It’s been quite the journey. What started with a few hardcore illicit finance nerds has grown to a community of over 8,000, with new subscribers every day. I’m always excited when someone else agrees to receive the newsletter or follows me on this platform, because I think we’re collectively one step closer to illicit finance being taken more seriously. And as regular readers of this newsletter know, countering the illicit finance threat is something I take very seriously.

This newsletter started as something I wanted to do to capture my thinking on illicit finance and security, share insights through something more enduring than the odd thread on Twitter (I refuse to use the new name because I think it’s dumb), and promote the courses and other activities that I do as part of Insight Threat Intelligence. It’s grown well beyond that and has actually become a revenue line for the business; it’s also become a source of some expenses, because I usually have at least one researcher working on the Global Terrorist Financing Report (our monthly roundup of terrorist financing news), as well as research for other newsletters.

When I first started out, I migrated old content from a blog I was running to help populate the back catalogue – a lot of that is still available on the site if you go way, way back. As with most Substackers, I started publishing free articles, but quickly added a paywall because, frankly, those news roundups are an annoying amount of work. Artificial intelligence has helped a bit, but we still need to check every story, verify details, and make sure it’s accurately represented, and I have yet to find an AI tool that does that to my satisfaction. All that to say: this newsletter remains labour-intensive, and I’m happy about that. The writing is the work.

Somewhere along the way, I started trying to write twice per week. That turned out to be too much — for both my readers and me. So now we focus on one article per week, and sometimes add a second if things are particularly newsy. I’m increasingly trying to take things slowly: reading, writing, and publishing with intention. In our information ecosystem, I think we can all use a bit of a break, and a focus on more signal, less noise.

Growth on this platform hasn’t been exponential for me. I feel like I’ve earned every one of my followers or subscribers; while Substack touts a network effect, I have yet to really experience it, and I haven’t had any posts go truly viral as I have elsewhere. But there’s something more organic and sustainable about this – I feel like every person is here because they want to be, not because they feel like they should be, or because the algorithm told them to be.

I think one of the things that I like the most about writing a regular newsletter is that it keeps the writing muscles sharp, even during long periods where I’m mostly researching, travelling, or giving talks, like right now, when over the period of three months I’m scheduled to be in three different countries and eight cities, some twice. It forces me to write, for better or for worse. Yes, this is pressure, but I also give myself grace, and if I really need to miss some weeks, that’s okay.

In recent years, I’ve experimented with publishing series. I’m not sure that these really work, but I like them because they give me a way to break up longer pieces of analysis and share them with readers, without overwhelming people with details, links, or forty-page documents. Feel free to let me know what you think about these series in the comments, by email, or however we communicate.

This platform itself isn’t without flaws. There are way too many Nazis on the platform, although I’d argue this is true of most social platforms these days. Substack also takes a pretty big cut of my profits, particularly compared to other platforms. Finally, Substack has started a Polymarket integration, which I think is criminal. (Note: it is not technically criminal now, but I’m willing to bet (haha) that it will become criminal within ten years when we see the full effects of the gaming and gambling epidemic. Maybe sooner, although policy change takes time.) This is all driven, of course, by Substack’s need to become profitable. It has no alternative viable path to profitability. Which, in my view, raises questions about the platform’s long-term viability.

To that end, I’ve migrated my content to a blog hosted on my website, which you can access at www.insightthreatintel.com. It has both a free and a paid section, and one of my wonderful team members maintains it, keeping it up to date with the latest news and analysis, pretty much at the same time as we release articles on Substack. This also gives some readers the chance to subscribe without supporting the Substack platform, which is an absolutely valid choice.

That’s not to say I’ll be disappearing from here anytime soon, but it is to say that I’m making plans (and maintaining newsletter lists!) so that if Substack disappears, I can still keep doing this work. Because that’s what matters, not the way it lands in your inbox.

