In late July, the United Nations Security Council released a detailed report on the threats posed by ISIS and al-Qaeda. The report is authored by the UN Analytical Support and Sanctions Monitoring Team, which assists the Security Council’s efforts to enforce sanctions measures – such as travel bans, asset freezes and arms embargoes – against designated terrorist groups and individuals. According to the report, UN Member States have “heightened” concerns about the “terrorist threat emanating regionally from Afghanistan,” namely from ISIS-K (or ISIS-Khorasan) and Tehrik-e Taliban Pakistan (also known as the Pakistani Taliban or TTP).
Although the UN Member States have many disagreements, the ISIS-K menace is “common to States with geostrategic differences and rivalries, to nations of all faiths and to secular nations.” Two attacks in early 2024 highlight the long arm of ISIS-K’s network. On Jan. 3, ISIS-K suicide bombers attacked a ceremony commemorating the death of Islamic Revolutionary Guard Corps (IRGC) commander Qasem Soleimani in Kerman, Iran. The attack killed more than 100 people and injured nearly 300 others. Then, on Mar. 22, gunmen assaulted the Crocus City Hall near Moscow, killing 145 people and wounding several hundred more. The two successful attacks, as well as a string of foiled plots, led European officials to take extra security precautions, especially as the Olympic Games opened in Paris late last month.
Meanwhile, the TTP has used Afghan soil to expand the scope of its insurgency in neighboring Pakistan. Although the TTP has not been focused on executing spectacular terrorist attacks outside of South Asia, its actions could destabilize the Pakistani state and spill over into surrounding countries. The monitoring team’s report also highlights the TTP’s close cooperation with al-Qaeda. Although al-Qaeda is assessed to currently lack “capacity to conduct large-scale operations externally,” its forces have been training and recruiting inside Afghanistan.
The summary below highlights several key points made by the UN monitoring team’s analysts concerning the leadership and operations of both ISIS and al-Qaeda. This summary provides additional context where appropriate.
The “identity and location” of ISIS’s global leader “is still not clear.”
ISIS has suffered a string of leadership losses since American forces killed Abu Bakr al-Baghdadi, the group’s first so-called “caliph,” during a raid in northern Syria in Oct. 2019. Baghdadi first ascended to the top spot in ISIS’s predecessor organization (the Islamic State of Iraq) in Apr. 2010. During his nine-year reign, there was no turnover at the very top of the ISIS pyramid. Since Baghdadi’s demise, however, three of his successors as ISIS’s “caliph” were killed in rapid order.
In Aug. 2023, ISIS publicly identified its fifth and current emir by his nom de guerre: Abu Hafs al-Hashimi al-Qurashi. And the group is clearly trying to protect his true identity. Remarkably, counterterrorism and intelligence officials cannot say with certainty who he is one year after his appointment. “The identity and location of the group’s leader, Abu Hafs al-Hashimi al-Qurashi is still not clear,” the UN monitoring team’s latest report reads.
The report notes that UN Member States hold divergent views on the individual’s identity. Member States have identified at least three “possible candidates.” The first two are: Abdallah Makki Mosleh Al-Rafi’i (a.k.a. Abu Khadija), an Iraqi, and Abdul Qadir Mumin, a Somali. Both are known senior figures in the ISIS hierarchy. The UN analysts say they play key roles in ISIS’s “General Directorate of Provinces,” which oversees and coordinates the activities of ISIS-affiliated groups around the globe.
Al-Rafi’i is also in the group’s chain-of-command in Iraq and Syria. Mumin (who was listed by the United States as specially designated global terrorist in 2016) is the head of ISIS’s “province” in Somalia, as well as an outfit known as Al-Karrar office. According to the UN experts, Al-Karrar is “significant in terms of the wider group’s finances and acts in some ways as connective tissue for a dispersed organization.”
A third man who may be the “caliph” is Ahmad Hamed Hussein al-Ithawi (a.k.a. Abu Muslim and Abu Hafs), a deputy ISIS leader in Iraq.
Some Member States think it is “possible” that ISIS has named “an African-origin leader,” such as Mumin, “based on adaptability, operational developments and the need to empower [ISIS] leaders from Africa.” Indeed, much of the UN monitoring team’s report is focused on ISIS’s expansive footprint across Africa. But other Member States disagree, emphasizing the “strategic and ideological importance” of Iraq and Syria to the organization.
Regardless, the UN monitoring team assesses that the two “top” positions in the ISIS chain-of-command are caliph and the head of the General Directorate of Provinces. And the three “above-mentioned candidates could occupy” either of these two positions.
