CIA confirms suspect worked with CIA‑backed unit; report identifies NDS‑03 base at Camp Gecko
The CIA has publicly confirmed that 29‑year‑old Rahmanullah Lakanwal, who was evacuated to the U.S. in 2021 under Operation Allies Welcome and later granted asylum, previously worked with a CIA‑backed Afghan partner force — reporting identifies the specific unit as NDS‑03 (the so‑called "Zero Unit") based at Camp Gecko. Lakanwal is accused of an ambush near the Farragut Square/Farragut West Metro area that critically injured two West Virginia National Guard members (Spc. Sarah Beckstrom, who later died, and SSgt. Andrew Wolfe, who remains hospitalized), faces federal assault charges, and is the subject of an FBI probe being treated as a possible act of international terrorism.
📌 Key Facts
- On Nov. 26, 2025, an ambush-style shooting occurred around 2:15 p.m. near the Farragut West / Farragut Square Metro area two blocks from the White House; video and officials say the attacker came around a corner, opened fire with a .357 Smith & Wesson revolver, and at least one National Guard member exchanged fire.
- Two West Virginia National Guard members on patrol — Specialist Sarah Beckstrom, 20, and Staff Sgt. Andrew Wolfe, 24 — were wounded; Beckstrom later died and Wolfe was critically injured, underwent surgery, woke from an induced coma and by Dec. 13 was breathing on his own and moving to inpatient rehabilitation.
- The suspect, identified as 29-year-old Afghan national Rahmanullah Lakanwal, was shot, subdued by nearby troops, taken into custody and hospitalized with injuries not believed to be life‑threatening; prosecutors charged him with multiple counts including assault with intent to kill while armed and using a firearm during a crime of violence.
- U.S. officials, including the CIA, publicly confirmed Lakanwal previously worked with U.S. government partner forces in Afghanistan — reported as the CIA‑backed unit NDS‑03 (the so‑called “Zero Unit”) that operated from Camp Gecko — and was evacuated to the U.S. under Operation Allies Welcome in 2021; he was later granted asylum in 2025 and had been living in Washington state with his wife and five children.
- The FBI is leading a nationwide investigation that has executed search warrants coast‑to‑coast, is probing Lakanwal’s Afghan partner‑force ties and associates, and is treating the case as a possible act of international terrorism while investigators have not yet established a confirmed motive.
- Federal and local officials said Lakanwal reportedly drove cross‑country to Washington, D.C.; authorities are reviewing who fired the round that struck the suspect and whether the attack was lone‑actor or part of a broader plot, with no definitive motive announced in briefings.
- The shooting prompted immediate security and policy responses: the President called it an “act of terror,” ordered 500 additional National Guard troops to D.C., and USCIS temporarily paused processing Afghan immigration requests pending a vetting review; senior officials and political leaders publicly criticized or defended prior vetting practices.
- Reporting documented post-arrival struggles and concerning behavior — including prolonged isolation, intermittent manic travel, employment instability and outreach by refugee services — and investigators have said they are examining possible post‑arrival radicalization and other influences (press reports note the FBI has scrutinized possible links such as Tablighi Jamaat).
📊 Relevant Data
Approximately 200,000 Afghans arrived in the United States after the Taliban takeover of Afghanistan in August 2021, mainly settling in states like California, Virginia, and Texas.
From Welcoming Allies to Threats of Deportation — ReliefWeb
As of 2025, about 2,000 Afghans in the United States have been flagged over alleged terrorism ties by U.S. intelligence.
US official says about 2,000 Afghans in country flagged over alleged terrorism ties — AMU TV
In 2025, U.S. Immigration and Customs Enforcement arrested an Afghan national affiliated with ISIS-K who was released into the U.S. under Operation Allies Welcome following the 2021 evacuation.
Miles from Nation's Capital, ICE Arrests ISIS-K Afghan Terrorist Who Was Released into U.S. Under Biden's Operation Allies Welcome — Department of Homeland Security
As of May 2023, the Terrorist Screening Center identified 55 Afghan evacuees who were either already on the Terrorist Screening Dataset or had derogatory information warranting placement on it.
