Qasim received a call in late March that his brother, an employee with Afghanistan's Taliban government, had been seriously injured in a suicide bombing near the Ministry of Foreign Affairs in Kabul.
The 32-year-old rushed to the hospital with his family, but when they got there he was told by the doctors his brother was already dead.
The explosion hit a security checkpoint as government employees were leaving work for the day. It struck at the heart of what was, until the collapse of the former Afghan government in August 2021, the capital's heavily fortified diplomatic enclave, known as the "Green Zone." The attack was later claimed by Islamic State Khorasan, or ISIS-K — the group's second strike on the ministry this year, as it focuses its firepower on high-profile targets, attempting to undermine the Taliban's rule and erode public confidence in its assurances of security.
"The Taliban are saying that they protect us, but really they cannot. Still we face threats from different groups in Afghanistan. I don't know who is really behind these incidents, ISIS or others," Qasim, who asked that his last name not be used due to security concerns, told CNN.
"Currently we don't have security in Afghanistan at all, whenever we go out we don't know if we will come home alive or not," he added.
In the nearly two years since the Taliban seized control of Afghanistan, ISIS-K has scaled up the volume and complexity of attacks across the country, putting pressure on the new government and raising concerns in the West about the possible regeneration of a group that could once again pose a serious threat internationally.
ISIS-K and the Taliban, both Sunni Islamist extremist groups, are enemies with differing ideologies, fighting each other for control over parts of the country — and recruits.
ISIS-K's recent attacks have largely been aimed at the Taliban and other symbolic targets, as well as at Afghanistan's Shia Muslim minorities, in particular the ethnic Hazaras. Bombings have increased in urban areas, leaving hundreds injured and dead. Between late 2022 and early 2023, ISIS-K attacked the Pakistani and Russian embassies, hit a hotel where Chinese business representatives were staying and carried out an explosion at an air force compound.
The group has frequently published its claims in its weekly newsletter, Al Naba, alleging that it has struck on 283 occasions in Afghanistan since the Taliban's takeover, killing at least 670 people and injuring 1,200 — a significant uptick in casualties per attack.
With media restrictions severely affecting journalists' ability to report independently in the country, and an absence of Western intelligence, it's difficult to verify these figures. In an address to the Security Council in March, the head of the UN Assistance Mission in Afghanistan (UNAMA), Roza Otunbayeva, said that ISIS-K posed "a growing threat," and raised concerns over the Taliban's capacity to cope with that challenge. But the Taliban have insisted that it has full control.
In light of patchy information on the ground, analysts are increasingly turning to open sources to assess the state of play in Afghanistan.
Afghan Witness, a project run by the UK-based Centre for Information Resilience, which monitors human rights in the country, this week released a new dataset of verified abuses and violent incidents since the Taliban's takeover. The data, which is available in a live map, includes 367 pieces of open-source evidence — largely videos and images shared on social media — about 70 ISIS-K attacks since August 2021. Taken together, they reveal a gradual shift in the group's activities in Afghanistan — from a few small-scale attacks targeting Taliban patrols and checkpoints in rural areas, such as the eastern Nangarhar province, where ISIS has maintained a presence since 2015, to a concentration of attacks in urban areas, including in the capital, Kabul, Herat in the west, and Mazar-i-Sharif and Kunduz in the north.
Before the Taliban's return to power, ISIS-K had not claimed any attacks in Mazar-i-Sharif, Afghanistan's third most populous city, but since then the group has claimed nine, including a blast in March that killed the Taliban governor of Balkh province in his office. In the first year under the Taliban's new government, ISIS-K claimed eight attacks in Kunduz city.
Afghan Witness' data on verified attacks and ISIS-K claims reflect the group's continued targeting of civilians, notably the Hazara community in Kabul, Herat and other cities, though attacks have slowed over the past few months as the group has focused on higher-profile Taliban targets.
"It is clear from the data and propaganda that they are pursuing elements of strategies used elsewhere, such as the targeting of minorities to promote sectarianism, and they have become increasingly bold in targeting high-profile and symbolic targets within Afghanistan," said David Osborn, team leader of Afghan Witness.
"Recently, the Taliban appear to have conducted a series of raids against the Islamic State, coinciding with a reduced number of attacks by the group. This is the picture we get from open source but in the long term it is unclear how far the Taliban's actions will blunt Islamic State-Khorasan's capability inside Afghanistan," he added.
Despite the Taliban's promises of a more moderate form of rule than when they were last in power two decades ago, they have reintroduced harsh measures in line with their strict interpretation of Islamic law, or Sharia, including public executions, flogging and banning women from education and the workplace.
