The state of terrorist financing, as seen by the United Nations
Review & analysis of the 33rd Monitoring Team report
Last week, the United nations Monitoring Team produced its thirty-third report on ISIL and Al Qaeda. I usually do a quick review of these reports on Twitter, but have decided to move my analysis over to Insight Monitor to better preserve and formalize it. This analysis pulls out the main finance pieces as reported by member states, outlines what’s new, and augments it with additional open-source material and analysis.
Overall, the report found that in some regions, there are fewer attacks, but that the lower number of attacks is being offset by increases in lethality. My view is that this could demonstrate that these groups have an abundance of resources. Terrorist groups tend to prefer higher lethality, more complex attacks (these tend to generate more media attention, among other things), and this could demonstrate an increasing resource base.
The ISIL Network
ISIL’s network in Africa (and beyond) remains a main line of reporting for the Monitoring Team. The team reported on most of the provinces, if only with a line or two for some of them.
With the loss of territory in Iraq and Syria, ISIL lost much of its immediate ability to generate large revenues. Over time, the United Nations Monitoring Team reports have indicated a decline in estimates of ISIL revenues from between $100-$300 million to more recent estimates of $25-50 million in reserves.1 Reporting indicates that ISIL reserves continue to decline and are currently estimated to be somewhere between $10 and $25 million.
Since the death of prior ISIL Mozambique / Ansar al Sunna / ASWJ leader Omar, there has been silence from current leader Abu Yasir Hassan, who has sought to disassociate from ISIL. There has also been no clear command and control over ASWJ by ISIL, including financially.
The leadership structure of ASWJ has been murky for a while, and my understanding was that Hassan had been the leader of ASWJ since at least mid-2023, if not earlier. While there have been some limited reports that ASWJ has received funds from ISIL, none of that information has been contained in UN reports.
In the DRC, the monitoring team reports that Meddie Nkalubo is alive, and actively directing and participating in ADF attacks. He was personally responsible for funding a campaign to bomb Uganda (all nine bombs used and intercepted in Uganda). Nkalubo is a coordinator in the ADF’s international finance network.
With the death of al-Karrar office leader al Sudani, Adbulkadir Mumin (the emir of IS East Africa) has taken over command and control of the al-Karrar office. The Monitoring Team also reports that the death of al Sudani seriously damaged the strategic role of ISL’s network in eastern and southern Africa.
However, this damage does not seem to have resulted in the loss of financial resources for the various groups that are part of this network; this might be a result of the relatively autonomous nature of much of their financing. While ISIL provided start-up money, the groups have been encouraged to become more autonomous over time, and they appear to have succeeded.
The monitoring team also reports that one member state believes that the east and central Africa network isn’t really ISIL; instead, it’s a network of fighters and religious figures with long-standing ties that use the network to extort money and exploit resources for financial gain and control, and that ISIL leverages these networks.
I’m not entirely sure what to make of this assertion. It’s plausible, but we’ve also seen extensive ISIL use of these networks, so I wonder if it’s perhaps a distinction without a difference. The end result is the same: ISIL is able to enjoy a robust and resilient network for finance and facilitation.
Islamic State West Africa Province generated funds locally from criminal activities, taxation of fishermen and traffickers, cattle rustling, kidnapping for ransom, and farming activities such as growing red chillis for sale to countries neighbouring Lake Chad. Reports of poaching (mostly ivory) in Benin, the Niger and Nigeria were also reported. Despite both Boko Haram and ISWAP being able to raise their own funds, their fighters were not well paid. My own research (yet to be published) indicates that there’s a lot of variation in the pay of fighters — depending on their role and responsibility, and a lot of the pay comes in the form of looted goods.
Despite the Somali government’s counter-terrorism offensive, Al Shabaab’s operational and financial capability remains undiminished, and the Monitoring Team reports that the group generates $100 million per year, mostly from illicit taxation. Mogadishu and southern Somalia remaining its biggest tax base. Al Shabaab exploits the collection of zakat, using targeted lifestyle audits of wealthy businessmen.