Share

That’s enough reflection for one day. On to the good stuff. To celebrate my five years on this platform, I’m offering a huge discount for new subscribers: 50% off an annual membership. This is a rare sale (we almost never have them), and this is by far the largest discount I’ve ever given. It’ll be available for the full month of April, so if you want to take advantage, be sure to lock it in before the end of the month. And you know the drill: like, share, and subscribe to help us grow our community!

50% OFF!

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

We’ll be back with regular newsletters in April — we’re on a short hiatus as I wrap up some significant fiscal year-end projects, deliver some technical assistance, and generally just try to get caught up on life.

If you want something a little bit more hands-on, we also have a course based on the book, which you can access here:

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

CASIS is pleased to announce the 2026 essay contest. Essays must address some dimension of intelligence, security, or law enforcement issues in any time period and in any country. Submissions can be from any Humanities or Social Sciences discipline, inter-disciplinary programmes, or law school.

For a full description of eligibility and requirements, see the official call for papers here.

The winners of the essay contest will receive cash prizes ($2500 for the graduate winner and $1000 for the undergraduate winner), and will also be invited to present their papers at the annual CASIS Symposium in Ottawa.

Please share with friends and colleagues!

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

In February 2026, news of terrorism financing struck almost every region of the world. From North America and Western Europe to the Middle East and Africa! We cover illicit financing through NGOs, terrorist organizations’ gold reserves, and money-filled briefcases headed to Hizballah. So, have a read, share with a colleague, and don’t miss out on our long-read recommendations!

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

Read more

It has been another packed month, full of research and analysis on terrorist financing and emerging threats. Be sure to subscribe so you don’t miss out!

In case you missed it…

Jessica is leading a new research project with the SOC ACE Research Programme: Criminal Hands, State Ends: State-Sponsored Assassination Using Organized Crime. The project examines how governments exploit organized crime networks for targeted killings. Check out the full project here.

Meanwhile, Leah, Steph, and Jess have been busy on the Secure Line podcast, releasing four new episodes, covering everything from global policy and organized crime to domestic threats and security trends. They had a talk about PM Carney’s Davos speech, how organized crime is increasingly being used as a tool of state power, grievance-fuelled violence (with Emily Corner, in light of the mass shooting at Tumbler Ridge), and reporting on national security issues with Chris Nardi from the National Post. Catch up on the latest episodes here.

Lastly, Jessica was quoted in a Global News article, offering her perspective on ongoing foreign interference in Canada.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Illicit Finance Investigations

The Illicit Finance investigations bundle includes access to both Financial Intelligence Fundamentals and Financial Intelligence Sources and is your one-stop shop to learn how to conduct an illicit finance investigation.

Whether your goal is to work as a financial intelligence analyst, an investigator, or in a related field, this bundle ensures you’re equipped with the skills needed to succeed.

Enroll now and take your expertise to the next level!

Articles

February was packed with insight. We started the month with our analysis of the 2025 Bondi Beach terrorist attack, breaking down how it was financed and what it reveals about disrupting future attacks. Next, we shared a commentary outlining Jessica’s recommended priorities for Canada’s future financial crimes agency to tackle emerging threats and protect Canadians. We also unpacked the 37th UN Monitoring Team Report, showing how ISIL, Al-Qaeda, and associated groups continue to sustain themselves through both traditional and innovative financing methods. Finally, in the second article of our Axis of Illicit Finance Series, we examined how Iran moves funds to the Houthis using cryptocurrency, spotlighting the networks that underpin this capability.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for February! See you in March with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

One of the most notable developments in AQ/ISIL terrorist financing concerns the Allied Democratic Forces (ADF), which is reportedly using satellite internet to facilitate cryptocurrency conversions into state-issued currency, including through mobile money applications. This demonstrates not only the increasing accessibility of crypto for terrorist actors but also a significant operational adaptation to access crypto even in remote areas. The technical and logistical barriers are being overcome, and groups are increasingly integrating digital assets into local financial ecosystems.

