Within hours of the Feb 6 bombing at an Islamabad Imambargah, Pakistani intelligence and law enforcement agencies traced the attackers to a residence in Hakimabad, Nowshera, about 49 kilometres east of Peshawar.
Officials described the operation as a race against time. After analysing technical data and pinpointing coordinates, security personnel surrounded the house by evening and called on those inside to surrender.
Initially, there was silence. Then a hand briefly appeared from behind the door, seemingly signalling surrender. Moments later, however, a lone gunman opened fire with a 9mm pistol at the security cordon. An assistant sub-inspector was shot in the chest and killed instantly, while two intelligence officials were injured.
The gun battle was brief. The attacker — later identified as Yousaf alias Qasim, also known as Idrees — was shot dead within minutes. Authorities said he was the Islamic State-Khorasan (IS-K) chief for Bajaur and the handler of the Imambargah suicide bomber, with a Rs12 million bounty on his head.
Officials believe the exchange of fire provided others inside the house enough time to destroy mobile phones and other potentially incriminating evidence.
Subsequent investigations revealed that the cell had been involved in a string of assassinations and suicide bombings. After operating in Bajaur, members reportedly relocated to Gujranwala, Lahore and eventually Nowshera.
Investigators have linked the group to the targeted killing of 20 individuals allegedly involved in the lynching of an IS-K operative who had attempted to assassinate a local JUI-F leader. The network has also been connected to the assassination of senior JUI-F leader Mufti Sultan Mahmood in Bajaur in October 2019, the July 30, 2021 suicide bombing at a JUI-F convention that killed more than 54 people and injured over 100, and the July 10, 2025 bombing that claimed the life of ANP leader Maulana Khanzeb.
Authorities further suspect the group’s involvement in the killing of at least 15 policemen and the July 2, 2025 bombing that killed the Nawagai assistant commissioner.
According to investigators, Idrees — a tailor by profession — had evaded capture for years by frequently changing locations, travelling with women and children, and avoiding long stays at any single address. Officials described the group’s movements as nomadic, often leaving behind belongings and failing to inform landlords before moving on.
Investigators were particularly struck by the active role of women in the network. Authorities say the suicide bomber travelled to Afghanistan’s Kunar province in May 2025, while female members of the group also crossed the border using altered passports. In one instance, a woman allegedly transported a suicide vest from Bajaur to Islamabad and handed it to another female accomplice. Officials say the entire family unit appeared deeply radicalised.
As authorities probe deeper into IS-K’s structure and reach, they now believe the group’s network extends far beyond Pakistan and Afghanistan, with links stretching to the Middle East and Central Asian republics. The outfit reportedly uses cryptocurrency for financing and encrypted applications to communicate, complicating intelligence efforts.
Based on current assessments, investigators consider IS-Khorasan a more entrenched and potentially more lethal threat than the banned Tehreek-i-Taliban Pakistan (TTP), citing its ideological commitment, operational sophistication, decentralised structure and capacity for large-scale attacks.