by Our Correspondent in Washington DC
Multiple interviews with the Federal Bureau of Investigation [FBI], Mohamed Naufar, one of the key leaders of the Islamic State (ISIS) cell responsible for the devastating 2019 Easter Sunday bombings in Sri Lanka, laid bare the structure, planning, training, and indoctrination that went into executing the country’s deadliest act of terrorism.
Over the course of four interviews conducted in June 2019 and March 2020 at the Criminal Investigation Department (CID) headquarters in Colombo, Naufar, who identified himself as the “second emir” or deputy leader of the ISIS cell in Sri Lanka, detailed his ideological alignment with the group, his recruitment and training efforts, and his relationship with the ringleader Zahran Hashim, who led the suicide attacks on April 21, 2019.
Related Article: Exclusive: US Government Identifies Mastermind of Easter Sunday Attack
Naufar explained to investigators that his alignment with ISIS was not immediate. While he had been exposed to radical ideas as early as 2009 during his time in Qatar, it wasn’t until 2017 that he fully embraced ISIS’s extremist worldview. He said Zahran, who founded the National Thowheeth Jama’ath (NTJ), began influencing him through recorded speeches, online propaganda, and direct ideological mentoring. After watching ISIS-produced videos and reading materials forwarded by Zahran, Naufar pledged allegiance to the group and committed himself to the goal of suicide attacks, telling the FBI that joining ISIS was his way of preparing for martyrdom.
According to Naufar, Zahran sought formal recognition from ISIS leaders in Syria by sending them a video filmed in a Sri Lankan forest, in which he, Naufar, and other group members—some of whom later became suicide bombers—pledged bayat (allegiance) to ISIS and its leader, Abu Bakr al-Baghdadi. This video, Naufar said, was routed through two Sri Lankans living in ISIS-controlled territory in Syria. Following this, Zahran claimed to have received approval from ISIS central command, who acknowledged their cell in Sri Lanka as an official ISIS affiliate.
Zahran then appointed Naufar as the group’s second-in-command and placed him in charge of propaganda, recruitment, and ideological education. But Naufar’s role extended far beyond media efforts. He personally coordinated and facilitated eight multi-day training sessions held in secret locations, usually rented safe houses. These courses—based on training materials allegedly supplied by ISIS—included modules on firearms usage, bomb-making, and religious indoctrination. Recruits were trained to use Type-56 assault rifles and 9mm pistols, and they learned how to manufacture black powder and nitrate-based explosives. Each training camp concluded with a formal pledge of allegiance to ISIS.
Security and secrecy were central to Naufar’s operations. He told the FBI that trainees were instructed not to bring phones, not to use real names, and to avoid disclosing personal information to each other. Zahran distributed phones specifically configured for secure communication, and the group relied exclusively on encrypted messaging apps like Telegram and Threema to coordinate their efforts. SIM cards were routinely swapped, and members were ordered not to make voice calls—only encrypted messages.
Naufar also admitted that ISIS in Sri Lanka discussed targeting American citizens and interests abroad. He told agents that during the courses, the group debated strategies to wage global jihad and even considered assassinating individuals or groups associated with the United States.
Despite these deep involvements, Naufar claimed that he had a falling out with Zahran roughly six weeks before the Easter attacks. He blamed Zahran’s poor operational security for exposing the group’s activities to law enforcement and stated that he attempted to distance himself from Zahran after a leadership dispute erupted in early March 2019. According to him, Zahran initially agreed to step down but reversed course the next day, insisting that only ISIS central leadership in Syria had the authority to appoint or remove a leader.
Naufar alleged he last saw Zahran on March 9, 2019, and that following the breakdown, he went into hiding in a Wattala safe house. However, on the morning of the Easter attacks, Naufar received a personal visit from Anwar Mohamed Riskan, another group member, who informed him that Zahran had “executed a series of attacks.” Naufar told investigators that upon seeing news of the bombings on Facebook, he fled the safe house. He maintained that he had no prior knowledge of the targets or timing of the attacks, although he admitted overhearing conversations about bomb-making months earlier between Hasthun (who later blew himself up at St. Sebastian’s Church) and Zahran’s brother.
Naufar offered multiple theories on Zahran’s choice of targets. According to his statements, the attacks were possibly in retaliation for an American-led assault on ISIS fighters in Syria in March 2019, which allegedly involved white phosphorus. He also said Zahran had discussed directives from ISIS central leadership encouraging attacks on Christian churches and Chinese interests—one reason why the Shangri-La hotel, headquartered in Hong Kong, was targeted. Moreover, Zahran believed martyrdom was preferable to capture, and that attacking Western-affiliated hotels would be seen as striking at the heart of global “infidels.”
After his arrest, Naufar attempted to destroy his phone, but failing that, he reset it to factory settings, believing it would erase its contents. When shown the phone during a March 2020 interview, he admitted it was his and that it had been in his possession at the time of his arrest.
Further evidence of Naufar’s deep involvement came from independent witness testimonies. According to the FBI, nine other individuals detained by Sri Lankan authorities—also linked to the ISIS cell—identified Naufar as a leader. Several of them confirmed that he was one of the primary instructors in ISIS-run training sessions. Thirteen witnesses further confirmed that a leadership rift erupted within the group in the weeks before the bombings. Crucially, none of the individuals interviewed contradicted Naufar’s role as second-in-command or disputed his senior status within the ISIS network in Sri Lanka.
In addition to confessions and witness statements, social media and email records corroborated Naufar’s account. His Facebook posts publicly expressed support for ISIS and endorsed its ideology. In one comment, he wrote, “Yes, I accept ISIS’s caliphate,” when asked about his allegiance. In another, he declared, “The United States is the enemy of Allah.” He referred to ISIS using coded terms like “1515” in public exchanges and joked with others about being arrested for his sympathies. He also exchanged emails with Zahran that included ISIS propaganda, articles from the terrorist group’s magazine al-Naba, and images glorifying jihad and martyrdom.
Ilham Ibrahim, one of the suicide bombers who detonated himself at the Shangri-La hotel, gave a hard drive to his brother shortly before the attack. The FBI’s forensic analysis of the drive revealed a massive trove of ISIS materials—pamphlets, training videos, ideological guides, and encrypted communication instructions—all aligned with the topics and techniques that Naufar described in his interviews.
Naufar’s own blog, which he operated prior to joining ISIS, was also reviewed by FBI agents. Spanning from 2014 to 2018, it included hundreds of posts on religious ideology and, in later entries, showed a shift toward sympathising with ISIS’s views.
From ideological conversion to military training, from online propaganda to operational secrecy, Mohamed Naufar played a central role in laying the foundations for the Easter Sunday massacre. His confession confirms what was long suspected: that the attacks were not the work of isolated radicals, but the outcome of a structured, trained, and ideologically hardened jihadist cell that operated as a local arm of the Islamic State.
Despite his claims of non-involvement in the final act of terror, Naufar’s own words—and the testimonies of others—firmly place him at the core of the group that shattered hundreds of lives on that Easter morning.
