Sanaullah Ghafari, the 29-year-old leader of the Afghan branch of Islamic State, has overseen its transformation into one of the most fearsome branches of the global Islamist network, capable of operations far from its bases in the borderlands of Afghanistan.
Islamic State has claimed responsibility for Friday’s mass shooting at a concert hall near Moscow that killed at least 137 people. U.S. officials have said they have intelligence indicating it was the Afghan branch, Islamic State Khorasan (ISIS-K), that was responsible.
Washington has said it had warned Russia this month of an imminent attack. A source familiar with this intelligence said it was based on interceptions of “chatter” among ISIS-K militants. Russia’s foreign ministry, however, has questioned whether ISIS-K was responsible.
The discovery of Tajik passports on the gunmen arrested by Russian authorities suggested a possible link to Ghafari’s group, which has aggressively recruited from the poor Central Asian country, security experts say.
In recent years, his organization has also sought repeatedly to strike at Russia in retaliation for its intervention in the Syrian civil war, which helped to defeat ISIS' regional operations.
Ghafari was initially reported killed in Afghanistan last June but escaped with injuries across the frontier into Pakistan and is believed to be living in its lawless Balochistan border province, two sources in the Afghan and Pakistani Taliban told Reuters. Pakistan’s foreign ministry did not respond to a request for comment on Ghafari’s whereabouts.
Named as emir of ISIS-K in 2020, Ghafari has reinforced the group’s reputation for hardline ideology and high-profile attacks. ISIS-K grabbed global attention with a 2021 suicide bombing on Kabul international airport during the U.S. military withdrawal that killed 13 U.S. soldiers and scores of civilians. In September 2022, it claimed responsibility for a deadly suicide attack at the Russian embassy in Kabul.
But perhaps its most brazen operation to date came in January, with a double suicide bombing in Iran that killed nearly 100 people at a memorial for Revolutionary Guard commander, Qassem Soleimani – the deadliest militant attack on Iranian soil since the 1979 Islamic Revolution.
Little was known about Ghafari before the 2021 strike on Kabul airport, which prompted Washington to place a $10 million bounty on his head. The Taliban sources said he is an Afghan Tajik who served as a soldier in the Afghan army and later joined ISIS-K, which was formed in late 2014.
Reuters spoke to more than a dozen sources – including serving and retired security and intelligence officials in Afghanistan, Pakistan, Iraq and the U.S., as well as members of the Afghan and Pakistani Taliban – who said that ISIS-K had exploited the Taliban’s failure to eliminate its safe havens in northern and eastern Afghanistan to expand regionally.
Under Ghafari, the group has used high-profile attacks as a recruiting tool and targeted ethnic Tajiks and Uzbeks across Central Asia, rather than Afghanistan’s Pashtun majority, which forms the backbone of the Taliban, the sources said.
ISIS-K takes its name from an old Persian term for the region, Khorasan, that included parts of Iran, Turkmenistan and Afghanistan, as well as areas of Tajikistan and Uzbekistan. Its propaganda, translated into regional languages as well as English, vows to establish a caliphate spanning that area.
“ISIS-K … seeks to outperform rival jihadis by carrying out more audacious attacks to distinguish its brand, poach from rivals, and gain resources from potential supporters,” said Asfandyar Mir, a senior expert on South Asia security at the U.S. Institute of Peace, a government research body based in Washington.
Unlike previous high-profile suicide attacks by ISIS-K, the gunmen on Friday had sought to escape and were detained by Russian authorities some 300 km west of Moscow, stirring some doubts within Russia over whether they really were jihadists. In unverified images shown on Russian media, one of the alleged assailants told an interrogator he had been offered half a million roubles (a little over $5,000) to carry out the attacks.
Russian President Vladimir Putin has yet to name those he thinks are responsible for Friday’s assault and has not publicly mentioned the Islamist militant group in connection with the attackers, who he said had been trying to escape to Ukraine.
Colin Clarke, with the New York-based Soufan Center, a think tank for global security issues, said that there were a number of examples of Islamist militants escaping instead of carrying out suicide missions, like the ISIS gunmen who fled after attacking the Bataclan music hall in Paris in November 2015.
“They could have been interested in conducting a follow-on attack,” Clarke said, adding that the attackers may also have avoided buying or transporting explosives to lessen their chances of detection.
Frank McKenzie, the former head of US Central Command – which covers Central Asia and the Middle East, as well as part of South Asia – said the Moscow attack was in line with ISIS-K’s long-term objective of increasing its foreign operations, including against the United States.
“They remain determined to attack us and our homeland,” said McKenzie, who was the head of U.S. forces in the region during the withdrawal from Afghanistan. “I think the odds of that are probably higher now than they were a couple of years ago.”
