Abdullah Bozkurt/Stockholm
The Islamic State in Iraq and Syria – Khorasan Province (ISIS-K or ISIL-K) terrorist organization has reportedly utilized Turkey for the transfer of fighters, logistics and target identification, as indicated by information from the United Nations, the Federal Bureau of Investigation (FBI) and Turkish judicial documents.
The UN monitoring team’s report on Afghanistan in the summer of 2023 underscored that ISIS-K, identified as the most significant existing terrorist threat in the country, its neighboring regions and Central Asia, includes Turkish nationals among its estimated 4,000 to 6,000 fighters.
In addition to Turkish citizens ISIS-K recruited individuals from Afghanistan, Azerbaijan, Iran, Pakistan, Russia and Central Asian countries. Furthermore, a small number of Arab fighters who had traveled from Syria to Afghanistan in 2022 also joined ISIS-K.
The information from the UN was corroborated by Turkish judicial documents investigating the ISIS-K network within Turkey. A recent indictment from the Istanbul Chief Public Prosecutor’s Office reported by the Artı Gerçek news platform in January provides additional details on how ISIS-K utilizes Turkey for logistics, serving as a hub to transfer fighters, obtain forged documents, arrange safe houses and procure arms and explosives for terrorist attacks.
The UN report on Afghanistan reveals a Turkish connection to ISIS-K:
ISIS_K_Afghanistan_report_UN_2023
The indictment contains substantial information shared by the ISIS-K Turkey leader, who became an informant, and intelligence provided by the FBI to Turkish law enforcement agencies regarding the terrorist group’s activities.
According to the statement provided to counterterrorism police in Turkey, the ISIS-K point man in Turkey, identified only by the initials A.C., a 45-year-old Kyrgyz national of Tajik origin, revealed that the terrorist group planned attacks on the consulates of Sweden and the Netherlands, synagogues and churches in Istanbul. A.C. confessed that he had facilitated the travel of suicide bombers from Russia, Europe, Central Asia and Afghanistan as well as being involved in the movement of money, arms and explosives.
Members of ISIS-K were accommodated in hotels in Istanbul’s conservative Fatih district and in safe houses across various Turkish provinces after their arrival in Turkey. They were provided with forged Afghan passports and identity documents to facilitate travel to Afghanistan through Iran, using a land route. The preparation of these forged identity papers took place in Turkey, Syria and Afghanistan.
According to A.C., Abdurakhoan Boboev, also known as Julaybib al-Kabli or Jalbib Al Kabuli, the perpetrator of the suicide bombing at a Shi’ite Muslim mosque in the northwestern Pakistani city of Peshawar in March 2022 that resulted in the death of 63 people, stayed in a safe house in Turkey. A.C. mentioned that al-Kabli, along with three other militants, sheltered in Turkey before being transported to Afghanistan through Iran.
In December 2021, A.C. received instructions from ISIS-K leadership to rent a house in Izmit, located to the west of Istanbul, to maintain a low profile. He picked up three Kyrgyz citizens and one Tajik, all aspiring suicide bombers, from the airport in Istanbul and took them to this house. Using fake Afghan identity papers that were sent from ISIS-K in Afghanistan, they crossed into Iran through the Turkish border province of Van with the assistance of smugglers.
A.C. claimed that the order for the suicide attack was given by ISIS-K leader Rostam Muhojirca, responsible for coordinating the terrorist organization’s explosives and attacks. However, according to Khyber Pakhtunkhwa’s Counter-Terrorism Department (CTD) in Pakistan, Hasan Shah, an ISIS-K commander, was identified as the mastermind behind the mosque attack in March 2022. Shah and a would-be suicide bomber were killed in an intelligence operation in Peshawar on May 14, 2022.
It is conceivable that both Muhojirca and Shah were involved in planning the attack, each possibly playing different roles or contributing in various capacities within the overall coordination of the operation.
