Taliban increase raids in response to recent attacks and seek to downplay ISKP threat

March saw a resurgence in activity from Islamic State – Khorasan Province (ISKP) in Afghanistan, with several high-profile attacks targeting senior Taliban officials and journalists, as well as the Ministry of Foreign Affairs in Kabul. 

In response to these attacks, the Taliban conducted multiple raids throughout Afghanistan – likely the reason why ISKP activity came to a halt in April. 

Between 16 March and 16 April, Afghan Witness (AW) recorded 15 Taliban operations against ISKP in Afghanistan, a significant increase from prior months. In raids in Balkh and Kabul, the Taliban claimed various high-ranking and influential ISKP members were killed or arrested, though their deaths cannot be verified by AW. 

The raids against alleged ISKP cells have been heavily communicated by the Taliban, and appear to be part of a wider effort to demonstrate progress against the group while also downplaying the threat. The increase in anti-ISKP operations precedes a recent media focus on the threat ISKP poses to the West, with a leaked Pentagon assessment suggesting Afghanistan has once again become a staging ground for terrorism. 

There was a marked increase in raids/clashes against alleged ISKP cells between 16 March - 16 April. No incidents involving gun attacks or alleged attacks were recorded in this reporting period - likely due to the intensification of raids.

March 17: three raids in Mazar-i-Sharif  

On March 18, the Taliban spokesperson Zabihulah Mujahid issued a statement on Twitter claiming the Taliban special forces raided three alleged ISKP hideouts in Mazar-i-Sharif the previous evening. According to Mujahid, the operations took place in police districts (PD) 5, 6, and 8, and “many Daesh were killed”, as well as weapons and ammunition seized and a Taliban fighter injured. 

A video allegedly filmed at a location of one of the raids showed Taliban fighters collecting a large amount of 100 US dollar notes from the debris. Many of the 100-dollar notes had fresh blood stains and were half buried by the rubble, suggesting they were not placed at the location after the raid but were present prior to the attack.

Figure: Screenshots from the video showing a large amount of 100-dollar notes found at the location of one of the raids in Mazar-i-Sharif. The money was collected by a Taliban fighter (right), and a special operations military (left).

In a statement on March 26, the General Directorate of Intelligence (GDI) claimed various high-ranking ISKP members had been killed in the three raids in Mazar-i-Sharif. They were named as Maulvi Ziauddin, allegedly the second in command of ISKP, Abu Umar Afridi, an alleged member of the ISKP council, and Ustad Salman Tajikistani, allegedly in charge of military exercises and bomb manufacturing.

AW investigators found various photos of bodies of the alleged ISKP members after the raids in Mazar-i-Sharif, although it is not clear which raid the images are from and the photos only showed four individuals. Three of the bodies appeared to be among debris, possibly caused by an explosion –  a technique commonly observed in GDI-led raids. The remaining body seemed to be in a better-lit location, potentially an outdoor setting. They all presented various gunfire injuries, mostly focused on the head and torso.

None of the dead bodies seen in photos were specifically identified by the Taliban as belonging to the three high-ranking ISKP fighters claimed to have been killed by the GDI operation. 

Commenting on the raids on March 18, the Afghanistan Liberation Movement (ALM), a resistance group formed by ex-Afghan National Security Forces (ANSF) members, stated “the Taliban started the hunt under the name of ISKP against ANSF”. 

AW investigators were not able to confirm the identity of the deceased, their alleged allegiance to ISKP, or possible past connections to the ANSF.

Al-Mersaad, a pro-Taliban media outlet, published an article claiming the people killed in the three operations in Mazar-i-Sharif were Uzbek and Tajik citizens. The news agency added that a large amount of weapons and ammunition was recovered from the alleged hideouts, though AW investigators did not verify the presence of any weapons, ammunition, or protective equipment from the photos and video shared online.

The three raids on alleged ISKP hideouts in Mazar-i-Sharif were the first reported in Balkh province since the beginning of the year.  

March 21: raid in Kabul 

Days after the three raids in Mazar-i-Sharif, on March 21, the GDI conducted another raid on an alleged ISKP hideout in Kabul’s PD12, with Zabihullah Mujahid later announcing that the raid killed  “three important members of Daesh”. On March 24, the GDI released a [WARNING: GRAPHIC] video of the raid, which contained text claiming the residence was the hideout of an ISKP member responsible for “an explosive attack on the mosque of the Ministry of Interior” in October 2022. 

Unlike previous GDI footage, the video showed the special forces team addressing the residents of the house with the use of a megaphone before launching the attack. A man was heard saying “Hey Khawarij! Surrender yourselves to face justice or go to hell but let your children and women go as they don’t deserve to die with you.”  Reports claimed that “two women and seven children” came out of the building, possibly after the GDI’s request.

