On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the attacker approximately nine minutes after the shooting started. 

Hours before the attack, the gunman pledged allegiance to ISIS and terrorist leader Abu Ibrahim al-Hashimi al-Qurashi in an Instagram post. Like in similar cases, this enabled ISIS to take credit for the attack. 

THE GUNMAN

Austrian Police identified the gunman as Kujtim Fejzulai (KF), a 20-year old Austrian. He had Albanian roots and held both Austrian and Macedonian citizenships. 

KF was known to the Austrian Office for the Protection of the Constitution and Counterterrorism since 2018 when he attempted to travel to Syria to join ISIS. Turkish intelligence apprehended FK before he could cross the border and extradited him to Austria. FK was sentenced to 22 months in jail on terrorism charges but was paroled eight months later.  

In July 2020, KF traveled to neighboring Slovakia to buy ammunition for a Kalashnikov AK-47 assault rifle. He nevertheless returned empty-handed as he did not have a gun license. The Slovak police say they informed their Austrian colleagues immediately, which the Austrian Interior Ministry corroborates. 

Despite the tip-off from the Slovaks, the Austrians failed to exploit the intelligence and arrest the attacker. KF went free, attended radical mosques, and eventually procured weapons. FK also met with known foreign Islamists last summer – two from Germany who were under surveillance and two from Switzerland who have been arrested. 

THE OBJECTIVE

Neither the timing nor the target area was a coincidence. KF launched the attack four hours before new coronavirus restrictions came into effect. As the Viennese enjoyed a last night out, bars and restaurants were packed. 

The attack started near a Jewish Cultural Center on Seitenstettengasse, which was initially considered the gunman’s target. It became clear later that KF’s aim was broader. Thanks to Social Media footage and openly available mapping services, we can partially recreate the attacker’s path. 

THE ATTACK

1. Aprox. 20:00 hours (CET), Seitenstettengasse, 48°12’42.2″N 16°22’28.5″E

Tactical overview 1: Vienna gunman begins his rampage

CCTV footage from the Jewish Cultural Center shows Fejzulai, armed with an AK-47, wearing a white robe and a ski mask, running down Seitenstettengasse. At approximately 20:00 CET, KF guns down his first victim in front of Meinz Cocktail Bar. 

 2. Aprox. 20:05, Schwedenplatz tram station, 48°12’43.5″N 16°22’33.8″E

Tactical overview 2: Gunfight between terrorist and police officers

The attacker appears again on social media. An eyewitness recorded a gunfight between the Austrian police and the terrorist at the Schwedenplatz tram station. The fire exchange resulted in the injury of one officer. The eyewitness filmed the gunfight from the 1st floor of the McDonalds across the street.

3. Aprox. 20:07, Stephandsom Strasse, 48.212196’’N, 16.375128’’E

Tactical overview 3: Gunman flees location of gunfight

An eyewitness video shows the gunman fleeing the gunfight scene via Stephandsom Strasse. KF passes in front of a Billa supermarket and a theatre before taking a left turn toward St. Ruprecht church, where he is ultimately gunned down by the police. 

4. Aprox. 20:09, St. Rupert’s Church, 48°12’43.6″N 16°22’28.6″E

Tactical overview 4: Tango down

The Austrian police guns down KF near St. Rupert’s Church. A photo shared on Twitter shows the suspect laid flat on the cobblestone.  

HUNT FOR SECONDARIES?

Initial reports indicated there were multiple active shooters. Social media photos show the arrest of several suspects. 

Austrian policemen arrest several suspects in connection with the ongoing security situation on 2 November 2020

Over the next few days, the Austrian authorities continued the hunt for potential accomplices through airborne patrols and follow-up raids. At least two helicopters were spotted on flight trackers, displaying behavior consistent with aerial surveillance.

Callsign “FLYCOM2,” operated by a private airborne monitoring company, surveilled the southern city of Graz and the Slovenian border. This sortie was very likely connected with follow-up counter-terrorist activities.  

Callsign “FLYCOM2” flying in a holding pattern over Graz before returning back to Slovenia (ADS-B Exchange screenshot)

The second helicopter flew with no identity and crossed into Slovakian airspace. The helicopter loitered over Bratislava before it returned to the Vienna metropolitan area. While we cannot tell with certainty who was operating the aircraft or what equipment it was carrying on board (SIGINT, IMINT), it is highly likely that this was also a follow-up counter-terror operation. 

“Anonymous” helicopter flies over Vienna after completing a sorties in Slovak airspace (ADS-B Exchange screenshot)

Austrian police also analyzed an estimated 20,000 video materials from eyewitnesses of the attacks, searched over 18 properties, and detained 14 persons believed to be connected with the gunman. 

Despite these efforts, the police have been unable to conclusively determine whether the gunman had any accomplices. 

THE AFTERMATH

KF’s attack marks the return of mass shootings in Europe after a period of relative calm. The Vienna shooting follows a series of terrorist attacks that have shaken France in recent weeks. 

There is reason to believe that ISIS might attempt to capitalize on the recent tempo and order or coordinate a new attack. However, given the group’s precarious situation in Syria and Iraq, it is unlikely that the “central leadership” will produce more than propaganda and calls to action to incite followers abroad. 

SITE Intelligence Group reports that ISIS propaganda has already launched a social media offensive earlier this month. Pro-ISIS media is inciting lone-wolf attacks against the West, with emphasis on Madrid and Paris. 

Another important lesson to draw from this attack is that no country, not even neutral ones like Austria that refrain from foreign intervention, are safe from jihadi terrorism.

T-Intelligence congratulates the Austrian security forces for enlisting the crowds’ help in the blitz chase for the shooter. At the height of the attack, the Viennese Police asked social media users to send images and videos related to the attack. User-generated content of the shooter posted on social media, proved to be valuable Open-Source Intelligence (OSINT) for live situational awareness, trial evidence, and forensics data.

Learn more about OSINT here.  

by HARM

Vlad Sutea

Founder of T-Intelligence. OSINT analyst & instructor, with experience in defense intelligence (private sector), armed conflicts, and geopolitical flashpoints.

Related intelligence:

Russia: Novatek’s Ust-Luga Gas Complex under Drone Attack (Damage and Effects)