The Turkish indictment specifies that ISIS-K planned terrorist attacks against the consulates of Sweden and the Netherlands in Istanbul following a Quran burning incident in Stockholm in 2022. Muhojirca allegedly issued the order for the attack from Afghanistan. An Azeri and two Chechens, who were sheltering in a safe house in Turkey, were assigned to carry out the attack. ISIS-K militants conducted surveillance around the consulate buildings, capturing photos and videos that were subsequently sent to ISIS-K headquarters in Afghanistan.
The surveillance note shared with A.C. and ISIS-K leadership in Afghanistan revealed that the terrorist group identified weak security around the Swedish Consulate building, with only two guards stationed in front. They concluded that they could potentially enter the building by force, and once inside, detonate explosives.
The planned method of the attack was described as inghimasi style, where the attackers infiltrate the building, fully aware that they might be killed. In such attacks, terrorists typically carry explosives to maximize damage, detonating them after exhausting ammunition or when facing imminent capture or death.
The ISIS-K leadership in Turkey encountered difficulties in obtaining the necessary AK-47s, explosives and ammunition for the planned attack on the Swedish Consulate. This led to a revision of the attack plans. Ultimately, the operation was canceled due to concerns about a potential leak, as stated by the public prosecutor who had filed the indictment against 17 foreign nationals and one Turkish citizen. There are rumors, according to A.C.’s information, that the three selected ISIS suicide bombers for the Swedish Consulate attack might have been shifted to Europe.
A.C.’s statement reveals that Turkey has indeed served as a logistics hub for nearly a decade for the global ISIS network. A.C., a merchant by profession, joined ISIS in 2014 while involved in business affairs in Kyrgyzstan. In 2015 he was directed by ISIS leadership to go to Turkey, which he managed to enter through the Russia and Iran land route. Renting a safe house in Istanbul’s Sefaköy district, he accommodated other ISIS militants. His assigned role was to welcome aspiring ISIS members arriving in Turkey, assist them in settling temporarily and later organize their travel to Syria and other countries.
After residing in Turkey for a period, A.C. was apprehended by Turkish police and deported to Egypt. He subsequently traveled to Ukraine and stayed there for three months before returning to Turkey under the assumed name of Farkhod Safarov, using a forged passport. He settled in an ISIS safe house located in Istanbul’s Sefaköy district. Throughout this time, communication with ISIS-K leadership was conducted through a Telegram channel.
He brought his wife and children to Turkey from Tajikistan in 2022 and rented a house in Istanbul’s Maltape district. ISIS sent funds to A.C. through the hawala system as well as to A.C.’s account in the Russian SberBank. The money covered salaries and expenses for ISIS members.
In time, a feud developed between A.C. and ISIS-K leadership in Afghanistan due to failures in executing several plans. A.C. decided to disclose what he knew about ISIS-K operations and informed the Kyrgyz consulate in Istanbul of his intentions. A diplomat from the consulate met with him twice and spoke by phone with Kyrgyzstan’s national security officer in Bishkek, who arranged for his detention by Turkish police. A.C. then provided Turkish authorities with information about ISIS-K.
The information provided by A.C. includes the identity of a Tajik man named Abdulkerim Abdullah (a.k.a Bilal), who received training in arms, explosives and the manufacturing of poisons in Afghanistan in 2010/2011. Detained by the US Army in 2015, he was imprisoned for a year before being released. He was subsequently sent to Turkey by ISIS, where he stayed for three months before traveling to Syria to join the group. As of the latest available information, he is believed to still be in Turkey.
According to the indictment, Abdulkerim Abdullah and convicted murderer Abdulkadir Masharipov were comrades and received religious education from the same imam. Masharipov, an ISIS terrorist, perpetrated a deadly New Year’s Eve attack on an Istanbul nightclub in 2017, resulting in the death of 39 people. A Turkish court in 2020 sentenced Masharipov to life in prison with no chance of parole.