Audit of the Federal Bureau of Investigation's Participation in the Screening and Vetting of Afghan Evacuees — Office of the Inspector General, Department of Justice
Over 200,000 Afghan refugees in the United States face significant integration challenges, including multidimensional stressors related to migration and resettlement.
📊 Analysis & Commentary (4)
Horror on Thanksgiving Eve
"The Playbook column comments on the D.C. Guard shooting (the suspect’s CIA‑linked Afghan background), warns that both parties are rushing to politicize the attack, and urges caution and evidence‑based responses rather than instant partisan exploitation."
The Ambush on the National Guard
"A Wall Street Journal editorial condemns the ambush of two National Guard members and uses the suspect’s status as an Afghan evacuee to criticize U.S. resettlement and vetting policies, urging a reassessment of security procedures."
The emerging MAGA fractures
"The Politico piece links the D.C. shooting and the suspect’s CIA‑partner background to an immediate hardline immigration push and uses POLITICO poll data to argue that such security‑driven policies risk exposing and deepening emerging fractures between MAGA loyalists and the broader 2024 Trump electorate."
Trump’s DC Guard deployment didn’t fuel violence — Biden's Afghan vetting breakdown did
"The opinion piece rebuts media claims that Trump’s D.C. Guard deployment fueled the National Guard shooting, arguing instead that the shooter’s alleged admission as an Afghan evacuee after a rushed post‑withdrawal vetting is the relevant policy failure and that the Guard presence reduced crime."
📰 Sources (51)
Wounded National Guardsman is making 'extraordinary progress,' can breathe on his own: doctor
New information:
- Medical condition update: Andrew Wolfe is off assisted breathing, can stand with help, and is moving to inpatient rehabilitation per MedStar.
- Funeral and honors for Sarah Beckstrom were completed Dec. 9 with detailed ceremony remarks and state-level acknowledgments.
FBI probes possible ties of National Guard shooter to shadowy sect, a ‘catalyst’ for jihad
New information:
- Introduces possible Tablighi Jamaat linkage being scrutinized by FBI/DHS as a radicalization vector post‑arrival in the U.S.
- Details of suspect’s communications to family ('with Tablighis') were provided to the FBI by his brother.
National Guardsman injured in shooting has woken up from induced coma, West Virginia governor says
New information:
- Gov. Patrick Morrisey announced that shooting victim SSgt. Andrew Wolfe has woken from an induced coma.
- Medical-status update provides a new development in the same incident connected to Rahmanullah Lakanwal.
National Guard shooting suspect spent weeks in isolation, 2024 emails say
New information:
- A former Afghan commando told CBS Lakanwal led an Afghan special forces unit in the south and worked closely with international troops.
- The commando said Lakanwal was deeply troubled by a close friend and fellow commander’s death in 2024 after an unsuccessful U.S. asylum bid.
- Adds personal context: prolonged isolation, reported 'manic episodes,' and family hardship in 2023–2024 as documented by caseworker emails.
Afghan suspect in National Guard attack was 'radicalized' after arriving to US, Noem says
New information:
- Noem states DHS believes Lakanwal’s radicalization occurred after he arrived in the U.S., adding a timeline detail to prior reporting on his background.
- She indicates investigators are engaging with people from his U.S. community who are providing information.
Advocate warned Afghan evacuee was 'not functional as a person' months before National Guard shooting
New information:
- AP-reviewed emails show an advocate warned months earlier that Lakanwal had 'not been functional' since March of the prior year, citing quitting work, isolating in a dark room, and unresponsiveness to family.
- The advocate reported alternating 'periods of dark isolation and reckless travel,' including abrupt trips to Chicago, Arizona, and Washington, D.C., sometimes described as 'manic' episodes lasting 1–2 weeks.
- USCRI staff traveled to Bellingham in March 2024 after warnings but made no meaningful contact; the advocate believed Lakanwal declined help.
