Myths and facts surrounding the Islamic State - Khorasan Province (ISIS branch in Khorasan).
Author: Amrullah Saleh, former first vice-president of the Islamic Republic of Afghanistan, especially for “Sangar”
1 - The origins of the formation of the Islamic State - Khorasan Province (ISIL-Khorasan) stems from the flight of several insurgent groups from the Orakzai region of Khyber Pakhtunkhwa Province of Pakistan to Nangarhar Province of Afghanistan in late 2014. It is unclear whether these insurgent groups were pushed into Afghanistan by the Pakistani military or were allowed safe passage into the country by secret agreement and in line with Islamabad's long-standing policy of expelling militants into Afghanistan. In Afghanistan, by kinship and regardless of ideological considerations, these insurgents are supported by the Nangarhar tribes west of the Durand Line, according to Pashtunwali ethics and partly to compensate for the hospitality that the Orakzais provided to Afghan citizens during the anti-Soviet jihad in the 1980s. That changed a few months later when rebel leaders made contact with ISIS headquarters in Syria. Within a few months, Orakzai's dispossessed rebel groups received $800,000 in aid. The exact date of the first cash payment is unknown, but it was discovered and confiscated by US/NATO forces. Communications between Orakzai insurgents and ISIS headquarters coincided with ISIS's decision to establish a branch of the group in Khorasan province.
2 - For several months in 2015 and early 2016, the Khorasan branch of ISIS refrained from attacking Afghan defense and security forces, causing locals to call them "good terrorists." However, this calm before the storm soon ended and security turmoil began. After the mosque bombing, this group lowered the Orakzai flag and raised the black ISIS flag. The emergence of an ISIS-Khorasan affiliate in Nangarhar province in eastern Afghanistan surprised counter-terrorism experts who believed that ISIS's "tamkin", the area under its rule (society submitting to them), could only be established in Salafi-majority areas. However, there were no Salafi residents in this particular area.
3 - By the end of 2015, the Haqqani network's contract to send mercenaries into the Syrian war in support of the ISIS group ended, and some of those who returned from this contract with the Syrian military mission joined ISIS-Khorasan in Nangarhar to pursue their goals. At this stage, Pakistan's military intelligence (ISI) without explanation summoned from Karachi jail a suspicious and controversial man named Muslimdust, a former jihadist accused of drug trafficking and sentenced to 30 years in prison. He was released and mysteriously took over the leadership of ISIS-Khorasan. Muslimdust later joined the Taliban, fueling rumors that early ISIS-Khorasan was more of a decoy than an actual offshoot of the main ISIS group. The transformation of ISIS-Khorasan from fake to real intensified after the first financial assistance from Aboubakr al-Baghdadi. This financial contribution from ISIS headquarters in Nangarhar was the main reason why the US military and the Resolute Support Mission began serious surveillance of the group.
4 - In the very early stages of the emergence of ISIS-Khorasan, leaders of the Afghan Salafi community/sect contacted the government of the Islamic Republic of Afghanistan to create the concept of ideological resistance to ISIS-Khorasan. They were worried that the activities of the ISIS group with Salafi ideology would ruin their reputation and position in society. The Salafis wanted to protect their sect from accusations of links to terrorism and criminals. This proposal was not considered due to the existence of ambiguities and gross misunderstandings regarding Salafism in Afghanistan, and the Afghan government at the time considered the creation and presence of Salafist armed groups to be dangerous. Instead, President Ashraf Ghani's government organized "tribal militias" against ISIS in Nangarhar, which proved effective in both rooting out the group and containing the Taliban. Because the Taliban alone were unable to fight ISIS-Khorasan, they were never able to break the tribal anti-ISIS militias that later became part of the contract forces of the Afghan National Security Directorate. Although all leaders of the current ISIS-Khorasan are Salafis or have Salafi views, the main Salafi community in Afghanistan has never taken action in support of ISIS-Khorasan. After occupying Afghanistan in August 2021, the Taliban massacred hundreds of Salafi leaders, especially in areas of Nangarhar province, on charges of spying for the republic's hapless government and refusing to support the Taliban. The campaign of executions and murders of Salafis in Nangarhar was carried out by Dr. Bashir, the head of Nangarhar's national security service, who allegedly lost members of his family in the conflict with the original ISIS-Khorasan group.