ISIS-K is the “greatest external terrorist threat to Europe.”
Unlike ISIS’s central leadership, ISIS-K has been led by the same man for the past four years. In June 2020, ISIS’s top global leadership appointed a loyalist known as Sanaullah Ghafari to lead ISIS-K. During his tenure as the group’s emir, Ghafari has transformed ISIS-K into a global menace.
According to the UN monitoring team, ISIS-K has focused on terror plots outside of Afghanistan while attempting to avoid costly battles with the Taliban. ISIS-K views the Taliban as its “ideological enemy.” The Taliban controls most of Afghanistan, outmanning and outgunning ISIS-K. So, while ISIS-K “aspires to control Afghan territory from which to infiltrate neighboring countries,” it “has limited high-impact operations within Afghanistan to soft targets,” such as “Taliban fighters queuing in front of a bank office in Kandahar and Western tourists in Bamiyan,” a site rich with Buddhist cultural history.
By avoiding pitched battles inside Afghanistan, ISIS-K has been able to survive the Taliban’s “pressure” and expand its operations elsewhere around the globe. ISIS-K “has done this through a mixture of strategy and opportunism, directing operatives from Afghanistan and neighboring countries, but also harnessing volunteers outside Afghanistan and tapping into diaspora communities, often from Central Asia, to provide logistical support,” the UN analysts write.
In addition to launching deadly attacks in Iran and outside of Moscow earlier this year, European authorities have disrupted a string of plots. The UN monitoring team writes that “the number of plots disrupted or being tracked through the Islamic Republic of Iran, the Levant, Asia, Europe, and potentially as far as North America is striking.” European authorities identified terrorist plots in the “planning stages” in several nations (e.g., planning a firearms attack on the Swedish parliament). Underscoring the gravity of this threat, the UN team cites recent counterterrorism operations in: Belgium, France, Germany, the Netherlands, Spain, Sweden, and Turkey (as well as Canada).
“European investigations illustrate the global and interconnected nature” of ISIS’s network.
While ISIS-K currently poses the main terrorist threat to nations around the world, it is important to recognize that it is not acting on its own but is instead part of a fairly cohesive ISIS network. The UN report provides several details that, upon close inspection, underscore this point.
The ISIS branch in Somalia, for instance, reportedly sends money to ISIS-K via Yemen. The transfers are “facilitated by the Al-Karrar office,” headed by Mumin (discussed above). The funds are used, in part, “to connect” ISIS-K leadership “with new Central Asian recruits,” especially from Tajikistan and Uzbekistan. ISIS-K’s “online recruitment and radicalization efforts” are focused on Tajik and Uzbek communities, encouraging “potential recruits to conduct attacks outside Afghanistan.” The group also relies heavily on “networks of facilitators between” Afghanistan and Turkey that are “capable of moving operatives from Central Asia and Afghanistan towards Europe to conduct external operations.”
ISIS-K is often thought of as an almost standalone entity – separate from ISIS’s “core” leadership elsewhere. But this is a false distinction. Several Member States pointed out that while ISIS’s “core” leadership claimed responsibility for this year’s attacks in Iran and Russia, ISIS-K “provided fighters, funds and training to the perpetrators of both actions.” One inference might be that ISIS’s senior leadership opportunistically claimed responsibility for attacks it did not have a hand in. But ISIS-K’s role in ISIS’s international network likely explains why ISIS’s “core” claimed responsibility for these high-profile massacres. There is no firm dividing line separating ISIS’s “core” leaders from the group’s affiliates.
Consider the following facts, all recognized by UN Member States: (1) ISIS-K’s emir, Sanaullah Ghafari, was appointed by ISIS’s senior leadership; (2) ISIS-K receives funds from ISIS’s Al-Karrar office in Somalia; (3) Al-Karrar is headed by Abdul Qadir Mumin, a Somali who is so senior within ISIS’s global hierarchy that some Member States even suspect that he is the organization’s “caliph;” and (4) ISIS-K relies on ISIS facilitation networks far from Afghan soil to facilitate its plotting. Taken together, these and other facts illustrate that ISIS-K is not some standalone entity, but instead part of a cohesive international organization that has survived and adapted to international counterterrorism pressure.
Al-Qaeda “remains strictly hierarchical” with Sayf al-Adl as its “de facto leader.”
On July 31, 2022, the U.S. killed al-Qaeda’s global leader, Ayman al-Zawahiri, in a drone strike in Kabul, Afghanistan. Since then, there has been uncertainty concerning the group’s top leader. Unwilling to embarrass their Taliban allies, al-Qaeda’s men have not officially eulogized Zawahiri, nor have they announced his successor. (A prior report by the UN analysts provides this explanation.)