- Additional context that he abandoned English classes, cycled through short-term jobs, and his children at times arrived at school unbathed or in the same clothes for days.
- FBI continues to examine motive and has not confirmed any ideological influence; DHS Secretary Kristi Noem has suggested possible post-arrival radicalization.
National Guard suspect "radicalized since he's been here in this country," Noem claims
New information:
- DHS Secretary Kristi Noem said the suspect was 'radicalized since he's been here in this country' and suggested ties in his U.S. community/state, offering no further details.
- Noem alleged Biden-era vetting was limited and contrasted it with current biometric and social-media checks she says are now in place.
- Samantha Vinograd stated there is no indication the shooting was a vetting failure and explained the scope and limits of the vetting system.
Suspect in National Guard attack struggled with 'dark isolation' as community raised concerns
New information:
- Reiterates Lakanwal served in a CIA-backed Afghan 'Zero Unit' before entering the U.S. under Operation Allies Welcome in 2021.
- Provides new context on his post-arrival deterioration, including inability to hold a job and isolation patterns that prompted outreach to a refugee services nonprofit.
Trump says one of the two West Virginia National Guard members shot by Afghan national has died
New information:
- AP cites sources and AfghanEvac that suspect Rahmanullah Lakanwal worked in a CIA‑backed Afghan Army unit, aligning with prior confirmations.
- Trump’s remarks escalate the incident’s framing as a 'terrorist attack' and criticize Afghan resettlement policy.
- Prosecutor Jeanine Pirro detailed the weapon and present charges, saying motive remains unknown.
One of the National Guard troops shot in D.C. attack has died, Trump says
New information:
- Confirms the deceased victim’s identity: Army Spc. Sarah Beckstrom.
- Confirms the second victim’s status: Andrew Wolfe remains in critical condition.
- Places the casualty update on Thursday night following the Wednesday ambush.
Trump says one of the National Guard members shot in D.C. has died
New information:
- A victim in the Farragut Square-area ambush has died: West Virginia National Guard member Sarah Beckstrom, 20.
- Trump disclosed the death during a Thursday evening call with service members.
Investigations of National Guard shooting reveals suspect worked for CIA in Afghanistan
New information:
- Investigators say the suspect drove across the country to carry out the attack.
- Prosecutors plan to charge the Afghan national with three counts of assault with intent to kill.
- The two National Guard members remain in critical condition.
Trump administration orders green card "reexamination" from "countries of concern"
New information:
- Victims identified as Army Spc. Sarah Beckstrom, 20, and Air Force Staff Sgt. Andrew Wolfe, 24; both remain in critical condition.
- U.S. Attorney Jeanine Pirro announced charges: three counts of assault with intent to kill while armed, plus a firearm during a crime of violence.
- Officials reiterate the suspect, Rahmanullah Lakanwal, arrived in 2021 under Operation Allies Welcome and was granted asylum earlier this year; a Guard member shot him to end the attack.
Trump criticizes the program that brought Afghan refugees to the U.S. who fought the Taliban
New information:
- CIA Director John Ratcliffe issued a statement blaming Biden-era Operation Allies Welcome vetting, saying the suspect "and so many others" should not have been allowed to come to the U.S.
- Article reiterates that Rahmanullah Lakanwal worked with a CIA partner force in Kandahar and adds that he was granted asylum in April under the Trump administration, according to #AfghanEvac.
- New personal detail: a former landlord says Lakanwal lived in Bellingham, Washington, with his wife and five children.
- #AfghanEvac outlined asylum vetting steps (fingerprinting, iris scans, background check, interview, risk assessment) that would have applied to Lakanwal.
- Scale/context update: about 76,000 Afghans were brought to the U.S. under Operation Allies Welcome, with initial processing at U.S. military bases (JB McGuire‑Dix‑Lakehurst, Fort McCoy, Fort Bliss).
