Five years after the demise of IS’s territorial caliphate in Syria and the subsequent arrival of the IS families in northeastern Syrian camps, IS and its aligned international networks continue to exploit the global financial system marked by their increased use of cryptocurrencies to raise funds for the detainees’ daily needs and securing their escapes via smuggling. This effort has also been largely driven by foreign detainees in Al-Hol and Al-Roj camps running their own crowdfunding initiatives from inside the camps across various social media platforms like Instagram, Facebook, and on encrypted applications like Telegram.
Pro-IS women in the camps, serving as a strategic pool for the group, continue to engage in acts of spreading violence and indoctrinating children with the group’s radical ideology. That they are able to receive substantial funds into the camp via hawala and other illicit transfers is a huge boon to their recruitment efforts as youth born and brought into IS and now detained with mothers who no longer adhere to the IS ideology are vulnerable to the women who have the resources to buy them good food, gifts from vendors in the camp and so on in order to seduce them away from their mothers into the terrorist ideology.
Some mothers report their teen girls being recruited in this manner by some female IS acolytes who have a lot of money, with their daughters coming home to their mother’s tent bejeweled with new hair pieces, etc telling her mother she’s an apostate and must be excommunicated [declared an unbeliever and therefore able to be killed by the group]. Young boys are also lured in the similar way by these women into enhancing their physical strength directing them to perform martial arts and military drills, acting as spies in the camp, enacting violence toward those not adhering to IS ideology, and even to studding some of the boys out to increase the birth rate of the group. Likewise, women in the camps have told the second author about “kill lists” that the IS women make for the event that their “brothers” free them by overtaking the camps so that they can know who are still IS adherents and who must be killed for walking away from IS.
The recent February report of Operation Inherent Resolve, the ongoing US-led coalition campaign against IS, also reported this threat of IS recruiting and maintaining loyal supporters, and securing their release by transferring them funds—up to $20,000 per month each— through intermediaries in Turkey via the hawala system, cash transfer apps, and increasingly via cryptocurrency. ICSVE’s monitoring likewise reveals a resurgence in the efforts of IS-linked German and Russian networks to mobilize financial resources for smuggling out teenage boys and families out of Al-Hol. However, ambiguity shrouds the fate of these adolescents post-escape, with questions lingering about how and when they will be handed over to the terror group or infiltrated back to their home countries.
In late February, a pro-IS Russian network of women in Al-Hol on Instagram reignited pleas to smuggle out teenage boys seeking $8000 for each adolescent, in anticipation of Russia’s repatriation of 32 children from Syria in March 2024. Their mothers apparently thought it better to be smuggled out to IS than to be repatriated home into the care of grandparents. Facing constant takedowns on Telegram have compelled these pro-IS Russian networks to shift their fundraising efforts to Instagram, amplifying their reach and visibility among IS supporters and somehow eluding Meta’s takedowns.
The network claimed to have raised $36,000 last year for the escape of 8 children, stating that they “found their way out of the camps to an unknown destination”. Moreover, in a recent security sweep in Al-Hol that led to the arrest of senior IS militants, IS women claimed that many teenage boys were also separated and taken into ‘rehabilitation centers,’ by SDF adding further impetus to their fundraising efforts. SDF says that rehabilitation is important for pulling children out of extremist thought and clearly separating them is protecting these youth from being smuggled out into the hands of IS. Several escape attempts have also taken place with Kurdish led Syrian Democratic Forces (SDF) having recently claimed foiling escape attempts of 2 teenage boys from Al-Hol.
The pro-IS Russian network predominantly secured donations through Russian payment app QIWI and cryptocurrency transfers. A USDT wallet used by this network, monitored by ICSVE, received around $8000 between January and April 2024. Notably, Tether currency remains the preferred choice for IS-linked networks, which also have extensively leveraged traditional banking systems in Europe and Russia for securing detainees’ escapes. This-pro IS Russian crowdfunding campaign employed a beneficiary account of an IS-linked financial facilitator at Dornbirner Sparkasse Bank AG , a small cooperative Austrian bank, alongside accepting transfers through Russian-owned MTS bank — placed under the US sanctions —for freeing detainees.
