After the deadly attack of IS-K on the Crocus concert hall in Moscow, which killed more than 140 people and injured dozens, the name of the young leader of this group has once again made headlines in different media platforms.

But about the real identity of this man who is behind the deadly attacks of IS-K, contradictory and often misleading information has always been reflected in the media.

Now, through interviews with former acquaintances and some information sources who have followed this case, the Independent Farsi reported it has obtained new details about his private life and her path to the leadership of the dreaded IS terrorist network.

Sanaullah Ghaffari, known as Shahab al-Muhajar, is sometimes mentioned as a member of the Haqqani terrorist network. In some cases, a fake identification card of him as a security guard of the former vice president of Afghanistan has been also published, and recently there are rumors about his membership in the rank of former Afghan army in the international media.

But who is Sanaullah Ghafari, where is he from, and how did he become the leader of the Khorasan branch of IS-K?

The Khorasan branch of IS, the only active operational branch of the group in Central Asia based in Afghanistan, has planned and executed several deadly attacks outside Afghanistan in the past several years.

The leader of this IS-K branch, which is now becoming a serious threat to the security of the region, is a young man named Sanaullah Ghafari, who is from Kabul, the capital city of Afghanistan.

Sanaullah Ghaffari is Pashtoon and from Kabul

Sources among the relatively distant members of Sanaullah Ghafari’s family have spoken about his family’s ethnic identity and his residency. According to the source, Sanaullah is the son of Abdul Jabbar, a former member of Hezb-e-Islami led by Gulbuddin Hekmatyar and originally from the Kharuti tribe of the Pashtun ethnicity.

His family, who are strongly Hanafi religious followers, live in Khoruti village between Mirbeche Kot and Shekardera, Kabul.

Ghafari’s family is not religious extremist, and they had no Salafist tendencies. However, Sanaullah Ghafari was attracted to Salafist ideas and joined terrorist groups since he was a student at Kabul University between 2012 and 2014.

In its recent report, the Reuters news agency quoted Taliban sources identified Sanaullah Ghafari as a Tajik origin and also a member of the national army of the former Afghan government, a claim that reliable sources in the National Security Department of the former Afghan government categorically denied.

A senior officer of Afghanistan’s National Security Department, who personally followed Sanaullah Ghaffari’s case during his tenure said that Ghaffari was never part of the security forces of the Afghan government rather he was attracted to Salafist groups when he was a student at Kabul University.

Then, due to the tact he showed in religious preaching among students, Haqqani network facilitated his travel to Waziristan of Pakistan.

Ghaffari took military courses in Waziristan under the supervision of Haqqani network and because he was familiar with computer programs, he worked in the field of designing, photographing and editing photos and videos for the Haqqani Network.

But it wasn’t long before he actually claimed the responsibility of planning the Haqqani network’s terrorist attacks, and while still working anonymously and far from fame, he became a serious force for the Haqqani network.

Playing with anonymous names and becoming leader of IS-K

Contradictory information has been published in the media outlets about how Sanaullah Ghafari joined the IS-K terrorist group.

Some have said that he is the liaison between the Haqqani network and the IS-K group, and some have also claimed that Sirajuddin Haqqani forced him to join IS-K. But these are just claims that have no valid reason to prove them.

But a senior national security officer of the former Afghan government revealed the secret of Sanaullah Ghafari’s joining IS-K as follows: One of the usual tricks of this man (Sanaullah) was to play with different names in different situations. When Sanaullah Ghaffari worked for the Haqqani network, he never introduced himself to two individuals or two groups with the same name during the planning and execution of the attacks, but he communicated with operational networks with a thousand different names.”

According to this officer, around 2014, when IS-K emerged in Afghanistan, with the help of this wide connection with its terrorist networks with different names, he got close to IS-K and finally fell from the Haqqani network to IS-K.

This senior national security officer cited an example during his mission to prove this claim and said: After IS-K attacks intensified in Afghanistan, we in the National Security Department, every time we arrested people related to IS-K who were involved in the attacks, we asked them about the identity of their commander and they mentioned different names. But when we asked them to describe the details of the face of their leader or commander, they all described the details of a specific face, and by comparing the portraits we had drawn based on their narratives, we realized that all these names belong to one person, and that is Sanaullah Ghafari.

Anonymous activity aimed to protect IS-K leader

In February 2022, the United States announced a reward of up to 10 million dollars for information leading to the identification and arrest of the leader of the Khorasan branch of IS.

