Gun attack on MP Kamolsak sparks widening probe as ISOC-linked pickup, ex-marines and dismantling plot emerge. PM Anutin orders an urgent report into a Narathiwat ambush which left the MP’s escort officer and driver seriously injured, deepening security concerns.
Prime Minister Anutin Charnvirakul on Friday ordered a full investigation by the Internal Security Operations Command (ISOC) into reports linking an attack and attempted assassination of Prachachart Party MP and human rights activist Kamolsak Leewama on March 20. The move comes as three suspects have confirmed links to the security forces, while a vehicle used in the attack was previously owned by ISOC in the South. Police have found that a garage owner was ordered to dismantle the vehicle within hours of the early morning attack in Narathiwat on March 29. Mr. Kamolsak was uninjured, but a police officer and his driver were seriously wounded.
Police in southern Thailand are advancing an attempted murder investigation into the shooting of MP Kamolsak Leewama. The attack occurred in the early hours of March 20 outside his home in the Bacho district, Narathiwat province.
The ambush on the MP as he returned by car from parliament in Bangkok left Mr. Kamolsak unhurt. However, a police security escort officer and his driver were hit and seriously injured.
Notably, the ambush came within hours of Mr. Kamolsak being linked to the elevation of Bhumjaithai Party leader Anutin Charnvirakul as Prime Minister. However, authorities have established disturbing links between the coordinated attack and the Internal Security Operations Command (ISOC) in the southern provinces.
Investigators focus on suspect vehicle links and early arrests as multi-agency probe gathers pace
The links are particularly highlighted in vehicles used in the attack. These were possibly owned by the security agency. Furthermore, extreme efforts were made to have them dismantled. This occurred immediately after the botched attack.
Since then, investigators have moved quickly, and multiple agencies have joined the inquiry. As a result, police, military units, and security bodies are working in close coordination.
Initially, two suspects were detained, both former marines and identified as a father and son. They were apprehended soon after the attack, and police have questioned them extensively. Meanwhile, their alleged roles remain under active investigation.
In addition, a third suspect has been identified as a former naval petty officer. Therefore, authorities are examining his movements and possible involvement in the operation. So far, arrest warrants have been issued for four suspects, and investigators are actively pursuing the remaining individuals. Consequently, the scope of the case continues to expand as new evidence emerges.
That must be a disturbing proposition for the government. Notably, Prime Minister Anutin Charnvirakul is de facto the head of the Internal Security Operations Command (ISOC), which has a controversial history in Thailand.
Political scrutiny grows over ISOC’s role amid long-standing concerns from parties and rights groups
For years, the People’s Party and its original parties have warned that the agency is linked to politics. At the same time, human rights groups and activists have long questioned its role. On the other hand, it is viewed by conservatives and many in the establishment as essential to the kingdom’s security.
Of course, it is too early to say what may be behind the March attacks. However, analysts note that Mr. Kamolsak Leewama is well known for human rights activities in the South. In particular, Mr. Kamolsak’s role as a lawyer who has acted for both victims of the insurgency and those abused by state authorities may have singled him out.
However, analysts always exercise caution in such situations. Alongside potential conflict factors, there are also personal motivations which have surfaced in these cases time and again. Undoubtedly, there is pressure on Internal Security Operations Command (ISOC) Region 4 to be seen to get to the bottom of the affair.
At the centre of the investigation is a white pickup truck used in the attack. It was later discovered dismantled, which immediately raised suspicion. Subsequently, police located the dismantling site in Tak Bai district, Narathiwat.
Dismantled pickup discovery in Tak Bai leads police to garage and raises questions over intent
The vehicle had been taken apart methodically, and key identifying features were removed. In particular, the vehicle identification number had been erased, suggesting deliberate action. Following this discovery, investigators traced the dismantling to a local garage owned by Mr Sunthorn, aged 62. He operates both a garage and a palm plantation in the district, and he was brought in for questioning.
During interrogation, Mr. Sunthorn admitted dismantling the pickup truck. However, he stated that he acted under instructions from a former marine already in custody. According to his account, the sequence began late on March 20 when he was contacted via the Line messaging application.
The former marine told him that two men would deliver a white pickup truck and instructed him to dismantle it. He was also told to sell the parts, and he agreed to carry out the request. Soon after, the vehicle arrived at his premises without license plates, and two men delivered it as described.
Garage owner details delivery of truck and later discovery of link to shooting of MP
After receiving the truck, Mr. Sunthorn drove the two men to the former marine’s residence before returning home. At that point, he claimed he had no knowledge of any criminal activity. Later that morning, however, he said he learned of the shooting through media reports. Only then did he suspect a connection between the vehicle and the attack.
Furthermore, he stated that one or two days later, the former marine contacted him again with further instructions. He was told to dismantle the vehicle completely and to erase the chassis number.
In response, Mr. Sunthorn said he complied fully with those instructions. He dismantled the vehicle and proceeded to sell the parts. Now, investigators are tracing those parts in an effort to recover evidence.
At the same time, they are verifying his account through communication records and other data. Importantly, Mr. Sunthorn identified one of the men who delivered the truck as a former naval petty officer. This detail aligns with police findings, and therefore, scrutiny has intensified around that individual.
Investigators examine ISOC vehicle ownership and communications as the probe deepens into suspects
Currently, Mr. Sunthorn remains under intensive interrogation, and his statements are being cross-checked. Investigators are reviewing his Line messages, call records, and financial transactions.
Meanwhile, the origin of the pickup truck has drawn significant attention. Authorities have confirmed that the vehicle belonged to the Internal Security Operations Command, or ISOC. As a result, the case has escalated beyond a standard criminal investigation.
