How the GRU used the Taliban to bleed U.S. forces in Afghanistan

My investigation with Christo Grozev and Roman Dobrokhotov on how the GRU, Russia’s military intelligence agency, spent years financing terrorist groups in Afghanistan to target U.S. forces.

The GRU, Russia’s military intelligence agency, spent years financing terrorist groups in Afghanistan to target U.S. and coalition forces. An investigation by The Insider has not only confirmed the existence of the program but also identified GRU officers responsible for its coordination. The Russian intelligence agency used a gemstone trading company as a front to run a network of Afghan couriers who delivered money to Taliban fighters and other militant groups. Once their missions were completed, the couriers were provided with Russian documents and granted asylum in Russia.

Der Spiegel contributed to this investigation.

Sam heard the explosion at Bagram Airbase at around five or six o’clock in the morning. Right away he knew this wasn’t the usual round of mortar or rocket attack. “I can't remember if the sirens went off at that point, but everyone was getting their kit on, grabbing a weapon.” An American Army officer stationed at the largest U.S. military installation in occupied Afghanistan, Sam (not his real name) recalls hearing Bagram’s first responders rushing to the scene of the blast. A big delivery truck jerry-rigged with thousands of pounds of explosives had just crashed into a wall which encircled an abandoned and unguarded Korean-built hospital outside of the main gate of Bagram, leaving a crater fifteen feet in diameter. It was December 11, 2019.

Then a second truck offloaded a squad of machine gun-wielding insurgents, some in suicide vests. They barricaded themselves inside the hospital, baiting Bagram’s defenders to try and clear a building that was now a dynamic booby trap. Instead, the hospital was cordoned off, and a company-sized element of multinational soldiers, including those from the U.S.-trained Afghan National Security Forces, fired into it. They were supported by helicopter gunships. The main battle was over by noon, but the attack didn’t culminate until two F-16s dropped “at least” two 500-pound bombs on the building. “We bombed our own base,” Sam said. “At least one suicide attacker survived badly concussed and tried to flee on foot. He was taken out by a sniper.”

Four U.S. personnel were injured. The impact of the vehicle-borne improvised explosive device shattered houses in the neighboring area, killing two Afghan civilians and injuring 80 more civilians. “It could have gone very differently had the VBIED hit close by,” Sam recalled. “That could have created an opening into the special operations side of the base. The carnage would have been much greater had they opted not to hole up in the hospital.”

Security forces stand watch near the scene of an attack close to Bagram Airbase in Parwan province, Kabul, Afghanistan, on Wednesday, Dec. 11, 2019.

Photo: Rahmat Gul / AP

That December 2019 attack, along with several others, was carried out by militants of the once and future Islamist government of Afghanistan, but it was financed by a foreign spy agency. After an eighteen-month investigation, The Insider and its partners have uncovered new evidence suggesting that Russia’s military intelligence service, the GRU, paid tens of millions of dollars to the Taliban in Afghanistan to target American, coalition, and Afghan military forces. GRU Unit 29155, the near-ubiquitous black ops team behind a series of bombings and poisonings in NATO countries, was behind this operation as well. The existence of the plot was first disclosed by U.S. intelligence and reported on by The New York Times a year before the U.S. withdrew from Afghanistan. At the time, it was couched as a “bounties” program.

According to Douglas London, the CIA’s chief for counterterrorism in south and southwest Asia from 2016 to 2018, “The Russians wanted the Taliban to spend more time killing Americans and less time killing Afghans. They relied on financial awards from Russian funding to encourage fighters to incur the greater risks in attacking the U.S. rather than Afghan targets. Russia’s intent with the Taliban evolved from minimal assistance and cooperation to proactively bleeding the United States.”

According to former Afghan and American intelligence officials, the GRU-Taliban program involved, at first, the recruitment of indigenous Afghan assets. Then it graduated to weapons and ammunition flows to the Taliban via neighboring Tajikistan, where Russia maintains its largest extraterritorial garrison. Finally, it led to money transfers to incentivize insurgent attacks on the occupying army. The former NDS officials said their investigation had linked at least 17 attacks by the Taliban with financial incentives coming from Russia “via a sophisticated money-moving network involving front companies and couriers in Tajikistan, China, and Pakistan.”

The operation kicked into high-gear around 2016, the year Donald Trump was elected president. In August 2017, the new administration adopted a South Asia policy meant to put pressure on the Taliban, but opted a year later to negotiate an end to America’s longest war. Those negotiations formed the lineaments of the Doha Agreement, which mandated “a timeline for the withdrawal of all U.S. and Coalition forces from Afghanistan.” The Trump administration began that withdrawal, and the Biden administration completed it on August 30, 2021 — amid chaotic airlifts out of Hamid Karzai International Airport in Kabul, the dissolution of the U.S.-backed Afghan government of Ashraf Ghani, a suicide bombing that killed 13 American servicemen and 170 Afghan civilians, and a lightning takeover of the entire country by the Taliban.

Based on the data The Insider has analyzed, it is clear Unit 29155 was recruiting assets used in the scheme starting from at least 2015. Dozens of them were deployed as couriers, money-movers, and liaisons with the Taliban before being resettled in Russia. Others now live as refugees in Western Europe and Asia, and at least some of them appear to maintain contact with their handlers. Meanwhile, the GRU spy at the helm of this operation remains a critical backchannel interlocutor with the new Afghan government, negotiating ongoing intelligence and military cooperation between Moscow and Kabul.

