Activities of "Islamic State-Province of Khorasan" in Turkey
The Islamic State in Iraq and Syria – Khorasan Province (ISIS-K or ISKP) terrorist organization has reportedly utilized Turkey for the transfer of fighters, logistics and target identification, as indicated by information fr om the United Nations, the Federal Bureau of Investigation (FBI) and Turkish judicial documents.
The UN monitoring team's report on Afghanistan in the summer of 2023 underscored that ISKP, identified as the most significant existing terrorist threat in the country, its neighboring regions and Central Asia, includes Turkish nationals among its estimated 4,000 to 6,000 fighters.
In addition to Turkish citizens ISKP recruited individuals fr om Afghanistan, Azerbaijan, Iran, Pakistan, Russia and Central Asian countries. Furthermore, a small number of Arab fighters who had traveled from Syria to Afghanistan in 2022 also joined ISKP.
The information from the UN was corroborated by Turkish judicial documents investigating the ISKP network within Turkey. A recent indictment from the Istanbul Chief Public Prosecutor's Office reported by the Artı Gerçek news platform in January provides additional details on how ISKP utilizes Turkey for logistics, serving as a hub to transfer fighters, obtain forged documents, arrange safe houses and procure arms and explosives for terrorist attacks.
The indictment contains substantial information shared by the ISKP Turkey leader, who became an informant, and intelligence provided by the FBI to Turkish law enforcement agencies regarding the terrorist group's activities. According to the statement provided to counterterrorism police in Turkey, the ISKP point man in Turkey, identified only by the initials A.C., a 45-year-old Kyrgyz national of Tajik origin, revealed that the terrorist group planned attacks on the consulates of Sweden and the Netherlands, synagogues and churches in Istanbul.
A.C. confessed that he had facilitated the travel of suicide bombers from Russia, Europe, Central Asia and Afghanistan as well as being involved in the movement of money, arms and explosives. Members of ISKP were accommodated in hotels in Istanbul's conservative Fatih district and in safe houses across various Turkish provinces after their arrival in Turkey. They were provided with forged Afghan passports and identity documents to facilitate travel to Afghanistan through Iran, using a land route. The preparation of these forged identity papers took place in Turkey, Syria and Afghanistan.
According to A.C., Abdurakhon Boboev, also known as Julaybib al-Kabli or Jalbib Al Kabuli, the perpetrator of the suicide bombing at a Shia Muslim mosque in the northwestern Pakistani city of Peshawar in March 2022 that killed 63 people, stayed in a safe house in Turkey. A.C. mentioned that al-Kabli, along with three other militants, sheltered in Turkey before being transported to Afghanistan through Iran. In December 2021, A.C. received instructions from ISKP leadership to rent a house in Izmit, located to the west of Istanbul, to maintain a low profile. He picked up three Kyrgyz citizens and one Tajik, all aspiring suicide bombers, from the airport in Istanbul and took them to this house. Using fake Afghan identity papers that were sent from ISKP in Afghanistan, they crossed into Iran through the Turkish border province of Van with the assistance of smugglers.
It is conceivable that both Muhojirca and Shah were involved in planning the attack, each possibly playing different roles or contributing in various capacities within the overall coordination of the operation. The Turkish indictment specifies that ISP planned terrorist attacks against the consulates of Sweden and the Netherlands in Istanbul following a Quran burning incident in Stockholm in 2022. Muhojirca allegedly issued the order for the attack from Afghanistan. An Azeri and two Chechens, who were sheltering in a safe house in Turkey, were assigned to carry out the attack. ISKP militants conducted surveillance around the consulate buildings, capturing photos and videos that were subsequently sent to ISKP headquarters in Afghanistan.
The surveillance note shared with A.C. and ISKP leadership in Afghanistan revealed that the terrorist group identified weak security around the Swedish Consulate building, with only two guards stationed in front. They concluded that they could potentially enter the building by force, and once inside, detonate explosives. The planned method of the attack was described as inghimasi style, wh ere the attackers infiltrate the building, fully aware that they might be killed. In such attacks, terrorists typically carry explosives to maximize damage, detonating them after exhausting ammunition or when facing imminent capture or death.
The ISKP leadership in Turkey encountered difficulties in obtaining the necessary AK-47s, explosives and ammunition for the planned attack on the Swedish Consulate. This led to a revision of the attack plans. Ultimately, the operation was canceled due to concerns about a potential leak, as stated by the public prosecutor who had filed the indictment against 17 foreign nationals and one Turkish citizen. There are rumors, according to A.C.'s information, that the three selected ISIS suicide bombers for the Swedish Consulate attack might have been shifted to Europe.