Reports indicate that the vehicle may have been lent by an ISOC soldier to a former soldier who is now a suspect. However, this detail remains under formal investigation, and officials have not reached a conclusion.
Nevertheless, the use of a state-linked vehicle has become a central issue. Investigators are examining how the vehicle was accessed and whether any procedures were violated. In doing so, they are also assessing possible accountability within the system.
Prime minister orders urgent ISOC investigation as coordination intensifies across security agencies
In response to these developments, Prime Minister Anutin Charnvirakul issued direct orders on Friday, April 3. He instructed ISOC to conduct an urgent and thorough investigation into the case. Acting in his capacity as Director of ISOC, he also ordered close monitoring of the situation. Furthermore, he called for all relevant agencies to integrate their operations fully. As a result, coordination between police, military, and security bodies has intensified.
ISOC has acknowledged the investigation and confirmed that inquiries began immediately after the incident. The agency stated that it is working closely with police and other security units. Officials said that early arrests reflect proactive operations and effective coordination.
However, the issue of the vehicle remains unresolved, and ISOC has stated that a detailed examination is underway. It is currently verifying whether any government resources were misused in the attack.
Moreover, ISOC has emphasised its commitment to transparency and accuracy. It stated that strict legal action will be taken if any misuse is confirmed. Colonel Ekwarith Chobchuporn, deputy spokesperson for ISOC Region 4, provided further clarification.
ISOC outlines legal process and pledges full cooperation while limiting disclosure of case details
He confirmed that all relevant agencies have integrated their efforts and that investigations are progressing rapidly. According to him, initial suspects have already been apprehended in line with legal procedures.
However, he declined to disclose detailed findings, stating that such information could affect the outcome of the case. Therefore, further updates will be released through official legal channels. He also reiterated that ISOC will fully support the police investigation.
In addition, he confirmed that any personnel found to be involved will face decisive legal action, including those within ISOC structures. At the same time, the agency has called on the public to rely on verified information and avoid spreading unconfirmed reports.
Meanwhile, political attention has intensified following these developments. Prachachart Party leader Thawee Sodsong has publicly highlighted the case. As a former Minister of Justice, he pointed to the dismantled vehicle as a key concern.
Notably, he emphasised that the vehicle was identified as a state asset, which has raised further questions. Earlier, security forces raided two locations in Tak Bai district and located the dismantled pickup truck, advancing the investigation significantly.
Attack leaves two injured as violence rises in the southern region under heavy ISOC security presence
Regarding the attack itself, Mr. Kamolsak escaped without injury. However, his driver was seriously wounded, and an escort police officer also sustained serious injuries. Both individuals received medical treatment, although their current conditions have not been detailed.
The attack took place in Narathiwat province, part of Thailand’s southern border region. This area has long been subject to extensive security operations. The South, including Narathiwat, has seen a notable surge in violence and attacks since early 2025.
ISOC maintains a major presence there through its Region 4 Forward Command. Notably, the agency has operated in the region for decades and oversees a wide network of security personnel.
Estimates indicate that ISOC’s presence in the South includes tens of thousands of personnel. These include military units, police officers, paramilitary rangers, and local volunteers. Therefore, the agency plays a central role in regional security operations. Against this backdrop, the emergence of links between suspects and former security personnel has intensified scrutiny.
Security force links and timeline analysis deepen probe into planning and execution of attack
Three suspects are confirmed to have prior security connections, including two former marines and one former naval petty officer. As a result, investigators are examining these links closely. They are assessing whether these connections influenced the planning or execution of the attack. However, no conclusions have been announced at this stage.
Meanwhile, the timeline of events remains under detailed review. The vehicle was delivered to the garage on March 20, while the shooting occurred in the early hours of the same morning. Investigators are analysing activities during this period to establish a clear sequence. In addition, communication data has become a key focus, including Line messages and phone records.
Furthermore, the dismantling of the vehicle appears deliberate and systematic. Instructions included removing identifying features such as the chassis number. Therefore, investigators suspect an effort to obstruct detection and delay identification.
Police reconstruct vehicle movements as the probe continues and further arrests remain possible
Police are now reconstructing the vehicle’s movements before and after the attack. They are also identifying all individuals who handled the vehicle at any stage.
At the same time, authorities have not ruled out further arrests. The investigation remains active, and new details continue to emerge. Overall, multiple agencies remain engaged, and all leads are being pursued. Consequently, the case remains a priority for authorities in the southern provinces as efforts continue to establish the full facts.
Prime Minister Anutin condemns cowardly attack on Southern Muslim MP who voted for him on Thursday
War of word erupts between Thailand and the United States after officials are sanctioned over Uyghurs
The attacks are yet another potential political headache for Prime Minister Anutin Charnvirakul, whose new government will be installed on Monday. Polls on Sunday suggest the public has little faith in the Prime Minister’s proposed administration. This is linked to the energy and economic crisis unleashed by the US-Iran war, which shows signs of escalating.
Join the Thai News forum, follow Thai Examiner on Facebook here
Receive all our stories as they come out on Telegram here
Follow Thai Examiner here
Further reading:
Prime Minister Anutin condemns cowardly attack on Southern Muslim MP who voted for him on Thursday
Senator warns Barisan Revolusi Nasional (BRN) operating at will in southern provinces causing terror
Defence minister says Barisan Revolusi Nasional (BRN) carried out gold raid and horde is in Malaysia
Insurgency erupts again in South with bold and brazen attacks on security forces shielded by border
Army security agency confirms bomb spree targeting tourist hotspots near Phuket linked to insurgency