Citing intelligence provided by Member States, the UN analysts have identified Sayf al-Adl, a veteran al-Qaeda figure long wanted for his alleged role in the 1998 U.S. Embassy bombings in Kenya and Tanzania, as the group’s “de facto leader.” Since 2018, the UN analysts have consistently reported that al-Adl is based in Iran. In Jan., the UN analysts reported that several Member States had identified “individuals traveling to provide liaison between” al-Adl in Iran and other senior al-Qaeda leaders based in Afghanistan. (Note: one unnamed UN Member State rejected claims of the presence of any al-Qaeda personnel in Iran.)
Importantly, the Special Inspector General for Afghanistan Reconstruction (SIGAR) noted in its Jul. 30, 2024 report to the U.S. Congress that al-Adl “reportedly resides in Iran” and had recently called for foreigners to travel to Afghanistan, where they can train “to strike” Western interests.
Al-Adl’s presence inside Iran is another source of embarrassment for the organization, as Sunni al-Qaeda does not want to admit its top man is living inside the predominantly Shiite Iran; nor does Iran want to admit it is home to al-Qaeda leadership.
The UN monitoring team describes al-Qaeda as “strictly hierarchical.” Though al-Qaeda’s “affiliates enjoy greater operational autonomy,” they “still seek leaders’ authorization on critical decisions.”
The report identifies several figures who are part of al-Qaeda’s current hierarchy, including Hassan Al-Waili, the main liaison “with regional Al-Qaeda affiliates.” Those “affiliates” include: Al-Shabaab in Somalia, Al-Qaeda in the Arabian Peninsula (Yemen), Al-Qaeda in the Indian Subcontinent (AQIS), Al-Qaeda in the Islamic Maghreb (West Africa) and Jama’at Nusrat al-Islam wal-Muslimin (or JNIM, also in West Africa). Citing intelligence from one Member State, the report also identifies other key al-Qaeda figures who have allegedly worked with al-Adl to “activate cells” in Europe, Iraq, Libya, and Syria.
Al-Qaeda “exercises strategic patience” in Afghanistan, “prioritizing its relationship with the Taliban.”
While the UN Member States view ISIS-K as “the most serious threat in the region projecting terror beyond Afghanistan,” al-Qaeda’s enduring presence in the country remains a concern as well. The UN analysts write that the Taliban has “substantially constrained the activities of the Al-Qaeda core and their affiliates in the country,” but it is not clear what that language means. The UN Member States warn that al-Qaeda operatives are traveling within the country for “training, recruitment and reorganization activities.” And al-Qaeda’s “continued reorganization and training are judged indicative of the group’s longer-term intent.” Moreover, the report includes striking details concerning al-Qaeda’s ongoing relationship with the Taliban.
For example, according to the UN analysts, a Libyan al-Qaeda member known as Abdelazim Ben Ali “is an adviser of the Taliban Acting Minister of the Interior, Sirajuddin Haqqani.” Haqqani, a U.S. and UN-designated terrorist, is a kingpin within the Taliban. He inherited control of the eponymous Haqqani Network from his deceased father, Jalaluddin. The Haqqani Network developed capacities for high-profile suicide attacks and special operations throughout the nearly 20-year war in Afghanistan. At the war’s end, Sirajuddin commanded a top post in the Taliban’s hierarchy. In addition to being named the Acting Interior Minister, he was also initially named a deputy emir to the Taliban’s top leader. His father, Jalaluddin, was arguably Osama bin Laden’s most important benefactor in Afghanistan, as he welcomed al-Qaeda’s first cadres to Afghanistan in the 1980s and housed them at camps that served as incubators for the nascent group. The relationship between the Haqqanis and al-Qaeda remains unbroken since then, with Sirajuddin a key al-Qaeda ally, as I have detailed elsewhere.
The UN monitoring team’s report contains several other details highlighting al-Qaeda’s presence in Afghanistan. Several Member States “noted the recent arrival in Kunar and Nuristan [eastern provinces of Afghanistan] of ethnic Arab al-Qaeda commanders who operated in Afghanistan previously and had historical linkages with the Taliban.” Another noteworthy al-Qaeda figure has been spotted in two other Afghan provinces. And two known AQAP members have also reportedly “migrated to Afghanistan from Yemen.”
Previous UN reports filed in recent months have included even more details concerning al-Qaeda’s footprint in Afghanistan, with Member States pointing to training camps dotted throughout the country.