As the Taliban try to minimize the threat ISIS-K poses, attacks on civilians continue.
"We've seen Islamic State-Khorasan target Shia Hazara as they attend schools, mosques and festivities. What is most striking is the helplessness of those caught up in the violence and the constant state of instability and fear that is created by the attacks," Osborn said of Afghan Witness' research. These communities feel the de facto authorities won't defend them, after years having been persecuted by the Taliban themselves, he added.
Nearly half of the attacks verified by Afghan Witness hit crowds as they gathered in public spaces, including markets, schools, hospitals, funerals, weddings and religious services.
In October 2021, two months after the US withdrawal, ISIS-K fighters bypassed Taliban security to access Imam Bargah Mosque, the largest Shia mosque in Kandahar, a city in the south of the country, during Friday prayers. They shot the temple guards, then detonated their explosive vests among the crowds, claiming to have killed and wounded more than 100 people. At the time, CNN was able to confirm more than 30 deaths.
A year later, in September 2022, a suicide bombing struck Kaaj Educational Center in Kabul's Dasht-e-Barchi district — a predominantly Hazara and Shia neighborhood that had suffered several devastating ISIS-K attacks before the Taliban took over — killing at least 25 people. The students, many of them girls, were taking a practice university entrance exam. The attack, videos of which were verified by Afghan Witness, was not claimed by ISIS-K, but, according to analysts, bore the hallmarks of the group.
Earlier that month, Human Rights Watch (HRW) said that Taliban authorities "had an obligation to protect at-risk communities" from repeated ISIS-K attacks, but that those authorities were failing to provide them with security, based on interviews with 21 survivors and their family members. Richard Bennett, the UN special rapporteur on human rights in Afghanistan, has also called for investigations into attacks on Hazara, Shia and Sufi communities, which he described as bearing the hallmarks of "crimes against humanity."
Fatima Amiri, 18, was among the students sitting the exam when gunfire erupted. She lost an ear and an eye in the attack that also shattered her jaw, and is still receiving medical treatment for her injuries. She recalls students screaming as a gunman opened fire on them at their desks, followed by the sound of an explosion, and her peers lying bloody around her on the floor.
"I saw many of my classmates were dying. I tried to escape. All the ways were closed. I climbed on a wall and jumped, I was in a bad condition full of blood," she said. "I am now a half-normal human being with one eye and one ear."
"We know that the Taliban cannot protect us. No one feels safe currently in Afghanistan."
ISIS-K's attacks have stoked anxiety among US officials about the group's capabilities, with some warning that it could soon develop the ability to strike Western targets.
Gen. Michael "Erik" Kurilla, head of the US Central Command (CENTCOM), told lawmakers in March that ISIS-K had become more emboldened, aiming to grow its ranks and inspire or direct attacks in the region and beyond. He estimated that the group would be able to conduct "an external operation against US or Western interests abroad in under six months, with little to no warning." Pressed about where terrorist attacks originating in Afghanistan might be directed, Kurilla said Europe or Asia were more likely targets than the United States.
Kurilla's statement highlights one of the chief concerns among Western intelligence — that now, in the wake of the US withdrawal, it is difficult if not impossible to assess the Taliban's effectiveness in curtailing ISIS-K. With no military or diplomatic presence on the ground, and drones now having to fly many hours from distant bases to get to Afghanistan for reconnaissance, intelligence access is incredibly limited, according to US officials and analysts.
For that reason, some have disparaged the Biden administration's "over-the-horizon" strategy — aimed at striking terrorists without American boots on the ground — as "over the rainbow." They point to the botched US drone strike in Kabul that killed 10 civilians, including an aid worker and seven children, as an example of the pitfalls for intelligence agencies even before the complete withdrawal, and the killing of al Qaeda leader Ayman al-Zawahiri as one of the sole successes to date.
In a 2023 threat assessment report by US intelligence agencies, the Office of the Director of National Intelligence said that ISIS-K "almost certainly retains the intent to conduct operations in the West and will continue efforts to attack outside Afghanistan."
The US has not recognized the Taliban as the government of Afghanistan. US officials are not cooperating with the Taliban to counter ISIS-K, nor does the US share any intelligence information with them, CENTCOM spokesperson Maj. John Moore told CNN. Instead, the Taliban are fighting the group — which the US estimates now numbers between 2,000 and 2,500 fighters in Afghanistan — on its own.
The uptick in violence has put the Taliban in a difficult spot. After two decades fighting their own insurgency, they are grappling with delivering security and sticking to their signature pledge under the US-Taliban Doha Agreement in 2020, to prevent any group from using Afghanistan to threaten the safety of the US and its allies.
