Russian intel accused of funding Afghan terrorist groups to target U.S., coalition forces

The Insider reported on the issue.

After an eighteen-month investigation, the Insider and its partners have uncovered new evidence suggesting that Russia’s military intelligence service, the GRU, paid tens of millions of dollars to the Taliban in Afghanistan to target American, coalition, and Afghan military forces.

According to Douglas London, the CIA’s chief for counterterrorism in south and southwest Asia from 2016 to 2018, “The Russians wanted the Taliban to spend more time killing Americans and less time killing Afghans. They relied on financial awards from Russian funding to encourage fighters to incur greater risks in attacking the U.S. rather than Afghan targets. Russia’s intent with the Taliban evolved from minimal assistance and cooperation to proactively bleeding the United States.”

Based on the data the Insider has analyzed, Unit 29155 began recruiting operatives in 2015, using them as couriers and liaisons with the Taliban. Many were resettled in Russia, while others live as refugees in Europe and Asia, maintaining contact with handlers.

The program paid $200,000 for each killed American or coalition soldier, with smaller sums for Afghan casualties. Russia is estimated to have paid the Taliban about $30 million, a small fraction of the CIA's $3-4 billion spent on Operation Cyclone.

The Biden administration acknowledged the GRU-Taliban program in an April 2021 White House fact sheet but took no formal action, choosing to address the issue through diplomatic, military, and intelligence channels instead.

“Why would the Russians do this to us?,” a former CIA officer and veteran Russia hand asked. “Because Russia's at war with the United States. They firmly believe they’re at war with us. And we’re naive.”

Moscow rules

According to the outlet, this operation was overseen by Lt. Gen. Ivan Kasianenko, a senior GRU officer with diplomatic cover, while Col. Alexey Arkhipov served as the main GRU liaison with the Taliban. Despite attempts by Afghan intelligence (NDS) to investigate, the operation was complicated by internal corruption and U.S. ambiguity, halting any significant action until the U.S. withdrawal from Afghanistan in 2021.

Russia’s destabilizing efforts in Afghanistan began in 2001, leveraging ties with Iran and the Taliban to counter U.S. presence and influence in the region. These actions included the smuggling of weapons into Afghanistan from neighboring Tajikistan and providing military aid to Taliban commanders. General John Nicholson, the former commander of U.S. forces in Afghanistan, attributed these actions to Russia's support for the Taliban, a tactic used to counter U.S. efforts while inflating the threat of ISIS. Despite reports, U.S. officials, including former Deputy National Security Adviser Charles Kupperman, were hesitant to openly blame Russia due to political sensitivities during the Trump administration.

The GRU's involvement in Afghanistan is part of a broader strategy of destabilizing efforts, such as assassination attempts and sabotage, which have been carried out by its Unit 29155. This unit, responsible for a series of high-profile attacks and poisonings, also played a key role in this covert campaign against U.S. forces. By 2022, the unit was absorbed into a new organization called the Department for Special Activities, which continues to engage in clandestine operations linked to Russia's broader geopolitical ambitions.

Uncut gems

In mid-2019, Afghan intelligence (NDS) uncovered a GRU-led scheme paying the Taliban to attack U.S. and coalition forces. The network utilized couriers and Afghanistan's hawala system to transfer funds from Russia via Tajikistan, China, and Pakistan. A series of NDS raids seized $650,000 from Rahmatullah Azizi's home in Kabul, although he had already fled to Russia. Azizi, a former smuggler turned GRU asset, oversaw the courier network, operating under multiple identities, including "Rakhim Akhmadov." The GRU's program employed firewalls to obscure its operatives' connections, and detainees' accounts revealed the Taliban used these funds for targeted attacks.

Azizi was a key figure in the GRU operation, elevated to near-officer status due to his strategic importance. Operating under the guise of gemstone trading, he managed ARIGS Ltd., a Russian company linked to GRU activities, and a similar entity in Kabul. These businesses provided a plausible cover for laundering funds tied to the bounty program. His integration into GRU networks extended to shared travel with operatives, including Ivan Senin and Alexander Kovalchuk, further confirming his pivotal role. The program's operations were entwined with Russia's broader geopolitical strategy, targeting U.S. military presence and leveraging Afghanistan's mineral wealth.

The GRU's use of gem-trading as a financial cover and its integration with Unit 29155 highlight its sophisticated approach to proxy warfare. ARIGS Ltd. was registered near GRU facilities in Moscow, and associates like "Artem Rubin" further linked the operation to diamond evaluation courses and Afghan recruits. Azizi openly displayed loyalty to Russia, with his social media accounts featuring images of Vladimir Putin. By 2022, ARIGS was liquidated, but the GRU’s activities underscored its commitment to undermining U.S. influence in Central Asia while exploiting Afghanistan's resources and local networks.