Relying on telecoms metadata, travel and border crossing logs, and leaked correspondence, The Insider found that Unit 29155 recruited at least three different networks of Afghan nationals to serve as intermediaries between the GRU and illegal armed groups operating in Afghanistan, primarily the Taliban. The most prolific network, operating in northern Afghanistan from a base in Kunduz, was headed by Rahmatullah Azizi, a longtime smuggler whose recruits included his own family members. They acted as couriers between Unit 29155 and the Taliban.

An avowed fan of Russian President Vladimir Putin, Azizi was primarily based in Russia as of 2015, but he traveled constantly to Afghanistan and other countries in the region. He was also issued three Russian passports under different names, one of them printed in the same numerical sequence as the two Unit 29155 operatives responsible for poisoning Sergei and Yulia Skirpal in Salisbury in 2018 with the military-grade nerve agent Novichok. Azizi created a front company as a money laundering vehicle for paying Taliban fighters — a gem-trading entity registered at a Moscow address connected with GRU headquarters.

The Insider spoke with four former Afghan officials, three of whom worked in senior positions within the National Directorate of Security (NDS), the country’s top intelligence agency, which was created with the help of the CIA after the U.S. invasion and occupation of Afghanistan in 2001. All were familiar with the GRU program and had knowledge of which attacks on U.S. forces were linked to Russian intelligence; their conclusions were based on evidence obtained from thirteen Afghan members of the network, who were detained by the NDS for a year-and-a-half. The Insider was able to substantiate several key details provided by the four sources based on data from leaked email accounts belonging to three Unit 29155 operatives. The investigation was able to reconstruct the travel patterns of Afghan couriers, comparing them with the timing of known Taliban attacks on U.S. and coalition forces. The network mapped by The Insider — which includes both the GRU handlers responsible for the program and their Afghan agents — appears to contain information previously unknown to the NDS and its U.S. intelligence partners.

The program, as per the ex-NDS sources, averaged $200,000 per killed American or coalition soldier, with the payment being disbursed to the network responsible. There were smaller allowances for killed Afghan troops and security officers. One former NDS official estimated that Russia paid a total of approximately $30 million to the Taliban via the scheme, a fraction of the $3 to $4 billion the CIA spent on Operation Cyclone, the covert program to fund, arm, and train the mujahideen to drive the Soviet Army out of Afghanistan in the 1980s. “I think $30 million was a small amount to give the United States a bloody nose,” one former NDS officer said. Another ex-NDS source claimed that at least that much had also been spent on funding other armed groups opposing the U.S.-supported Afghan government, a claim partly corroborated by data showing close contacts between the GRU spymasters and members of Afghan resistance movements dating back to 2014.

The Insider interviewed six former CIA officers involved in analyzing the intelligence on the GRU’s operations in Afghanistan. All except London requested anonymity as a condition for commenting, but all maintained that The Insider’s findings complement and amplify what has been the conventional wisdom of the U.S. intelligence community over the past four years — a conventional wisdom that has often been undermined or occluded by politicized agendas. “There are many instances when we got punched in the face and were told to do nothing about it for fear of escalation,” one former CIA officer said. “This was one.”

“There were multiple services and multiple disciplines of information, and the evidence of this program was all right there,” another U.S. intelligence official, who was intimately involved in analyzing the program at the interagency level, told The Insider. “It was just lacking in hard nouns and personae, which have now been uncovered.” The reluctance to unambiguously accuse Russia of suborning an extremist adversary to kill U.S. servicemen, that former official added, “wasn’t because of a lack of information — it was a lack of priority, maybe even fortitude.”

Information about the GRU-Taliban program was included in Trump’s Presidential Daily Brief on February 27, 2020. During an NBC-hosted presidential debate in October of that year, then-candidate Joe Biden said, “I don't understand why this president is unwilling to take on Putin when he's actually paying bounties to kill American soldiers in Afghanistan.” The Biden administration later alluded to the “reported” program in a White House fact sheet published in April 2021, but it took no formal action against Russia, such as implementing sanctions. “Given the sensitivity of this matter, which involves the safety and well-being of our forces,” the fact sheet stated, “it is being handled through diplomatic, military and intelligence channels.”

Ten months later, Russia invaded Ukraine.

“Why would the Russians do this to us?,” a former CIA officer and veteran Russia hand asked. “Because Russia's at war with the United States. They firmly believe they’re at war with us. And we’re naive.”

Moscow rules

The NDS was never able to establish the identity of the GRU point-men for the bounties scheme, nor was it convinced that a single operative was involved. It was correct about the latter assumption.

The head of the program, The Insider can reveal, was Lt. Gen. Ivan Kasianenko, a deputy commander of Unit 29155 who has worked under diplomatic cover as a military attaché in the Russian embassies in Tehran and Kabul. The main GRU liaison with the Taliban, Col. Alexey Arkhipov, continues to negotiate with the Taliban, which Vladimir Putin has called the “de facto government” of Afghanistan. The Kremlin is on the cusp of lifting its terrorism designation and sanctions regime against the group.

Passport photos of Maj. Gen. Ivan Kasianenko, left. Col. Alexey Arkhipov, right.

One former NDS official said its investigation into the GRU program, which had led to arrests of a dozen members of the Azizi network, was hampered by the Afghan government for undisclosed reasons, “possibly due to corruption and other Russia-aligned interests.” Moreover, U.S. ambiguity as to the existence and nature of the program dissuaded the NDS from dedicating more counterintelligence resources to chasing it up. All that became moot when the last American soldiers boarded their C-17 cargo planes home in late August 2021. The Taliban swept back to power, and the NDS ceased to exist. Previously detained members of the GRU-run network were released, and many were exfiltrated to Russia and given new identities.

