An Afghan national named Rahmanullah Lakanwal has been identified as the suspected shooter in the ambush attack that killed one National Guard member and wounded another just blocks away from the White House on Wednesday, the Department of Homeland Security said.

The CIA said Thursday that Lakanwal previously worked with the U.S. government, including the CIA, as a member of a partner force in Kandahar that ended in 2021 following the U.S. withdrawal from Afghanistan.

The suspect was shot by another guard member and taken into custody, officials said. He is currently hospitalized. No other suspects have been identified in connection with the shooting, multiple law enforcement sources told CBS News.

U.S. Attorney Jeanine Pirro said Friday the suspect will be charged with murder in the first degree. On Thursday, she said he was facing charges of assault with intent to kill while armed and possession of a firearm during a crime of violence. 

Here's what we know about the suspect so far. This story will be updated as additional information is confirmed. 

Suspect entered U.S. 4 years ago

Lakanwal, 29, entered the United States in 2021, multiple law enforcement sources told CBS News on Wednesday. 

Secretary of Homeland Security Kristi Noem said on X that the suspect was paroled into the U.S. on Sept. 8, 2021, under a Biden-era program for Afghan nationals called Operation Allies Welcome. 

The suspect and his family fled Taliban threats in Afghanistan's Khost province, and relocated to Kabul before being transferred to the United States, multiple U.S. officials told CBS News. 

President Trump described him as "a foreigner who entered our country from Afghanistan, a hellhole on Earth," in a video message late Wednesday. He said the suspect's status was extended "under legislation signed by President Biden."

A Department of Homeland Security official told CBS News the suspect was paroled into the U.S. on humanitarian grounds back in 2021. That was the main legal mechanism the Biden administration used to welcome tens of thousands of Afghan evacuees after the Taliban takeover in August 2021.

Lakanwal later applied for asylum with U.S. Citizenship and Immigration Services in 2024 and his application was granted in 2025, the DHS official said. But his request for a green card, which is tied to the asylum grant, is pending.

Many of the Afghan nationals who were admitted to the U.S. in 2021 were issued special immigrant visas offered to those who worked alongside the military during its 20-year war, while others were given a temporary humanitarian status known as parole. 

More than 8,000 people from Afghanistan were also granted deportation relief under a separate program called temporary protected status, which Biden extended in 2023 but Mr. Trump chose to end earlier this year.

Suspect had worked with U.S. forces and CIA in Afghanistan

A CIA spokesperson confirmed Thursday that the suspect worked with the U.S. government, including the CIA, during the war in Afghanistan. 

CBS News has also learned that the suspect led a team in the former Afghan national armed forces that worked directly with U.S. and British forces. 

Operational vetting conducted during the war was aimed largely at ensuring Afghan partner forces would not turn their weapons on U.S. personnel, and former intelligence officials said that the screening was not meant to serve as an immigration clearance. 

According to a former Afghan commando who spoke with CBS News on Thursday, Lakanwal led a unit of Afghan special forces in the south of the country and worked closely with the international troops.

The former commando told CBS News that Lakanwal was left deeply troubled by the death of a close friend and fellow Afghan commander in 2024, whom he said had unsuccessfully sought asylum in the U.S.

Multiple law enforcement sources told CBS News on Thursday that a running theory of investigators is that the suspect suffered from paranoia and other mental health challenges that indicated he believed authorities sought to deport him from the U.S. Counterterrorism officials said that ISIS and al-Qaeda-aligned narratives often target former U.S. partner forces with messaging that they will be abandoned or deported. While the suspect repeatedly expressed a fear of deportation, investigators have not linked that anxiety to extremist propaganda or a specific organization, officials said. Investigators are searching for evidence of extremist influence. 

Suspect placed on a ventilator

The suspect was subdued at the scene of the shooting and taken into custody by National Guard members and law enforcement officers, Jeff Carroll, executive assistant chief of the D.C. Metropolitan Police Department, told reporters Wednesday.

The suspect has been sedated and placed on a ventilator since the shooting, multiple U.S. officials told CBS News. The treatment has complicated efforts to interview him and retain biometrics.

Police say suspect was "lone gunman" who "ambushed" National Guard

Carroll said the suspect appeared to be "a lone gunman that raised the firearm and ambushed these members of the National Guard" as they patrolled near a mass transit station in downtown D.C.

The suspect had four rounds in his handgun initially, multiple sources familiar with the investigation told CBS News. The revolver used in the attack was not registered to the suspect, according to investigators. Instead, it belonged to a deceased Washington state resident. Officials said the number of bullets in the weapon is unusual and remains unexplained. 

The first victim — a female guard member — was struck immediately and collapsed where she stood. She sustained at least two gunshot wounds during the ambush, the sources said.

Then, the suspect took her weapon and used it to continue shooting, striking the second guard member, according to multiple sources. A third guard member, who was not injured, ultimately returned fire, ending the attack.

One of the victims, 20-year-old Army Spc. Sarah Beckstrom, has died, Mr. Trump said Thursday. The second victim, Air Force Staff Sgt. Andrew Wolfe, 24, was in critical condition after undergoing surgery, Pirro said earlier Thursday.

The guard members were on "high visibility patrols," Carroll said, part of a monthslong deployment of National Guard troops from D.C. and several states ordered by Mr. Trump.

Suspect drove from Washington state

Pirro said Thursday morning that the suspect drove to D.C. from Bellingham, in Washington state, with "the intended target of coming to our nation's capital." She said the suspect lived with his wife and, officials believe, five children.

FBI Director Kash Patel said a search warrant had been executed at the suspect's last known address in Washington state. Based on what was found at the address, law enforcement were able to find people associated with him in San Diego.

"During that process, we seized numerous electronic devices to include cellphones, laptops, iPads and other material that is being analyzed as we speak," Patel said. "Interviews were conducted and are going to continue to be conducted, and we will go anywhere in the country or the world where the evidence leads us."

Multiple family members of the suspect in Washington state have been interviewed by investigators following a search of the suspect's Bellingham home, multiple law enforcement sources told CBS News on Thursday.

U.S. intelligence analysts are combing the suspect's communications and online footprint for signs of international coordination or ideological radicalization, multiple U.S. officials said. An early review of his social media and messaging channels has not revealed links to foreign handlers or extremist groups. 

The Department of Homeland Security had earlier spelled his last name as Lakamal.