ISKP: Attacks targeting Taliban in Kunduz and Kabul

In the early morning of 11 February 2025, numerous Afghan and international news agencies and social media users reported an explosion in Kunduz City near the New Kabul Bank branch. According to local freelance journalist Habib Azizi, who also shared [WARNING: GRAPHIC] imagery of the bodies of the victims, the explosion occurred at 08:30 local time with “very heavy” casualties.

Later on the same day, Azizi claimed that an individual had been seen at the entrance of Kabul Bank running towards a group of Taliban members, allegedly prior to the explosion. However, after one of the Taliban members had reportedly tried to restrain the attacker, the attacker then detonated an explosive device before he had entered the building.

Following the incident, other imagery emerged showing a crowd of people and armed Taliban in the area. Further photos showed the [WARNING: ALL GRAPHIC] bodies of the victims, including posts identifying [WARNING: ALL GRAPHIC] individual Taliban members killed in the attack. Among the victims of the attack were also civilians. Social media posts and news outlets have identified one of the civilian victims as Shahab Salarzi, a professor at Kunduz University.

On the same day, a journalist and Afghanistan International senior news producer with over 190,000 followers on X, Abdulhaq Omeri, shared a forwarded audio message from WhatsApp. In the message, a man speaking in Pashto narrates that he had just spoken to Mawlawi Sajjad, Taliban Director of the General Directorate of Intelligence in Kunduz, who informed him that there had been a “suicide attack”. The speaker added that around 15 to 16 “comrades” had been “martyred” and “around the same number of comrades” had been injured.

The vocabulary used indicates that the man speaking in the audio is likely a Taliban member, who may have shared the audio on a Taliban internal chat before the message was forwarded to the journalist. Another post sharing the same message claimed that the person speaking in the audio is an “Emirate Mujahadeen”.

AW geolocated the video shared by Afghanistan International showing a cloud of smoke in front of the New Kabul Bank building, moments after the explosion [36.727855, 68.869905] (Figure 1).

The Taliban had previously conducted an attack on the same bank during the insurgency in 2011.

ISKP claim and differing accounts of casualty numbers

On 12 February 2025, ISKP released a statement (although dated to 11 February) claiming responsibility for the attack (Figure 2), alleging that “dozens” were killed and wounded among the ranks of the “apostate” Taliban. It also names the attacker as Abu Ali Al-Ansari.

The number of casualties, however, remains disputed. CIR identified the bodies of at least six men in footage that circulated on social media. Afghan journalist in exile Bilal Sarwary claimed that according to information from internal Taliban groups, around 20 people were killed and up to 15 wounded, “all of whom were from the Taliban Ministry of Defence”. According to Sarwary, the injured individuals were taken to the Army Hospital. Sarwary added that some of the victims were allegedly from Takhar and Kunduz provinces.

Meanwhile, a Pakistani journalist and vlogger, Rizwanur Rehman Razi, with over 351K followers on X, and another user known as “Akhtar Hussain”, with over 13K followers, alleged that over 60 Taliban members were killed as a result of the attack. The same number of casualties was reported by Al-Ahad News and Eye on Frontlines Urdu.

The attack marks the first ISKP attack recorded by AW in Kunduz since June 2022. However, the Taliban have since claimed several successful raids and captures of ISKP members in the province, with the most recent alleged arrest of an ISKP member in May 2024.

Taliban response and recent security measures

On the same day, the spokesperson for the Kunduz police, Jumauddin Khaksar, confirmed to TOLOnews that an explosion had taken place. Khaksar confirmed later to AmuTV that the incident was a result of a “suicide attack” which had occurred while a group of people, including Taliban members, were gathered at the Kabul Bank to receive their salaries. The same statement was shared by the Ministry of Interior Police Radio, an account with over 16,000 followers on X.

On the day following the attack, Abdul Mateen Qani, spokesperson for the Ministry of Interior, claimed that perpetrators of “incidents such as the attack in Kunduz” orchestrated their activities from abroad. The statement echoes a claim by Zabiullah Mujahid, the Taliban official spokesperson, who said in an X space on 3 February 2025 that the “law and order situation […] is exemplary under the Taliban”. Mujahid also reportedly alleged that the Islamic State has no power in Afghanistan.

A month before the attack, the Taliban had reportedly raised security concerns internally about potential attacks at bank branches where members collect salaries. Journalist Bilal Sarwary shared two letters in Pashto dated 10 January 2025 from Taliban officials raising these concerns.

The first letter — allegedly from the Ministry of Interior but signed by the Governor of Herat, Shaykh al-Hadith Noor Muhammad Islamjar — addressed all security offices in Herat, ordering the salaries of all military personnel to be paid at military centres and available ATMs, adding that Central Bank branches would only provide services for civil servants and the public.

The second letter, signed by the Minister of Defence Mawlawi Mohammad Yaqoub Mujahid, quoted a warning from the General Directorate of Intelligence warning that “Mujahideen” and employees of the Islamic Emirate gather in front of the banks during salary distribution hours without paying attention to “security measures and concerns”.

The letter further requests that the Ministry of National Defence inform staff of the security concerns, and instruct them to receive salaries at garrisons, or otherwise to pay attention to their security while at banks. Finally, the letter requests that the Financial and Budget Directorate reach an agreement with relevant banks to install ATMs at the garrisons.

Second alleged ISKP attack in Kabul

A second attempted ISKP attack took place in Kabul on 13 February 2025, but appears to have been unsuccessful. The attacker was allegedly attempting to enter the Ministry of Urban Development and Housing, but was shot outside the building, causing their explosive vest to detonate.

The attack was claimed by ISKP on 15 February 2025 in a statement alleging that they had killed 10 members of the Taliban, including a senior official. The statement disclosed the name of the attacker as Abu Yusuf Al-Ansari (sharing the same surname as the Kunduz perpetrator, Al-Ansari).

Although the Taliban reportedly claimed that only one person was killed and three wounded, an unnamed doctor at “Kabul’s Emergency Hospital” (unclear from reporting if this refers to the humanitarian NGO Emergency), claimed to The Times of India that five to six people had been wounded.

ISKP content encouraging attacks against the Taliban

On the day of the Kunduz attack, an infographic was released by the al-Azaim Media Foundation, ISKP’s de facto official media outlet. The infographic, was released in English, Pashto, and Turkish, and features a hand holding a knife with the words “blood for blood”, overlaid on the faces of several senior Taliban members. The poster also features an hourglass which appears to be counting down.

The image can be read as an explicit threat of revenge against senior members of the Taliban. AW was unable to verify the exact time the original image was released, but it was also shared across multiple social media platforms following the Kunduz and Kabul attacks.

Another image shared by ISKP supporters following the official attack claim showed pictures of the alleged perpetrators and Zabiullah Mujahid, with a quote from Mujahid from 10 February claiming that IS had been destroyed in Afghanistan. Mujahid’s statement is captioned “Monday” and the image of the attacker is captioned “Tuesday”, while the bottom part contains the English text: “Do you still not believe?”

The aggressive propaganda approach seeks to portray an image of strength and inevitability to ISKP’s operations in Afghanistan, taking advantage of relatively limited tactical successes to embarrass and undermine the Taliban’s claims to have stamped out ISKP.