top of page



Week of: Monday, September 27, 2021

Eid Gah Mosque in South-East Kabul[1]

The Counterterrorism Group (CTG) is issuing a FLASH ALERT to Afghanistan and other countries with personnel and citizens in Afghanistan due to the increased threat posed by Islamist extremist groups like Islamic State Khorasan Province (ISIS-K) as they attempt to spoil the Islamic Emirate of Afghanistan’s (IEA) reconstruction efforts. The current CTG threat matrix indicates that there is a HIGH PROBABILITY that rival militant groups will continue to threaten IEA forces in Kabul and senior Taliban officials throughout Afghanistan. The current CTG threat matrix also indicates that there is a HIGH PROBABILITY of additional attacks in Kabul as rival groups exploit the country’s instability. Although no group has claimed responsibility for this attack, CTG believes it is highly likely that ISIS-K perpetrated the attack as it is one of the only groups with the operational capabilities to oppose the Taliban government.

The first significant attack on the Taliban since the withdrawal of US troops, the bombing occurred on Sunday, October 3rd, 2021 and killed at least five civilians and wounded at least twenty others at Kabul’s second-largest mosque, Eid Gah.[2] CTG’s assessment that ISIS-K likely conducted the attack is based on the fact that the group’s militants have intensified their assaults against the Taliban in recent weeks, especially in the strongholds of eastern Afghanistan, likely signaling a widening conflict between both groups.[3] It claimed responsibility for recent smaller attacks in Jalalabad and Parwan provinces where IEDs and ambushes killed at least ten Taliban soldiers.[4] Al-Qaeda (AQ) affiliated groups are also possible perpetrators of the attack, however, this is highly unlikely because AQ leadership has pledged allegiance to the Taliban and cannot afford to abandon the IEA given its weakened global status. While ISIS-K and AQ’s current manpower and resource constraints limit their ability to threaten the Taliban on the conventional battlefield, the groups’ underground, asymmetrical campaigns will likely undermine and destabilize the new Taliban government in areas where they retain strength, such as Jalalabad and Kabul. As more Afghans become disenchanted with an inefficient Taliban government, militant groups like ISIS-K are likely to gain popularity among Uzbeks, Tajiks, Uyghurs, and Turkmen living in northern Afghanistan and Central Asian countries who have historically been marginalized by the Taliban and ISIS-K will likely continue to recruit from Taliban defectors.

Since the most recent attack occurred during a memorial service in which senior Taliban officials were present, the officials were likely the intended targets for the attack. The Taliban’s security appeared effective in preventing the attackers from entering the mosque, however, its rings of security were likely overwhelmed by hundreds of people entering and exiting the venue. As the attack occurred in a crowd at the mosque’s gate, it is likely a suicide bomber or remote detonation initiated the attack. A vehicle-borne IED is very unlikely. Although no Taliban members were injured, according to initial reports, this is likely to change as more information becomes available. To prevent the attackers from gaining a propaganda victory, IEA officials are likely to manipulate casualty numbers to create a perception of invincibility to the rival group and local populace.

Attacks by opposing militant organizations are likely to continue against the Taliban government as they are empowered to challenge the IEA after the withdrawal of Afghan and American intelligence personnel. As casualties from the attack are admitted for treatment, attacks on medical facilities are also likely due to several reasons: the Taliban’s security is likely unrefined as it learns governance functions; security around hospitals is likely stretched thin due to the high number of victims; and extremist groups have attacked soft targets such as hospitals in the past.[5] An insider attack on Taliban forces or their leadership has a roughly even chance of occurring since Taliban defectors who joined rival militant groups almost certainly have the cultural and ideological knowledge to integrate into Taliban ranks to launch lone-wolf attacks.

Taliban spokesman Saeed Khosty reported that three individuals were arrested in connection to the bombing; however, the Taliban have not released additional information.[6] The Taliban may announce disingenuous captures of rival militant leaders to preserve goodwill and portray itself as an effective government because the attack likely reduced its legitimacy. Taliban leaders are likely to reduce their public engagements for days or weeks to limit exposure to assassination attempts. Those who engage the public as part of their job are likely at heightened risk for attacks.

Foreign nationals in Afghanistan should avoid large gatherings of people, especially of Taliban supporters as they are likely to be targeted in suicide bombings and shootings. Cautious intelligence sharing and coordination between the international community and Taliban regarding plots would be helpful, albeit in a limited capacity. Steps to target militants in Afghanistan should continue to be taken, such as airstrikes against high-value senior leadership and strategic locations of Islamic militant groups. This would not only limit militants’ capabilities to attack US interests but also promote marginal cooperation between the US and IEA. Since a majority of anti-Taliban attacks are conducted using IED devices and the majority of the IEDs victims are civilians, the nations bordering Afghanistan like Pakistan, China, and Iran should work with industry and commercial organizations to develop strategies to make it more difficult for terrorist groups to redirect fertilizers to IED manufacturing. Fertilizer in Afghanistan is already banned however due the proliferation of IEDs from other rival groups, the Taliban may likely regulate materials that can be used for explosives.[7] This not only would help maintain domestic stability in Afghanistan, but also prevent terrorist groups from using these explosives against Chinese, Iranian, and Pakistani forces. International forces should continue to monitor signals intelligence for details into the next attack. International forces should also continue to use intelligence, surveillance, and reconnaissance platforms to monitor intelligence indicating future attacks. Although the Taliban government is unlikely to collapse, the continued targeting of Taliban officials will most certainly increase instability in the nation and put civilians at risk of serious bodily injury or death.


CTG assesses that the current threat of attacks against foreign nationals, Afghan civilians, and Taliban forces is HIGH. The CENTCOM Team’s analysis indicates that the risk of increased violence focused towards civilians throughout Afghanistan is HIGH due to threats in highly-populated areas. Attacks against Taliban leadership by rival Islamist militant groups will persist as long as the Taliban are in power, likely for the medium to long term. CENTCOM will continue to monitor the situation as the current threat of attack is HIGH.

If any individuals are interested in learning more about security measures to protect their facilities and personnel, please contact The Counterterrorism Group (CTG) by Telephone 202-643-248 or email


[2] Afghanistan: Several people killed by bomb attack near a Kabul mosque, BBC News, September 2021,

[3] ISIS affiliate claims spate of attacks on Taliban in Afghan city of Jalalabad, CNN, September 2021,

[4] Ibid.


[6] Two Killed In Blast Outside Kabul Mosque. Radio Free Europe Radio Liberty, September 2021,




bottom of page