The State Department in its bounty announcement described Ghafari, better known by his nom-de-guerre Shahab al-Muhajir, as an experienced military leader who had planned ISIS-K suicide attacks in Kabul.
It separately identified Ismatullah Khalozai, who ran a network of informal money transfers, or hawala, from Turkey, as the group’s “international financial facilitator”. A July 2023 report to the UN Security Council on the international threat posed by Islamic State said that ISIS-K numbered 4,000 to 6,000 people on the ground in Afghanistan, including fighters and family members.
Security experts trace the group’s expansion to the collapse of the parent Islamic State (IS) movement during the war in Iraq in 2017.
Many foreign fighters fled Iraq and reached Afghanistan-Pakistan to join ISIS-K, bringing expertise in guerrilla warfare that developed the group’s ability to launch attacks in Iran, Turkey and Afghanistan, according to a senior Iraqi security official, who asked not to be named.
Iraqi security believes that ISIS-K has been working to establish a regional network of jihadist fighter cells that could help execute international attacks, based on information from dozens of senior ISIS operators detained over the last two years, the official said.
Two senior Iraqi ISIS leaders arrested in Turkey in December and handed over to Baghdad told Iraqi intelligence that they would contact Ghafari for financial and logistical support by exchanging messages through two Tajik members of ISIS-K in Turkey, according to the Iraqi official, who is part of a security unit that monitors Islamic State activities in Iraq and neighbouring states.
A Taliban intelligence official estimated that 90 per cent of ISIS-K’s cadre is now non-Pashtun. Tajiks and Uzbeks are the other large ethnic groups that populate the north of Afghanistan.
Mawlawi Habib Rahman, a former senior leader of ISIS-K who surrendered to the Taliban, told Aghan media outlet Al-Mirsaad in November that the group had also successfully recruited Tajik nationals.
“They are told you were infidels and you have now newly become Muslim [after joining ISIS-K],” Rahman said. Recruiters say the Tajik government is made up of “infidels” and that ISIS-K wanted to rescue oppressed Muslims, he said. A Jan. 2024 UN report on the group noted it had stepped up its efforts to enlist foreign fighters and disillusioned members of the Taliban, with a special focus on Tajiks. It said that Tajik citizen, Khukumatov Shamil Dodihudoevich, alias Abu Miskin, had become an active propagandist and recruiter.
Tajikistan, a Persian-speaking and predominantly Sunni Muslim country, is home to 10 million people. After a brutal civil war in the 1990s, it remains one of the poorest former Soviet republics. Its economy is heavily dependent on remittances from over a million migrant workers in Russia.
Tajik officials have said that many Tajiks who live in Russia complain of mistreatment, making them easier targets for extremist recruitment while they are far from their homes.
A day before the Moscow attack, a top U.S. military officer told the House Armed Services Committee that Taliban efforts to suppress ISIS-K in Afghanistan were proving insufficient.
General Michael “Erik” Kurilla, the commander of US Central Command, said in written testimony that the Taliban had targeted some senior ISIS-K leaders but did not have the ability nor intent to maintain pressure on the group. This had allowed ISIS-K to regenerate its networks, he said.
“ISIS-Khorasan retains the capability and will to attack U.S. and Western interests abroad in as little as six months and with little to no warning,” Kurilla told a Senate committee hearing this month.
Zabihullah Mujahid, spokesman for the Taliban administration in Kabul, said ISIS-K had been seriously weakened by a security crackdown and was only carrying out rare operations against civilians. He denied the group was based on Afghan territory, but said it wasn’t clear where it was based.
The UN report in January said that a decline in attacks by the ISIS-K within Afghanistan probably reflected a change of strategy by Ghafari, as well as counterterrorism efforts by the Taliban.
Authorities in several European countries made a spate of arrests of alleged ISIS-K recruits in July and December last year, accused of plotting terror attacks. Christine Abizaid, director of the National Counterterrorism Center, told a House committee in November, that ISIS-K had so far used “inexperienced operatives” to attempt attacks in Europe. France, which will host the Olympic Games from late July, said late on Sunday it was raising its terror alert warning to its highest level following the shootings in Moscow.
For the past two years, ISIS-K has been fixated on Russia, criticizing Putin for changing the course of the Syrian civil war by supporting President Bashar al-Assad against Islamic State, security experts said.
“ISIS-K has been plotting attacks within Russia for some time,” said Aaron Zelin, a senior fellow at the Washington Institute For Near East Policy, a U.S. think tank. He noted that recent attempts by the group to strike within Russia had been unsuccessful.
Russia’s FSB security service said on March 7 it had foiled an armed attack by the group on a synagogue near Moscow.
ISIS-K’s networks within the Tajik and Central Asian communities may have facilitated efforts to conduct operations in Moscow, with its large migrant population, Zelin said.