Direct proof of use
U.S. Forces Afghanistan reported that militants in Helmand Province's Nadi Ali District had obtained a ZPU-1 anti-aircraft gun, mounted it on a pickup truck, and staged it for use against coalition aircraft on 21 April 2009.
The same report said the militants were seen firing the ZPU-1 near a local bazaar. Coalition forces then located the gun, identified it as loaded and ready for use on the truck, and destroyed it with a precision strike after checking for non-combatants in the area.
Sources: Second Anti-Aircraft Gun Destroyed in Helmand
Timeline
Australian War Memorial collection records show a ZPU-1 associated with Afghanistan, 2001-2021, and state that Australian special operations forces serving in Afghanistan took the weapon in 2006 before it was secured at Camp Russell for destruction or use as a target.
On 21 April 2009, coalition forces destroyed the Nadi Ali ZPU-1 after villagers reported the militants' acquisition and staging of the gun and after militants were observed firing it near the bazaar.
Sources: AWM ZPU-1 Collection Record, Second Anti-Aircraft Gun Destroyed in Helmand
Narrative
The documented Afghan use fits the ZPU-1's late-service pattern as a light 14.5 mm anti-aircraft mount adapted to vehicles. WeaponSystems.net describes the ZPU-1 as a two-wheel single-barrel KPV mount whose post-Cold War value rose when heavy weapons were mounted on pickup trucks for technicals, often in ground-support roles as well as local air-defense use.
In the Helmand incident, the available source identifies the users only as militants and does not name a specific unit. The side attribution is therefore limited to Taliban and allied militants, reflecting the insurgent anti-aircraft activity against coalition aircraft that the report describes in Nadi Ali.
Sources: Second Anti-Aircraft Gun Destroyed in Helmand, WeaponSystems.net ZPU-1