While Insight Monitor has yet to tackle the issue of Al Shabaab finance, we can refer to this excellent report.
Terrorist financing and cryptocurrency
Member states reported on a number of terrorist financing cases involving cryptocurrency. One reported a case involving a complex terrorism financing scheme for the recruitment and travel of foreign terrorist fighters to Afghanistan through electronic wallets that received over $2 million in donations on the Tron blockchain from more than 20 Western countries. The scheme was operated by an organized criminal network of Tajik individuals led by Khukumatov Shamil Dodihudoevich (alias Abu Miskin), who was arrested in Istanbul, Türkiye, in late June. This is likely a reference to this report (from TRM Labs) and this report of arrests in Türkiye.
A pro-ISIL media group, Meydan Medya, appealed to donors, directing the use of Monero coin. Other ISIL outlets also appealed for Monero in more than 20 languages. Member states also noted Al Qaeda’s use of cryptocurrency to raise and move funds. This is interesting - I don’t think we’ve seen much from this group on the crypto front, so this will be a trend to watch (and investigate further).
In December, the Spanish National Police dismantled an ISIL network with branches in Afghanistan, the Middle East, the Sahel, the Maghreb and Europe, accused of laundering funds and moving €200,000 worth of cryptocurrencies to conduct attacks in Europe. Thirteen individuals were arrested, and two imminent attacks thwarted, in this complex counter-terrorism investigation supported by 12 countries. More information on the case can be found here.
The Republic of Korea imprisoned two Central Asian individuals for soliciting funds for KTJ in the Syrian Arab Republic using cryptocurrencies (stablecoins). Approximately $12,000 were used mostly for purchasing weapons and ammunitions.
AQAP faces financial challenges and is unable at times to pay members or finance operations. The group uses robbery, arms smuggling, counterfeiting, selling petroleum derivatives and extorting local business to pay for protection as primary sources of income. In recent months, the AQAP abduction cell increased kidnapping-for-ransom operations in Yemen, targeting foreign employees of international organizations. The sale and purchase of land on real estate markets were reported as a means of income. AQAP also raised funds from remittances from overseas relatives of members. Financial troubles might be exacerbated by the death of Abu Nasser al-Hadhrami, who dealt with media and financial matters.
Jama’at Nusrat Al-Islam Wa Al-Muslimeen (JNIM), an umbrella coalition of al-Qaeda aligned groups: Experts believe that JNIM-affiliated groups, including Katibat Macina, jointly earn between $18 and $35 million annually. JNIM has significant local capacity that allows it to levy taxes, extort funds and carry out abductions (likely kidnapping for ransom). The monitoring team reports that the group is well financed mostly from local funding sources, including by taxing or operating artisanal mines mainly in Burkina Faso and through cattle rustling within the Sahel region.
AQIM is involved in arms and drug smuggling, illegal migration, and taxation. Prior Monitoring Team reports suggested that AQIM was not directly involved in arms smuggling but rather collects fees and in-kind services from criminal organizations in return for protection.
The Monitoring Team reports provide a snapshot of terrorist financing activities across a number of different groups. While they occasionally provide previously un-reported information, member states tend to share information that has already been reported publicly, as the media articles linked here illustrate. Member states should be encouraged to share more high-level analysis, more detailed information on disruption cases (and non-public cases), and be generally more open with the Monitoring Team. This will help provide the international community with better information upon which it can base decisions about resource allocations and counter-terrorism (financing) priorities.
© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.
United Nations Security Council, “Thirty-Second Report of the Analytical Support and Sanctions Monitoring Team Submitted Pursuant to Resolution 2610 (2021) Concerning ISIL (Da’esh), Al-Qaida and Associated Individuals and Entities,” July 25, 2023