5 - There have been scattered rumors circulating in the public, with strong logic and a large amount of confirmation and evidence that the US military/CIA facilitated the battle between ISIS-Khorasan and the Taliban, and sometimes provided air cover to the Taliban factions for the stabilization of the stalemate between these two groups. US military generals have refuted this claim, saying that "the Taliban may have benefited from our air campaign against ISIS-Khorasan as a free pass, but it was not coordinated with Taliban." The current leader of ISIS-Khorasan was a member of the Haqqani network at the time and had already carried out several deadly demonstration operations in areas of Kabul on behalf of the Haqqani network. The question remains why the US military never wanted to destroy either of these two groups (Taliban and ISIS-Khorasan), even though they had enormous military and intelligence power in the region and the support of local communities. The use of the Mother of All Bombs (MOAB) on April 3, 2017, against one of the suspected ISIS-Khorasan command caves was a foolish decision that, while not damaging ISIS, raised its profile. It also gave ISIS-Khorasan more reasons to seek additional assistance from ISIS headquarters. It is believed, on reasonable grounds, that the purpose of this weak attack was to test the effectiveness of the bomb rather than to destroy the ISIS-Khorasan group's command cave. Of course, it is not yet known who died in the attack. No residents died as a result of this attack, and no final statements or detailed accounts of this attack have been published.
6 - The “useful life” of ISIS-Khorasan leaders is very short, except the current leader of this group, who lived on average more than 18 months due to his skills and numerous factors related to the strategic environment. After the exclusion of Muslimdoost, who was not a Taliban jihadist but from the Islamic Union jihadist Party, all the leaders of ISIS-Khorasan were either former members of the Afghan Taliban or former members of the Tehreek-e-Taliban Pakistan. Before the appearance of Sanaullah, also known by the nickname "Shahab al-Muhajir", the National Security Directorate of the Islamic Republic of Afghanistan arrested Aslam Farooqi, the most prominent leader of ISIS-Khorasan, who lived in Kandahar. He was released from prison in 2021 as the Taliban entered Kabul. The release of Aslam Farooqi is one of the clearest examples of how the mainstream Taliban have sometimes underestimated or concealed the presence of ISIS-Khorasan due to the historical relationship between the two groups. Except for Muslimdust and the current leader, all previous leaders of ISIS-Khorasan had strong religious beliefs. Sanaullah, also known as Shahab al-Muhajir, also from the Nasiri Pashtun tribe in the Shakardara region, north of Kabul, is a man who dropped out of engineering school, first married a distant relative, and then married the daughter of a Salafi family in Badakhshan province.
7 - The ISIS-Khorasan branch also entered the field with its terms and literature, such as "tamkin" (territory under rule), "katiba" (military unit), "igmasi" (suicide who first fights with a weapon and then blows up his vest), "Lajna Sharia" (central council) or committee, which is theoretically the highest decision-making body. ISIS typically spends significant time and resources justifying its anti-Shiite policies, ignoring legitimate governments, portraying al-Qaeda as an ally of Shiite Iran, and accusing the Taliban of being mercenaries of "infidel's organizations." They were faced with the problem of creating a "caliphate" based on the teachings of Ibn Taymiyyah, one of the strictest muhaddith of Islam with the smallest number of followers. However, the Taliban's suicide squad training programs are the same as those for ISIS. The same material is taught to terrorist forces by different instructors: one under a white flag, the other under a black flag.
8 - In the years before the Taliban came to power, about 15 katiba of ISIS-Khorasan were suppressed by Afghan defense and security forces with the cooperation of the US military and CIA-backed militias. According to our information, this group currently has four katiba, two of which are headed directly by Sanaullah himself. These two katiba are called “ighmasi” and “istishhadi” (“ighmasi” is for suicide bombers with weapons and vests, and “istishhadi” is only for suicide bombers with vests).
9 - In the first months of 2023, ISIS-Khorasan carried out its activities slowly due to a lack of financial resources. But in the second half of the year, the group received a significant amount from "foreign sources", which was reported to be around two million dollars. This amount was distributed among various Afghanistan commanders and units (sub-katiba). Besides “foreign aid,” ISIS-Khorasan has other sources of income, including a tax on timber trade in Kunar province, extortion, businessmen blackmail, and some financial assistance from wealthy individuals who sympathize with or are threatened by the group. In 2023, financial assistance from Kandahar topped the list but was still negligible compared to income from the timber trade and foreign aid.
