How Sanaullah Ghafari gave teeth to Islamic State’s Afghan branch
Sanaullah Ghafari, the 29-yearold leader of the Afghan branch of Islamic State, has overseen its transformation into one of the most fearsome branches of the global Islamist network, capable of operations far from its bases in the borderlands of Afghanistan.
Islamic State has claimed responsibility for Friday’s mass shooting at a concert hall near Moscow that killed at least 139 people. US officials have said they have intelligence indicating it was the Afghan branch, Islamic State Khorasan (Isis-K), that was responsible.
Washington has said it had warned Russia in March of an imminent attack. A source familiar with this intelligence said it was based on interceptions of “chatter” among Isis-K militants.
The discovery of Tajik passports on the gunmen arrested by Russian authorities suggested a possible link to Ghafari’s group, which has aggressively recruited from the poor Central Asian country, security experts say.
In recent years, his organisation has also sought repeatedly to strike at Russia in retaliation for its intervention in the Syrian civil war, which helped to defeat Isis’ regional operations.
Ghafari was initially reported killed in Afghanistan in June 2023 but escaped with injuries across the frontier into Pakistan and is believed to be living in its lawless Balochistan border province, two sources in the Afghan and Pakistani Taliban said.
Pakistan’s foreign ministry did not respond to a request for comment on Ghafari’s whereabouts.
Named as emir of Isis-K in 2020, Ghafari has reinforced the group’s reputation for hardline ideology and high-profile attacks. Isis-K grabbed global attention with a 2021 suicide bombing on Kabul international airport during the US military withdrawal that killed 13 US soldiers and scores of civilians. In September 2022, it claimed responsibility for a deadly suicide attack at the Russian embassy in Kabul.
But perhaps its most brazen operation to date came in January, with a double suicide bombing in Iran that killed nearly 100 people at a memorial for Revolutionary Guard commander Qassem Soleimani — the deadliest militant attack on Iranian soil since the 1979 Islamic Revolution.
Little was known about Ghafari
before the 2021 strike on Kabul airport, which prompted Washington to put a $10m bounty on his head. Taliban sources said he is an Afghan Tajik who served as a soldier in the Afghan army and later joined Isis-K, which was formed in late 2014.
More than a dozen sources — including serving and retired security and intelligence officials in Afghanistan, Pakistan, Iraq and the US, as well as members of the Afghan and Pakistani Taliban — said Isis-K had exploited the Taliban’s failure to eliminate its safe havens in northern and eastern Afghanistan to expand regionally.
Under Ghafari, the group has used high-profile attacks as a recruiting tool and targeted ethnic Tajiks and Uzbeks across Central Asia, rather than Afghanistan’s Pashtun majority, which forms the backbone of the Taliban, the sources said.
Isis-K takes its name from an old Persian term for the region, Khorasan, that included parts of Iran, Turkmenistan and Afghanistan, as well as areas of Tajikistan and Uzbekistan. Its propaganda, translated into regional languages as well as English, vows to establish a caliphate spanning that area.
“Isis-K … seeks to outperform rival jihadis by carrying out more audacious attacks to distinguish its brand, poach from rivals, and gain resources from potential supporters,” said Asfandyar Mir, a senior expert on South Asia security at the US Institute of Peace, a government research body in Washington.
UKRAINE ESCAPE
Unlike previous high-profile suicide attacks by Isis-K, the gunmen on Friday had sought to escape and were detained by authorities about 300km west of Moscow, stirring some doubts within Russia over whether they really were jihadists. In unverified images shown on Russian media, one of the alleged assailants told an interrogator he had been offered half-a-million roubles (more than $5,000) to carry out the attacks.
Russian President Vladimir Putin said for the first time on Monday that radical Islamists had carried out the assault but he has not publicly mentioned IsisK in connection with the attackers, who he said had been trying to escape to Ukraine. Putin said “many questions” remained to be answered.
Colin Clarke, with the New York-based Soufan Center, a think-tank for global security issues, said that there were a number of examples of Islamist militants escaping instead of carrying out suicide missions, like the Isis gunmen who fled after attacking the Bataclan music hall in Paris in November 2015.
“They could have been interested in conducting a follow-on attack,” Clarke said, adding that the attackers may also have avoided buying or transporting explosives to lessen their chances of detection.
Frank McKenzie, the former head of US Central Command — which covers Central Asia and the Middle East, as well as part of South Asia — said the Moscow attack was in line with Isis-K’s long-term objective of increasing its foreign operations, including against the US.
“They remain determined to attack us and our homeland,” said McKenzie, who was the head of US forces in the region during the withdrawal from Afghanistan. “The odds of that are probably higher now than they were a few years ago.”
FINANCIAL FACILITATOR
The state department in its bounty announcement described Ghafari, better known by his nom de guerre Shahab alMuhajir, as an experienced military leader who had planned Isis-K suicide attacks in Kabul.
