Illicit Weapons in Afghanistan –Issue 02

Conflict Armament Research (CAR) is an independent investigative organisation based in the UK. Established in 2011, CAR documents weapons, ammunition, and related military materiel in conflict zones, and traces chains of supply to identify points of diversion.

Between February 2019 and July 2021, CAR investigators worked in Afghanistan to document illicit weapons in the country. CAR’s Afghanistan data set comprises some 1,600 small arms and light weapons, more than 1,300 rounds of ammunition, and dozens of related items, such as night vision equipment, riflescopes, and components for improvised explosive devices (IEDs). In this Frontline Perspective series, CAR explores the supply dynamics that have sustained and supported armed groups in Afghanistan over the past few years.

Since the Taliban takeover of Afghanistan in mid-August 2021, concerns have grown over the changing terrorist landscape in the country and the threat posed by groups such as the Islamic State Khorasan Province (ISKP). In recent months, ISKP has claimed responsibility for conflict activity across Afghanistan, including prominent attacks in  Kabul ,  Kandahar ,  Kunduz , and  Nangarhar  provinces, which have killed and wounded scores of civilians. Understanding how terrorist and insurgent groups continue to gain access to weapons and ammunition is critical to countering these threats moving forward. Although the Taliban now seek to consolidate power, they do so against a host of shifting internal alliances and interests, which are further complicated by the deteriorating economic and humanitarian situation across the country.  

This is the second  Frontline Perspective  highlighting key findings from CAR’s Afghanistan data set. Read the first edition –  Taliban seizures of US-equipment are only a fraction of the story  - here. It focuses on weapons used in two high-profile attacks in Kabul: the May 2019 Taliban-claimed attack on Counterpart International, a contractor of the United States Agency for International Development (USAID), and the November 2020 ISKP-claimed attack on Kabul University.

Given that such incidents have been all too common in Afghanistan, this sample is narrow, but it reveals distinct commonalities among the weapons chosen for such high-profile attacks. This publication also marks the first time that detailed photographs of the weapons used in these urban attacks have been shared publicly. Analysis of the weapons used in these two attacks highlights subtle similarities in the preparation and profile of the selected weapons. It helps shine a spotlight on tactics previously deployed by the Taliban and by ISKP in Kabul. By providing insights into weapon selection for such high-profile attacks, it can also help inform security monitors and analysts moving forward.

The relationship between the Taliban and ISKP in Afghanistan is complex. Ever since the latter emerged on Afghanistan’s terrorist landscape in 2015, the Taliban have fiercely challenged those pledging allegiance to ISKP. They have expended significant resources to fight ISKP’s territorial advances in the East, forcefully subdued ISKP sympathisers elsewhere, and regularly promote antagonistic propaganda against the group. ^[1]  In turn, ISKP has bolstered rhetoric aimed at the Taliban, renewed its recruitment efforts, and  taken up the insurgent flag  against any government led by or including the Taliban.

Interactions on the ground are often more nuanced, however. Despite a history of inherent sectarian difference between the Hanafist-associated Taliban and Salafist-oriented ISKP, dynamics are often intertwined with complex local undercurrents. For instance, the Taliban have never been a monolithic entity; rather, they are characterised by polycentric nodes of power whose views and priorities may not always internally align. Elements of the Taliban-affiliated Haqqani Network have allegedly coordinated with ISKP on occasion. Moreover, ISKP has often recruited from disenfranchised Taliban fighters and commanders. ISKP may also become a focal point for any individuals who have grievances against or want to resist Taliban rule, regardless of their ideological adherence to the group. ^[2]  Compounding these factors is a severe economic downturn in the country, which can be expected to fuel financially motivated recruitment to armed groups in general. Meanwhile, these dynamics are further complicated by a myriad of other terrorist groups operating in and around Afghanistan.

The result is a multifaceted, continually shifting landscape where the relationships between attackers, attack coordinators, and networks of logistical and tactical support may overlap, regardless of distinct claims of attack authorship. Terrorist attacks in Kabul have long been a topic of debate in this regard. From 2015 until the Taliban takeover in 2021, high-profile attacks in Afghanistan’s capital were claimed by the Taliban, ISKP, and, in some cases, both. ^[3]  Attackers from both groups deployed similar tactics and targets often bore similar profiles.

