WASHINGTON: The Afghan national suspected of shooting two National Guard members near the White House on Wednesday previously worked alongside U.S.-backed military and intelligence units in Afghanistan, FBI Director Kash Patel said on Thursday.
“There is confirmation now that the subject had a relationship in Afghanistan with partner forces,” Patel told reporters. “We are fully investigating that aspect of his background, including any known associates either overseas or in the United States.” He confirmed the bureau is pursuing the case as an ongoing terrorism investigation.
Patel said the FBI and partner agencies secured the crime scene immediately after the attack, seized the weapon used, and collected evidence now being processed at a federal laboratory.
As part of a widening national investigation, authorities have executed multiple search warrants across the country, including at the suspect’s last known residence in Washington state. Agents have been interviewing witnesses and relatives “to pursue anyone and everyone associated with the subject,” he said.
Jeanine Pirro, the U.S. Attorney for Washington, D.C., said the suspect faces multiple felony charges, including three counts of assault with intent to kill while armed and possession of a firearm during a violent crime.
A National Guard member wounded in Wednesday’s ambush near the White House has died in the hospital, President Donald Trump announced on Thursday, while a second Guardsman remains in critical condition.
Sarah Beckstrom, 20, died of her wounds, and her fellow Guardsman Andrew Wolfe, 24, was “fighting for his life,” Trump said, as investigators conducted what officials said was a terrorism probe after Wednesday’s shooting.
Authorities identified the suspected gunman as Rahmanullah Lakanwal, 29, an Afghan national taken into custody at the scene. Intelligence officials cited by Fox News say Lakanwal worked with several U.S. government agencies, including the CIA, during the war.
Originally from Khost province, he served in two CIA-supported units under the former Afghan National Directorate of Security (NDS). Although nominally part of the NDS, these units operated under direct CIA guidance. Lakanwal served in NDS Unit 01, which conducted counterterrorism operations in Kabul, Parwan, Wardak, and Logar, according to US media reports.
He received agency training at CIA’s Eagle Base in Deh Sabz district in 2007. Eagle Base—later demolished during the 2021 U.S. withdrawal—was a key counterterrorism training hub housing NDS-01, NDS-02, NDS-03, NDS-04, KPF, and KSF units, and included facilities for sensitive operations. After the U.S. exit, the compound was taken over by the Haqqani Network’s Badri 313 unit, which later facilitated movements leading to the Abbey Gate attack that killed 13 U.S. service members and about 170 Afghans in August 2021.
Lakanwal later joined the team supporting CIA’s Kandahar Base, a site historically tied to Taliban co-founder Mullah Omar, Osama bin Laden, and, from 2002–2021, Camp Gecko, which hosted NDS-03 and the Kandahar Strike Force. Lakanwal participated in counterterrorism missions alongside U.S. personnel in Kandahar, Uruzgan, and Zabul provinces.
Following Wednesday’s attack in Washington, ISIS-linked channels were the first to praise the incident, reportedly because Lakanwal’s half-brother — Muawiyah Khurasani, also known as Hayatullah — had been a recruiter for the Islamic State–Khorasan Province (ISKP). Khurasani previously worked with Tehrik-e-Taliban Pakistan (TTP) in Pakistan’s Orakzai region before joining ISKP. He was killed in July 2022 in a targeted operation in Nangarhar.
After the fall of Kabul in 2021, former members of the Kandahar Protection Force (KPF) and Khost Protection Force became key targets for both the Haqqani Network and ISKP. These groups attempted either to recruit them or coerce them through threats, extortion, and exposure of their past cooperation with the U.S. Both groups also produced thousands of fake IDs, enabling militants to pose as former KPF/01/02 members and exploit U.S. evacuation routes.
Officials say Lakanwal’s identity and employment records are legitimate, but Patel confirmed that a full review is under way given that extremist networks have openly boasted about infiltrating U.S. resettlement pathways by impersonating such units.