At the same time, while cryptocurrency adaptation is increasing, it does not displace more traditional revenue streams. Across theatres, local taxation and extortion networks remain central to sustaining operations, alongside criminal activity such as smuggling and illicit trade. The report reinforces a familiar pattern: innovation at the margins, but continuity at the core. For most groups, territorial control, coercive taxation, and embedded criminal economies continue to underpin their financing strategies.

JNIM

According to the UN, JNIM profited from a single large ransom payment and used that to increase its capabilities. Here at Insight Monitor, we wrote about that large ransom payment, noting that “the money will certainly allow JNIM more operational freedom of movement in the coming months, and likely incentivize them to gain more territory and solidify control and influence in the region.” JNIM engages in both low-level (and low-cost) local kidnappings, as well as higher cost (and higher reward) international kidnapping for ransom.

JNIM is assessed by the UN to be the wealthiest Al-Qaeda affiliate after Al-Shabaab, having significantly expanded its revenue base through territorial control. The group raises funds by taxing and regulating gold mining and other commercial activities, imposing road tolls and transportation fees, and engaging in smuggling and livestock rustling. It also collects zakat (charitable donations), with rates varying by location; in areas where local communities resist or are perceived as uncooperative, zakat can be increased to extortionate levels. This diversified and locally calibrated approach to revenue generation has strengthened JNIM’s financial resilience.

Lakurawa

The UN also mentioned (I believe for the first time) Lakurawa, a group within the Islamic State Greater Sahel,2 and described their financing as primarily illegal tax collection and cattle rustling. You can read more about Lakurawa in this Soufan Center intel brief.

Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

ADF

The Monitoring team also reported an increase in ADF's use of cryptocurrency for financing. They also noted that the ADF now has greater satellite connectivity, enabling the group to convert cryptocurrency into usable funds via mobile money applications and wallets. This capability allows them, even when deep in the bush and in areas outside of conventional cell coverage, to access and covert cryptocurrency to state-issued currency. To read more about ADF financing:

Share

ISIL

The UN monitoring team assesses that the revenue collection capability of ISIL in Somalia has been significantly degraded. While the group continues to generate revenue through its business interests, it can no longer collect revenue in key locations such as Bosasso, Qandala, and Ba’ad, where security conditions have tightened. The securitization of these areas has disrupted their taxation and extortion activities, constraining their ability to operate as they once did. That said, ISIL-Somalia has been able to draw on residual funds, which have helped sustain the group despite these setbacks.

ISIL-K has sought to exploit geopolitical flashpoints, including the war in Gaza, to drive fundraising and mobilize support. By framing distant conflicts as part of a broader narrative of global grievance, the group attempts to tap into issues that resonate with potential donors and sympathizers. This reflects a broader adaptation strategy: rather than relying solely on local revenue generation, ISIL-K leverages international events to expand its financial reach and reinforce its relevance within the global jihadist movement.

At the same time, counterterrorism efforts have disrupted elements of ISIL’s broader financial architecture. In Iraq, authorities dismantled a finance network with connections stretching to Côte d’Ivoire, Madagascar, and Togo. The geographic spread of this network underscores the transnational character of ISIL’s facilitation structures and its reliance on dispersed nodes to move and store funds. Disruptions in one theatre, therefore, have ripple effects across regions, illustrating both the network's scope and its potential vulnerability to coordinated action.

ISIL-K has also faced setbacks in the digital financial space. The group reportedly lost access to approximately $100,000 in Monero after several individuals were arrested, preventing it from retrieving funds held in associated wallets. In response, it altered its Monero quick response code distributed through its propaganda arm Voice of Khorasan and introduced a new Bitcoin address. This episode highlights both the risks and adaptability associated with cryptocurrency use: while digital assets offer speed and global reach, they also expose groups to technical and operational vulnerabilities when key facilitators are detained.