Russian attempts to recruit assets within the Taliban — and to generally destabilize the U.S. nation-building project — began almost immediately after the establishment of the Afghan Interim Administration in December 2001. Initially, the Russians sought accomplices among the preexisting networks in the local security and military apparatus established during the Soviet occupation of Afghanistan. These lost much of their utility after American-led reforms and lustration at the Afghan Defense and Security Forces (ANDSF). That’s when Russia turned to Iran for help, according to the former NDS officials. The Islamic Revolutionary Guards Corps (IRGC) acted as go-between for Moscow and the Taliban commanders, funneling Russian weapons and money to them. Subsequently, the GRU established direct contacts with the Pashtun insurgency.

The contours of this three-way relationship were limned by Gen. John Nicholson, the commander of U.S. forces in Afghanistan, in a BBC interview in March 2018. Nicholson alleged that Russian weapons smuggled into Afghanistan from neighboring Tajikistan were finding their way into Taliban hands. He further accused Russia of inflating the number of Islamic State jihadists in Afghanistan in order to “legitimize the actions of the Taliban and provide some degree of support to the Taliban.” In December 2016, Nicholson stated that both Russia and Iran had established ties to the deposed Islamist government.

In mid-August 2020, the Trump administration leaked intelligence to CNN suggesting that a foreign government was responsible for paying bounties to Taliban fighters linked to the Haqqani Network, an autonomous outcropping of the Taliban led by Afghan warlord Siraj Haqqani, the son of an anti-Soviet guerrilla once supported by the CIA. The U.S. “identified payments linked to at least six attacks carried out by the militant group just last year alone,” including the December 2019 assault on Bagram. Though the foreign government in question remained classified, two U.S. sources told CNN it was not Russia but Iran that had paid for this operation. Tehran’s alleged subvention was cited as one reason Trump decided to assassinate Gen. Qassem Soleimani, the head of the IRGC’s expeditionary arm, the Quds Force, in a missile strike near Baghdad International Airport in January 2020.

The Quds Force under Soleimani’s command financed and oversaw a long-running campaign of pro-Iranian militia attacks on U.S. forces in Iraq, which the Pentagon estimated killed more than 600 American servicemen.

According to Charles Kupperman, a deputy national security adviser during Trump’s first term, “the issue of bounties [in Afghanistan] is foggy concerning the Russian-Iranian relationship.” He added that there was an unwritten rule in the Trump White House not to attribute malign activity to Russia so as to avoid antagonizing the president, who was outspoken in his praise for his Russian counterpart.

“Everyone had a pretty good suspicion that there were Iranian and Russian plots to kill our forces in Afghanistan,” Kupperman told The Insider. “But it was always going to be easier to publicly pin the blame on Iran because of Trump’s reluctance to take a hard line with Putin. And our intelligence community didn’t want to face the perennial question of, ‘Okay, the Russians are hurting us, so what are we going to do about it?’”

Douglas London said that during his time at CIA he saw the Iranians “hedging their bets. They have no love for the Taliban, but as they saw the Taliban doing better, particularly out west where the Iranians have interests and access, Tehran started to reach out more to the Taliban. They provided military aid. They were dealing with individual Taliban commanders who were more proximate to them.”

The route Nicholson described, which saw Russian materiel pour into Afghanistan from Tajikistan, was hardly a coincidence.

Unit 29155 maintains a forward operating presence at Russia’s 201st Military Base in Dushanbe. When Biden met with Putin at their summit in Geneva in June 2021, Putin trolled the American president by teasingly offering to allow U.S. counterterrorism forces to be hosted at the 201st after the American pullout from Afghanistan, according to former U.S. Ambassador to Russia, John J. Sullivan. “As Putin chuckled, General Gerasimov’s eyes widened,” Sullivan wrote in his recent memoir, Midnight in Moscow, referring to Russia’s Chief of the General Staff. “This clearly was an unscripted moment and an apparent effort at humor by Putin, because it was so utterly improbable, and indeed there was never any follow-up.”

The former NDS officials said that there had been consensus in the country’s security circles about Russia’s destabilizing role in supporting the Taliban against the ANDSF and coalition forces. That consensus was apparently shared by the CIA’s expansive Kabul Station. The tricky part was predicting where pure espionage and influence operations ended and covert action began.

Between June and August of 2020, the New York Times ran a series of stories about the GRU paying the Taliban to kill American troops. Based on interrogations of Taliban detainees and electronic intercepts showing “large financial transfers from a bank account controlled” by the GRU to one linked to the Taliban, U.S. intelligence attributed the program to Unit 29155. That in itself was a big clue as to the purpose of these transactions, as the Russian black ops unit engages exclusively in kinetic operations: assassinations, coups, sabotage, and cyberattacks. Unit 29155’s recruitment of foreign assets, such as a family of “illegals” in the Czech Republic or a group of paramilitaries in Montenegro, is done in pursuit of those activities.

The Insider has spent over a decade anatomizing and unmasking members of this special operations team, finding it responsible for multiple poisoning — of the Skripals, of a Bulgarian arms dealer, and of the arms dealer’s son and factory manager — and also of carrying out an abortive insurrection in Montenegro, along with bombings of ammunition depots and arms storage facilities across Bulgaria and Czechia. Earlier this month the European Union issued sanctions against Unit 29155 as a whole and against its commander, Andrey Averyanov, individually.

In late 2022, Unit 29155 was subsumed, along with two other sub-units dedicated to the GRU’s bespoke form of clandestine warfare, under the umbrella of a new organization. Its name is the Department for Special Activities, an apparent homage to a notorious Soviet-era KGB Department for Special Tasks, which was in charge of, among other things, the murder of Ukrainian nationalists in Europe and of Leon Trotsky in Mexico.

