ISKP: “Kill them wherever you find them” highlights increased activity in Afghanistan

Photo: © Afghan Witness, 2023, Kandahar, Afghanistan

On 4 January 2024, Islamic State spokesman Abu Huthaifa al-Ansari, announced the start of the “Kill them wherever you find them” campaign on al-Furqan, an IS-affiliated media outlet. Following the announcement, AW noted an increased number of attacks in Afghanistan. Since the start of the campaign, ISKP has claimed three attacks across Afghanistan (two in Kabul and one in Kunar). Three further unclaimed attacks, with ISKP trademarks, were noted in Kabul, Mazar-i-Sharif (Balkh),  and Zaranj (Nimroz). If these attacks are indeed the work of ISKP, this marks a level of activity not seen since 2022; it also demonstrates a combination of past ISKP strategies, targeting minority and high-value targets simultaneously.

ISKP claim attacks in Kabul

On 6 January and 9 January 2024, ISKP claimed two attacks on small passenger buses in Dasht-e-Barchi (west Kabul), and Police District 16 (PD16, east Kabul), respectively. Following the explosion in Dasht-e-Barchi, which affected Hazara civilians, AW visually confirmed at least four casualties. 

Following the explosion in PD16, social media users reported the death of three people. AW geolocated the explosion along Ahmad Shah Baba Road [34.524787, 69.278428], but did not visually confirm any casualties. On 11 June 2022, ISKP claimed a similar style attack in the area, targeting a small passenger bus.

Figure: Geolocation of video shared on Facebook, showing the aftermath of the ISKP claimed attack, targeting a small passenger bus in PD16, east Kabul [34.524787, 69.278428]

Analysis of explosives used 

AW assesses that an improvised explosive device was used in the Dasht-e-Barchi attack on 6 January 2024. The positioning and type of explosive device used appear to be consistent with a Magnetic IED (M-IED) or similar device, coated in a sticky substance. AW notes that use of M-IEDs is a common tactic employed by ISKP in the targeting of civilians. These devices are covertly attached to the underside of vehicles or locations where magnets can be easily attached. They appear to have become a tool of choice for carrying out assassinations or attacks on moving targets. 

On 9 January 2024, a second explosion occurred on a similar-style small passenger bus in PD16, east Kabul. AW assesses that this explosion took place inside the vehicle rather than externally. This was determined by the lack of externally warmed metal and damage that would be consistent with an external blast. The images show damage to all of the vehicle’s rear windows, indicating that pressure from inside the minibus blew out the windows, which is consistent with an explosion occurring inside the vehicle. 

AW did not note major internal damage to the upholstery; this indicates a lack of fire damage. On the rear of the external portion of the vehicle, there is visible shrapnel damage on the door panelling, and both wheels on the visible side of the vehicle appear to be deflated. This shrapnel-style damage, along with the lack of fire damage, are consistent with a hand grenade or military explosive that would have limited flame production.

Figure: Image shared by Rukhshana Media shows the damage to the roof of the small passenger bus in Dasht-e-Barchi, west Kabul. AW assesses the damage is consistent with a M-IED attack (left). Image of the damaged small passenger bus in PD16, Kabul, shows visible shrapnel and lack of fire damage. AW assesses that this explosion was potentially caused by a hand grenade or similar device (right).

Analysis of direction of travel of targeted small passenger buses

Historically, ISKP attacks in Kabul’s Dasht-e-Barchi mostly target mini buses carrying civilians travelling into the area. AW analysis of these attacks revealed that all ISKP-targeted small passenger buses were travelling east on the main Shahid Mazari road running through the area. Several of these explosions occurred near the entrance of the Dasht-e-Barchi area. AW assess ISKP likely places M-IED devices on the vehicles before they enter the Dasht-e-Barchi area, which are then detonated once the buses enter the area.

Unclaimed attacks in Kabul, Nimroz, and Balkh with ISKP trademarks

On 11 January 2024, an explosion occurred along Shahid Mazari road in Kabul’s mainly Shia Dasht-e-Barchi area. That day, international humanitarian organisation Emergency NGO reported their surgical centre received 13 injured people following the explosion. An unverified list of victims was later shared on social media, containing 22 names. AW visually confirmed at least four casualties following the explosion which was geolocated in front of the Barchi City Center along the main road in Dasht-e-Barchi [34.499899, 69.069330].

Also, on 11 January 2024, an explosion occurred in the city centre of Mazar-i-Sharif, Balkh province. AW geolocated the explosion to the front of the blue mosque in the centre of Mazar-i-Sharif [36.708584, 67.108193], indicating that this attack was intended to target civilians. Despite this, AW could not verify any casualties. 

Then, on 14 January 2024, an explosion [WARNING: GRAPHIC] occurred in the courtyard of the Taliban governor's office in Zaranj, Nimroz province [30.9609830, 61.8608346]. AW visually confirmed one casualty, a man who had been decapitated; it is likely that this individual was the suicide bomber who attempted to enter the building. Following the attack, the Governor of Nimroz province, Sheikh Muhammad Qasim Khalid, said: “An attacker came to the provincial compound, he was identified and neutralised by the security guards. The detonation of explosives caused slight injuries to 3 members of the security guards.”

In a video shared immediately following the Zaranj attack, by a pro-Taliban account on X (formerly Twitter), the Governor of Nimroz is seen speaking on the phone. He says: "Our friends are searching for this other person and I am doing all good.” AW assesses this possibly indicates that a second attacker fled the scene following the failed attack.

Simultaneous attacks signalling shift in tactics

Since the Taliban seized control of Afghanistan, ISKP has claimed five attacks along the main Shahid Mazari road, which runs through Kabul’s Dasht-e-Barchi area. Between November and December 2021, ISKP claimed three attacks, after which ISKP activity in the area ceased. Following a long period of absence, and a shift in focus by ISKP to high-value targets – such as the Russian embassy – the group returned to Dasht-e-Barchi at the end of October 2023, claiming two attacks. With the increase in recent claimed attacks in Dasht-e-Barchi, it appears ISKP has renewed its targeting of the Shia population in the area.

ISKP has shifted tactics several times since the Taliban takeover of Kabul. Immediately following the takeover, ISKP focused its frequent attacks on Taliban patrols in Kabul and Nangarhar, as well as minority targets. In 2022, ISKP shifted focus, with a decrease in the number of attacks and several periods of complete absence. During this period, however, ISKP conducted multiple high-value attacks, targeting foreign interests such as the Pakistani Head of Mission, as well as [WARNING: GRAPHIC] high-ranking Taliban officials or supporters. This trend continued until late 2023, when ISKP renewed their smaller scale attacks on Kabul’s Shia population.

The failed suicide attack targeting the  Taliban  Governor's office in  Zaranj,  Nimroz province,  likely carried out by ISKP, could signal that ISKP plan to implement attacks targeting both minority and high-value symbolic individuals and sites, combining previous strategies.  

AW assess all noted unclaimed attacks have ISKP trademarks, occurring in Shia areas of Afghanistan, affecting civilians,  or targeted high-ranking  Taliban officials.  At the  time of writing,  the three attacks mentioned above remain unclaimed, however, if they are indeed the work of ISKP, it marks a level of activity not seen since 2022.