Al Shabaab

The report also notes developments concerning Al-Shabaab and its relationship with Al-Qaeda in the Arabian Peninsula (AQAP). While financial support from Al-Shabaab to AQAP may have declined, cooperation between the two groups continues. This suggests that even when financial flows fluctuate, operational or strategic ties endure, including those associated with weapons trafficking networks. In the Somali context, this underscores a broader pattern in which terrorist groups adapt to financial pressure but maintain networks that allow them to remain resilient.

To read more about Al Shabaab financing:

Libya

In Libya, security services have dismantled at least four cells involved in terrorist financing, migrant and fighter smuggling, and media operations, with links extending to Europe, Iraq, Syria, the Sahel, and East Africa. One of these cells played a logistical role, facilitating operations through smuggling networks and money laundering. The use of smuggling routes and financial crime as enabling mechanisms reflects a pragmatic blending of ideological objectives with criminal enterprise; when one node is disrupted, others can absorb the shock.

AQAP & the Houthis

At the same time, the threat from Al-Qaeda in the Arabian Peninsula (AQAP) is reportedly growing, driven in part by improved funding streams. AQAP, for instance, has profited from Al Shabaab piracy by receiving a share of payments made by vessels in exchange for transiting through high-risk waters. The group also uses Telegram to solicit funds and connect supporters to financial intermediaries. (This is a form of informal crowdfunding that allows them to access international support networks.) Increased access to resources appears to have strengthened the group’s operational tempo and capacity, underscoring the persistent relationship between financing and capability. Where funding improves, groups can move beyond subsistence-level activity and reconstitute networks, invest in recruitment, and plan more ambitious operations. This pattern reflects a familiar dynamic: financial resilience often precedes operational resurgence.

Further complicating the picture, the Houthis reportedly provided AQAP with financial support for a successful attack. This illustrates the fluidity of relationships in conflict environments, where tactical or transactional arrangements can override ideological divides.

Conclusions

The through line in this report is not dramatic innovation; it is consistency and slow adaptation to counter-terrorist financing measures. Groups are experimenting at the edges, whether through cryptocurrency, satellite internet access, or opportunistic alliances, but their core revenue models remain intact. Taxation, extortion, smuggling, and embedded criminal economies continue to sustain most organizations. Disrupting a wallet address or arresting a facilitator matters, but it rarely dismantles the underlying system. These networks are adaptive by design; when pressure is applied in one area, activity shifts to another.

Countering this ecosystem is becoming increasingly difficult amid geopolitical fragmentation and strategic distraction. Cooperation on sanctions enforcement, financial intelligence sharing, and capacity-building is more difficult to sustain when alliances are divided and disrupted and multilateral institutions are strained. Terrorist groups, by contrast, exploit these seams: weak governance, contested territories, and inconsistent enforcement all make terrorist groups stronger. As states turn inward or prioritize great-power competition, the space for illicit finance expands. The difficulty of coordinated disruption, combined with enduring funding streams, leaves all of us less safe than we might otherwise be.

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

But before we dive in… Jessica has been busy in the background this month:

• She shared her insights in this Global News article involving a Toronto auto exporter who has been accused of laundering money for Hezbollah.

• She provided expert commentary in a Money Laundering Bulletin article on how Hawala networks and crypto-enabled transfers are exploited by terrorist groups.

• She was the guest speaker in the Terrorist Financing Detection: Tools, Tactics and Real-World Solutions webinar hosted by Nasdaq Verafin.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Financial Intelligence Sources

Ready to go beyond the basics of financial intelligence? Our Financial Intelligence Sources course dives deeper, exploring open and closed sources, leaked data, and more. Perfect for researchers, compliance and intelligence professionals, and anyone in a FININT or OSINT role.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month, we kicked off an 8-part series exploring how Iran uses cryptocurrency to evade sanctions and operate within a broader illicit financial network. We also introduced our Trends in Terrorist Financing 2020-2025 dataset, built from six years of research, which highlights key patterns in how terrorist financing operates. Finally, we examined how digital assets are increasingly used alongside traditional financial systems, the rise of crypto-hawala networks, and the regulatory and intelligence challenges this creates.