Uncut gems

The NDS uncovered the GRU-Taliban program in mid-2019 during interrogations of detainees. Afghan officials, the Times noted, had arrested suspected middlemen involved in the payments program — they were using the Afghan hawala system of informal money transfers to move the Russian cash to its intended recipients. “The money had been initially transferred to Tajikistan, China, and Pakistan, and then to Afghanistan,” one of the former NDS officials said.

Afghan intelligence launched a series of raids in 2019 in Kabul and northern Afghanistan, seizing “about $650,000” in the home of Rahmatullah Azizi, who had already escaped back to his base in Russia. Three former NDS officials told The Insider that all of the detained suspects hailed from the Afghan provinces of Kabul, Logar, or Kunduz. Their role had been that of couriers working on behalf of the GRU, which set up various firewalls to prevent the collapse or disclosure of the whole program in the event that one or several members were ever captured.

The U.S. intelligence community was not divided as to the fact that the GRU was sending money to the Taliban, nor on the topic of what NDS detainees were claiming in custody. Instead, the debate regarded the purpose of this operation. The CIA and the National Counterterrorism Center shared a “moderate” confidence that it constituted a fee-for-murder arrangement, “moderate” being a term of art used in the intelligence community indicating that “information is credible and plausible but not corroborated sufficiently to justify a higher level of confidence,” according to the Director of National Intelligence. The National Security Agency, which deals in signals intelligence, had “low” confidence, suggesting information is “scant, questionable, or very fragmented, so it is difficult to make solid analytic inferences.”

“There was no debate on what Russia was providing or that the Taliban used it in attacks against the U.S.,” Douglas London told The Insider. Part of the problem, as he saw it, was the sensationalism and inexactitude of the “bounties” allegation, which sounded like a plotline out of High Noon. The word the intelligence community preferred was “payments,” according to London, who affirmed the existence of the program — and Trump’s awareness of it — in a New York Times op-ed that ran in July 2020 after being cleared by the CIA’s Prepublication Classification Review Board. Another issue within the intelligence community was the veracity of what Taliban detainees told the NDS under interrogation, even if their statements broadly conformed to what U.S. signals intelligence had collected on GRU payments.

In a series of interviews with The Insider, London characterized what the GRU was doing as a “strategic incentives program” aimed at refocusing the Taliban’s guerrilla terrorism against Americans. The overriding objective, he said, was to erase the United States’ military and intelligence footprints in Central Asia, a region Russia considers to be within its own sphere of influence. This meant driving U.S. and NATO troops out of Afghanistan. The program developed gradually, but ultimately expanded into proxy warfare as Putin became increasingly hostile to Washington over the last decade.

In 2009, the Obama administration got Putin to agree, in principle, to allow the Pentagon to transit troops and weapons to Afghanistan using Russian airspace and rail systems. But the policy was only fitfully implemented. In 2014, as a winter protest movement in Ukraine gave way to Russia’s seizure of Crimea and its sponsorship of a dirty war in Donbas, the Kremlin pressured Kyrgyzstan to vacate the Manas Transit Center, a critical logistics hub that the U.S. Air Force had used to service operations in Afghanistan since 2001.

The NDS was able to identify the courier network’s ringleader, the aforementioned former Kunduz-based smuggler Rahmatullah Azizi, who is cited fleetingly in one of the New York Times articles on the GRU payments program. Azizi had been running a company in Afghanistan, registered in his father’s name, that specialized in the trading of precious and semiprecious gemstones. The NDS suspected that at least part of the GRU’s money was being smuggled into the country in gems in order to lend it a commercial veneer of plausible deniability. Afghanistan is home to as much as $1 trillion worth of mineral deposits, according to the U.S. government, and lately the Taliban has begun to ramp up foreign direct investment, including from Russia, in mining rights.

Rahmatullah Azizi in a photo from a now defunct social media account, archived by the NDS. According to one ex-NDS official, the account professed support for Islamic radicalism and hatred for the U.S., Israel and India.

Other members of Azizi’s family were caught up in the NDS dragnet at the time, but not ringleader Rahmatullah, who escaped to Russia before the operation started to come apart.

Born in 1978 in Kabul before growing up in Kunduz, Azizi has lived part-time in Moscow since 2015. The earliest recorded presence of him in Russia can be linked to the issuance date of his first cover documents. On November 26, 2015, he obtained a Russian domestic passport and a driver’s license under the name “Rakhim Akhmadov,” who was listed as having been born in 1977 in the Russian city of Astrakhan.

The Azizi family from left to right: Rahmatulla, Wahidullah, Hasibulla, Ab Mutalib, and Hedaytullah

Almost immediately upon arriving in Moscow, Azizi started traveling regularly to Afghanistan and Dubai, where one of his brothers involved with the GRU program was based. He made these trips both under his real name and as “Rakhim Akhmadov.” The domestic passport issued under this false identity was numbered 4515077714, different only in the last two digits from the passport number issued to “Ruslan Boshirov,” the cover name of Col. Anatoly Chepiga, one of the Unit 29155 poisoners of Sergey and Yulia Skripal. (Chepiga’s passport is numbered 4510777736.). Similarly, Azizi’s international travel passport was numbered 654341494, differing only in the last two digits from those of several members of Unit 29155 — and also from the special passports issued to the daughter and grandchildren of Sergei Shoigu, Russia’s former minister of defense.

Azizi was so highly valued by the GRU that he was not treated as a low-level agent might have been, but was given the same stature as a full-fledged officer. He has traveled on joint airline bookings with other assets recruited by Unit 29155, such as Zafar Par Gul, another Afghan courier, and with senior operatives of the unit including Ivan Senin, a GRU case officer, and Alexander Kovalchuk, the deputy head of the Afghan payments program.

