ISIS-K is trying to undermine Afghanistan's Taliban regime, from inside and out. That's America's problem, too.

In late September, Afghanistan's new Taliban leaders ordered their commanders to conduct a full background check on all fighters. The sudden move was prompted by concerns that other extremist groups have infiltrated the Taliban's ranks.

Senior members of the former Afghan government and one top Taliban official currently in a security role say the leader of ISIS-Khorasan (ISIS-K), a notorious terror operative whose identity has remained shrouded in mystery for years, is believed to be among the infiltrators. The officials spoke to CBS News on the condition of anonymity.

Some Taliban foot soldiers are believed to have abandoned the group to join ISIS-K or al Qaeda, preferring an even more extreme — and brutal — interpretation of Islam, but these sources say the ISIS faction is working deliberately to undermine the Taliban's authority from both inside and outside the group. That carries risks not only for Afghanistan, but for the United States and its allies.

Since forming in 2015, ISIS-K has carried out some of the deadliest attacks in Afghanistan. The group didn't immediately claim the devastating bombing on Friday that hit a mosque in Kunduz, leaving scores of people dead. But ISIS-K has a long history of attacking Afghanistan's Shiite Muslim minority, and Taliban spokesman Bilal Karimi told CBS News that ISIS-K was behind the carnage. 

Four of ISIS-K's top commanders were killed by U.S. drones or Afghan security forces over four years following its founding. (ISIS-K is also known by other acronyms, including ISKP.)

In June 2020, the top job went to a militant known as Shahab al-Muhajir. Most assumed from his name that he was of Arab, not Afghan descent. Two former high-ranking Afghan government security officials and the senior member of the current Taliban regime have told CBS News, however, that he is a veteran of Afghanistan's domestic insurgency, and that his real name is Sanaullah. (Afghans often use only one name.) 

They say he's a graduate of the Kabul Polytechnic Institute who, according to a voter registration card found by Afghan security forces, is 31 years old. The former Afghan officials say the man now known as al-Muhajir received training in Pakistan from two different extremist groups based there, including the Taliban-affiliated Haqqani network.

"Whatever his ethnicity, he has ended up being much better positioned than his predecessors to revive ISKP," Ex-Trac, an organization that analyzes threats posed by extremist groups, wrote in an August assessment. "His taking the reins of power in mid-2020 culminated in radical change for the organization, change that has seen it transitioning from a fragmented and degraded network into the aggressive phalanx it is today."

While other ISIS-K commanders have focused on seizing territory, the former Afghan officials say al-Muhajir is part of a more strategic cadre that aims to undermine Afghanistan's leadership to gain freedom to operate. 

The former Afghan security officials say al-Muhajir has managed to keep hiding his real identity and continue operating as a Taliban imposter. One of the former Afghan government security sources said al-Muhajir had even managed to hold a meeting with Taliban deputy head of intelligence Mullah Tajmir Jawad, without the official realizing he was talking to the ISIS-K leader.

A former senior Afghan intelligence officer tells CBS News that about one year ago, "after lots of hard work," the country's security forces managed to locate al-Muhajir, but the ISIS-K leader escaped capture. All they found was his national ID card — with his real name on it — and another ID identifying him as a member of the Afghan army.

The other former Afghan security official says captured ISIS-K militants would routinely tell interrogators they'd met al-Muhajir, but "when we showed them photos to identify al-Muhajir, they used to point the finger at the wrong person, meaning even people within ISKP were meeting an imposter, not the real boss."

"ISKP's leader Shahab right now is working within Taliban ranks, but the Taliban don't know him," the former intelligence official told CBS News. "ISKP in Afghanistan is a live bomb roaming free within the Taliban."

A senior Taliban official told CBS News on Wednesday that the new Afghan regime does have the previous government's security files on al-Muhajir, but they haven't yet tracked him down.

The other former Afghan official told CBS News that ISIS-K is splitting its efforts, with "some of them openly opposing the Taliban, while some of them remain within the Taliban for their own interests, like enemies staying in the enemy's house and looking for an opportunity, 24/7." 