Stay informed with our latest analyses — explore our newest articles below:

Share

That’s a wrap for January! See you in February with more analysis and updates. Be sure to subscribe so you don’t miss out! This is news and analysis you won’t find anywhere else.

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Financial Intelligence Sources

Do you want to identify and exploit new sources of financial intelligence? Our evergreen course is your guide to finding, analyzing, and contextualizing open source financial intelligence. This step-by-step guide to FININT sources will greatly expand your intelligence knowledge and skills. This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

North America

Read more

1. A not-to-miss webinar on terrorist financing

2. An update on recent media interviews

3. Exciting news about the paperback edition of Illicit Money: Financing Terrorism in the 21st Century

4. A link to the latest Global Terrorist Financing Report

5. News about our terrorist financing analysis course

6. Two new Secure Line podcast episodes!

Read for more:

Terrorist Financing Webinar

In partnership with Nasdaq Verafin, Jessica will be sharing her knowledge and expertise on terrorist financing trends and issues on a panel. You can register for “Terrorist Financing Detection: Tools, Tactics, and Real-World Solutions” here. The webinar is on 21 January at 12:30 pm EST. Don’t miss out!

Register

In the Media

Jessica gave a media interview for the Financial Times on Binance’s compliance woes. You can read her comments here. Her thoughts on the issue of noncompliance on crypto exchanges can be summarized succinctly with this quote: “…part of the problem with the fines is that we’re just talking about so much money being made on these platforms that even a billion-dollar fine becomes fairly meaningless.”

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Illicit Money Update

Good news! Jessica’s publisher for Illicit Money also recently announced that the book is going to be published in paperback format. We know some of you have been put off by the price (especially outside of North America), so hopefully this version will be a bit more affordable. We’ll be sure to share details when it’s released.

Terrorist Financing Analysis

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to the terrorist financing analysis course, plus a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Share

Secure Line Podcast

Secure Line podcast also released two new episodes in December. The first was with the Economist’s Defence Editor Shashank Joshi where Jessica, Leah and Stephanie talk about the year that was (2025) and the year ahead (2026). The second was the Festivus episode, where the Secure Line hosts share their grievances from the year and what they’re looking forward to for 2026. This is a rare video episode, complete with Christmas sweaters!

There’s lots more to come from Insight Monitor, Secure Line, and Insight Threat Intelligence for 2026, so be sure to subscribe and stay up to date!

Subscribe now

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Have a read, and share with a colleague!

Read more

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Terrorist Financing Analysis Bundle

Become an expert on how terrorist groups move, store, and exploit funds. This bundle gives you access to a customizable analytic tool, relevant case studies, and other practical resources you need to detect, analyze, and disrupt illicit financing networks.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

This month, we began with a profile of Al-Qaeda affiliate Jama’at Nusrat al-Islam wal-Muslimin (JNIM), exploring how its $50 million ransom boosts operation capacity and regional influence in Mali. We also covered the FATF 2025 plenary, providing a quick summary of “grey” list updates and the latest global AML/CTF developments. We wrapped up the month with a rare money laundering conviction in Canada, breaking down the Alexandra Chow case and what it reveals about the country’s $45 billion illicit economy.

Stay informed with our latest analyses — explore our newest articles below:

Share

December is going to be a bit slower for Insight Threat Intelligence — we are off most of the month, so expect just a couple of articles from us. But we’re back in the new year with a full year of content planned (and room for some surprises, which there always is!). As a reminder, our prices are increasing January 1st, so if you haven’t subcribed yet, be sure to do so before the new year! The increase will be modest, but existing subscribers remain at the old rate. So what are you waiting for?

Subscribe now

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Have a read, and share with a colleague!

Read more

Read more

Read more

But before we dive in…

A few quick updates to keep you in the loop:

Cynthia Miller-Idriss will be in Ottawa on Thursday October 30th to talk about her new book Man Up! Her work continues to challenges how we understand extremism, gender, and radicalization, making for a lively and timely discussion. Tickets are limited so grab yours while you can.