Apart from the initial communication with the residents, the GDI’s footage showed the same modus operandi as seen in previous Kabul raids: heavy gunfire and rockets launched towards the residence causing the structure to partially or completely collapse.  

Footage of the raid’s aftermath shared similarities with scenes captured in Mazar-i-Sharif days earlier. AW investigators verified the presence of three [WARNING: GRAPHIC] bodies at the scene, two of which seemed to have died as a result of the building’s collapse, and one due to various gunshots to the torso. The figure below shows two weapons allegedly recovered from the location, and two crushed bodies after the partial collapse of the building.

Figure: Two weapons allegedly recovered from the location (left), and two crushed bodies after the partial collapse of the building (right, highlighted in orange)

A video recorded the following morning showed the significant damage caused to the building. All visible glass was shattered, walls collapsed or covered in bullet holes, and the bodies remained in the same location. 

This was the fourth raid reported this year in the capital. On January 4 and February 13, the GDI performed raids on PD8 properties, and on February 26, the group reported a raid in PD17.

April 3: raid in Nimruz 

The Taliban’s raids continued in early April, with two separate operations carried out on April 3 and 9, targeting alleged ISKP hideouts in PD3 of Nimruz’s capital, Zaranj City.  These are the only documented operations against ISKP safehouses in Nimruz province since the Taliban takeover, although two ISKP members were reportedly arrested in January this year.

After the raid on April 3, clashes reportedly erupted and continued into the early hours of April 4. Former Tolo News Correspondent, Abdulhaq Omeri, shared a video of the clash, recorded from a balcony overlooking Zaranj’s PD3, in which gunfire and an explosion are audible, as well as a flash from the explosion.  

Photos of the scene of the raid show the presence of Taliban special forces, likely part of the GDI. As seen in previous raids against alleged ISKP cells, a photo of the raid's aftermath showed a large amount of rubble, though it is unclear whether the destruction observed in the photos was due to explosives near the property or rocket-targeted attacks during the raid. 

Local sources told Amu TV that suspected ISKP members escaped during the clash and scattered into the neighbourhood, prompting the Taliban to extend their operation in the area. The Taliban did not reference any escaped ISKP members or mention a wider search operation in their official communications. 

Zawia News, an Afghan digital news agency, published a video showing injured men inside a helicopter. According to the caption, the victims were Taliban fighters wounded during the clash in the Masoom Abad area. Zawia News reported three people were killed and 18 injured due to the clashes. When approached by Tolo News, the Nimruz Taliban Police spokesperson, Gul Mohammad Qudrat, did not provide figures regarding the number of ISKP casualties but claimed all members of the terror group cell in the area were killed. 

April 9: second raid in Nimruz 

On April 9, Amu TV reported a second conflict in Zaranj City between the Taliban and “unknown armed men”, which reportedly started at 0530 local time and occurred in the Syedabad area in PD3. The claim was accompanied by a video showing the presence of various armed Taliban fighters in armoured vehicles. 

Bakhtar News, a Taliban-controlled state news agency, confirmed the claim and area where the raid took place, reporting that two ISKP members were killed and another one arrested as a result of the operation on the alleged hideout. A video shared on social media showed smoke rising from the alleged ISKP safe house and audible heavy gunfire. AW investigators geolocated the residence to the southern outskirts of Zaranj City in PD3. 

Figure: Geolocation of the alleged ISKP safehouse raided by the Taliban in PD3 of Zaranj city, Nimruz province [30.938991, 61.855396]

In one of the photos shared on social media, Taliban fighters can be seen carrying yellow jerry cans, likely containing explosive material, as seen in the figure below on the left. AW investigators previously observed similar methods in two raids on alleged ISKP safehouses in Kabul in August 2022 and [WARNING: GRAPHIC] February 2023. In both instances, the Taliban used explosives to destroy houses or buildings with ISKP suspects inside, rather than conducting a clearing operation.    

A video of the explosion at the alleged ISKP safehouse in Zaranj on April 9 appeared to show the location of the detonation. The blast seemed to originate at the ground level, as seen in the images below on the right. It is likely that Taliban forces placed the explosives near the wall towards the end of the clash when it was safer to approach the location. 

Figure: Taliban fighters carrying containers, possibly with explosive material (left). The sequence of events of the explosion at the alleged ISKP safehouse in Zaranj (right).