Using his “Akhmadov” identity, Azizi incorporated a Russian company, ARIGS Ltd., in September 2017. (The entity’s name is presented on its Facebook page with a space in between the letters, as AR IGS, and was presumably formed from the initials of Azizi’s fake identity, plus IGS.) Its declared purpose was trading in diamonds and other precious stones. According to one ex-NDS official, Azizi’s father, Enayatullah, registered a similarly-themed company in Kabul at around the same time. The NDS surmised that gem-trading between Russia and Afghanistan was one of the methods used for funneling funds connected to the bounty program. According to data from the Russian trade registry, ARIGS ceased its activity in 2020 and was liquidated in 2022.

Azizi is hardly shy about demonstrating fealty to his adoptive motherland.

On one of his active Facebook pages, where Azizi refers to himself as “Ar Igs,” the profile picture is a photo of Vladimir Putin. The page indicates November 17, 2017 as the start date for Azizi’s job at ARIGS, Ltd. On one of his other Facebook accounts discovered by The Insider, his profile page was changed in June 2016 to feature a big picture of Putin. Underneath it, Azizi commented: “In the hope that one day we will also have the same president.”

More intriguing is the fact that ARIGS, Ltd. was incorporated at the address Narodnogo Opolcheniya 34, directly next door to a GRU corporate apartment building and just down the street from the GRU Academy.

A photo of Rahmatullah Azizi, left, with his brother Hedayatullah Azizi, right, in a restaurant in Moscow across the river from The Russian Defense Ministry, which oversees the GRU. The photo was retrieved from Azizi’s Facebook page in 2019.

Adding ballast to the hypothesis that gem-trading was the money-laundering mechanism for the bounty program is the presence of yet another Unit 29155 member in Azizi’s orbit. In 2018, a certain Artem Rubin signed up for a course dedicated to “the evaluation of rough diamonds” at the Moscow State University’s gemology institute.

Artem (“Rubin”) Rubtsov from Unit 29155, wearing a gray shirt in the front row.

“Rubin” is the Russian word for ruby, and the surname was yet another cover identity, this one belonging to Artem Rubtsov, a Unit 29155 member who listed ARIGS as his employer when signing up for the university course. “Artem Rubin” flew to Kabul on joint bookings with several members of Russia’s network of Afghan recruits, including in 2017 with Ata Mohamad Amiri, the GRU’s liaison with the resistance movement in the Panjshir region of Afghanistan.

Images of cut emeralds and uncut rubies, retrieved from the Facebook pages of ARIGS.

Image of giant uncut emerald from the Panjshir valley, retrieved from the leaked mailbox of Unit 29155 operative Alexey Arkhipov.

The GRU's Afgantsy

The timing of Azizi’s recruitment tracks with what U.S. intelligence was collecting on a burgeoning Russian-Taliban relationship that was beginning to turn kinetic, London told The Insider. “The Russians wanted us gone, as Afghanistan was too close to Russia — too close to their area of operations in Central Asia. So they were playing on both benches. They were still working with the NDS and talking to the Afghan government, and they were talking to the Taliban. But from the teens onward, and certainly during my time, they decided, ‘Okay, we’re really going to lean towards the Taliban. Then they started using cash to incentivize the Taliban to offer bonuses for their folks to go after Americans.”

The timing of the network’s creation may also speak to another motive in the Kremlin’s decision to wage a proxy war against its main adversary. The 2014 Revolution of Dignity in Kyiv all but ended Russia’s decades-long influence over Ukraine. Putin characterized the resulting political transformation as a “fascist” coup, which he conspiratorially insisted was the work of U.S. skullduggery. In fact, the relationship Putin believed existed between Washington and Kyiv only took root afterward. The development of a formidable intelligence nexus between the CIA and the Ukrainian special services — particularly its military intelligence agency, HUR, the GRU’s Ukrainian counterpart — followed from Russia’s first invasion of Crimea and Donbas rather than preceding the revolution. Nevertheless, the resulting cooperation saw the CIA train Ukrainian spies to be sent abroad, including to Russia, and led to the development of an elite Ukrainian special operations group, Unit 2245, whose veterans include the current HUR chief, Gen. Kyrylo Budanov. The dividends of this relationship continue to play out on the battlefield and in the Black Sea, where HUR commandos routinely destroy Russian ships, aircraft, and personnel.

“If you take the Russian view of things, 2014 is the year you have to look at,” a former CIA officer who worked in Afghanistan told The Insider. “Ukraine is much more important to Putin than Afghanistan ever was. The Russians went looking for ways to hit back at us for hindering their plans for Ukraine. That this included recruiting assets in our own theatre of combat fits in perfectly with their playbook of asymmetric warfare.”

Afghanistan is also terra cognita for the GRU. The service’s meddling in the country dates back to the GRU’s infancy, in the 1920s, when, in tandem with the Communist International, it plotted insurrections from Germany to China. Afghanistan is the one place where this aggressive foreign policy actually bore fruit.

In 1924, using Soviet troops dressed as civilians, the Red Army seized an island on the Amu Darya River, which flows through northern Afghanistan. The island became a staging ground for espionage and influence operations across Afghanistan, but Moscow’s activities focused most heavily on Kabul. Four years later, in 1928, the Fourth Department, as the GRU was then called, dispatched 800 fighters from Tashkent. Disguised as Afghan Army soldiers and backed by artillery and aircraft, they embarked on a mission to crush a peasant revolt led by Habibullah Kalakani, an Afghan Army deserter turned bandit who was taking on Afghan leader Amir Amanullah Khan. Although Amanullah was pro-British and supported westernizing reforms, Soviet diplomats with pre-Bolshevik experience in the “Great Game” convinced themselves he would cause trouble for the Crown in northwest India. Stalin agreed.