A.C. also identified the individual responsible for trafficking ISIS fighters from Syria to Afghanistan through Turkey. This person, known only by his first name, Anas, is a Tajik national who operates two safe houses in Istanbul’s Bayrampaşa and Pendik districts. Working in coordination with his aide Ahkam, an Azeri national, they collaborate with ISIS operative Abu Idris in Syria to manage the repatriation of fighters from Syria.
It is noteworthy that A.C. was quickly released during his initial detention in Turkey on an unspecified date by the Turkish authorities. This aligns with a pattern observed where many ISIS militants detained by Turkish police are often quickly released, deported or receive light sentences, enabling them to resume activities on behalf of the ISIS network.
In fact some of the ISIS suspects involved in an attack on the Church of Santa Maria (Meryem Ana Doğuş Kilisesi) in Istanbul’s Sarıyer district on January 28, 2024 that resulted in one fatality had previously been detained and released by Turkish authorities.
Edelkhan Inazhaev (aka Ilyas), a Chechen detained for his alleged role in the church attack, was previously arrested on July 1, 2016 in connection with an ISIS attack on an Istanbul airport that resulted in the death of 45 people. He was subsequently released, joined ISIS in Syria and returned to Turkey. During a raid, police found a gun converted from a blank-firing pistol in his home, and his phone contained photos of the vehicle used in the church attack, along with images of ISIS members and documents explaining how to make bombs.
Zharaidat Esmurzieva, who was with Inazhaev when he was detained by the police and introduced as his wife, was previously married to ISIS suicide bomber Behruz Bobokalonov (aka Abu Kasas Al Taciki). Intelligence documents listed Esmurzieva as a volunteer to become a suicide bomber.
Similarly, Andrei Guzun, a Moldovan national who was detained for his connection to one of the shooters in the church attack, had been arrested in Turkey’s resort province of Antalya in 2017 under the name of Adam Khamirzaev, according to fingerprint records kept by the police. He was quickly released after a brief detention at the time.
Khamirzaev, known by his assumed name of Adam Abu-Darrar Al-Shishani, was believed to be the mastermind behind the attack. The intelligence file on Khamirzaev indicates that he is one of the senior figures in the ISIS Turkish network.
Another man named Makhammad Yusuf Alisher, also known as Ugli Mirzoev and detained in connection with the church attack, was already familiar to Turkish authorities. The intelligence file on him reveals that in July 2023 he was in the process of setting up a training compound on a farm in Istanbul with the aim of dispatching terrorists to the US. Mirzoev was reportedly working under the command of Khamirzaev.
The suspected shooters in the church attack — 24-year-old Tajik national Amirjon Kholikov (aka Hamza), and 37-year-old Russian national of Tajik origin David Tanduev — were detained by Turkish police within 10 hours, suggesting that authorities may have had prior knowledge of them. The police also recovered the clothes and one of the guns used in the attack. Both men were employed at a sushi restaurant in Istanbul’s conservative Bahçelievler district.
Both men were believed to be linked to ISIS-K in Afghanistan. They have been living in Turkey for the last four years.
The shooters conducted surveillance on several churches in the Beyoğlu, Balat and Karaköy neighborhoods in Istanbul on January 20 and 21 but determined that the security in these crowded areas was high. Ultimately, they chose to attack the Church of Santa Maria in Sarıyer due to its easy access to the highway, providing a convenient escape route.
The vehicle used by the assailants was registered in Poland and driven to Turkey on November 27, 2022 by a man named Abdullo B., who then flew to Russia two days later. The vehicle changed ownership several times without official registration in motor vehicle records and was rarely used in traffic until the day of the attack. This suggests that ISIS aimed to avoid leaving traces by minimizing the car’s appearances on traffic cameras.
