NEW DELHI: ISIS is increasingly using crypto currencies and online payment systems.

The latest report from the analytical support and sanctions monitoring team of the United Nations Security Council has stated that the threat posed by the Islamic State in Iraq and the Levant—Khorasan (ISIL-K), an affiliate of ISIS, has grown significantly, with the group expanding its operations beyond its traditional strongholds in the Middle East.

The report has stated that it is attempting to increase its presence in India, where it has released propaganda aimed at exacerbating Hindu-Muslim tensions and has sought to recruit lone actors through local handlers.

The findings come as a concern for security agencies globally and in India, with ISIL-K now actively targeting a range of countries and leveraging a sophisticated network of operatives and supporters.

The report, which is based on the inputs from the ground and after meeting UN member countries, has stated that ISIL-K’s activities have markedly increased in recent months, reflecting a strategic shift from high-impact operations within Afghanistan to conducting large-scale attacks beyond its borders.

The group’s reorientation is evident from the significant terrorist attack in Moscow on 22 March 2024, which resulted in 145 fatalities and several hundred injuries. This attack underscores ISIL-K’s capability to strike far from its base and highlights the growing threat it poses to global security.

The expansion of ISIL-K’s operations is not confined to direct attacks. The group has also focused on building a network of facilitators and supporters across various regions. This network includes recruitment and training of foreign fighters from Central Asia, the Middle East, and other regions. Central Asian nationals, including Tajiks and Uzbeks, have been particularly targeted for recruitment, with some travelling to Afghanistan for training before returning to their home countries or moving to other regions to execute attacks.

Additionally, the investigators have stated they found Arabs travelled to Afghanistan under the guise of hunting trips. This cover is used to engage in training and other activities linked to Al-Qaeda, demonstrating the group’s sophisticated approach to covert operations and recruitment.

Kabul based sources, when asked about the presence of Al-Qaeda operatives and the links between the Taliban, denied it emphatically.

The investigators have said that ISIL-K’s expansion is particularly concerning in Europe, where it is now assessed as the greatest external terrorist threat.

The group has demonstrated its capacity to execute and plan attacks across multiple European countries, including Belgium, France, Germany, the Netherlands, Spain, Sweden, and Türkiye. Despite efforts by European authorities to dismantle ISIL-K cells, the group’s logistical and financial support networks remain robust, enabling it to continue its operations.

In addition to Europe, ISIL-K has also made significant inroads into South Asia. The group has attempted to increase its presence in India and has sought to recruit lone actors through local handlers. Despite challenges in conducting large-scale attacks in India, ISIL-K has kept a steady focus on propaganda and recruitment to influence the region.

In Pakistan, ISIL-K has been implicated in several attacks, including a notable attack on 26 March 2024 against Chinese nationals working on a hydropower dam project near Besham in Khyber Pakhtunkhwa Province. The group’s activities in Pakistan are part of a broader collaboration with the Tehrik-e-Taliban Pakistan (TTP) and Al-Qaeda in the Indian Subcontinent (AQIS). This collaboration has led to more lethal attacks and increased instability in the region.

Taliban sources said that there was no evidence of Al-Qaeda working with the TTP and this “bogus” input was reportedly given to the UN team by Pakistan for its own strategic objectives.

As per the investigators, ISIL-K’s strategy of embedding covertly within Al-Qaeda-affiliated groups complicates the ability to estimate accurate figures regarding its strength and the loyalty of its fighters.

ISIS, investigators found, has grown as far as extent of resident networks, access to weapons, the military training of operatives, the ability to evade counter-terrorism measures, and the identification of viable targets are concerned.

Similarly, the group has leveraged its sophisticated media capabilities to amplify its propaganda and recruitment efforts. One of the group’s notable campaigns is the “kill them wherever you find them” initiative, which seeks to inspire and direct attacks in each of the group’s self-proclaimed “provinces.” This campaign reflects ISIL’s strategy to project an image of global reach and operational capability despite significant setbacks.

In the first weeks of 2024, ISIL (Daesh) claimed coordinated operations across its self-proclaimed “provinces,” maintaining a narrative of heightened threat and operational capability. The group’s media efforts aim to counter any perceptions of diminishing intensity in its operations and to inspire and direct potential attackers worldwide.