The rebel leader Kalakani, nicknamed Batcha Sakao (the “Water Carrier”) by his enemies, was outmatched in terms of firepower and was easily dispensed with. But the counteroffensive went so well that it had to be called off after Amanullah fled to India. Russian intercepts indicated that Moscow’s hand in the affair was hardly invisible to Western spy agencies, and fearing a propaganda disaster that would backfire and bolster British influence, Stalin canceled his own intervention, allowing Kalakani to march triumphant into Kabul, where he was anointed king of Afghanistan. After a reign of nine months, he was overthrown and executed.

The second Soviet intervention in Afghanistan, beginning in 1979 and lasting until 1989, is far more notorious. A joint KGB-GRU operation, known as “Storm-333,” was launched to assassinate Afghan leader Hafizullah Amin. Intended as a limited military campaign to install a more pliant puppet in the form of Babrak Karmal, the invasion became a brutal decade-long occupation, which the CIA played no minor role in bringing to an ignominious end for the Kremlin. By the time Mikhail Gorbachev withdrew the last Soviet soldiers from Afghanistan in February 1989, Western-made Stinger anti-aircraft missiles provided to the Afghan mujahideen had downed hundreds of Soviet combat aircraft and helicopter gunships. Historians consider the cost of that war to be a contributing factor of the collapse of the Soviet Union — an event Putin has characterized as the biggest geopolitical catastrophe of the twentieth century.

Despite the Soviet Union’s defeat in Afghanistan, cooperative networks between the Russian occupiers and their indigenous collaborators continued into the twenty-first. Viktor Bout, a former GRU officer turned international arms dealer, equipped the Taliban with an air force in the 1990s and was accused by Peter Hain, the British Foreign Office’s then-minister of state for Africa, of also supplying al-Qaeda. That did not stop the “merchant of death,” as Hain famously dubbed Bout, from selling weapons to the Taliban’s mortal enemy, Ahmad Shah Massoud, the commander of the Northern Alliance and a one-time Afghan defense minister. The Tajikistan-born Bout liked to hunt the finely-horned Marco Polo sheep of the Pamir Mountains with Massoud, an ethnic Tajik, who knew his Russian broker was also selling to the Islamists who wanted the celebrated Afghan guerrilla dead.

Gen. Andrey Averyanov, the former commander of Unit 29155 — now a deputy director of the GRU overseeing three successor units which emerged from the original — also matured in the cask of Central Asia. He was born in 1967 in Turkmenistan and attended the Tashkent Military School in Soviet Uzbekistan. This background, combined with his unique skill set in waging a low-burn war against the West inside NATO territory since 2011, made him especially well-suited to work the post-Soviet “Afgantsy” file right at the moment when another superpower’s army was preparing to pack up and leave.

The attacks

Travel data examined by The Insider and its partners shows that between 2017 and 2019, Azizi traveled from his new home in Russia to Afghanistan, plus to other nearby cities, at least 13 times. He initially went as “Rakhimov,” but from 2018 on, Azizi was on the move as the Russian-born version of his actual self. The data shows that he was present in Afghanistan during several of the attacks linked to the payments program. These include an attack on the northern Baghlan province on February 28, 2017; an April 30, 2018 roadside bombing of a NATO convoy in a village in Daman province, which left 8 Romanian soldiers wounded and 11 children dead; a suicide bombing aimed at the private British security firm G4S in Kabul on March 17, 2018, which killed three and wounded two when the bomber detonated his device before reaching the target; and the attack on an Afghan security checkpoint in Kunduz on October 21, 2019, which killed 16 Afghan policemen.

A timeline of known Taliban attacks against U.S. and coalition forces in Afghanistan, alongside the documented presence in the country of the GRU’s key Afghan assets.

Several of the payment-linked operations targeted areas where American personnel were known to be stationed.

The most sophisticated of these was against Camp Shorab in Helmand province. On March 1, 2019, Taliban gunmen and suicide bombers dressed as ANDSF soldiers infiltrated this military base, which housed the Afghan Army’s 215th Corps as well as a U.S. garrison of a few hundred Marine advisers. During a siege of the base lasting several hours, one suicide bomber detonated a device in a dining facility while other Taliban fighters in disguise began shooting. A total of 23 Afghan soldiers were killed, and another 16 wounded. No U.S. advisers were so much as injured. Unit 29155 spent at least $500,000 — and likely closer to $600,000 — for that one attack, according to two former NDS officials familiar with the investigation.

The linchpin of this attack, according to the NDS, was Haji Mohammed Ayoub, an alleged drug dealer from Helmand province, whom the Afghan security service arrested in January 2020. “He was Azizi’s main point of contact for the Taliban in the Quetta Shura,” one of the ex-NDS officials told The Insider, referring to the leadership council of the organization. “Haji Mohammad Ayoub brokered the deal with the Taliban to attack the Shorab Camp in Helmand. He and his father, Mohammad Sulaiman, provided financial support to most of the Taliban leadership, including Mullah Omar.”

An earlier ambush occurred on January 20, 2019, when a U.S. military convoy was targeted on a strategic highway connecting Logar province to Kabul. A Taliban car bomber blew up vehicles containing the then-governor of the province and the head of its regional intelligence service. That explosion killed at least eight Afghan security forces and injured ten more. The governor and spy chief were unhurt.