The weapons relied upon by these groups to carry out attacks reflect the nature of their existing stockpiles and recent supplies. Analysis of these weapons provides important insights, not only into the materiel within a group’s possession, but also the scale and organisation of a group’s weapon management practices and how these may shift if violence continues.

Terrorist attacks in Kabul have long been a topic of debate: from 2015 until the Taliban takeover in 2021, high-profile attacks in Afghanistan's capital were claimed by the Taliban, ISKP, and, in some cases, both.

Although CAR investigators documented hundreds of weapons recovered from the Taliban and other armed groups in Afghanistan, very few of these could be directly attributed to specific attacks. In rare circumstances, CAR investigators accessed weapons that had been recovered by the former Afghan National Defence and Security Forces (ANDSF) following notable attacks in Kabul. This Frontline Perspective considers six such recovered firearms:

• four assault rifles used in the May 2019 Taliban-claimed attack on USAID contractor Counterpart International; and
• two assault rifles used in the November 2020 ISKP-claimed attack on Kabul University (see Map 1).

The rifles used in these two high-profile attacks show subtle similarities that distinguish the weapons from the larger data set that CAR documented in Afghanistan. They point to a distinct nature of attack preparations undertaken by both groups in Kabul.

On 8 May 2019, the Taliban carried out an attack targeting USAID contractor Counterpart International. Taliban spokesperson Zabihullah Mujahid issued a claim of responsibility for the attack via Twitter on 8 May (see below). The attack killed nine and wounded three in Kabul’s Shahr-e Naw neighbourhood (Al Jazeera, 2019). The Afghan security forces recovered four assault rifles used by the attackers and CAR investigators documented all four weapons in their custody on 13 June 2019.

Three of the weapons used in the attack were 7.62 × 39 mm AKM assault rifles produced in 1961, 1967, and 1970 during the Soviet Union-era by factories based in what is today the Russian Federation; ^[4]  the fourth was an AKMS assault rifle manufactured in Romania in 1985. ^[5] 

All four appeared well maintained for their age and featured their original internal working components, except one rifle whose return spring guide had been replaced. Below, you can explore each of these four weapons in detail. Scroll across the images to see each component and marking documented by CAR investigators in Afghanistan.

CAR investigators documented six components with markings that matched the serial number of this AKM assault rifle (ИФ1166) that was used in the attack on Counterpart International in May 2019. The sole exception was a return spring guide, whose markings were not clearly legible.

CAR documented five components with identical markings to the weapon's serial number, БИ1578. The sole exception was a return spring guide that was marked '894', indicating that it likely originated with another weapon.

All seven of the components that CAR documented as part of the AKM assault rifle with the serial number HШ5800 bore marks indicating that they were part of the original weapon.

All six components that CAR documented with this Romanian-manufactured AKMS rifle bore marks that identified them as having originated with the weapon.

Table 1 summarises the marks that CAR observed on the four weapons used in the attack on Counterpart International in May 2019.

Given that artisanal rifles are in common illicit circulation in Afghanistan, it is worth noting that none of the four rifles was of artisanal or local manufacture. Roughly half of the weapons in CAR’s Afghanistan data set are local copies of Chinese, European, Russian, and US models that are commonly produced in the Khyber Pakhtunkhwa region of Pakistan. These artisanal weapons constitute a significant source of illicit cross-border supply due to their low cost and widespread availability. Their reliability and performance vary considerably, however, which may explain their absence from the sample of weapons used in high-profile attacks.

The four rifles were fitted with side-folding buttstocks. In the case of the three AKM rifles, this modification took place after production, since no Soviet-era manufactured AKM-pattern rifles were fitted with side-folding stocks at manufacture. The rifle in Figure 1 was fitted with an Egyptian-pattern side-folding stock, recognisable by its distinctive triangular shoulder plate and straight stock strut (Iannamico, 2012, p. 440; see Figure 5). The rifle in Figure 2 bears a generic East German-style side-folding stock, which is often available on the open market (see Figure 6). The weapons in Figures 3 and 4 are both fitted with Romanian-style side-folding stocks, identified by their push-button release and the slight curve in the metal where the shoulder plate folds back into the strut (Iannamico, 2012, p. 385; see Figures 7 and 8). ^[9]  

The presence of AKM rifles fitted with post-production folding stocks is notable, as CAR identified replacement stocks on only around one in nine of the 100 plus non-artisanal AKM assault rifles in the Afghanistan data set. While this modification may be uncommon in CAR’s sample, it is not unique to Afghanistan, and CAR has observed such modifications in other conflict theatres. Compared to fixed-stock counterparts, foldable stocks arguably make concealment and transport less onerous. They are advantageous for smuggling items into or moving them around an urban environment such as Kabul, or when operators manoeuvre on motorbikes or in vehicles. It is possible that these weapons were selected, sought out, or modified precisely due to their portability and ease of concealment in the city. 

