Sanullah Ghafari, the 29-year-old leader of the Afghan branch of Islamic State, has overseen its transformation into one of the most notorious groups in the global Islamist network, capable of operations far from its bases on Afghanistan's borders.
Islamic State claimed responsibility for the mass killing at a concert hall near Moscow on Friday that killed at least 139 people.
Washington said it warned Russia of the attack earlier this month, and a source told Reuters that the intelligence was based on intercepted conversations between ISIS-K militants.
The fact that Tajik passports were found with the attackers arrested by the Russian authorities indicates a possible connection with Ghafari's group, which aggressively recruited members from this poor country in Central Asia, according to security experts.
Last June, it was reported that Ghafari had been killed, but it turned out that he was only wounded, and two sources in Pakistan and Afghanistan told the British agency that he was believed to be living in the Pakistani province of Balochistan.
Appointed ISIS-K emir in 2020, Ghafari reinforced the group's hardline ideology and intensified high-profile attacks.
ISIS-K gained international attention with a suicide attack on Kabul International Airport in 2021 during the US military withdrawal that killed 13 US soldiers and dozens of civilians. In September 2022, the group claimed responsibility for a deadly attack on the Russian embassy in Kabul.
However, perhaps the most daring operation to date came in January with a twin suicide attack in Iran that killed nearly 100 people at a memorial service for Revolutionary Guard commander Qassem Soleimani - the deadliest attack on Iranian soil since the 1979 Islamic Revolution.
Little was known about Ghaffari before the Kabul airport attack, after which Washington offered a $10 million reward for information leading to his capture or death. Taliban sources told Reuters that he is an Afghan Tajik who was a soldier in the Afghan army and later joined ISIS-K, which was formed in 2014.
Dozens of sources Reuters spoke to, including security and intelligence officials in Afghanistan, Pakistan, Iraq and the US, as well as the Afghan and Pakistani Taliban, said ISIS-K had taken advantage of the Taliban's failure to destroy their strongholds in the north and east. Afghanistan to expand globally.
Under Ghafari's leadership, the group specifically targeted ethnic Tajiks and Uzbeks across Central Asia for recruitment instead of Afghanistan's Pashtun majority, from which the Taliban's key base originates, the sources said.
The name ISIS-K comes from the old Persian term for the region, Khorasan, which includes parts of Iran, Turkmenistan and Afghanistan, as well as areas of Tajikistan and Uzbekistan. Their propaganda is based on the promise of establishing a caliphate in that area.
"ISIS-K ... seeks to outpace rival jihadists by carrying out bolder attacks to stand out, recruit competitors and gain resources from potential supporters," said Asfandiar Mir, a South Asia security expert at the US Institute of Peace.
Unlike previous ISIS-K attacks, Friday's attackers tried to flee but were caught by Russian authorities about 300 kilometers from Moscow, raising some doubts within Russia about whether they were truly jihadists. In a video published by Russian media, the authenticity of which has not been confirmed, one of the alleged attackers said that he was offered half a million rubles (a little more than $5000) to carry out the attack.
Colin Clark, of the Soufan Center in New York, said there are numerous examples of Islamic extremists fleeing instead of committing suicide, such as the IS attackers who escaped after the attack on the Bataclan music hall in Paris in November 2015.
"It is possible that they wanted to carry out another attack," Clark told Reuters.
Frank McKenzie, the former head of US Central Command, said the attack in Moscow was in line with ISIS-K's long-term goal of intensifying operations abroad, including those against the US.
"They are determined to attack us and our homeland," said McKenzie, who was at the head of American forces during the withdrawal from Afghanistan. "I think the chances for that are probably higher now than they were a couple of years ago."
International recruiters
Ghafari, better known by his nom de guerre Shahab al-Muhajir, is described by the State Department in the warrant as an experienced military leader who planned ISIS-K suicide attacks in Kabul.
In particular, Ismatulah Kalozai, who ran a network of informal money transfers from Turkey, was identified as the "international financial intermediary" of the group.
A July 2023 report presented to the UN Security Council on the international threat of the Islamic State stated that ISIS-K has between four and six thousand people in Afghanistan, including fighters and family members.
