MAGNET – S2 INTELLIGENCE REPORT
Subject: Afghan-National Threat Incidents in the United States
Period: Late November – Early December 2025
251209-2024z
Cases Covered:
- Washington, D.C. National Guard Shooting
- Texas TikTok Bomb Threat
- Virginia ISIS-K Support Arrest
1. WASHINGTON, D.C. – NATIONAL GUARD AMBUSH SHOOTING
Incident Summary
- Date: 26 November 2025
- Location: 2 blocks from the White House, Washington, D.C.
- Suspect: Rahmanullah Lakanwal, 29, Afghan national
- Victims:
- Killed: SPC Sarah Beckstrom, 20 (West Virginia National Guard)
- Critically wounded: SPC Andrew Wolfe, 24
Key Facts
- Lakanwal arrived in the U.S. under Operation Allies Welcome (2021).
- Former member of a CIA-backed Afghan “Zero Unit / Strike Force”, trained in paramilitary operations.
- Drove across the country to D.C. and executed an ambush-style shooting using a .357-caliber revolver.
- Motive still undetermined — no manifesto, no public ideological claim, no confirmed ISIS/Taliban connection.
- Charged with:
- First-degree murder
- Assault with intent to kill
- Possession of a firearm during a violent crime
Assessment
- Lone-actor attack with military training.
- No verified ideological motive yet — may be grievance, psychological deterioration, or radicalization.
- Represents high threat potential because of paramilitary background.
2. TEXAS – TIKTOK / VIDEO BOMB THREAT
Incident Summary
- Date of arrest: 25 November 2025
- Location: Fort Worth, Texas
- Suspect: Mohammad Dawood Alokozay, Afghan male
Key Facts
- Posted a video call / TikTok video showing himself describing building a bomb in a vehicle.
- Stated he “came to America to kill Americans” and expressed support for the Taliban.
- No bomb was found, and no attack was executed.
- Arrested on:
- State terroristic-threat charges
- Federal charge: transmitting a threatening communication
- Identified using facial recognition after viral circulation of the video.
Assessment
- Ideologically aligned with Taliban, not ISIS-K.
- No evidence of material capability — threat was intent-based, not operational.
- Indicates extremist rhetoric but limited tactical ability.
- Still dangerous due to willingness to make public threats.
3. VIRGINIA – ISIS-K SUPPORT / NATIONAL SECURITY ARREST
Incident Summary
- Date of arrest: 3 December 2025
- Location: Waynesboro, Virginia
- Suspect: Jaan Shah Safi, ~48, Afghan national
Key Facts
- Entered the U.S. September 8, 2021, via Operation Allies Welcome.
- Former Deputy Director of Afghanistan’s NDS (National Directorate of Security) in Nangarhar — high-ranking intelligence position.
- DHS/ICE allege:
- He provided material support to ISIS-K, including weapons supplied to his father, a militia commander.
- He had prior connections to ISIS-K networks.
- Arrested by HSI as a national security threat after his TPS (Temporary Protected Status) expired under new policy changes.
- ISIS-K is a branch of the broader Islamic State (IS), sharing its extremist Salafi-jihadist ideology.
- Their goals include establishment of a strict Islamic “caliphate,” rejection of modern secular governments, and violent enforcement of a particular interpretation of Islamic law (Sharia).
- ISIS-K has carried out attacks in Afghanistan and surrounding regions; they target not only Western or coalition forces but also civilians, rival religious/ethnic groups, and Afghan government forces.
- Supporting ISIS-K thus suggests an alignment with radical militant Islamist ideology, militant jihadism, and willingness to support violent extremism
Assessment
- Most serious case in international ties, not domestic action.
- No evidence of a U.S.-based ISIS-K plot, but strong allegations of foreign support networks.
- Could represent deep-cover infiltration or vetting failure during evacuation.
COMPARATIVE THREAT ANALYSIS
| Case | Type of Threat | Ideology | Capability | U.S. Target | Link to Others |
|---|---|---|---|---|---|
| D.C. Shooter | Direct lethal attack | Unknown | High (military trained) | Yes | No proven link |
| Texas Bomb Threat | Communicated threat (non-executed) | Pro-Taliban | Low | Intended but no action | No link |
| Virginia ISIS-K Support | Foreign terror support / infiltration | ISIS-K aligned | Medium (weapons support overseas) | No active plot found | No operational link |
Key Point:
None of the three are connected operationally, but all entered via the same program (Operation Allies Welcome), which is driving political and security reassessment.
S2 ESTIMATED THREAT LEVELS
- D.C. Shooter:SEVERE
- Demonstrated lethal intent, military training, acted alone.
- Texas Bomb Threat:MODERATE
- Intent present, but no capability demonstrated.
- Virginia ISIS-K Case:HIGH (External), LOW (Domestic)
- Strongest foreign-terror alignment but no evidence of U.S.-based attack plans.
OVERALL S2 FINDINGS
- These 3 incidents occurred within ~7 days, amplifying national-security alarm.
- All individuals were Afghan evacuees (2021–2022), sparking debate over vetting.
- No cell, network, or coordinated plot has been publicly identified.
- These cases fall into three separate extremist categories:
- Unknown motive / lone attacker (D.C.)
- Taliban sympathizer (Texas)
- ISIS-K supporter (Virginia)
- Signals diverse radicalization paths, not a unified threat group.
CONCLUSION
These three incidents represent the most significant cluster of Afghan-national–related threats since the fall of Kabul. Although not connected, they collectively demonstrate:
- Vetting weaknesses in Operation Allies Welcome
- Multi-ideology radicalization (Taliban vs ISIS-K vs personal grievance)
- Heightened domestic threat from both lone actors and foreign-influenced individuals
What we can expect:
SOURCES: We can expect more arrests and investigations of Afghan evacuees as DHS and FBI re-screen thousands of 2021 arrivals, along with increased political pressure over vetting failures. Security around military personnel and government sites will tighten, and law enforcement will crack down harder on online threats after the Texas video case. Media and misinformation will surge, but there is still no evidence of any coordinated Afghan terror cell—these three incidents appear unrelated but will trigger heightened alerts, more monitoring, and potential additional ISIS-K–related foreign support arrests.
*NBC News (November 27, 2025): Initial reporting on the targeted ambush, Lakanwal’s identification, and his 2021 entry under Operation Allies Welcome.https://www.nbcnews.com/news/us-news/what-to-know-dc-national-guard-shooting-rahmanullah-lakanwal-rcna246154
*Covers formal charges, witness accounts of the shout, and Lakanwal’s remote court appearance from the hospital. Confirms victims and his Operation Allies Welcome entry in 2021.https://abcnews.go.com/US/suspect-dc-shooting-2-national-guard-members-formally/story?id=128047008
*Arrest details, TikTok specifics, and DHS statement on Fort Worth target; links to D.C. shooting timing.https://abcnews.go.com/US/afghan-national-arrested-alleged-bomb-threat-texas-dhs/story?id=127969689
*Details weapons to father, TPS termination, and Operation Allies Welcome entry; frames as “illegal alien terrorist.”https://www.dhs.gov/news/2025/12/03/miles-nations-capital-ice-arrests-isis-k-afghan-terrorist-who-was-released-us-under
Comments are closed