Taliban denial

Saeed Khosty, spokesman for the Taliban regime's Interior Ministry, told CBS News on Thursday that it was "not true" that al-Muhajir was operating within his group.

Khosty insisted that ISIS-K was "not as much of a threat" in Afghanistan as reports suggest, and he said media outlets were ignoring the Taliban's claims to have "driven out" ISIS-K fighters from strongholds east of Kabul.

"Talking about ISIS threats in Afghanistan is like a propaganda for ISIS," Khosty protested. "This is making people confused, but the level and skills of the ISIS-K threat are not at that high level."

"Room to breathe" 

Both the Trump and Biden administrations, in defending their decisions to withdraw from Afghanistan, vowed to hold the Taliban to its promise to prevent other groups, namely al Qaeda and ISIS, from using Afghan soil to plot attacks against America and its allies.

But surging violence by ISIS-K, and the group's alleged infiltration of the Taliban regime, may complicate the new leaders' ability to deliver. 

"The more pressure ISKP exerts on the Taliban, the harder it will be for its nascent government to maintain centrifugal force. A fragmented Taliban wrought apart by in-fighting and distrusted by the communities over which it rules would give ISKP room to breathe," Ex-Trac warned in its late-August report.

While playing down the ISIS-K threat, the Taliban also seems to be taking it very seriously, claiming a series of raids targeting the group in recent days, and vowing more to come. An internal communique from the Taliban regime's Intelligence Commission, seen on Wednesday by CBS News, lays out plans to target two districts east of Kabul believed to be ISIS-K strongholds. The Taliban security officers say in the document that the areas must be "completely cleared" of ISIS-K fighters.

The threat to increase operations comes amid reports that the Taliban is indiscriminately killing men from areas they believe to be saturated with ISIS-K supporters. The Taliban has claimed that raids in recent weeks have killed ISIS-K fighters, and it insists the Afghan people do not support the ISIS affiliate. But locals have reported that only civilians were killed in some of the Taliban raids, and at checkpoints on major roads out of these areas.

Ex-Trac said ISIS-K — which the recently ousted government estimated to have between 2,000 and 3,000 fighters — went quiet for a couple weeks as the Taliban reasserted control over the country in late August. The notable exception was the devastating Kabul airport bombing that killed 13 American troops and 170 Afghans.

On September 18, ISIS-K fully resumed operations, according to Ex-Trac, with 22 attacks in just 11 days that primarily targeted the Taliban and civilians. 

The violence "proves the claims wrong that the Taliban's military ascendency has ended the war in Afghanistan," former Pakistani lawmaker Afrasiab Khattak, who founded the cross-border Afghanistan Pakistan Peoples Friendship Association, told CBS News.

There are new attacks in Afghanistan blamed on ISIS-K almost every day. One of the most recent was a suicide bombing targeting a Kabul mosque on Sunday. ISIS claimed responsibility for the attack, which left at least five civilians dead. As it often does, the group exaggerated the scope of the strike, claiming to have killed "dozens in the ranks of the Taliban."

"Aspirations to attack the United States"

The U.S. has targeted ISIS-K with airstrikes since pulling its forces out of Afghanistan in August.

Early this month Defense Secretary Lloyd Austin said the U.S. military would, "remain focused on ISIS-K," to the extent possible post-withdrawal. He vowed that at "the time of our choosing, in the future, we will hold them accountable for what they've done," referring to the Kabul airport bombing. 

Joint Chiefs of Staff Chairman General Mark Milley, during Congressional testimony, said it was "possible" the U.S. would cooperate with the Taliban at some point in the future to address the ISIS-K threat.

"A reconstituted al Qaeda or ISIS, with aspirations to attack the United States, is a very real possibility," Milley said. He estimated that ISIS-K would need between six months and several years for "reconstitution."

He acknowledged that the mission to counter ISIS-K and other groups would be "much harder now. But not impossible."

U.S. Central Command Commander General Kenneth McKenzie was asked if he was confident that the U.S. military could deny ISIS-K and other groups the ability to stage attacks from Afghan soil.

"I think that's yet to be seen," said the general. "I do not yet have that level of confidence."

In:
• Taliban
• Islamic State of Iraq and the Levant
• ISIS-K