On April 9, Amu TV shared a [WARNING: GRAPHIC] video showing two children and a woman in a hospital, who according to the outlet’s sources, were wounded during the raid in the Syedabad area. According to the report, the woman succumbed to her injuries and both children were in critical condition. According to the outlet’s tweet, the Taliban prevented journalists from reporting at the scene of the incident and speaking to local residents. 

8am media provided similar claims about a woman and child who were injured during the clashes, and reported that local sources claimed the Taliban “dragged a woman and a young child out of the area in a wounded state”. AW investigators were not able to independently verify the claim.

Criticism from pro-ISKP online community  

The footage of Taliban fighters blowing up the alleged ISKP cell drew criticism from pro-ISKP social media users, with some claiming the Taliban could not face the Islamic State soldiers directly and were resorting to explosives out of cowardice. 

One user, referring to the Taliban as a “U.S. anti-terror militia”, claimed the Taliban were “blowing up complete homes along with kids and women”, and mocked the Taliban’s denial of ISKP’s presence inside Afghanistan. 

Another pro-ISKP account asserted that rather than fighting ISKP directly, the Taliban “always fire missiles and rockets and deliberately kill everyone inside the house” when going after “one of two Mujahideen who live with their families”.

The Taliban’s push to downplay ISKP threat 

There has been a recent communications push by the Taliban to demonstrate progress and simultaneously downplay the threat of ISKP in Afghanistan, after the group’s return to action in March with several high-profile attacks, which occurred despite the Taliban’s frequent and heavily communicated raids against alleged ISKP cells in the months prior. 

The GDI announcement on March 26 claimed three important ISKP figures were among those killed in the coordinated raids in Mazar-i-Sharif, and was followed by a live Voice Of America (VOA) Pashto interview with the Taliban spokesperson Zabihullah Mujahid on March 31, in which Mujahid claimed that ISKP no longer poses a significant threat in Afghanistan. He stated that since the Taliban takeover, 1,600 to 1,700 ISKP members have been imprisoned, and over 1,100 more have been killed by the Taliban. As of the time of writing, ISKP had not commented on the Taliban’s claims. 

On April 2, a pro-Taliban propaganda channel released an unverified voice clip from ISKP leader Shahab Al-Muhajir, in which he is heard expressing disappointment and dismay at the recent loss of senior figures and fighters from the group. This would be the first time an audio clip was attributed to Al-Muhajir, and, while the authenticity of the voice clip is unconfirmed, an analyst quoted by VOA highlighted evidence supporting its veracity, while also suggesting the comments accurately reflect the reality on the ground for the group. ISKP has not released the message at the time of writing.  

On the same day as the leaked voice clip, the Taliban’s GDI released a video containing the confession of an arrested ISKP member named Ainuddin alias Mohammad. Ainuddin Mohammad was allegedly involved in the recent major attacks in Balkh and Samangan, including the suicide attack against the Taliban’s Balkh governor and the explosion which targeted journalists inside the compound of Tebyan Cultural Centre and AVA News Agency.  

The leaked audio and confession video are the latest in a series of Taliban announcements that seek to portray a campaign of success against ISKP. While ISKP conducted high-profile attacks in Kabul and Balkh in 2023, the Taliban continue to downplay the group's threat, instead claiming that ISKP is on the verge of collapse in Afghanistan. 

This line contrasts with the stance taken by the senior US General, Michael Kurilla, in mid-March, when he warned against ISKP’s rapidly growing capabilities to attack American or Western interests in less than six months. The Taliban’s spokesperson rejected his statement as untrue and exaggerated, but Kurilla’s concerns have since been echoed by a leaked Pentagon assessment, which, according to a Washington Post exclusive, portrays the terror threat to Europe, Asia and the United States as a growing security concern.

In the article, a U.S. defence official points out that the Taliban have put pressure on ISKP since the U.S. withdrawal, suggesting mutual objectives when it comes to the security threat the group pose. The idea that the Taliban are collaborating with or are subservient to the U.S. is a consistent theme being pushed by pro-ISKP social media accounts, and has recently escalated, with the accounts jumping on comments made by U.S. officials as ‘proof’ of a collaboration between the Taliban and U.S. against ISKP.

These comments were followed by news on April 25 that the Taliban had killed the leader of the IS cell responsible for the Kabul airport suicide bombing in August 2021. According to the New York Times, U.S. officials said that based on classified intelligence reports, analysts were able to conclude with “high confidence” that the chief plotter of the airport attack had been killed. 

However, there have been no further details or supporting evidence provided, as with the other high-profile ISKP members the Taliban claim to have killed in recent months. The U.S. reportedly learned of the leader's death in early April, but it is unclear whether he was targeted specifically by the Taliban or if he was killed during their ongoing clashes with ISKP.