It separately identified Ismatullah Khalozai, who ran a network of informal money transfers, or hawala, from Turkey, as the group’s “international financial facilitator”. A July 2023 report to the UN Security Council on the international threat posed by Islamic State reads that Isis-K numbered 4,000-6,000 people on the ground in Afghanistan, including fighters and family members.
Security experts trace the group’s expansion to the collapse of the parent Islamic State movement during the war in Iraq in 2017. Many foreign fighters fled Iraq and reached Afghanistan-Pakistan to join Isis-K, bringing expertise in guerrilla warfare that developed the group’s ability to launch attacks in Iran, Turkey and Afghanistan, according to a senior Iraqi security official, who asked not to be named.
Iraqi security believes that Isis-K has been working to establish a regional network of jihadist fighter cells that could help execute international attacks, based on information from dozens of senior Isis operators
detained over the past two years, the official said.
Two senior Iraqi Isis leaders arrested in Turkey in December and handed over to Baghdad told Iraqi intelligence that they would contact Ghafari for financial and logistical support by exchanging messages through two Tajik members of Isis-K in Turkey, according to the Iraqi official, who is part of a security unit that monitors Islamic State activities in Iraq and neighbouring states.
A Taliban intelligence official estimated that 90% of Isis-K’s cadre is now non-Pashtun. Tajiks and Uzbeks are the other large ethnic groups that populate the north of Afghanistan.
Mawlawi Habib Rahman, a former senior leader of Isis-K who surrendered to the Taliban, told Aghan media outlet Al-Mirsaad in November that the group had also successfully recruited Tajik nationals.
“They are told, ‘you were infidels and you have now newly become Muslim [after joining Isis-K]’,” Rahman said. Recruiters say the Tajik government is made up of “infidels” and that Isis-K wanted to rescue oppressed Muslims, he said.
A January UN report on the group reads it had stepped up its efforts to enlist foreign fighters and disillusioned members of the Taliban, with a special focus on Tajiks. It said that Tajik citizen, Khukumatov Shamil Dodihudoevich, alias Abu Miskin, had become an active propagandist and recruiter.
Tajikistan, a Persian-speaking and predominantly Sunni Muslim country, is home to 10million people. After a brutal civil war in the 1990s, it remains one of the poorest former Soviet republics. Its economy relies heavily on remittances from more than a million migrant workers in Russia.
Tajik officials have said that many Tajiks who live in Russia complain of mistreatment, making them easier targets for extremist recruitment while they are far from their homes.
A day before the Moscow attack, a top US military officer told the House Armed Services Committee that Taliban efforts to suppress Isis-K in Afghanistan were proving insufficient.
Gen Michael “Erik” Kurilla, the commander of US Central Command, said in written testimony that the Taliban had targeted some senior Isis-K leaders but lacked the ability and intent to maintain pressure on the group. This had allowed Isis-K to regenerate its networks, he said.
SERIOUSLY WEAKENED
“Isis-Khorasan retains the capability and will to attack US and Western interests abroad in as little as six months and with little to no warning,” Kurilla told a Senate committee hearing in March.
Zabihullah Mujahid, spokesperson for the Taliban administration in Kabul, said Isis-K had been seriously weakened by a security crackdown and was only carrying out rare operations against civilians. He denied the group was in Afghan territory, but said it wasn’t clear where it was based.
The UN report in January reads that a decline in attacks by
Isis-K in Afghanistan probably reflected a change of strategy by Ghafari, and counterterrorism efforts by the Taliban.
Authorities in several European countries made a spate of arrests of alleged Isis-K recruits in July and December 2023, accused of plotting terror attacks. Christine Abizaid, director of the National Counterterrorism Center, told a House committee in November that Isis-K had so far used “inexperienced operatives” to attempt attacks in Europe.
France, which will host the Olympic Games from late July, said on Sunday it was raising its terror alert warning to its highest level after Friday’s shootings.
For the past two years, Isis-K has been fixated on Russia, criticising Putin for changing the course of the Syrian civil war by supporting President Bashar alAssad against Islamic State, security experts said.
“Isis-K has been plotting attacks within Russia for some time,” said Aaron Zelin, a senior fellow at the Washington Institute For Near East Policy, a US think-tank. He noted that recent attempts by the group to strike in Russia had failed./
THE SECTION, WHICH HAS BEEN LINKED TO FRIDAY’S MASS SHOOTING NEAR MOSCOW, IS CAPABLE OF OPERATIONS FAR FROM ITS BASES
AUTHORITIES IN SEVERAL EUROPEAN COUNTRIES MADE A SPATE OF ARRESTS OF ALLEGED ISIS-K RECRUITS IN JULY AND DECEMBER 2023