10 - Until the fall of 2023, the ISIS-Khorasan Central Council, or Lajna Sharia, had 23 members, most of whom were from the Bajaur tribal areas of Khyber Pakhtunkhwa, as well as Kunar, Kunduz, Kabul and Herat provinces in Afghanistan. A remarkable and confusing point is that the only member of Lajna Sharia from Badakhshan province, where there is a significant Salafi community, is a man named “Muawiyah Badakhshani”, a graduate of one of the universities in Lahore, married to a Pakistani woman. He is a Lashkar-e-Taiba veteran. Lashkar-e-Taiba is a highly organized organization known as an unofficial branch of the Pakistan Army. Muawiyah is known as a polyglot among members of the Lajna Sharia of ISIS-Khorasan.
11 - The propaganda department of ISIS-Khorasan, the most effective and well-equipped department of this group, is headed by Sultan Aziz Azam, a journalist and graduate of the Faculty of Journalism of the University of Nangarhar Province. He is a passionate speaker and worked at a local radio station before being suspected of links to ISIS-Khorasan. Despite conflicting information about Azam, he is now considered the second most powerful person in the ISIS-Khorasan structure. His many responsibilities are believed to include planning city bombings and other complex operations. According to information received from ISIS-Khorasan followers, Azam was seen in 2023 in the city of Karachi (Pakistan), where he lived with his family under an alias. A significant expansion of ISIS-Khorasan's PR activities began with the launch of an advertisement in Persian with a special propaganda leaflet for the residents of Panjshir, which urged them to join ISIS-Khorasan and take revenge on the Taliban militants. The group continues to attract a growing audience in the Indian subcontinent, attempting to widen the divide between Hindus and Muslims and portray itself as a force that takes revenge on the powerful. In a voluminous and repetitive ISIS-Khorasan propaganda booklet entitled “Cow Worshippers – How to Defeat the Arrogance of Hindus?” outlines the group's strategy against India.
12 - To gain help as well as attention from Western countries and Iran, the Taliban exaggerate their bias against ISIS-Khorasan. The only important Lajna Sharia person killed by the Taliban was Mullah Fateh Kunari, known as "Commander Qari Kuffar". He was killed at his safe house in northern Kabul during the conflict with the Taliban. The reality of the Taliban's war against ISIS is less than 10% of what the government of the Islamic Republic of Afghanistan did before. Not a single ISIS-Khorasan katiba was completely suppressed by the Taliban. The Taliban's propaganda achievements mainly include attacks on individual members of ISIS-Khorasan. Although there is no staffing quota or standard for katiba, according to archived documents of the National Security Directorate of the Islamic Republic of Afghanistan, the minimum number required for each katiba is 20 people.
13 - Several factors make it difficult and even impossible for the Taliban to fight ISIS-Khorasan. These factors are:
A) Many leaders of ISIS-Khorasan, including the current leader of this group, are former and at some point in time members of the terrorist group Taliban. This background allows ISIS-Khorasan cadres to act smarter than their former comrades and use common tactics for defense and escape.
B) Thousands of Taliban members shared cells with ISIS-Khorasan prisoners in prisons in the Islamic Republic of Afghanistan. Under one roof, some members of ISIS-Khorasan became Taliban, and some Taliban joined ISIS-Khorasan. This confusion creates a lot of room for maneuvering for ISIS-Khorasan. Shahab al-Muhajar reportedly stated that he has 15,000 supporters and collaborators within the Taliban who will be mobilized one by one for special operations and until the time is right, for an internal "military coup" and using all of them.
14 - The emergence of Sanaullah, alias Shahab al-Muhajir, in the leadership of ISIS-Khorasan is linked to his alleged role in the Kabul airport bombing near Abbey Gate, which killed more than 250 people, including 13 American soldiers in August 2021. Cruelty, inhumanity, and more brutality helped him rise to the leadership ladder, not intelligence or religious and academic differences. More experienced and religious representatives of Lajna Sharia always question his religious and scientific credentials. Internal conflicts over who is worthy of leadership caused ISIS-Khorasan to stagnate for several months in 2023 and cause divisions within the group; until they overcame their differences at a "council" meeting in Nuristan Province in Afghanistan. It was during this time that some pro-Taliban and Pakistani social media accounts began speculating about the death of Sanaullah, known as Shahab al-Muhajir. It is reported that members of Lajna Shariah had heated and deep discussions with him, which were exaggerated under the name “armed conflict” on Taliban and Pakistani social media accounts. The leader of the ISIS-Khorasan affiliate wanted to exclude Muawiyah Badakhshani from Lajna Shariah but was unable to gain sufficient support for this. Based on the latest information received, after the last meeting of Lajna Sharia in Nuristan, Muawiya returned to Lahore again.