After residing in Turkey for a period, A.C. was apprehended by Turkish police and deported to Egypt. He subsequently traveled to Ukraine and stayed there for three months before returning to Turkey under the assumed name of Farkhod Safarov, using a forged passport. He settled in an ISIS safe house located in Istanbul's Sefaköy district. Throughout this time, communication with ISKP leadership was conducted through a Telegram channel. He brought his wife and children to Turkey fr om Tajikistan in 2022 and rented a house in Istanbul's Maltape district. ISIS sent funds to A.C. through the hawala system as well as to A.C.'s account in the Russian SberBank. The money covered salaries and expenses for ISIS members.
In time, a feud developed between A.C. and ISKP leadership in Afghanistan due to failures in executing several plans. A.C. decided to disclose what he knew about ISKP operations and informed the Kyrgyz consulate in Istanbul of his intentions. A diplomat from the consulate met with him twice and spoke by phone with Kyrgyzstan's national security officer in Bishkek, who arranged for his detention by Turkish police. A.C. then provided Turkish authorities with information about ISKP.
The information provided by A.C. includes the identity of a Tajik man named Abdulkerim Abdullah (a.k.a Bilal), who received training in arms, explosives and the manufacturing of poisons in Afghanistan in 2010/2011. Detained by the US Army in 2015, he was imprisoned for a year before being released. He was subsequently sent to Turkey by ISIS, wh ere he stayed for three months before traveling to Syria to join the group. As of the latest available information, he is believed to still be in Turkey.
According to the indictment, Abdulkerim Abdullah and convicted murderer Abdulkadir Masharipov were comrades and received religious education fr om the same imam. Masharipov, an ISIS terrorist, perpetrated a deadly New Year's Eve attack on an Istanbul nightclub in 2017, resulting in the death of 39 people. A Turkish court in 2020 sentenced Masharipov to life in prison with no chance of parole.
It is noteworthy that A.C. was quickly released during his initial detention in Turkey on an unspecified date by the Turkish authorities. This aligns with a pattern observed wh ere many ISIS militants detained by Turkish police are often quickly released, deported or receive light sentences, enabling them to resume activities on behalf of the ISIS network.
In fact some of the ISIS suspects involved in an attack on the Church of Santa Maria (Meryem Ana Doğuş Kilisesi) in Istanbul's Sarıyer district on January 28, 2024 that resulted in one fatality had previously been detained and released by Turkish authorities. Edelkhan Inazhaev (aka Ilyas), a Chechen detained for his alleged role in the church attack, was previously arrested on July 1, 2016 in connection with an ISIS attack on an Istanbul airport that resulted in the death of 45 people. He was subsequently released, joined ISIS in Syria and returned to Turkey. During a raid, police found a gun converted fr om a blank-firing pistol in his home, and his phone contained photos of the vehicle used in the church attack, along with images of ISIS members and documents explaining how to make bombs.
Similarly, Andrei Guzun, a Moldovan national who was detained for his connection to one of the shooters in the church attack, had been arrested in Turkey's resort province of Antalya in 2017 under the name of Adam Khamirzaev, according to fingerprint records kept by the police. He was quickly released after a brief detention at the time. Khamirzaev, known by his assumed name of Adam Abu-Darrar Al-Shishani, was believed to be the mastermind behind the attack. The intelligence file on Khamirzaev indicates that he is one of the senior figures in the ISIS Turkish network.
Another man named Makhammad Yusuf Alisher, also known as Ugli Mirzoev and detained in connection with the church attack, was already familiar to Turkish authorities. The intelligence file on him reveals that in July 2023 he was in the process of setting up a training compound on a farm in Istanbul with the aim of dispatching terrorists to the US. Mirzoev was reportedly working under the command of Khamirzaev.
The shooters conducted surveillance on several churches in the Beyoğlu, Balat and Karaköy neighborhoods in Istanbul on January 20 and 21 but determined that the security in these crowded areas was high. Ultimately, they chose to attack the Church of Santa Maria in Sarıyer due to its easy access to the highway, providing a convenient escape route. The vehicle used by the assailants was registered in Poland and driven to Turkey on November 27, 2022 by a man named Abdullo B., who then flew to Russia two days later. The vehicle changed ownership several times without official registration in motor vehicle records and was rarely used in traffic until the day of the attack. This suggests that ISIS aimed to avoid leaving traces by minimizing the car's appearances on traffic cameras.
