of course claim it was Whoever is most politically locally convenient. I don’t think this is a false flag one though. Because there’s simply no need for it.