The GRU's Afgantsy

Rahmatullah Azizi’s recruitment aligns with U.S. intelligence reports of a growing Russian-Taliban relationship aimed at driving out American forces from Afghanistan. Moscow's strategic pivot in the mid-2010s saw the GRU incentivizing Taliban attacks against U.S. troops through cash payments. This shift coincided with Russia's frustration over losing influence in Ukraine following the 2014 Revolution of Dignity, which Moscow blamed on U.S. interference. In retaliation, Russia expanded its asymmetric warfare tactics, targeting U.S. operations in Afghanistan to undermine Washington’s influence in Central Asia. This approach leveraged the GRU’s historical familiarity with Afghanistan, a region central to Soviet-era interventions, including the covert operations of the 1920s and the infamous 1979 invasion.

The GRU’s legacy in Afghanistan extends from early Soviet espionage to its modern proxy warfare. Its operatives, including figures like Viktor Bout, maintained cooperative networks with local actors despite shifting alliances. Gen. Andrey Averyanov, a senior GRU official with roots in Central Asia, exemplifies this continuity, applying his expertise in covert operations to destabilize NATO forces and exploit Afghanistan’s strategic significance. This history underscores Russia’s enduring reliance on Afghanistan as a theater for countering Western influence, shaped by lessons from past Soviet interventions and adapted to modern geopolitical conflicts.

The attacks

Between 2017 and 2019, Rahmatullah Azizi made at least 13 trips from Russia to Afghanistan and nearby regions, coordinating attacks funded by the GRU’s payments program. These included high-profile incidents like the 2019 Camp Shorab infiltration, which killed 23 Afghan soldiers, and earlier attacks targeting NATO personnel and U.S. Marines. Local collaborators like Haji Mohammed Ayoub brokered deals between Azizi and the Taliban leadership, with operations funded by substantial GRU cash transfers, reportedly in the hundreds of thousands of dollars.

The GRU also operated other networks, including one led by Par Han Gul Zafar, who recruited Afghan couriers and coordinated payments from Moscow. Evidence from leaked documents and photos shows these cells, including the Azizi family, facilitated U.S. dollar payments to finance Taliban attacks on American forces. These covert operations highlight the GRU’s strategy of using local operatives to wage asymmetric warfare in Afghanistan, with a clear focus on targeting U.S. personnel.

The handlers

Former NDS officials revealed that initial contact between the GRU and the Taliban was brokered through Iran, evolving into a direct relationship. Lt. Gen. Ivan Kasianenko, a senior Unit 29155 member and deputy commander of the Department of Special Tasks, exemplifies this connection. Kasianenko served as Russia’s military attaché in Tehran before being reassigned to Kabul, frequently traveling between Moscow, Kabul, and Karaganda. Another key figure, Col. Alexey Arkhipov, managed the Azizi courier network and remained involved in GRU operations in Afghanistan, organizing Taliban visits to Moscow and liaising with its leadership. He helped facilitate conferences involving Taliban hardliners and Afghan politicians, bypassing U.S.-backed officials, and maintained a clandestine backchannel with the Taliban, now viewed by Russia as an ally in counterterrorism efforts against ISIS-K.

Leaked emails and memos reveal Taliban requests for GRU assistance, including the return of aircraft, training for security forces, and support in securing territory. Arkhipov's role was highlighted in the documentary Hollywoodgate, where he was seen attending a military parade marking the Taliban's return to power. The film also captured a Taliban commander discussing plans to seize Tajik territory with Russian help, pending the resolution of Russia’s war in Ukraine. Arkhipov’s communications confirm that the Kremlin is considering Taliban requests related to Tajikistan, potentially aligning with the Islamist regime to counter opposition forces based there.

Air India

After the U.S. withdrawal from Afghanistan, the GRU relocated many of its Afghan agents to Russia, including the Azizi family, who arrived in Moscow in late 2021 using new Russian identities. Wahidulla Azizi’s passport was issued by the Russian consulate in Istanbul, facilitating his entry. However, Moscow was not the final destination for most Afghan operatives. In May 2022, following Russia’s invasion of Ukraine, senior GRU and FSB officers, including Unit 29155’s former commander Averyanov and Arkhipov under the alias “Alexey Sorokin,” visited Delhi with FSB’s Fifth Service officers. Although the purpose of the trip remains unknown, shortly afterward, several Afghan couriers tied to the GRU began traveling to Delhi, with some settling there under Russian identities, including Rahmatullah Azizi and his family, despite their previous hostility toward India.

Other GRU-linked Afghans moved to Western Europe under the pretense of seeking asylum from the Taliban. Investigations revealed some had previously visited Russia on GRU-facilitated trips, with two asylum seekers now residing in Germany. German authorities denied entry to others connected to the payments program. Meanwhile, Hasibullah Azizi remains in Moscow under the identity “Hasib Ahmadov,” actively working with Unit 29155 on undisclosed missions. Attempts to access his employment details were blocked, with sources indicating he is linked to Russia’s Presidential Administration.