European security agencies are searching for at least eight suspects they believe are linked to the ISIS attacks in Paris and Brussels.
Their names are listed in an 11-page security bulletin that was circulated among European law enforcement agencies on March 23, the day after the Brussels attacks.
All but one of the suspects are said to have connections to Abdelhamid Abaaoud, the leader of the Paris attacks, or Salah Abdeslam, the only survivor among the Paris attackers, who was arrested earlier this month in Brussels.
The security bulletin gives a sense of ISIS’ geographical reach in Europe. Three of the suspects were residents or spent time in the Netherlands, Germany and Sweden respectively.
A source with access to the document shared details with CNN.
CNN was provided the identities of two of the eight at large: They are Naim al Hamed and Yoni Patric Mayne.
Naim al Hamed
The list includes a man identified by his Syrian identity papers as Naim al Hamed. CNN reported Friday that Hamed is being sought by European security on suspicion of operational involvement in the Brussels attack. Authorities are far from persuaded that’s his real name.
Investigators believe “Hamed” and a man using the false identity Monir Ahmed Alaaj traveled to Europe from Syria together in September. Weeks later, they were picked up at a hotel near a refugee center in Ulm, Germany, by Abdeslam, who drove them to Brussels.
The man known as “Alaaj” was arrested with Salah Abdeslam in Molenbeek on March 18, days after their hiding place in the Forest district of Brussels was discovered by police.
Yoni Patric Mayne
Another name on the list: Yoni Patric Mayne, a Belgian-Malian who once worked in a video shop in Brussels. Mayne has long been on the radar screen of Western intelligence agencies because he accompanied Abaaoud to Syria in 2014.
Mayne is listed in a French police report as having boarded a flight from Cologne to Istanbul with Abaaoud and Abaaoud’s 13-year old brother, Younes, to Istanbul on January 20, 2014.
Both Abaaoud and Mayne were part of the so-called Zerkani recruiting network named after Khalid al Zerkani, a Brussels-based veteran of the Afghan Jihad who was known as “Papa Noel” by his acolytes because he funded their travel to Syria. A Belgian court sentenced Zerkani to 12 years in jail last year.
According to Belgian security analyst Pieter Van Ostaeyen, Mayne first traveled to Syria in April 2013. He returned home and was briefly detained but was able to return to Syria the following year. ISIS fighters in Raqqa tweeted a photo purporting to show him dead in March 2014. His current status is unknown, but his inclusion in the recent European security bulletin suggests intelligence agencies believe his death may have been faked.
That’s also what Abaaoud did in the autumn of 2014, arranging for word to be sent back to his own family in Brussels so that it would be easier for him to return to Europe.
The Abaaoud connection
European intelligence agencies have established that Abaaoud was at the center of a web of ISIS conspiracies in Europe. In June 2015, Nicholas Moreau, a Frenchman suspected of joining ISIS, was taken into custody by French authorities after being deported from Turkey. He was later charged with being part of a conspiracy related to a terrorist enterprise.
Under interrogation, he claimed Abaaoud had been tasked by ISIS with examining the background of potential recruits for attacks in Europe, according to French police documents.
According to the documents, Abaaoud helped set in motion several plots targeting Europe, including an ambitious gun and bomb plot thwarted by a Belgian commando raid in Verviers in eastern Belgium in January 2015. He was also behind a plot by a student to attack a Paris church last April.
Abaaoud was also an associate of Reda Kriket, another member of the Zerkani network, who was arrested in Paris on Thursday. French Interior Minister Bernard Cazeneuve has alleged that Kriket was in the final stages of planning an attack.
Inside an apartment rented by Kriket in the Paris suburb of Argenteuil, police found 2 kilograms of the high explosive TATP and several Kalashnikovs. Two of those arrested the following day in Brussels were linked to Kriket, according to officials.
Another man was arrested in Rotterdam on Sunday as part of the same investigation. The 32-year old French citizen is named Anis B. and accused of “involvement in planning a terrorist attack,” according to French media.
Abaaoud is also linked to the very first terror attack carried out by an ISIS sympathizer in Europe. Four days before he left from Cologne Airport in January 2014, Abaaoud had a call from a Turkish cell phone — lasting 24 minutes, according to French police documents. The caller was Mehdi Nemmouche.
Five months later, Nemmouche allegedly carried out a gun attack at a Jewish museum in Brussels, killing four people. He’s awaiting trial in France.
Secret communications
The training of ISIS recruits destined for Europe involves bomb-making, weapons and communications.
Last summer, a French student was arrested in Paris on suspicion of a plot to take hostages at a concert hall. His name was Reda Hame. According to a transcript of his interrogation obtained by CNN, Hame claimed he had been provided weapons training, including in the use of Kalashnikovs, by Abaaoud in a park in Raqqa in early June. But he’d backed out of the plot when he arrived in France.
Hame also revealed to interrogators that ISIS had set up an elaborate encrypted communication system so that it could keep in touch with its European operatives.
While with ISIS in Raqqa, he said he was instructed to encrypt communications with a software tool called “Truecrypt,” which authorities found on a thumb drive he had been given by Abaaoud. Hame said he had been taught to copy a message into the software, select an encryption option and then paste the message into a password-protected sharing site.
“An English speaking expert on clandestine communications I met over there had the same password,” Hame told interrogators. “It operated like a dead letter drop.”