15 - The existence of a chain of business links between the Taliban and ISIS-Khorasan has also been documented. Mullah Taj Mir Jawad, the Taliban's deputy security chief who was based in Peshawar, Pakistan, and orchestrated attacks in Kabul for more than two decades, successfully outsourced some of the dirty work to ISIS-Khorasan for huge sums of money and sometimes protection. For example, Mawlawi Safiullah, the Taliban police chief in Baghlan province, was a prominent commander of the Badakhshan Taliban. One day, among his comrades from Badakhshan, he publicly expressed dissatisfaction and criticized the character and racist behavior of the Taliban administration in Kabul. Mullah Javad Tajmir was informed of this and his relationship with Ahmad Masud, the leader of the National Resistance Front. Mawlawi Safiullah, a brave Taliban from Badakhshan, who overestimated his position among the Taliban to avoid revenge from the group, was killed when a bomb planted in his car by ISIS-Khorasan mercenaries, supported and directed by Mullah Taj Mir. This is one of the cases reported in 2023. Every aspect of this case was discovered and documented.
16 – The Katibs or operational units of ISIS-Khorasan follow the principle of “division” and interact with each other based on specific operational needs. The program for studying the “business” of ISIS-Khorasan is similar to the programs of the intelligence services of modern countries. They train their troops in interrogation behavior and tactics. Members of ISIS-Khorasan mainly use Telegram and Signal to communicate and avoid using WhatsApp. If an operative is caught by one katiba, he will have no idea about the location and identity of the other katiba. This isolation has helped ISIS-Khorasan remain active despite constant casualties. The question arises, does Shahab al-Muhajar himself oversee all ISIS-Khorasan networks, or is each katiba independent? The answer to this question remains a mystery. The only department that is connected to all the katibas is the media department, which is headed by Sultan Aziz Azam, a former journalist and current terrorist.
17 - The brutal attack that took place in Moscow on March 22 was first attributed to ISIS and then claimed on the ISIS Amaq website. This attack certainly raised a question in most societies and government agencies: why does this terrorist group attract “foreigners,” especially citizens of Central Asian countries? ISIS is a high-tech terrorist organization. They attract them by infiltrating chat rooms, social media accounts and identifying vulnerable, disaffected, and troubled youth. We must also remember that ISIS is also a contract killing organization. They have different training programs designed for different categories of conscripts. Those used in Moscow seem to fall more into the “disposable” category. These types of people are recruited to carry out a suicide mission, and it is obvious that such people receive two types of lessons in orientation and training to carry out attacks; This starts with an online motivational speech and ends with in-person meetings, but in-person meetings are not always necessary. If a person is not familiar with the use of weapons and explosives, he is invited to their shelters somewhere in Afghanistan for training. Afghanistan under Taliban rule is currently the safest place for such training.
18 - Since mid-2023, the Taliban intelligence department has created a fake recruitment unit called ISIS-Khorasan, which attracts young people from various Central Asian countries and Central Asian migrant workers in Russia to Kabul via Turkey and Iran. This unit is an affiliate of ISIS-Khorasan, but in reality, this is an intelligence trap for the Taliban. The trip of the future terrorist is paid for by the intelligence of the Taliban group in the name of ISIS-Khorasan. Upon arrival in Kabul, some of these new arrivals will be detained for the false but successful story of the Taliban, where controversial media headlines will write: “Taliban as a good group, effectively fighting ISIS-Khorasan.” The Taliban would later transfer these captives to their countries of origin. The Afghanistan Green Process Intelligence Team has the names of many of these unfortunate people in Taliban detention cells. The Taliban provides this so-called "achievement" to foreign intelligence agencies to improve and strengthen relations with them. But not all these prisoners and real statistics are transferred to foreign intelligence agencies; Some of them will be trained in the use of weapons and explosives and sent on special missions on behalf of ISIS-Khorasan. This program is dangerous and has had many leaks and crashes so far.