Registration for the CASIS 2025 Symposium closes on October 10th. Don’t miss your chance to join researchers, policymakers, and practitioners as they tackle today’s shifting security landscape. For more info and to register click here.

The Secure Line Podcast is back and we have released three new episodes to kick off the season! Leah, Steph, and I are excited to be back and will be unpacking the key issues shaping Canadian and global security. You can find us on Spotify, YouTube, or wherever you get your podcasts.

As always, we published our latest Global Terrorist Financing Report, highlighting major developments from the past month.

Financial Intelligence Sources

Ready to go beyond the basics of financial intelligence? Our Financial Intelligence Sources course dives deeper, exploring open and closed sources, leaked data, and more. Perfect for researchers, compliance and intelligence professionals, and anyone in a FININT or OSINT role.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

In September, we dug into the finances of the Gulf Cartel, tracing how it raises, moves, and manages its funds while expanding its global reach. We examined JNIM, one of the world’s most dangerous terrorist groups, and broke down Canada’s 2025 Money Laundering and Terrorist Financing Risks Report, providing fresh insight into evolving threats and their regulatory impact. We also highlighted trends in left-wing terrorism in North America, showing incidents remain stable overall - contrasting Canada’s sharp decline with the continued surge in right-wing violence. Finally, we explored La Familia Michoacana’s origins and financial strategies, revealing how the group conceals and sustains its operations across multiple factions.

Stay informed with our latest analyses — explore our newest articles below:

Share

Much of this content is behind a paywall, but now you can access one article. Which one will you choose? Feel free to share this with a colleague, and thank you for your commitment to tackling illicit finance and global security.

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

📚 Cynthia Miller-Idriss in Ottawa

Early next month, Cynthia Miller-Idriss will host a talk here in Ottawa on her new book Man Up!. Her work continues to challenge our understanding of extremism, gender, and radicalization, and the discussion is sure to be lively, timely, and deeply relevant to both Canadian and global audiences. The good news is that it’s open to the public, so be sure to join us!

Register

🎟 CASIS 2025 Symposium: Disorder at the Gates

The annual CASIS symposium is right around the corner — Disorder at the Gates will bring together researchers, policymakers, and practitioners to examine the shifting security landscape.

Tickets are still on sale for a few more weeks — so don’t wait to secure your spot! Some of our featured speakers include Michael Kovrig, Deputy Minister of Public Safety, Tricia Geddes, and legal scholar Kent Roach, among many others. Expect high-level insights and some candid conversations you won’t hear anywhere else.

Register: CASIS

🎙 Secure Line Podcast — Season in Full Swing

Secure Line is back! We’ve released two new episodes to kick off the season, with much more planned for the rest of the year. From Bill C-2 (Strong Borders) to state-sponsored killings and your usual terrorism, foreign interference, and espionage content, Leah, Steph, and I are unpacking the key issues shaping Canadian and global security. If you haven’t tuned in yet, now’s a great time to catch up. We’re on Spotify, YouTube, and wherever you get your podcasts. Listen, rate, share, and subscribe!

🔒 Behind the Scenes: GNET Talk

I also recently gave a talk for GNET (unfortunately, not publicly available), where I drew on ITI’s unique dataset of terrorist financing and adaptation. This is exactly the kind of cutting-edge analysis we build into our products — and occasionally share with select audiences. You’ll see some of that data in this newsletter and in upcoming reports, and if you want to commission some specific research and analysis from us, get in touch!

Contact Us

📑 Recent Insight Monitor Analysis

If you missed them, here are some of the latest pieces of analysis from Insight Monitor:

• The 2025 State of Money Laundering and Terrorist Financing in Canada — a critical look at where Canada stands, and the gaps that persist.

• Global Terrorist Financing Report — August — tracking key financial trends across groups and regions.

• JNIM’s Financial Profile — an in-depth dive into the finances of Jama’at Nasr al-Islam wal Muslimin.