On April 8, 2019, a third attack targeted Bagram, with a suicide bomber detonating his car near a convoy close to the airbase. The blast killed three U.S. Marines — Staff Sergeant. Christopher K.A. Slutman, Corporal Robert A. Hendriks, and Sergeant Benjamin S. Hines — and wounded three other U.S. service members. U.S. intelligence was investigating this attack in relation to the intelligence on the GRU payments program. Marine Gen. Kenneth McKenzie, Jr., the head of U.S. Central Command, later claimed to have found no evidence to support such a link.

A fourth attack happened days after Zalmay Khalilzad, the U.S. Special Representative for Afghanistan Reconciliation, boasted of “excellent progress” in peace negotiations with the Taliban in Qatar. On August 7, 2019, another car bomb was detonated in front of a military training center and police recruitment office in Kabul. Fourteen people were killed and over 100 injured.

Minutes after that bomb went off, Wahidullah Azizi, one of Rahmutallah’s brothers based in Dubai, posted a photograph to his Facebook page with the message: “Moments ago, a powerful explosion occurred in western Kabul.” The comments underneath expressed regret for the loss of life.

The NDS arrested Wahidullah during one of his trips to Kabul. He was released no later than August 2021, when the Taliban returned to power, and was given a Russian passport and exfiltrated by Unit 29155 to Russia.

After the bomb went off on August 7, 2019, Wahidullah Azizi posted a photograph to his Facebook page with the message: “Moments ago, a powerful explosion occurred in western Kabul.”

The Azizi family functioned as a cell that was recruited and run by the GRU to operate as liaisons and couriers with the Taliban. But it wasn’t the only one. Another was run by a Russia-based Afghan citizen named Par Han Gul Zafar, who worked directly for Alexei Arkhipov. Leaked car insurance data shows Zafar was listed as a co-insured driver on the policy for Arkhipov’s corporate vehicle, a Toyota Land Cruiser. (A different co-driver listed on the insurance of three other cars belonging to Arkhipov — a Citroen, an Audi, and a Mitsubishi — is Dr. Alexander Mishkin, Anatoly Chepiga’s Unit 29155 accomplice in the Skripal poisoning.)

GRU Unit 29155 ran at least three networks of Afghan couriers and liaisons as part of their payment program with the Taliban.

Like Azizi, Zafar was issued both a GRU passport from the special batch reserved for Unit 29155 operatives and a fake Russian identity — that of “Zafar Davletshin,” which borrowed the last name of his Russian wife. Based primarily in Moscow, Zafar acted as a recruiter-agent and as his own semi-autonomous case officer, enlisting and handling other Afghan couriers who traveled to and from Afghanistan and neighboring countries. Zafar himself traveled to Kabul at least once, in September 2017, on a joint booking with Rahmatullah Azizi.

Two members of his cell, brothers Hamed and Najibullah Mohibzada, came to control their own courier network consisting of “friends and family” in Kabul, as evidenced by passport scans and visa invitations discovered by The Insider in Arkhipov’s leaked mailbox. During one of their trips to Afghanistan, the Mohibzadas attended a birthday party with members of their cell.

Hamed and Najibullah Mohibzada (far left) and Ismail Pirzada (pictured in the center wearing a black shirt).

The gathering in Balkh on October 26, 2016 — roughly a year after Unit 29155 began recruiting Afghans — saw Hamed Mohibzada and his brother, a fellow Russian recruit, congratulate their friend Jan Pirzada. Pirzada was also part of the network. A party photo posted to Odnoklassniki, a second-tier Russian social network, shows the group celebrating and drinking Coca-Cola.

Immediately after the party, Ismail Pirzada, Jan’s brother and accomplice, posted a photo showing two bundles of U.S. dollars, each containing about $100,000. “The GRU were clearly using U.S. banknotes to pay for the killings of U.S. soldiers,” a former NDS officer told The Insider when shown the photos, expressing doubt that these young Afghans, not known to come from wealthy families, could have obtained access to such a large cache of American greenbacks from alternative sources.

The handlers

According to former NDS officials, initial contacts between the GRU and the Taliban began with the brokerage of Iran and grew into a direct relationship later on. This may explain the curious diplomatic path of one of the most senior members of Unit 29155, Lt. Gen. Ivan Kasianenko, 49, currently the deputy commander to the Department of Special Tasks, the unit’s new umbrella organization. His phone number appears in each Unit 29155 member’s call records, and he is named as “deputy to the chief” in several of their contact lists.

Left: Colonel Kasianenko at a military parade in Tehran, September 2008. Right: Kasianenko at the Victory Day celebration in Kabul, May 9, 2015.

Based on open-source data, in September 2008, Kasianenko was serving as Russia’s military attaché in Tehran. At some point prior to 2015, he was re-deployed to Kabul under the same diplomatic title. Border crossing data analyzed by The Insider shows that between 2014 and 2020 Kasianenko frequently traveled between and among three cities: Moscow, Kabul, and Karaganda (located in central Kazakhstan).

Another senior Unit 29155 member, Col. Alexey Arkhipov, not only ran the Azizi courier network but also remained intimately involved with GRU’s intelligence operations in postwar Afghanistan, travelling there under the cover name “Alexey Titov.” Like Kasianenko, Arkhipov appeared on flight manifests and communicated directly with Azizi. He also continues to liaise with the Taliban following its seizure of power.

Alexey Arkhipov (“Titov”). Photo retrieved from his personal archive.

Call records and leaked emails suggest Arkhipov played a key role in organizing Taliban delegation visits to Moscow in November 2018, February 2019, and May 2019. Arkhipov and his bosses — Averyanov and Kasianenko — appear to have been the driving forces behind conferences on the future of Afghanistan at which Taliban hardliners were seated next to senior Afghan politicians — none of whom happened to hail from the U.S.-backed Ghani government. In the conference literature, Averyanov is described as a “Special Envoy for Afghanistan,” a title he is not broadly known to hold in the Russian government. Arkhipov is listed as “Advisor to the Special Envoy.”