Standard-issue military rifles—that is to say, those commonly issued to dismounted infantry troops—are often fitted with fixed stocks, which improves their accuracy potential. Folding-stock rifles are more often encountered in service with troops who operate from vehicles, perform non-combat duties, or need to deploy from a confined space. CAR posits that fixed-stock military rifles that are diverted and repurposed for criminal or insurgent use are likely to be adapted to suit the needs of the new user, which may include modifying the weapon to accept post-production folding stocks. The side-folding stock can be readily fitted to a fixed-stock AKM-pattern rifle, with little modification to the weapon. Under-folding stocks cannot be as easily retrofitted, which is why side-folding stocks are more often encountered as a post-production modification to fixed-stocked weapons.

Figures 9–12 below show the buttstock attachments in detail.

Three of the four rifles used in the Counterpart International attack had identical single point sling attachments with a clip at the end (see Figures 13–15). The presence of a clip attachment on the rifle sling is highly distinctive; no other assault rifles—of any model—in CAR’s Afghanistan data set display this form of modification. Such clip attachments are typically used by combatants who wear body armour or tactical vests, as they allow them to attach the weapon to their body, drop it, and pick it up repeatedly from the same place over the course of attacks that can be hours long. The use of clip attachments may suggest that the fighters were trained in common military practices or that they observed and imitated the tactics of trained security forces. ^[10] 

Three of the four rifles used in the Counterpart International attack had identical single point sling attachments with a clip at the end. The presence of a clip attachment on the rifle sling is highly distinctive; no other assault rifles—of any model—in CAR’s Afghanistan data set display this form of modification.

ISKP claimed responsibility for an attack at Kabul University on 2 November 2020, in which at least 22 people were killed and another 22 were wounded. The former Afghan security forces recovered two assault rifles used by the attackers and CAR field investigators documented the weapons in their custody on 1 December 2020.

Both recovered weapons were 7.62 × 39 mm AKS-47 Type 2 non-artisanal assault rifles produced in 1953 and 1954 by Izhmash, a factory based in what is now the Russian Federation (see Figures 16 and 17 - weapons 5 and 6 below). Each weapon appeared to be well maintained, with original internal working parts, although one rifle was fitted with a replacement top cover (see Table 2).

The presence of multiple matching internal components in weapons that are almost 70 years old and in active use in conflict is striking. By comparison, CAR investigators documented nine other AKS-47 rifles in Afghanistan with visible serial numbers. Analysis of the markings on the bolt carrier, bolt, top cover, and return spring guide on these nine weapons found that none retained all four of these original components; instead, bore marks suggested that they had been replaced at some point in their lifespan. Intermixing of parts in older weapons is the norm across CAR’s global weapon database.

There are subtle similarities in the apparent preparations undertaken for the two attacks analysed in this Frontline Perspective. The six weapons used stand out in several ways when compared to CAR’s larger data set of nearly 600 rifles that the ANDSF recovered from the Taliban, ISKP, criminals, and other armed groups in Afghanistan.

First, the combatants appear to have selected specific rifle models for each attack. By choosing three modified AKMs and an AKMS with side-folding buttstocks, and two AKS-4 models with standard factory-folding buttstocks, they ensured the weapons would be relatively easy to transport and conceal in an urban environment.

Second, the age of the selected weapons is significant for investigators. The rifles deployed in the Taliban attack on Counterpart International were 34–58 years old, while the ones used in the ISKP attack on Kabul University were nearly 7 years old. Due to their age, these weapons are nearly impossible to trace. While it is unlikely that such considerations played an overt role in the selection of these weapons for these two high profile attacks, the observation raises questions as to how these items may have been stored over time, and why their age was not considered a deterrence to selection.