Beyond running donation drives, Russian women amongst all the foreign IS detainees have emerged online to be the most vocal supporters for IS exhibiting extremist tendencies. Social media discourse originating from the camps indicates that the intransigent pro-IS Russian detainees celebrated the attack claimed by the Islamic State central on a Moscow concert venue, which resulted in the death of over 140 individuals decrying “the brutal treatment” of the detained Tajik suspects during their interrogation with the Russian authorities. One woman expressed her sentiments, stating, “Alhamdulillah! If the brothers did it, may Allah grant them even more strength and victories wherever they are? I am elated by such news. If these ‘kafirs‘ are harming each other, let their suffering be even more severe!” Other Russian IS sympathizers voiced their support for the group, asserting that the attack on “Russian infidels” was long overdue—a “sin they should pay for, the shedding blood of Muslims in Syria.”
Three German language entities linked to IS, since January 2024, have been covertly collaborating to finance detainees’ under the guise of separate crowdfunding initiatives. They strategically cross-promote their campaigns on Telegram to enhance credibility of their fundraisers. The overarching narrative emphasizes the Islamic obligation of aiding “captives” and “families of mujahedeen,” particularly during Ramadan, when such acts are believed to yield multiplied Islamic rewards. These entities offer flexible money transfer options, including online payment services like PayPal, money transfer services like Western Union, and direct international wire transfers allowed with a minimum limit of €50.
A common Bitcoin address shared by all three German IS-linked networks received a substantial transfer of $20,000 between October 2023 and February 2024, exposing an illicit money trail to Switzerland for the first time. In December 2023, approximately $1000 were sent to German IS-linked Bitcoin addresses from a crypto investment and trading platform Swissborg, based in Lausanne, Switzerland. Moreover, these networks frequently rotate new Tron wallets every 15 days demonstrating the widespread use of tether cryptocurrency for their financial operations.
While IS-linked networks predominantly rely on cryptocurrencies for their fundraising endeavors, the German language IS-linked networks have also increasingly accepted donations through direct bank transfers, providing IBAN details of IS-linked financial intermediaries, unveiling a complex web of money laundering networks across European jurisdictions. To accommodate potential donors with limited knowledge of cryptocurrencies, direct donations through SWIFT transfers are encouraged.
Funds earmarked for detainees under the oversight of German-IS networks were diverted to an obscure entity or what looks like a shell company called “Aqua Creative Global” to their Copenhagen-based banking account, Banking Circle SA. Banking Circle SA is a European banking platform specializing in B2B payment solutions, operating across multiple European countries, with its headquarters in Luxembourg. By routing illicit funds purportedly through a shell company based in Denmark, individuals associated with this crowdfunding campaign can evade detection more effectively. This strategy aims at leveraging the legitimacy of the company’s operations and transactions, further complicating efforts to trace and uncover their illicit activities. IS-linked German networks also routed suspicious transactions through England with the IS-linked entity receiving transfers on behalf of these networks into the bank account opened with the London based Revolut bank.
Since 2020, another German network, “Free our Sisters” has been actively soliciting funds to support convicted or arrested IS sympathizers, as well as supporters of other militant groups in Germany. Their fundraising tactics include financially supporting the detainees and their families through selling translated copies of jihadist preacher Sheikh Abu Musa Jibril’s works, known for his influence on Westerners who joined the Syrian conflict, and translating literature from other radical preachers and selling second hand goods like watches, clothes, perfumes etc. Currently, the network is seeking contributions to cover the legal expenses of a woman charged with aiding IS detainees in Syria, with a target of raising €3000. Donations are directed through direct transfers into the recipient’s savings account at Targobank, a local commercial bank based in Dusseldorf, Germany. Despite numerous smuggled escape attempts by detainees being thwarted by the Syrian Democratic Forces (SDF), German networks persist in their appeals of brokering the release via smuggling of the IS families. In February, the German-IS linked entities sought $5000 to secure the escape of a family of four from Al-Hol.
