Innovation at the Margins, but Continuity at the Core: How ISIL and AQ Are Adapting—and Enduring
On February 4, 2026, the United Nations Monitoring Team released its 37th report on ISIL, Al-Qaeda, and associated groups.¹ This article will provide a review of the report, with a specific focus on terrorist financing and what it reveals about how these groups are sustaining themselves. keep reading for a brief synopsis of the key financial dynamics that stood out in the report.
For additional context, please check out some of our previous analyses below:
Photo by Nils Huenerfuerst on Unsplash
One of the most notable developments in AQ/ISIL terrorist financing concerns the Allied Democratic Forces (ADF), which is reportedly using satellite internet to facilitate cryptocurrency conversions into state-issued currency, including through mobile money applications. This demonstrates not only the increasing accessibility of crypto for terrorist actors but also a significant operational adaptation to access crypto even in remote areas. The technical and logistical barriers are being overcome, and groups are increasingly integrating digital assets into local financial ecosystems.
At the same time, while cryptocurrency adaptation is increasing, it does not displace more traditional revenue streams. Across theatres, local taxation and extortion networks remain central to sustaining operations, alongside criminal activity such as smuggling and illicit trade. The report reinforces a familiar pattern: innovation at the margins, but continuity at the core. For most groups, territorial control, coercive taxation, and embedded criminal economies continue to underpin their financing strategies.
JNIM
According to the UN, JNIM profited from a single large ransom payment and used that to increase its capabilities. Here at Insight Monitor, we wrote about that large ransom payment, noting that “the money will certainly allow JNIM more operational freedom of movement in the coming months, and likely incentivize them to gain more territory and solidify control and influence in the region.” JNIM engages in both low-level (and low-cost) local kidnappings, as well as higher cost (and higher reward) international kidnapping for ransom.
JNIM is assessed by the UN to be the wealthiest Al-Qaeda affiliate after Al-Shabaab, having significantly expanded its revenue base through territorial control. The group raises funds by taxing and regulating gold mining and other commercial activities, imposing road tolls and transportation fees, and engaging in smuggling and livestock rustling. It also collects zakat (charitable donations), with rates varying by location; in areas where local communities resist or are perceived as uncooperative, zakat can be increased to extortionate levels. This diversified and locally calibrated approach to revenue generation has strengthened JNIM’s financial resilience.
Lakurawa
The UN also mentioned (I believe for the first time) Lakurawa, a group within the Islamic State Greater Sahel,² and described their financing as primarily illegal tax collection and cattle rustling. You can read more about Lakurawa in this Soufan Center intel brief.
ADF
The Monitoring team also reported an increase in ADF's use of cryptocurrency for financing. They also noted that the ADF now has greater satellite connectivity, enabling the group to convert cryptocurrency into usable funds via mobile money applications and wallets. This capability allows them, even when deep in the bush and in areas outside of conventional cell coverage, to access and covert cryptocurrency to state-issued currency.
To read more about ADF financing:
ISIL
The UN monitoring team assesses that the revenue collection capability of ISIL in Somalia has been significantly degraded. While the group continues to generate revenue through its business interests, it can no longer collect revenue in key locations such as Bosasso, Qandala, and Ba’ad, where security conditions have tightened. The securitization of these areas has disrupted their taxation and extortion activities, constraining their ability to operate as they once did. That said, ISIL-Somalia has been able to draw on residual funds, which have helped sustain the group despite these setbacks.
ISIL-K has sought to exploit geopolitical flashpoints, including the war in Gaza, to drive fundraising and mobilize support. By framing distant conflicts as part of a broader narrative of global grievance, the group attempts to tap into issues that resonate with potential donors and sympathizers. This reflects a broader adaptation strategy: rather than relying solely on local revenue generation, ISIL-K leverages international events to expand its financial reach and reinforce its relevance within the global jihadist movement.
At the same time, counterterrorism efforts have disrupted elements of ISIL’s broader financial architecture. In Iraq, authorities dismantled a finance network with connections stretching to Côte d’Ivoire, Madagascar, and Togo. The geographic spread of this network underscores the transnational character of ISIL’s facilitation structures and its reliance on dispersed nodes to move and store funds. Disruptions in one theatre, therefore, have ripple effects across regions, illustrating both the network's scope and its potential vulnerability to coordinated action.