Third, while it is not uncommon to find well-maintained weapons in illicit circulation, these weapons exhibit a higher degree of maintenance than many of those observed in the rest of CAR’s data set from Afghanistan. Their good condition may be attributable to exceptional care over several decades, but it could also be indicative of a short chain of custody or limited battlefield use, despite the weapons’ ages.

Fourth, all items were of Soviet-era design and manufacture, despite the prevalence in Afghanistan of other options, such as readily accessible artisanal weapons, or the  documented availability of US models . This finding indicates that groups carrying out such high-profile attacks in Afghanistan may opt for well-maintained Soviet-era weaponry that is both familiar and reliable.

Perhaps most notably, particularly given their advanced age, the weapons still featured nearly all their original working parts. These included bolts, bolt carriers, and return spring guides, as identified by the components’ markings, which matched the main serial numbers on the left side of their forward trunnions or receivers. Of all the main components of the rifles used in these two attacks, only one return spring guide and one top cover had been replaced.

Matching components are not necessary for the proper functioning of a rifle. CAR has observed a high degree of ‘cannibalisation’ of decades-old weaponry in Afghanistan and across many other countries, where worn or faulty components are swapped with replacement parts from weapons with different serial numbers. In contrast, the weapons used in the Kabul attacks were not subject to such widespread replacements, and they appear to have been well kept for decades, raising questions as to their provenance and storage prior to their use in these attacks.

It is unlikely that ISKP has established distinct and effective sources of supply in Kabul that are completely independent of those previously used by the Taliban. Based on a decade of investigations in various conflict theatres, CAR has found that supply lines to different non-state actors in any given theatre tend to be consolidated. While the assessment of the rifles used in the two Kabul attacks. does not speak directly to the associated sources of supply, it does show that, prior to the fall of the former Afghan government, the Taliban and ISKP employed comparable weapon selection and preparation tactics in opting for firearms with similar characteristics.

These similarities distinguish the six weapons used in the two high-profile attacks in Kabul from those in CAR’s larger Afghanistan data set, which covers more than 1,600 weapons documented between 2019 and 2021. In selecting these six rifles, the attackers appear to have shown a preference for familiar, reliable, Soviet-era weaponry, and specifically for ones that retain their original components decades after manufacture and remain in good condition.

The multifaceted security landscape in Afghanistan will likely continue to shift and develop. In a country where the Taliban have yet to consolidate control, ISKP and other terrorist groups in the region remain a threat, networks of logistical support between these groups may overlap, and decades of war have left a plethora of weapons in circulation, further investigations of illicit arms flows in and around Afghanistan will continue to be necessary.

For all media queries, please contact   media@conflictarm.com 

Ali, Obaid. 2016. ‘The 2016 Insurgency in the North: Raising the Daesh Flag (although Not for Long).’ Afghanistan Analysts Network. 15 July.

—. 2018. ‘Qari Hekmat’s Island Overrun: Taleban Defeat “ISKP” in Jawzjan.’ Afghanistan Analysts Network. 4 August.

Al Jazeera. 2019. ‘Afghanistan: Taliban Attacks Counterpart International in Kabul.’ 8 May.

—. 2021. ‘Afghanistan: Deadly Blasts, Gunfire Hit Kabul Military Hospital.’ 2 November.

Asey, Tamim. 2021. ‘New Worrying Trends Emerging in #AFG [tweet].’ Twitter. 24 October.

Beaumont, Peter. 2021. ‘Shia Mosque Bombing Kills Dozens in Afghan City of Kunduz.’ Guardian. 8 October.

Blue, Victor J., Thomas Gibbons-Neff, and Christina Goldbaum. 2021. ‘ISIS Poses a Growing Threat to New Taliban Government in Afghanistan.’ New York Times. 3 November.

C., Jimmy. 2009. ‘East German, Romanian, Polish Side Folding Stocks Comparison.’ AK Reference Library. 3 May.

CAR (Conflict Armament Research). 2021. ‘Taliban Seizures of US Equipment Are Only a Fraction of the Story.’ Frontline Perspective: Illicit Weapons in Afghanistan, Iss. 1.

Copp, Tara. 2017. ‘ISIS, Taliban Claim Attack on Kabul Airport Hours after Mattis Makes Surprise Visit.’ Military Times. 27 September.