Alongside the German and Russian linked IS networks, the prominent English language IS-linked network, is also running donation drives not only for female detainees but also for incarcerated IS fighters in Kurdish-controlled northeastern Syrian prisons and areas controlled by the Turkish backed Syrian National Army, where they claim sending relief packages is easier as they are “in contact with the brothers”. The administrators of this pro-IS channel have disclosed that the funds could also be directed to meet the specific needs of IS fighters on the frontlines in Syria with whom they maintain direct contact. One of this channel’s supporters, apparently a female detainee, claims nothing has changed in the five years since the Islamic State’s territorial defeat in Baghouz and that the hearts of the foreign fighters remain committed to it.
This network also maintains a presence on IS’s rocket chat server, Tech Haven for bolstering its fundraising efforts. The crypto wallet address provided by the networks usually serves as a temporary storage for funds, which are then transferred through multiple wallets before reaching their final destination where they are converted into fiat currency, obscuring the transactional trail. Crowdfunding proceeds, primarily sourced from bitcoin donations, totaled around $22,000 between January and April 2024 for this fundraiser. Moreover, an alternate bitcoin address associated with this pro-IS network has been found channeling funds to an address linked with criminal entities engaged in phishing and impersonation scams. The network advised donors to direct funds to a PayPal merchant address under the “friends and family” option, aiming to bypass transaction fees and blend suspicious transactions with legitimate ones.
Likewise, the Islamic State in Khorasan province’s Tajik network has been crowdfunding for the female detainees over the past three years. Under the pretext of fundraising to support Tajik IS women, the ISKP Tajik network, this time appears to have diverted funds towards operational and recruitment activities through cryptocurrency transfers. ICSVE discovered that approximately $2800 were transferred in tranches from the USDT address used by ISKP’S Tajik network to Bybit crypto wallet on the same day of the Moscow concert hall attack, March 22nd. Russian and Ukrainian media reports corroborated these findings, suggesting ISKP’ used the USDT wallet to transfer payment to men apprehended in connection with the attack. That ISKP’ ostensibly paid half of the promised amount through USDT transfers to one of the alleged perpetrators further was substantiated when, the detained Tajik national , in his interrogation with the Russian authorities said that he carried out the attack for 5,00000 rubles (roughly $5000) out of which he had received almost half of the amount.
No further transaction activity has been reported post-March 22nd in the USDT wallet used by ISKP’s Tajik network signaling that the wallet solely created 8 days before the attack, on 14th March, was purportedly opened for sending money to the IS fighters who attacked the Moscow concert venue. ISKP’s network was also found converting funds into Syrian pounds for the Tajik IS women routed through the Russian payment service Yandex Money and Russian state owned SBER bank. It’s apparent that the Central Asians, particularly ethnic Tajiks who are vulnerable to recruitment for many reasons, have been a primary target for the group’s propaganda and recruitment efforts, with the Tajik contingent playing a significant role in the group’s aggressive fundraising endeavors and perpetrating deadly suicide bombings in Afghanistan and neighboring countries.
Though ISKP has shown a tendency to employ untraceable privacy oriented crypto currency like Monero, monitoring shows the group has also increasingly channeled funds using bitcoin and tether currencies. Between October and November 2023, a sum of $20,000 was purportedly transacted through a bitcoin address of ISKP via the multi-currency wallet provider Totail.coin. Notably, one of the transfers was sent through centralized virtual exchange Coinex reflecting that mainstream centralized exchanges have been the biggest recipient of illicit cryptocurrency, “taking in just under half of all funds sent from illicit addresses.” Furthermore, upon monitoring the transaction trail, it was revealed that prior recipients of transfers from the aforementioned ISKP-linked bitcoin address had also received funds via the virtual exchange Garantex, which was sanctioned by the US for facilitating financial transactions on dark web markets for criminal actors and terror organizations.
Join us next week for Part II of this two-part series.