💡 Final Note

As always, thank you for reading Insight Monitor. This community continues to grow (we’re just shy of 8,000 subscribers now!), and I’m grateful for the engagement, feedback, and ideas you share. If you or your organization need in-depth analysis of terrorist financing, illicit finance, or sanctions evasion, let’s talk — we typically have the bandwidth for a few custom projects each year. And as always, we appreciate it when you share this newsletter so we can continue to grow our community of people interested in making the world safer and fairer for everyone!

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Have a read, and share with a colleague!

Read more

A quick note before we start: Registration is now open for the CASIS Symposium 2025 - Disorder at the Gates: Canada’s Role in a Fragmenting World. This one-day event will take place on November 7, 2025, in Ottawa, Ontario. Space is limited - check out the full details on panels, keynotes, and registration here.

As always, we published our latest Global Terrorist Financing Report, providing subscribers with a rundown of key stories which covered the activities of ISIL, JNIM, Hezbollah, and more.

Financial Intelligence Sources

Ready to go beyond the basics of financial intelligence? Our Financial Intelligence Sources course dives deeper, exploring open and closed sources, leaked data, and more. Perfect for researchers, compliance and intelligence professionals, and anyone in a FININT or OSINT role.

Join our community, tackle real-world exercises, and gain skills you won’t find anywhere else. Enroll now and take your expertise to the next level!

Articles

In August, we kicked off with the capture of ISIL-Somalia’s finance chief, Abdiweli Mohamed Yusuf —showing how taking out key financiers creates short-term opportunities for disruption. We then explored ISIL’s evolving financing methods, from cloud-based Hawala networks to low-tech cash stashing, and highlighted emerging trends and enforcement challenges. Next, we looked at Lebanon’s closure of Hezbollah’s central bank, examining whether it truly disrupts their financial operations or simply pushes them further underground. Finally, we reviewed the 2024 Coutts Plot, a planned anti-authority attack in Canada, detailing the perpetrators, their motivations, and how law enforcement successfully disrupted the plot.

Stay informed with our latest analyses — explore our newest articles below:

Share

Feel free to share this with a colleague, and thank you for your commitment to tackling illicit finance and global security.

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

The Terrorist Financing Global Landscape

In this webinar, I join Fouad Hassouneh, VP Product Management at Nasdaq Verafin, for an in-depth look at current threats and trends in terrorist financing. This exclusive event will explore valuable insights to help your institution better understand and combat the terrorist financing activities threatening global security and the financial system.

Don’t miss it on 10 September, 12:30pm. Register here: https://verafin.com/event/the-terrorist-financing-global-landscape-current-threats-trends/?src=linkedin

GNET Webinar - Terrorist Financing: Trends, Technologies, & Countermeasures

I will be presenting at the Global Network on Extremism and Technology (GNET), with support from the Global Internet Forum to Counter Terrorism (GIFCT) webinar on countering terrorist financing. I’ll be joining and to talk about the nexus between terrorist financing and technology. Specifically, the webinar will highlight the following topics:

• Tech-enabled crowdfunding and cryptocurrency: how groups adapt, or fail to adapt, to enforcement landscapes;

• From hawala to stablecoins: understanding the liquidity architecture sustaining modern extremist operations;

• A look at regional dynamics in Europe and the latest findings from the Financial Action Task Force.

The presentations, followed by a Q&A, will highlight key considerations for P/CVE practitioners, researchers, and policymakers working to counter terrorist financing.