There are several photos of Sanaullah Ghafari, which the US State Department has published as photos of the leader of IS-K and announced his age as 29 years old. But informed sources in the intelligence apparatus of the former government of Afghanistan said that the published photo of the IS-K leader is about 10 years ago and he was almost 24 years old in 2014 and 2015, which means that he is about 34 to 35 years old now.

Meanwhile, a classmate of Sanaullah Ghafari at Kabul University said that he was a university student at least 10 years ago and was over 22 years old.

He also corrected the information published in the media about Ghaffari’s field of study and said that they were classmates at Kabul University’s Faculty of Economics.

This is while some media have mentioned Sanaullah Ghaffari’s education at Kabul Polytechnic University of Engineering and some others at Kabul University’s Faculty of Theology.

Meanwhile, the security sources revealed some tips about the protection methods of the IS-K leader. The senior officer of the National Security Department of the previous government of Afghanistan said that Sanaullah Ghafari tries to operate in complete anonymity and for this reason “he never has a mobile phone and a special protection team is not seen around him”.

Sanaullah Ghaffari survived several attacks

However, the senior security officer noted that he had survived several attacks by the Afghan National Security Forces.

This source clarified: “In 2018, the National Security Forces of Afghanistan carried out two attacks to arrest or kill Sanaullah Ghafari in the small village of Kochkan in Shakardara, Kabul, but he survived these attacks and was not captured.”

He added: “The leader of IS-K has only one special assistant named Salahuddin, who is apparently one of his university classmates and now works as the operational deputy of IS-K and is always by Sanaullah Ghafari’s side.”

Regarding the residence of the IS-K leader, it is said that he has traveled to Pakistan on several occasions, but security sources confirmed that Sanaullah Ghafari has been in Afghanistan all the time, except for the training course he took in North Waziristan under the supervision of the Haqqani network. And now he lives inside Afghanistan.

The deep influence of IS-K in the Taliban system

In the last two years and seven months after returning to power in Afghanistan, the Taliban has always claimed that they have suppressed IS-K in Afghanistan and that this group is no longer considered a threat in Afghanistan.

In the latest case, Zabihullah Mujahid, the spokesman of the Taliban said that IS-K has lost its operational capability in Afghanistan.

But the information of the intelligence sources of the former government of Afghanistan is speaking otherwise. These sources say that civilians are often targeted in Taliban operations, which are carried out from time to time under the name of destroying IS-K shelters, while IS-K members are not only present in their hideouts in Afghanistan, but have also widely infiltrated the ranks of the Taliban.

As an example, this source pointed to the murder of Abdul Rahim Haqqani, one of the leader of the Haqqani network, in a suicide attack in Kabul and said: The murder of Abdul Rahim Haqqani was planned by a former member of the Haqqani network named Haji Bashir, who joined the Salafi groups in Kabul prison and was recruited by IS-K.”

He furthered: “Haji Bashir hired Abdul Rahim Haqqani’s driver to take the suicide bomber to the premises of the religious school that Abdur Rahim Haqqani was in charge of.”

According to security sources, a large number of Taliban members who were in Afghan prisons in recent years were attracted to Salafist ideas and after being released from prison, they often joined IS-K.

This example shows that contrary to the claims of the Taliban, IS-K has influence in different layers of the Taliban system. The deadly attacks that IS-K recently carried out in Iran, Pakistan and Russia have been attractive and encouraging to some middle-ranking members of the Taliban.

Some reports, including the report of the United Nations Security Council, show that Daesh has about four to six thousand fighters (along with their families) in Afghanistan, some of whom are former members of the Taliban, while other people who went to Afghanistan from Iran and regional countries also joined IS-K group.

Information from security sources shows that some members of the main branch of IS-K, who fled from Iraq and Syria go to Iran and from there to Afghanistan through illegal means.

Is it possible to contain the growing threat of IS-K

After the withdrawal of US and NATO forces from Afghanistan, the US claimed to continue the fight against terrorism in this country through aerial surveillance. But the point is that the US uses the Taliban as an intelligence force on the ground to identify and target threatening situations.

Security sources in the previous government of Afghanistan said that the Taliban currently do not have the capacity and ability to collect the information needed by the US Air Force, and as long as there is no necessary force on the ground, there is no possibility of air operations against terrorist groups.

Therefore, it seems that there is currently no serious air threat to IS-K in Afghanistan, and for this reason, this group is freely planning and executing complex and deadly attacks inside and outside of Afghanistan.