The TTP (Tehrik-e Taliban) has “intensified” its attacks against the Pakistani military.
The UN monitoring team highlights al-Qaeda’s ongoing alliances with other jihadist groups in the region. While al-Qaeda is often thought of as a strictly Arab organization, its close ties to non-Arab groups in Afghanistan and Pakistan, as well as elsewhere, have long been a source of strength for the organization.
For instance, the UN analysts warn that the Pakistani Taliban (Tehrik-e Taliban Pakistan, or TTP) has “intensified attacks” in Pakistan, conducting “more than 800 attacks” during the first six months of 2024, “primarily targeting military installations.” And the TTP is using “North Atlantic Treaty Organization-caliber and other weapons obtained in Afghanistan to target Pakistani military border posts.”
The TTP’s rise is worrisome, as it seeks to destabilize the nuclear-armed Pakistani state and replace it with a draconian religious regime like the one imposed by the Afghan Taliban. What’s more, the UN’s analysts have concluded that both the Afghan Taliban and al-Qaeda back the TTP’s growing insurgency.
The TTP has increased its operations with the Afghan Taliban’s “acquiescence” and “at times support,” the UN analysts write. Both the Afghan Taliban and al-Qaeda help train “local Afghan fighters and TTP operatives” at the TTP’s camps. Several Member States report that an Egyptian al-Qaeda veteran known as Abu Ikhlas-al Masri is “providing suicide bomber training to [the] TTP in Kunar Province.” Al-Masri was detained at the controversial U.S. detention facility in Bagram for years, but he was freed after the Taliban took over Afghanistan in 2021. Al-Masri is reportedly working with Jamaat-ul-Ahrar, a TTP splinter faction that rejoined the TTP in Aug. 2020.
The UN monitoring team also warns that al-Qaeda’s regional branch, Al-Qaeda in the Indian Subcontinent (AQIS), is part of a new coalition known as Tehrik-e Jihad Pakistan (TJP). “There is increased support and collaboration between TTP, the Taliban and Al-Qaida in the Indian Subcontinent…sharing manpower and training camps in Afghanistan and conducting more lethal attacks under the banner of Tehrik-e Jihad Pakistan,” the UN monitoring team writes. The analysts assess that the TTP “could transform into an umbrella organization for other terrorist groups” and may even merge with AQIS, which “could escalate the threat against Pakistan, and eventually India, Myanmar and Bangladesh.”
ISIS and Al-Qaeda may be able to evade the UN sanctions regime through technological innovation.
The UN monitoring team warns that by exploiting 3D printing and developing their own “unmanned aerial and maritime weapons and surveillance systems,” ISIS and al-Qaeda may be able to evade the arms restrictions imposed by the UN sanctions regime. The analysts cite several alarming examples to support their concerns, writing that “near military-grade capabilities” are becoming “available to sanctioned terrorist groups.”
For instance, one Member State reported that Shabaab, al-Qaeda’s East African affiliate, has been “experimenting with 3D printing” to “manufacture components for adaptation of commercial unmanned aerial systems.” Shabaab reportedly sought to recruit engineers for the effort, with the goal of deploying drones with a “greater payload capacity for attacks.”
Across the Gulf of Aden in Yemen, AQAP is “developing improved unmanned aerial systems” and reportedly “pursuing enhanced maritime capability, including drones or autonomous vessels.” AQAP has already used “commercial unmanned aerial systems with a 5–7 km range in operations,” and “is looking to secure advanced unmanned aerial systems with greater range.” The al-Qaeda affiliate has a “dedicated unit” responsible for developing “unmanned air and sea weapons systems capabilities,” including “weaponized unmanned boats.”
Some Member States note that ISIS’s Somali and Yemen branches are likewise experimenting with weaponized unmanned aerial systems.
The UN monitoring team recommends better cooperation against evolving threats.
The UN monitoring team offers several recommendations to deal with the many threats documented in its report. In particular, the UN analysts focus on ISIS’s “growing use” of cryptocurrencies. They recommend that Member States “share any relevant information on digital wallet addresses associated with” listed terrorist entities. And the monitoring team plans to continue consulting “with relevant international organizations about practical implementation of the sanctions measures as they relate to” ISIS’s and Al-Qaeda’s “use of virtual assets.” The analysts recommend that Member States do a better job of using international databases to enhance sanctions implementation. They also encourage Member States to share “real-time biometric information consistent with national legislation to interdict attempted travel of listed individuals.”
It is clear from the monitoring team’s report that the international community needs to continue adapting to the terrorist threat. The terrorists’ operations and methods certainly continue to evolve.