Join us on 16 September at 11am! Register here: https://us02web.zoom.us/webinar/register/WN_adf1xYXBQPGkeIh2RJvxOw#/registration

Illicit Finance Course: Law, Power, and Global Security

I’m also pleased to share that I’ll be launching a new course this winter on illicit financing. This course is inspired by my course of the same name at the University of Calgary (where I’m a post-doctoral researcher). When I shared that I was teaching this course, many people wanted to know how they could enroll in it. So here it is! I’m still formatting it for an online-only experience (I’m teaching it in a hybrid format in Calgary), so it’s not available quite yet. However, it is available for pre-order at a significantly discounted price.2

https://insightthreatintelligence.thinkific.com/courses/IF

Disorder at the Gates: Canada’s Role In A Fragmenting World

On 7 November, join us in Ottawa as the Canadian Association for Security and Intelligence Studies hosts its annual symposium. All the relevant details can be found here:

For my part, I’ll be leading a panel on crime and national security. This is an event you won’t want to miss. And if you do attend, be sure to catch me and say hello!

Register Today

The Return of Secure Line Podcast!

And last but not least, , Leah West, and I are returning for season 2 of Secure Line. We have a great lineup planned (plus always room for “emergency pods”). We’re starting our recording today, so you can expect some new content within the next couple of weeks. And if you’re new to Secure Line, you can get caught up on YouTube, Spotify, or wherever you get your podcasts. We also share the transcript over on the substack.

That’s all for now folks. Good luck to me this fall as I try to get all of this done (and a LOT more). Stay tuned for the news, analysis, and drama you’ve come to love from Insight Monitor.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Register Today

Disorder at the Gates - Canada’s Role In A Fragmenting World

We will have four panels, a keynote address from , presentations by our student essay contest winners, and a special “history of CASIS” presentation to mark our 40th anniversary.

Our panels include:

Economic Security

Canadians are increasingly paying attention to economic security threats and international trade relationships as external shocks threaten to impact our prosperity and competitiveness. In this panel, we will discuss what "economic security" means as well as the primary challenges to being secure. Issues discussed in this panel will include: Is there any reason to distinguish between "economic security" and "national security" in today's discourse? How do Canada and like-minded countries build resiliency and mitigate short-term disruptions to its economic security? What role does intelligence and information sharing play in maintaining economic security, for example, in mitigating risks related to foreign investment? What are some risks "on the horizon" we should be thinking of? How do we remain innovative and competitive on the global stage in an era of increasing uncertainty?

Crime and National Security

In an era of geopolitical fragmentation, the lines between organized crime and national security are increasingly blurred. This panel will examine how states exploit criminal networks to advance their strategic objectives—whether through targeted assassinations, transnational repression of diaspora communities, or covert influence campaigns. At the same time, powerful criminal organizations have evolved beyond traditional illicit enterprises, amassing economic and political influence that threatens state sovereignty and stability. From cartel violence undermining governance to cybercriminal syndicates disrupting global financial systems, these entities are no longer just a law enforcement problem—they are a national security threat. This discussion will explore the evolving nexus of crime and statecraft, the implications for Canada, and how policymakers must adapt to this complex threat landscape.

Lone Actors vs Collective Actors

This panel features perspectives from a sociological, psychiatric and legal lens about what makes, drives, and maintains extremist actors ranging from those who act alone, in concert with others, and/or in the name of a terrorist organization. Panelists will discuss the latest trends about the prevalence of lone versus collective actors on the spectrum of extremism in Canada and across the world. Discussions about grievances, as understood from a psychiatric and sociological perspective, will inform questions around “why” people radicalize, what drives radicalization to violence, how we measure the risk of radicalization using actuarial tools, and how early interventions can make a difference.”

Intelligence Relationships

The new world disorder is causing nations to re-examine relationships and alliances that have historically contributed to international stability. This panel will consider how Canada’s intelligence relationships been affected by this disorder and how they might be impacted in the future. Can existing partnerships be relied upon to continue to provide the quality and quantity of information required by Canada? Is there a need to consider the establishment of new intelligence relationships? To whom should Canada turn to fill the void created by the possibility of a withdraw from long established relationships? As Canada seeks new business relationships, do they present opportunities for new intelligence partnerships? What are the risks and opportunities for Canada?

The full schedule is available here.

We hope you will join us and help advance awareness about security and intelligence in Canada!

Register Today

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.