The report has mentioned European investigations to illustrate the global and interconnected nature of ISIL facilitation. In March 2024, two Afghan individuals were arrested in Germany for planning a firearms attack against the Swedish Parliament. In the same month, the Spanish Civil Guard arrested an individual in Barcelona who had trained four members of an ISIL-K cell that was later dismantled in Sweden. This case highlighted connections with another individual detained in December 2023 in Canada, who was planning an attack. In June 2024, the Spanish Civil Guard carried out a multinational operation, arresting nine individuals and dismantling one of the largest ISIL media networks in Europe. This network, with servers in Iceland, Germany, the Netherlands, Spain, and the United States, supported multiple media outlets to disseminate propaganda and messages urging terrorist attacks in over 30 languages, including Bahasa Indonesia and Pashto.

ISIL-K’s online recruitment and radicalization efforts are targeting specific communities to bolster its ranks. The group focuses on Tajik communities and, to a lesser extent, Uzbek communities, encouraging individuals to conduct attacks outside Afghanistan. This targeted recruitment is part of a broader strategy to exploit disaffected individuals and radicalize them to further ISIL-K’s objectives. The principal routes for new recruits to reach Afghanistan involve travelling from Central Asia through Türkiye and the Islamic Republic of Iran. This travel network facilitates the movement of potential recruits and allows ISIL-K to maintain a steady influx of personnel to support its operations.

ISIL-K has also adapted to modern technological advancements. For example, Al-Shabaab, an affiliate of ISIL, has experimented with 3D printing to create components for weaponized unmanned aerial systems. This innovation reflects a broader trend of terrorist groups utilizing new technologies to enhance their capabilities and evade security measures.

ISIS’s long term strategy includes preserving battle-readiness, increasing revenue generation, and enhancing recruitment efforts. The group aims to maintain its presence and influence through a combination of low-impact attacks and sporadic high-impact operations. Its long-term goal is to destabilize Afghanistan, expand into neighbouring regions, and project terror beyond its traditional borders.

How Is The Group Keeping Itself Funded?

ISIS (Daesh) is continuously innovating in raising and moving funds while engaging in traditional illegal income sources like kidnapping for ransom, taxation, extortion, trafficking, petroleum products, donations, and investments in commercial businesses.

Offshore betting companies are being exploited to anonymously upload and cash out funds. Terrorist groups are using online platforms to transfer funds to countries near Iraq and Syria.

Apart from that, social media messaging, crowd-funding, and mobile applications, often featuring videos promoting extremism and soliciting donations, are being carried out.

Instructions for payments via digital wallets and crypto currencies are routinely provided. Terrorists are promoting preliminary Sharia assessments for crypto currency use. Channels like CryptoHalal and Umma Crypto on Telegram that allow moderators to control currency acquisition and monitor funds are being used extensively.

The expansion of ISIS’s digital platform use has also come as a worry.

Various crypto currency exchanges, gaming platforms, e-wallets, and stable-coins facilitate fundraising and fund transfers are now working as a tool for ISIS.

Cash couriers and hawala are still preferred for conflict areas, but ISIS is increasingly using crypto currencies and online payment systems. The use of electronic wallets, prepaid cell cards, and crypto currencies is expected to grow. Mobile payment too remains in use.

Anonymity-enhancing crypto currencies like Monero are favoured by ISIS and affiliates. In October 2023, ISIS launched its first Monero donation drive via QR code in its magazine “Voice of Khurasan”. Subsequent Telegram posts solicited funds using Monero. The association with illicit activities and regulatory requirements led some exchanges to delist Monero, complicating its exchange for fiat or other crypto currencies. Many member states require virtual asset service providers to manage anonymity-enhancing technologies’ risks.

In 2023, ISIS received $2.5 million, possibly funding the Crocus City attack. Another $1 million was received in December 2023. Previously, $2 million from Western countries was reported on the Tron blockchain. Concerns arise about privacy-enhanced crypto currencies financing terrorism through the art industry due to this market’s unregulated nature. The report has mentioned links between organised crime and terrorism in cultural property trafficking in the context of cached cultural artefacts from Iraq and Syria that ISIS had stolen.

(With reporting by Sunday Guardian Live)