Details emerge on CIA unit alleged National Guard shooter served with in Afghanistan
New information:
- Fox identifies the specific CIA‑backed 'Zero Unit' as NDS‑03 and says it operated from Camp Gecko (Mullah Omar’s former compound) across Kandahar, Helmand and Uruzgan.
- Afghan Evac says Lakanwal entered the U.S. in 2021 under Operation Allies Welcome and was granted asylum in April 2025 under the Trump administration.
- A senior U.S. official says CIA vetting would have checked NCTC databases and kept identities confidential; notes Afghans sometimes forged birth dates to meet age requirements.
- U.S. Attorney Jeanine Pirro and FBI Director Kash Patel publicly criticized vetting at a Nov. 27 press conference.
- Timeline detail: Lakanwal reportedly began working with the CIA around 2011, likely as a minor.
Trump celebrating Thanksgiving at Mar-a-Lago
New information:
- Identifies the two wounded West Virginia National Guard members by name and age: Spc. Sarah Beckstrom, 20, and Pfc. Andrew Wolfe, 24; both remain in critical condition.
- States both Guardsmen had been stationed in D.C. since August and were deputized less than 24 hours before the attack to conduct presence patrols.
- Reports suspect Rahmanullah Lakanwal drove from Washington state to carry out the attack and was shot by another Guard member before being taken into custody.
- Includes Trump’s video statement labeling the shooting an 'act of terror' and pledging to 'reexamine every single alien' who entered from Afghanistan under Operation Allies Welcome.
- Notes Defense Secretary Pete Hegseth’s announcement of 500 additional National Guard troops to D.C. (contextual to the incident).
D.C. Shooting: What We Know About the National Guard Victims
New information:
- Officials identified the two wounded Guard members as USAF Staff Sgt. Andrew Wolfe, 24, of Martinsburg, W.Va., and U.S. Army Specialist Sarah Beckstrom, 20, of Summersville, W.Va.
- Wolfe is assigned to the Force Support Squadron, 167th Airlift Wing, West Virginia Air National Guard; Beckstrom is assigned to the 863rd Military Police Company, 111th Engineer Brigade, West Virginia Army National Guard.
- Service entry dates: Wolfe entered service Feb. 5, 2019; Beckstrom on June 6, 2023.
- Medical status update: both remain in critical condition; Beckstrom’s father says she has a 'mortal wound' and is unlikely to recover.
- Both had been deployed to Washington, D.C., since August as part of the Trump administration’s crime‑crackdown deployment.
National Guard shooting suspect served in CIA counterterrorism unit, group says
New information:
- AfghanEvac identifies the specific Afghan unit as NDS-03, described as operating at the CIA’s direction.
- CIA Director John Ratcliffe said the suspect was admitted to the U.S. due to his prior work with the U.S. government, including the CIA.
- Timeline details: evacuated to the U.S. in Aug. 2021 under humanitarian parole; asylum was granted in April 2025.
- Immigration status details: the suspect had SIV chief of mission approval but had not yet obtained lawful permanent residence.
- FBI Director Kash Patel said the suspect’s relationship with partner forces in Afghanistan will be a central focus of the probe and alleged vetting failures by the prior administration.
- AfghanEvac emphasized extensive vetting for this population and cautioned against broad-brush judgments; founder Shawn VanDiver’s on‑record quote included.
Trump reacts to National Guard shooting in D.C. as details emerge about Afghan suspect
New information:
- CBS reports President Trump publicly weighed in on the D.C. National Guard shooting.
- CBS says the suspect, Rahmanullah Lakanwal, previously worked with the U.S. government, including the CIA.
- CBS reiterates the suspect entered the U.S. in 2021.
2 National Guard members in critical condition after "ambush" attack linked to Afghan national
New information:
- Officials say the suspect, 29-year-old Rahmanullah Lakanwal, now faces several D.C. charges of assault with intent to kill while armed.
- Authorities characterized the incident as an 'ambush' attack.
- Two National Guard members remain in critical condition, per the latest update.
+ 31 more sources