Security experts believe that the group's expansion began after the collapse of the Islamic State movement during the 2017 Iraq war.
Many foreign fighters have fled Iraq and come to Afghanistan and Pakistan to join ISIS-K, bringing with them knowledge of guerrilla warfare tactics that have helped the group develop the ability to carry out attacks in Iran, Turkey and Afghanistan, an Iraqi told Reuters. security official.
ISIS-K ... seeks to outpace rival jihadists by carrying out bolder attacks to stand out, recruit competitors and gain resources from potential supporters, Asfandiar Mir said.
Iraqi security services believe that ISIS-K is working to establish a regional network of cells of jihadist fighters that can help carry out international attacks.
Two senior Iraqi IS leaders, who were arrested in Turkey in December and extradited to Baghdad, told Iraqi intelligence that they contacted Ghafari for financial and logistical support by exchanging messages through two Tajik members of ISIS-K in Turkey, an Iraqi official said. .
One Taliban intelligence official estimates that 90 percent of ISIS-K members are non-Pashtuns. Tajiks and Uzbeks are the other two large groups that inhabit northern Afghanistan.
Mawlavi Habib Rahman, one of the former ISIS-K leaders who surrendered to the Taliban, told the Afghan media outlet Al Mirsad in November that the group had successfully recruited Tajiks.
"They were told that they are infidels and now they have become Muslims again (after joining ISIS-K)," Rahman said. Recruiters claim that the Tajik government consists of "infidels" and that ISIS-K wants to save oppressed Muslims, he said.
A January 2024 UN report noted that the group has stepped up efforts to recruit foreign fighters and disaffected Taliban members, with a particular focus on Tajiks. It is alleged that Tajik citizen Kukumatov Shamil Dodihudevich, known by the name Abu Miskin, has become an active propagandist and recruiter.
Tajikistan, a predominantly Sunni Muslim country where the Persian language is spoken, has a population of 10 million. After a brutal civil war in the 1990s, it remains one of the poorest former Soviet republics. Its economy is largely dependent on the earnings of migrant workers in Russia.
Tajik officials say many of their compatriots living in Russia complain of mistreatment, making them easy targets for extremist recruitment while living far from their homes.
Russia and the West targeted by ISIS-K
A day before the attack in Moscow, a senior US military official told the House Armed Services Committee that the Taliban's efforts to suppress ISIS-K in Afghanistan have not been successful.
General Michael Eric Kurila, the commander of the Central Command, stated in a written testimony that the Taliban did target certain senior leaders of ISIS-K, but that they had neither the capacity nor the intention to maintain pressure on the group. This allowed ISIS-K to rebuild its network, he said.
"ISIS-Korasan still has the capacity and the will to attack American and Western interests abroad in less than six months," said Kurila.
Zabihula Mujahid, a spokesman for the Taliban administration in Kabul, said that ISIS-K has been severely weakened and is conducting only rare operations against civilians. He denied that the group was stationed on the territory of Afghanistan, but said that he did not know where their base was.
The UN report said the drop in ISIS-K attacks inside Afghanistan likely reflects a change in Ghafari's strategy as well as the Taliban's counterterrorism efforts.
Authorities in several European countries carried out a series of arrests of alleged ISIS-K recruits in July and December last year, accused of planning terrorist attacks.
Christine Abizaid, director of the National Counterterrorism Center, told a House committee in November that ISIS-K has so far used "inexperienced operatives" to attempt attacks in Europe.
France, which will host the Olympics, raised its alert level to the highest level after the attack in Moscow.
For the past two years, ISIS-K has focused on Russia, criticizing Putin for turning the tide of the war in Syria by supporting President Bashar al-Assad against the Islamic State.
"ISIS-K has been making plans for attacks inside Russia for some time," Eron Zelin from the Institute for Middle East Policy in Washington told Reuters. He pointed out that the group's recent attempts to attack inside Russia have been unsuccessful.
Russia's FSB security service announced on March 7 that it had foiled an attack on a synagogue near Moscow.
It is possible that ISIS-K networks within the Tajik and Central Asian communities participated in efforts to conduct operations in Moscow, along with their large migrant population, Zelin said.
Bonus video:
