Hawala in the Cloud, Cash Under the Mattress: ISIL’s Evolving Finances
Thirty-sixth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2734 (2024) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities
Hello, Insight Monitor subscribers, and welcome to another week of news and analysis you won’t find anywhere else. Last week, the latest UN Monitoring Team report was released. And while we’re certainly not first to do a summary and highlight key points, we did take our time to go through it, find all the terrorist financing-related content, and pull out some novel developments and key issues. So here you go! Have a read, and let us know what you think.
The 36th Analytical Support and Sanctions Monitoring Team report, submitted in July 2025, offers a wealth of new insight into the financing of ISIL, Al-Qaida and their affiliates. Beyond the expected operational updates, the report contains some of the most interesting recent developments in terrorist financing, showing how groups are adapting both traditional methods and emerging technologies to sustain their activities.
ISIL continues to rely on familiar methods of moving money through hawala networks and cash transfers, but these are now augmented by more sophisticated tactics. Female couriers are increasingly employed to transport funds in order to avoid detection. As we’ve long talked about, using female financial facilitators is a form of financial tradecraft intended to take advantage of counterterrorism forces’ bias against seeing women as terrorist actors.
Cloud hawala systems, where transaction records are stored online rather than in physical ledgers, are becoming more common, complicating monitoring efforts. (On the other hand, these online ledgers are likely vulnerable to cyber intrusions, so they present a unique opportunity for intelligence collection. Traditionally, collecting intelligence on hawala operations has involved significant HUMINT capabilities.) Safe-drop boxes have also emerged as a technique, allowing operatives to deposit funds at exchange offices that can be retrieved using only a password or code, adding another layer of operational security.
In Somalia, the Al-Karrar office has been cut off from central ISIL funding, prompting the search for alternative income streams. One adaptation has been to rely on small-scale kidnap-for-ransom schemes, with demands as low as US $50 to $100 sent via mobile money applications to secure quick releases. This is reminiscent of the same tactic used by various criminal entities in Nigeria, where “express kidnappings” are common. (In my book, Illicit Money, I make the distinction between these types of local kidnappings for ransom, which usually generate small proceeds, and large international kidnappings for ransom that can generate ransoms in the tens of millions of dollars.)
The group has also begun keeping physical cash caches in hidden locations, while also concealing funds in the bank accounts of sympathetic businessmen and investing in local enterprises—both to mask resources and to generate ongoing returns. Similar investments were made in Mozambique, which we wrote about for Insight Monitor back in 2023.
Building on what has previously been reported, the Monitoring Team noted that ISIL-KP in Afghanistan has embraced cryptocurrencies as a key component of its financial toolkit, using platforms such as Monero, KuCoin, MEXC, Huobi and Totalcoin. While Monero’s popularity appears to be waning due to de-platforming from national exchanges and the difficulty of converting it, other tools are filling the gap. Chief among them is “Cash Now,” a cryptocurrency exchange app that facilitates rapid swaps between different crypto assets, giving ISIL operatives ready access to liquid funds without relying on the formal banking sector.1 Telegram’s @wallet funding app has also gained traction because it requires no know-your-customer checks, and unhosted wallets are increasingly used for single-use transfers that leave few traces. The report also notes that ISIL operatives are experimenting with AI-generated fake documents to circumvent know-your-customer procedures..
Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!
Libya’s intelligence service has recently dismantled three ISIL facilitation networks. The first specialized in recruiting operatives from North Africa and moving them to Somalia and the Sahel, providing forged passports and safe houses along the way. The second laundered money through front companies to help fighters and their families escape the al-Hawl camp in Syria and relocate to Libya, where they were housed in ISIL-funded safe houses. This network also pursued investments in regional countries. The third focused on transferring funds to ISIL using cryptocurrencies. This is interesting, as much of ISIL’s network in Libya has reportedly been destroyed in recent years.
Taken together, these developments point to a clear trend: the increasing sophistication of financial tradecraft across ISIL’s network and in the broader terrorist financing arena. Investments in legitimate-seeming companies suggest an interest in long-term sustainability, while the growing adoption of cryptocurrencies reflects both opportunism and a growing liquidity in the cryptocurrency market that makes them useful for terrorist (both organizational and operational) financing. The report underscores that even when traditional funding lines are disrupted, these groups find ways to diversify income streams, conceal assets and adapt quickly to enforcement pressures
© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.
Interesting, right? I’m trying to find out more about this app. Stay tuned.