In addition to the deception method, some mosques and special schools in northern Afghanistan conduct sermons and lectures for Central Asian audiences and guest workers in Russia. These schools and mosques advertise their WhatsApp numbers on their websites and invite listeners and visitors to interact and take action. People who have shown interest from the audience are later introduced to other programs. In some cases, these mosques and madrassas are inviting their audiences to speak remotely, as well as giving speeches to congregations in mosques before Friday prayers. This opportunity makes volunteers happy and encourages them to continue the relationship. Some of them end up falling into the Taliban's trap. Common themes for easily recruiting volunteers include sharing frustrations with being ruled by a secular legal government or the difficulties of working and migrating abroad. A high level of frustration indicates the vulnerability of the volunteer and makes him a suitable candidate for the role of a full-fledged terrorist.
19 - The Afghanistan Green Process intelligence team prepared profiles of approximately 575 ISIS-Khorasan operatives in various regions of Afghanistan. These people are all new arrivals, and none of them are Republican-era prisoners released by the Taliban. Among them, 495 (86.1%) terrorists are citizens of Afghanistan, 71 (12.3%) are Pakistani, 4 (0.7%) are Iraqi, 4 (0.7%) are Syrian and one is Yemeni. Of the 495 citizens of Afghanistan, the ethnicity of 238 people (48.9 percent) is unknown, 249 people (43.3 percent) are Pashtuns, 31 people (5.4 percent) are Tajiks, 11 people (1.9 percent) are Nuristanis and 0 .5 percent are Uzbeks. Information and biography of each named individual can be obtained from the Afghanistan Green Process Intelligence Team.
20 - ISIS's fifty-page propaganda brochure focuses primarily on the reasons for the divergence in the group's strategic and global vision from al-Qaeda. The document, literally entitled "Betrayal in the Unity", refers to the moment when ISIS-Khorasan decided to help the "besieged and weakened al-Qaeda" in Iraq and Syria under the leadership of Abu Bakr al-Baghdadi and thereafter. The ISIS statement claims that al-Qaeda was unable to separate itself from Shiite interests and join the fight for the pure cause of establishing a "caliphate" and that is why their alliance did not last long. According to the document, which was released primarily for the group's internal use, the consequences of the alliance were serious as disgruntled al-Qaeda members launched a campaign of revenge against ISIS and collaborated with the intelligence services of "infidel and apostate governments." This document opens a window into the internal dynamics between various terrorist organizations; Although lower-ranking members of these organizations may switch sides to overcome stagnation and frustration, their leaders are intransigent. Powerful intelligence agencies mainly created the differences and disputes between them for geostrategic and geopolitical reasons. As a result of the well-organized work of such powerful intelligence agencies, a global terrorist alliance was not formed, and these groups remain fragmented along geostrategic fault lines by the emerging divisions of the new Cold War. However, as great power rivalry intensifies, attempts to influence and remotely control extremists in the realm of political Islam will become increasingly powerful.
21 - At a meeting in Nuristan in early fall 2023, members of ISIS-Khorasan's Lajna Sharia reportedly decided to delay the creation of tamkeen, a territory under their control, and instead focus on dramatic attacks and media noise. At this council, three points of view were discussed: to create a “tamkin”, most members considered it too risky and should be postponed. Some members preferred small, sustained attacks. It was concluded that such attacks might not attract the media attention the organization needed and would result in a waste of resources, so it was decided to go straight to urban attacks with mass, shocking, and dramatic casualties. However, this decision does not restrict the group from carrying out other simpler operations such as kidnapping, extortion, targeted killings, and intimidation.
22 - Conclusion: There are two groups of ISIS-Khorasan, one of which is a real branch of ISIS, and the other is a deep fake, controlled by the Taliban intelligence group. Both ISIS- Khorasan affiliates - the real one and the fake one - are contract killers. The abundance of suicide bombers among the Taliban allows them to use some of them for more dirty work and blame it on ISIS. Today's Afghanistan is far from within reach; Western donor countries, especially the United States, are pouring huge amounts of money into the Taliban administration without oversight or strings attached. Civil society is suppressed and there is no free media in the country, so undercover investigations are needed to uncover the hidden truth. Will Moscow's attack change the world's view of what is happening in Afghanistan? Will March 22 become September 11 in Russia? Which ISIS-Khorasan group was recruited to attack Moscow? In this regard, many questions arise that will not be answered soon, and certainly will not be resolved only by arresting the perpetrators of the incident. Finding the masterminds behind this brutal attack is an entirely different set of serious intelligence efforts. The four Tajik citizens involved in the brutal terrorist attack on March 24 are nothing more than the burnt nuts of organized intelligence. We need to keep an eye on this!
