Abstract: Like all terror groups, Central Asian terrorist groups are continuously attempting to diversify how they finance their activities to avoid detection. Drawing on various reports, court documents, an array of research literature, and online extremist materials, this article explores some innovative methods that Central Asian terrorists have recently experimented with to finance their activities. Their online financing efforts tend to involve three stages. The first is the dissemination of fundraising propaganda and contacting prospective donors via online public accounts. The second is communication via encrypted messaging apps to identify a suitable mode of transaction and to provide security protocols. The third is the transaction itself. Understanding these mechanisms can help enhance relevant countries’ response strategies against terrorism financing risks.
In October 2021, Kazakh authorities revealed that the country’s law enforcement entities had suppressed several dozen instances of terrorist financing in Kazakhstan since 2019.1 Similarly, counterterrorism agencies in Tajikistan investigated 15 cases in 2021 alone.2 In Uzbekistan, from 2016 to the first half of 2021, 60 men and two women were convicted for their involvement in terrorism financing.3 Nearly 70 percent (or 43) of these convicts in Uzbekistan reportedly committed their crimes in a foreign country. While Kazakhstan and Tajikistan have not provided many details of the cases committed abroad, what is known is that in recent years, individuals from Central Asian countries were found to have been involved in terrorism financing cases in Russia,4 Turkey,5 Germany,6 Sweden,7 the United States,8 and South Korea,9 indicating terrorist groups’ interest in diaspora communities and migrant workers abroad as potential donors.
Drawing on evidence sourced from various local and international news reports, court documents, and online extremist propaganda materials, this article explores various tools and methods of illicit fundraising and fund-moving that have been used by Central Asian individuals and terrorist groups linked to Hayat Tahrir al-Sham (HTS) and the Islamic State in recent years. Based on the available open-source information, the article makes some tentative conclusions about the emerging patterns of terrorism financing in Central Asia that could also help enrich existing perspectives on the issue in other contexts. The article first outlines the available literature on Central Asian terrorism financing. It then draws on the existing open-source information to outline modalities in the three-step approach that tends to be used by Central Asian jihadi fundraisers: online fundraising appeals, encrypted communication with potential donors, and the transaction itself.
The Existing Literature
The available open-source reporting about terrorism financing cases in the region suggests that funds from Central Asia and its diaspora abroad mainly go, or are intended to go, to conflict zones such as Syria, Iraq, and Afghanistan to support various jihadi groups operating there. The main beneficiaries have been Central Asian units and individuals associated with Hayat Tahrir al-Sham (HTS), al-Qa`ida’s former representative on the Syrian battlefield, and the Islamic State’s central network in Syria and its local faction in Afghanistan known as the Islamic State-Khorasan Province (ISK).a However, due to the scarcity of relevant publicly available data, only tentative observations can be made about Central Asian terrorism financing, including the size, scope, and geography of money transfers and how money is collected, moved, and used. The lack of open-source information is a function of the clandestine nature of terrorist groups and their operations, and the unwillingness of financial investigators to reveal sensitive details.10
As in many other contexts, the literature covering the topic in the Central Asian problem set has been piecemeal. Most existing publications are either not recent or only touch upon certain aspects of the subject. For instance, a study published by Kamila Abdulkarimova and Sanzhar Abubakirov in 2019 analyzed Kazakhstan’s anti-money laundering (AML) system and legal regulations designed to combat money laundering and terrorist financing.11 An article published by other Kazakh experts, Zagira Iskakova and Akmeir Rakhymzhanova, in 2014 highlighted the development of effective financial monitoring systems as an important preventive mechanism against money laundering and terrorism financing in their country.12 Similarly, a collection of essays that was published in 2019 jointly in Bishkek and Moscow as an a supplementary textbook for university students and, separately, a PhD study completed by Almaz Bazarbaev in 2004 explained the international and national legal basis of countering money laundering and terrorism financing in Kyrgyzstan.13
Only a handful of publications have provided a detailed examination of the issue of terrorism financing in Central Asia. One such publication came out in Bishkek in 2021 as an outcome of research that was conducted by a team led by Afzal Ashraf and Indira Aslanova.14 Based on interviews with several foreign terrorist fighters and their family members from Kyrgyzstan, the report explored some interesting cases of fundraising from inside Kyrgyzstan and among its immigrant communities abroad, particularly in Russia and Turkey and to a lesser extent in South Korea and Ukraine. However, the report did not reveal how the funds raised had been delivered to their intended beneficiaries.
More recently, the research outlets Militant Wire and The Khorasan Diary have featured articles by Lucas Webber and others exploring how Afghanistan-based militant groups have used various online tools and platforms to boost recruitment and fundraising from Central Asia. However, this coverage has been mainly confined to the Islamic State terrorist network.15 Separately, Viktor Mikhailov of the Center for Studying Regional Threats (CSRT), a Tashkent-based independent research center, has published some articles and analysis on fundraising propaganda and tactics used by Central Asian groups linked to HTS in particular.16 In sum, the author’s review of existing literature shows there are significant knowledge gaps especially in understanding how terrorism financing risks evolve around new technologies.b
The Three-Step Approach to Online Fundraising
Terrorist groups have often been early adopters of new technologies. They also often imitate each other’s perceived successful tactical or technological innovations.17 Given the widespread access to the internet and the rapid expansion of virtual communication platforms and encrypted messaging apps, bad actors have for some time been exploiting such online tools for fundraising.