Leaked email correspondence further shows that Arkhipov continues to man a back-channel with the Taliban, and Russia appears to be on the verge of normalizing relations with the group. In July, Putin described it as an “ally in counterterrorism,” an apparent reference to the Taliban’s ongoing fight with the more radical Islamic State-Khorasan Province, or ISIS-K, the Afghan and Pakistani franchise of the transnational jihadist group. (ISIS-K claimed responsibility for the grisly arson and gun attack on Crocus City Hall in Moscow in March, which left 145 dead and 500 wounded.)

A hand-written memo found in Arkhipov’s inbox contains what are evidently clandestine requests from the Taliban to the GRU. The “new Islamic government,” the memo states in handwritten Pashto — translated in pen-ink into Russian — is seeking assistance to bring “stolen helicopters and airplanes” to Afghanistan from Tajikistan and Pakistan, “assistance in training of our security officers,” and “general assistance in rebuilding our defense capabilities.” The memo also asks that Moscow not permit “the activity of enemies of the new Islamic rule from the territory of Tajikistan,” an allusion to former Afghan government officials who fled to Afghanistan’s post-Soviet neighbor seeking refuge upon the collapse of the Ghani government.

A memo from the Taliban seeking Russia’s assistance, found in Alexey Arkhipov’s mailbox.

Coincidentally, Arkhipov’s role as a GRU liaison with the Taliban was discovered by The Insider in the course of this investigation. He makes a cameo appearance in a 2023 documentary, Hollywoodgate, about the U.S. pullout from Afghanistan and the takeover by the Taliban of the Hollywood Gate Complex, an abandoned CIA base in Kabul. Clad in dark glasses, Arkhipov is featured as one of the many Russian dignitaries attending a 2022 military parade in Tehran held to commemorate the first anniversary of the Taliban’s return to power in Kabul. One more figure in the background is Russia’s current military attaché to Iran, Major General Alexey Grebnev, yet another GRU officer who was crucial in the creation of the bounties program, according to former NDS officials.

A separate scene from Hollywoodgate provides unexpected insights into another previously unreported relationship between the Taliban and Russia.

In one of the closing sequences of the film, a Taliban commander is seen discussing plans to take over territory from Tajikistan, where Russia maintains its 201st Military Base — which houses elements of Unit 29155, among other assets. The commander says he anticipates help from Russia in this endeavor, “when they solve their Ukraine problem; now they are too busy with that [war].”

Arkhipov’s emails confirm that the Kremlin is indeed considering requests from the Taliban to assist with concessions in relation to Tajikistan, including access to territories allegedly providing safe haven to opponents of the new Islamist regime.

Air India

Following the exit of U.S. and coalition forces from Afghanistan, the GRU exfiltrated many of its remaining agents to Russia. The Azizi family members who had been jailed by NDS, along with their parents, all arrived from Dubai to Moscow in August and September 2021, border crossing records show. They were given new Russian identities, allowing them to enter without visas. In Wahidulla Azizi’s case, his Russian passport was issued at the Russian consulate in Istanbul.

Moscow, however, was not the final destination of most of the GRU’s Afghan assets.

In May 2022, three months after the start of Russia’s full-scale invasion of Ukraine, a group of top GRU and FSB officers flew on an undisclosed trip to Delhi. The delegation included Averyanov, the former commander of Unit 29155, and Arkhipov, who traveled under his new cover identity, “Alexey Sorokin.” It also featured three senior officers from the FSB’s Fifth Service, the foreign arm of Russia’s feared domestic security apparatus, which is tasked with active measures and destabilization efforts overseas. The Fifth Service was responsible for attempting to subvert the Ukrainian government at the start of the February 2022 invasion. Gen. Sergey Beseda, its now disgraced former director, was part of the delegation.

There is no information about the purpose of the visit or the arrangements that may have been made between Russia’s two most aggressive intelligence units and their Indian hosts. But shortly after the trip, several Afghan nationals who were previously deployed to courier GRU money to the Taliban began traveling regularly to Delhi. Some of them settled there under assumed Russian identities. Despite his prior expressed hostility to the Indian state, Rahmatullah Azizi and several of his family members are among them.

Several of the Afghans whose passports and other personal details were found in the mailboxes of Arkhipov or his subordinates migrated to Western Europe under the guise of being refugees from the Taliban. The Insider’s investigative partner, Der Spiegel, discovered that at least two of them had sought asylum in Germany shortly after visiting Russia on GRU-facilitated invitations. One, whose asylum request was denied, is a 27-year-old Afghan who entered Germany from Russia last spring and now lives in Brandenburg. A second asylum seeker was connected to Lower Saxony. After first traveling to Moscow, he has remained in Germany since the summer of 2023, Der Spiegel found. German authorities have also refused entry to a third Afghan from the GRU payments program, who attempted to cross into the country from Poland last April.

At least one of the younger Azizi brothers, Hasibullah, remains in Moscow, where he has assumed the GRU-issued Russian identity of “Hasib Ahmadov.” Based on leaked telephone records, Hasibullah is actively working with members of Unit 29155 on new, as-yet-unknown missions. A recent attempt by The Insider to obtain a transcript of his employment status from Russia’s abundant data market resulted in a flat refusal from one otherwise accommodating vendor: “This person works for the Presidential Administration and his data is off limits.”

With additional reporting by Roman Lehberger and Fidelius Schmid.