Doxsee, Catrina, Jared Thompson, and Grace Hwang. 2021. ‘Examining Extremism: Islamic State Khorasan Province (ISKP).’ Center for Strategic and International Studies. 8 September.

Faiez, Rahim, and Kathy Gannon. 2020. ‘ IS Attack on Afghan University Leaves 22 Dead, 22 Wounded .’ 2 November.

Graham-Harrison, Emma, and Abdul Rauf Wafa. 2021. ‘ Shia Mosque Bombing in Afghanistan that Killed at Least 47 Claimed by ISKP. ’ Guardian. 15 October.

Iannamico, Frank. 2012. AK-47: The Grim Reaper II. Henderson, NV: Chipotle Publishing.

Mujahid, Zabihullah. 2019. ‘ #AlFath Attack on Counterpart International Network in #Kabul City Began with Tactical Blast 12pm Today, Destroying All Barriers & Allowing [tweet]. ’ Twitter. 8 May.

Osman, Borhan. 2016. ‘ The Islamic State in “Khorasan”: How It Began and Where It Stands Now in Nangarhar. ’ Afghanistan Analysts Network. 27 July.

Sarwary, Bilal. 2021. ‘ A Number of Former Members of ANDSF from Eastern Afghanistan Have Joined ISKP Recently, These Include at Least 3 Members [tweet] .’ Twitter. 27 October.

Trofimov, Yaroslav. 2021. ‘ Left Behind After U.S. Withdrawal, Some Former Afghan Spies and Soldiers Turn to Islamic State. ’ Wall Street Journal. 31 October.

—, Nancy A. Youssef, and Sune Engel Rasmussen. 2021. ‘ Kabul Airport Attack Kills 13 U.S. Service Members, at Least 90 Afghans. ’ Wall Street Journal. 27 August 2021.

UNSC (United Nations Security Council). 2021. ‘ Twenty-eighth Report of the Analytical Support and Sanctions Monitoring Team Submitted Pursuant to Resolution 2368 (2017) Concerning ISIL (Da’esh), Al-Qaida and Associated Individuals and Entities .’ S/2021/655 of 21 July.

Watkins, Andrew. 2020. ‘ Taliban Fragmentation: Fact, Fiction, and Future .’ United States Institute of Peace. 23 March.

[1] The most notable examples of Taliban action against ISKP sympathisers came from Jawzjan, Kunduz and Baghlan, and Zabul provinces. For Jawzjan province, see Ali (2018); for Kunduz and Baghlan provinces, see Ali (2016); and for Zabul province, see Osman (2016) and Blue, Gibbons-Neff, and Goldbaum (2021).

[2] See also Asey (2021) and Sarwary (2021).

[3] On 27 September 2017, for instance, both ISKP and the Taliban claimed responsibility for that day’s rocket attack on Kabul airport (Copp, 2017).

[4] On 5 November 2021, CAR submitted a trace request to the Permanent Mission of the Russian Federation to the United Nations regarding these items. At the time of writing, CAR had not received a response. Given the absence of a trace response, CAR cannot assess the legality of the transfer/s in question.

[5] On 24 September 2021, the Government of Romania responded to a formal trace request issued by CAR on 28 August 2021. This response confirms: 1) Uzina Mecanică Sadu S.A. manufactured the AKMS assault rifle bearing the serial number ‘1985 S-BD 1234’, the subject of CAR’s trace request, in 1985; and 2) taking into consideration that the rifle was manufactured and exported more than 30 years ago, the exporter could not provide details regarding the export of this item.

[6] This Frontline Perspective refers to countries of manufacture using present-day place names. For instance, ‘Russian Federation’ refers to the current territory of the Russian Federation both before and after the collapse of the Soviet Union.

[7] The Government of Romania uses the model designations AKM and AKMS and CAR also employs this terminology.  

[8] Although CAR field investigators make every effort to document each component of a rifle with its corresponding marks, photo-documentation can be limited by time restraints or dynamic conditions on the ground.

[9] See also Jimmy C, Gunboards.com (2009).

[10] Notably, International Security Assistance Force (ISAF) troops, the multinational Western-led military mission in Afghanistan in 2001–14, adopted this sling attachment early on in their campaign.