ISIL-K has also faced setbacks in the digital financial space. The group reportedly lost access to approximately $100,000 in Monero after several individuals were arrested, preventing it from retrieving funds held in associated wallets. In response, it altered its Monero quick response code distributed through its propaganda arm Voice of Khorasan and introduced a new Bitcoin address. This episode highlights both the risks and adaptability associated with cryptocurrency use: while digital assets offer speed and global reach, they also expose groups to technical and operational vulnerabilities when key facilitators are detained.
Our Terrorist Financing Analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.
Al Shabaab
The report also notes developments concerning Al-Shabaab and its relationship with Al-Qaeda in the Arabian Peninsula (AQAP). While financial support from Al-Shabaab to AQAP may have declined, cooperation between the two groups continues. This suggests that even when financial flows fluctuate, operational or strategic ties endure, including those associated with weapons trafficking networks. In the Somali context, this underscores a broader pattern in which terrorist groups adapt to financial pressure but maintain networks that allow them to remain resilient.
To read more about Al Shabaab financing:
Libya
In Libya, security services have dismantled at least four cells involved in terrorist financing, migrant and fighter smuggling, and media operations, with links extending to Europe, Iraq, Syria, the Sahel, and East Africa. One of these cells played a logistical role, facilitating operations through smuggling networks and money laundering. The use of smuggling routes and financial crime as enabling mechanisms reflects a pragmatic blending of ideological objectives with criminal enterprise; when one node is disrupted, others can absorb the shock.
AQAP & the Houthis
At the same time, the threat from Al-Qaeda in the Arabian Peninsula (AQAP) is reportedly growing, driven in part by improved funding streams. AQAP, for instance, has profited from Al Shabaab piracy by receiving a share of payments made by vessels in exchange for transiting through high-risk waters. The group also uses Telegram to solicit funds and connect supporters to financial intermediaries. (This is a form of informal crowdfunding that allows them to access international support networks.) Increased access to resources appears to have strengthened the group’s operational tempo and capacity, underscoring the persistent relationship between financing and capability. Where funding improves, groups can move beyond subsistence-level activity and reconstitute networks, invest in recruitment, and plan more ambitious operations. This pattern reflects a familiar dynamic: financial resilience often precedes operational resurgence.
Further complicating the picture, the Houthis reportedly provided AQAP with financial support for a successful attack. This illustrates the fluidity of relationships in conflict environments, where tactical or transactional arrangements can override ideological divides.
Conclusions
The through line in this report is not dramatic innovation; it is consistency and slow adaptation to counter-terrorist financing measures. Groups are experimenting at the edges, whether through cryptocurrency, satellite internet access, or opportunistic alliances, but their core revenue models remain intact. Taxation, extortion, smuggling, and embedded criminal economies continue to sustain most organizations. Disrupting a wallet address or arresting a facilitator matters, but it rarely dismantles the underlying system. These networks are adaptive by design; when pressure is applied in one area, activity shifts to another.
Countering this ecosystem is becoming increasingly difficult amid geopolitical fragmentation and strategic distraction. Cooperation on sanctions enforcement, financial intelligence sharing, and capacity-building is more difficult to sustain when alliances are divided and disrupted and multilateral institutions are strained. Terrorist groups, by contrast, exploit these seams: weak governance, contested territories, and inconsistent enforcement all make terrorist groups stronger. As states turn inward or prioritize great-power competition, the space for illicit finance expands. The difficulty of coordinated disruption, combined with enduring funding streams, leaves all of us less safe than we might otherwise be.
¹ United Nations Security Council, Thirty-Seventh Report of the Analytical Support and Sanctions Monitoring Team Submitted Pursuant to Resolution 2734 (2024) Concerning ISIL (Da’esh), Al-Qaida and Associated Individuals and Entities.
² Our profile of ISGS’s financing is available through our case studies library: https://insightthreatintelligence.thinkific.com/courses/take/terrorist-financing-case-studies-library/texts/47282318-how-to-access-the-case-studies
© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.
This article and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this article and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.