Taliban security forces have been waging ongoing operations and night raids against ISIS-K. The raids often target civilians accused of harboring or helping ISIS-K members, with the Taliban assaulting and detaining people without due process, according to research by Human Rights Watch (HRW). In some cases, Taliban authorities have forcibly disappeared or killed detainees, dumping or displaying bodies in public areas.
"The Taliban have been going after them in ways that are actually counterproductive because they have tackled them in the same way that everyone who's been in power in Afghanistan has tackled insurgencies, which is as brutally as possible, which means you stir up a lot of resentment in local communities, and that stirs up more recruits," Patricia Gossman, associate director for HRW's Asia division, said. "We documented a number of raids by the Taliban in Kunar and Nangarhar, which ended up with a lot of people being killed who may or may not have had anything to do with ISIS-K."
The US National Security Council claimed in April that the Taliban had killed the ISIS-K leader who plotted the deadly 2021 suicide bombing at the Kabul international airport's Abbey Gate, which was carried out amid chaotic evacuation efforts, killing 13 US service members and more than 170 Afghans who were trying to flee the country. In the days prior to the attack, the suicide bomber was among thousands of prisoners who were freed by the Taliban from Parwan detention facility at Bagram air base and Pul-e-Charkhi prison.
"In 2021, ISIS-K was reduced to a couple of cells in the country and a very tiny, small stronghold in Kunar Province, and that was it. However, in the less than stellar handover procedure, in that chaos, the Taliban opened the prisons, including Bagram, which was a big mistake ... they underestimated that there were also a couple of thousand ISIS-K members, who, once freed, just walked off," said Hans-Jakob Schindler, senior director of the Counter Extremism Project, who served as a member and then as coordinator of the UN Security Council's ISIL, al Qaeda and Taliban Monitoring Team.
"The organization was very diligently able to reestablish itself."
UN Secretary-General António Guterres reported in January 2022 that the number of ISIS-K recruits had doubled in less than a year, from approximately 2,200 to nearly 4,000 fighters, with up to half of them foreign terrorist fighters, according to one assessment. Their ranks were buoyed by the prison breaks, and their diverse membership has meant the Taliban risk defections by countering them, Schindler said, adding that could spur anti-Taliban factionalism. Since the group was established in 2015, ISIS-K has included a number of former Taliban, as well as Pakistani fighters, including from the Tehrik-e Taliban Pakistan (TTP) which was designated as a foreign terrorist organization by the United States in 2010.
The group, operating in compartmented cells, is capitalizing on loose tactical partnerships and a large number of unaffiliated fighters, or freelance jihadists, who now have greater access than ever before to a large number of capabilities following the United States' hurried departure, according to Javid Ahmad, a nonresident senior fellow with the Atlantic Council's South Asia Center who is tracking ISIS-K's activities.
"They now have unfettered access to the black market, for purchasing not just light weapons, but fertilizers for explosives, smaller commercial drones, which they can customize. They have access to sophisticated communication equipment. They are buying laser-guided sniper weapons. They have access to night vision goggles. And oftentimes when they do targeted assassinations, that's how they do it," said Ahmad, formerly Afghanistan's ambassador to the United Arab Emirates, who has worked with the US defense community.
Ahmad and Schindler both say that the ISIS-K bombing at the entrance of the foreign ministry, past at least three checkpoints, reflects the group's growing access to intelligence and its capacity to execute complex operations. And though it has not yet demonstrated its ability to carry out attacks outside of Afghanistan, it has ambitions to do so, they agree.
"We are about to repeat the same mistake that we did in the 1990s, believing that Afghanistan ... has very little if anything to do with us," Schindler said. "We took the eye off the ball and we are about to do the same thing again."
Leaked classified documents from the Pentagon, obtained by The Washington Post in April, portray Afghanistan as a staging ground for ISIS-K, and suggest the group is a growing threat to the US, Europe and Asia. The US intelligence assessment, which was disseminated on the Discord messaging platform, revealed the group's efforts to coordinate several external operations, targeting embassies, churches, business centers and the 2023 FIFA World Cup soccer tournament, the Post reported.
Responding to a question about the leaks, Vedant Patel, the US State Department's deputy spokesperson, said: "The degradation of ISIS in the region continues to be a top priority for this administration and it's something that we continue to work collectively on with our allies and partners."
The Taliban rejected the report, with its spokesperson, Zabihullah Mujahid, saying in a statement on Twitter that the Islamic Emirate of Afghanistan "has full control over the country and does not allow anyone to use Afghanistan against the security of any other country," adding that terrorist groups like ISIS-K had been "severely affected and are in the process of being destroyed."