Thus far, Turkish authorities have detained 51 suspects, predominantly Tajiks, in connection to the church attack, all within 24 hours of the incident. Of these, 26 were deported, and the remaining 34 were referred to court for arraignment. The court ordered the arrest of 25 suspects while releasing nine under judicial supervision. On February 3 police detained 17 ISKP suspects in connection to the church attack.
In addition to those mentioned earlier, some of the arrestees include Abdulaziz Abdullaev, Rasul Akhmadjanov, Islam Magomadov, Omadbek Kodirjonovich Djabborov, Temurbek Murodjonugli Essonov, Hazratumar Mahamatsoliev, Shamsullo Radzhabov, Husnitdin Kunarov, Lusup Tsuroev, Movlat Tsuroeev, Mukhammad Kodır Mirzaev, Ismonalı Mirzojonov, Farrukh Soliev, Alisher Rakhimov, Olim Ghulomov and Zharaidat Esmurzieva. Two of the suspects were identified as being connected to ISKP in Afghanistan. Three Turkish nationals — Mahmud Muhammed, Enver Karakaş and İbrahim Sünmez — were also arrested in connection to the attack.
Muhammed and Karakaş also have Chinese passports, suggesting they're Uighurs. The former acquired Turkish nationality on March 4, 2016, and the latter on December 23, 2002. Both individuals were known to Turkish authorities for their ties to jihadist groups in Syria. In Turkish intelligence documents, Muhammed was described as an individual with links to jihadist group the Turkistan Islamic Party (TIP, formerly known as the East Turkistan Islamic Party, ETIP). The shooters denied receiving specific instructions for the attack but admitted that the general call by ISIS to target Jews and Christians inspired them, especially in the context of the Hamas-Israeli conflict.
Several indications, such as the use of pistols converted from blank-firing guns rather than high-caliber assault weapons and explosives, and firing at walls instead of directly at the worshippers, including the Polish consul general, who were attempting to protect themselves by lying on the ground, suggest that the shooters may not have had extensive training. It is premature to conclusively label this incident as a lone wolf attack, given that the shooters had connections to the ISIS network in Turkey, employed surveillance tactics and successfully fled the scene.
The swift roundup of suspects by Turkish police, including members of the ISIS network involved in the church attack, suggests that most suspects were already known to the authorities.
The Güvercintepe neighborhood in the Başakşehir district, wh ere the shooters and their accomplices reside, is known to be home to jihadist networks, particularly those associated with ISIS. An estimated 10,000 Tajik, Afghan, Uzbek and Syrian nationals live in the area. Turkish police, on average, conduct around two raids a month in Güvercintepe to crack down on ISIS.
In addition to Güvercintepe, ISIS utilizes approximately a dozen other places in Istanbul wh ere migrant communities reside to conceal its cells and evade the scrutiny of Turkish authorities. These areas include Zeytinburnu, Yeşiltepe, Sümer, Nuripaşa, Fatih Molla Gürani, Molla Hüsrev, Atikali, Pendik, Şifa, Kağıthane, Sancaktepe and Tuzla. Approximately half the police operations against the ISIS network in Turkey take place in Istanbul.
The Turkish government's immediate response to the church attack was to impose a gag order on media coverage of the incident. Simultaneously, it was obvious that Turkey's pro-government media and propagandists were mobilized to divert attention fr om the perceived failures of the Islamist government led by President Recep Tayyip Erdogan in preventing the attack. Articles in the government-controlled media entertained conspiracy theories, suggesting that foreign intelligence services were behind the attack.
For instance, an article published two days after the attack in Hürriyet, a publication under the control of the Erdogan government, stated, “In the initial assessments, foreign intelligence agencies targeting Turkey utilized ISIS as a proxy organization.” Additionally Nedim Şener, a government propagandist, even suggested in an article on January 31 that Israeli Mossad might have been behind the attack.
It is clear that ISIS and its branch ISKP have been utilizing Turkey as a logistics hub and carrying out attacks on specific targets, despite efforts by the Erdogan government to present a different narrative. Additionally, there is a different reason for concern.
That reason is the pronounced dominance of terrorists originating from Russia and CIS countries. This indicates that a substantial ISIS force has effectively developed in the Central Asian republics, and currently it is taking on prominent roles within the organization. The situation is further exacerbated by concentrations of ISIS supporters in the northern parts of Afghanistan, wh ere up to 10,000 individuals from Central Asia are present.