Thus far, Turkish authorities have detained 51 suspects, predominantly Tajiks, in connection to the church attack, all within 24 hours of the incident. Of these, 26 were deported, and the remaining 34 were referred to court for arraignment. The court ordered the arrest of 25 suspects while releasing nine under judicial supervision. On February 3 police detained 17 ISIS-K suspects in connection to the church attack.
In addition to those mentioned earlier, some of the arrestees include Abdulaziz Abdullaev, Rasul Akhmadjanov, Islam Magomadov, Omadbek Kodirjonovich Djabborov, Temurbek Murodjonugli Essonov, Hazratumar Mahamatsoliev, Shamsullo Radzhabov, Husnitdin Kunarov, Lusup Tsuroev, Movlat Tsuroeev, Mukhammad Kodır Mirzaev, Ismonalı Mirzojonov, Farrukh Soliev, Alisher Rakhimov, Olim Ghulomov and Zharaidat Esmurzieva.
Two of the suspects were identified as being connected to ISIS-K in Afghanistan.
Three Turkish nationals — Mahmud Muhammed, Enver Karakaş and İbrahim Sünmez — were also arrested in connection to the attack. Muhammed and Karakaş also have Chinese passports, suggesting they’re Uighurs. The former acquired Turkish nationality on March 4, 2016, and the latter on December 23, 2002. Both individuals were known to Turkish authorities for their ties to jihadist groups in Syria. In Turkish intelligence documents, Muhammed was described as an individual with links to jihadist group the Turkistan Islamic Party (TIP, formerly known as the East Turkistan Islamic Party, ETIP).
The shooters denied receiving specific instructions for the attack but admitted that the general call by ISIS to target Jews and Christians inspired them, especially in the context of the Hamas-Israeli conflict.
Several indications, such as the use of pistols converted from blank-firing guns rather than high-caliber assault weapons and explosives, and firing at walls instead of directly at the worshippers, including the Polish consul general, who were attempting to protect themselves by lying on the ground, suggest that the shooters may not have had extensive training.
It is premature to conclusively label this incident as a lone wolf attack, given that the shooters had connections to the ISIS network in Turkey, employed surveillance tactics and successfully fled the scene. The swift roundup of suspects by Turkish police, including members of the ISIS network involved in the church attack, suggests that most suspects were already known to the authorities.
The Güvercintepe neighborhood in the Başakşehir district, where the shooters and their accomplices reside, is known to be home to jihadist networks, particularly those associated with ISIS. An estimated 10,000 Tajik, Afghan, Uzbek and Syrian nationals live in the area. Turkish police, on average, conduct around two raids a month in Güvercintepe to crack down on ISIS.
In addition to Güvercintepe, ISIS utilizes approximately a dozen other places in Istanbul where migrant communities reside to conceal its cells and evade the scrutiny of Turkish authorities. These areas include Zeytinburnu, Yeşiltepe, Sümer, Nuripaşa, Fatih Molla Gürani, Molla Hüsrev, Atikali, Pendik, Şifa, Kağıthane, Sancaktepe and Tuzla. Approximately half the police operations against the ISIS network in Turkey take place in Istanbul.
The Turkish government’s immediate response to the church attack was to impose a gag order on media coverage of the incident. Simultaneously, it was obvious that Turkey’s pro-government media and propagandists were mobilized to divert attention from the perceived failures of the Islamist government led by President Recep Tayyip Erdogan in preventing the attack.
Articles in the government-controlled media entertained conspiracy theories, suggesting that foreign intelligence services were behind the attack. For instance, an article published two days after the attack in Hürriyet, a publication under the control of the Erdogan government, stated, “In the initial assessments, foreign intelligence agencies targeting Turkey utilized ISIS as a proxy organization.” Additionally Nedim Şener, a government propagandist, even suggested in an article on January 31 that Israeli Mossad might have been behind the attack.
It is clear that ISIS and its branch ISIS-K have been utilizing Turkey as a logistics hub and carrying out attacks on specific targets, despite efforts by the Erdogan government to present a different narrative.