Open-source data indicates that the financing efforts currently employed by Central Asian groups in the online domain are typically conducted in three main phases, with each step involving a different set of tools and techniques. The general three step process that the author observed include:
Step 1: The dissemination of fundraising appeals and the establishment of contacts within the pool of potential supporters online. The process is usually conducted on public pages and accounts, with those often spelling out explicitly the launch of fundraising campaigns.18 While the stated cause the funds are being raised for may vary from case to case, one similar feature that they share is the framing of such drives as an opportunity to make indirect contribution to “jihad” for those who cannot travel to conflict zones to attend the conflict in-person. Fundraising ads and posters tend to be first shared on websites and blogging pages affiliated with terrorist groups, from where they are further spread across various social media/networking platforms including Facebook, Instagram, Twitter, YouTube, and public groups and channels in encrypted messaging apps. This process is mostly relevant to HTS-linked Central Asians. As the Islamic State did not have separate media teams dedicated to propaganda in Central Asian languages,c to the author’s knowledge, the Islamic State terrorist network has not established prominent web and blogging sites in these languages, and therefore Islamic State fundraising campaigns usually started on social media and networking sites and encrypted platforms.
As will be discussed in detail in relevant sections below, enhanced censorship and content moderation policies adopted by tech companies and the implementation of terrorist designation practices by countries have led terrorist groups to readjust their online propaganda strategies, while accelerating their shift to encrypted platforms.19
Step 2: The establishment of closer connections with potential supporters via encrypted messaging apps such as Element, Telegram, Tutanota, Wire, and Zello. In this stage, fundraisers tend to verify their identities, establish their financial circumstances, and determine their level of skills to conduct certain fund transfer methods. This stage also involves delivery of detailed security instructions to donors to complete the transfer through the mode identified as suitable.
Step 3: The completion of the transaction within the identified mode of digital transfer such as e-Wallets or cryptocurrencies.
The sections that follow look at the patterns of activity of Central Asian jihadi fundraisers relating to each of these steps.
Step 1: Online Fundraising Appeals
Despite the emergence of more secure types of internet communication tools such as encrypted messengers, jihadi groups of all stripes, including Central Asian groups, still rely on online public social media and networking platforms, web/blogging sites, and online forums as preferred channels for propaganda messaging. This is because, unlike private messengers where user engagement level is limited to a certain extent, online public platforms retain huge user bases globally—an ideal space that offers terrorists wide access to potential sympathizers.
Jihadi terrorist groups have preyed upon Central Asia’s domestic population and its diaspora abroad not only as potential recruits but also financial supporters.d Central Asian jihadi groups fighting in Syria and Iraq have consistently invested in propaganda efforts and adeptly used the internet to deliver their messages to the target population. As of July 2022, about 52.7 million (or 73 percent) of Central Asia’s total 72 million population had access to the internet.20 According to estimates, there are nearly five million Central Asians living in Russia. The United States hosts nearly 120,000 Central Asian immigrants, while a few hundred thousand Central Asians are known to reside in Turkey. Their total number in Germany, Poland, and Sweden runs into the tens of thousands. Between 20,000-30,000 Central Asian immigrants reside in South Korea, the largest such population in East Asia. These communities have been growing gradually throughout the last decade.
HTS-related Cases
Among Central Asian jihadi groups fighting in Syria, Kateebat Imam al-Bukhari (KIB) and Kateebat at Tawhid wal Jihad (KTJ) have been the most active in terms of both propaganda outreach and military strength. Affiliated with al-Qa`ida, the two groups operate primarily in Syria’s northwestern Idlib province, under the control of HTS.
KIB and KTJ, through their own media divisions—which are called “Al-Bukhari Media” and “Jannat Oshiqlari” (‘Lovers of Paradise’), respectively—have extensively produced extremist content and disseminated it online. Especially before their inclusion in the sanctions lists of United States, the United Nations, Central Asian governments, and Russia in recent years, KIB and KTJ had annually put out several dozen audio and video media releases on their Uzbek-language blogging websites.21
In the past, these releases have been redistributed by the groups’ members and supporters on various social media sites including YouTube, Facebook, Instagram, Odnoklassniki, and VK, often without altering the existing title and visual content.22 Some of these videos have recently appeared on Vimeo and Internet Archive. The propaganda messages have focused on promoting the narratives of victimhood of the Syrian people and cultivating a sense of solidarity among potential Central Asian recruits at home and abroad. Such publications have often included the groups’ contact details on encrypted online platforms such as Telegram, Tutanova, and WhatsApp for those who wished to communicate with them on any matters, including to offer financial assistance. For instance, propaganda accounts on YouTube such as “Ustozlar yo’li” (“The Path of the Teacher/Guide”) and “Abu Saloh darslik” (“Abul Saloh textbook”) contain videos propagating the jihadi cause of KTJ and HTS. In the video descriptions and comments under their YouTube videos, the accounts have provided their contact details on Telegram for those viewers who would be interested in contacting them.
The author’s tracking of online jihadi media indicates that KIB and KTJ have found it more difficult to post on social media platforms since their designations as terrorist groups.23 Unlike previously, the groups now cannot maintain group accounts under their actual name for lengthy periods of time. Instead, their content is posted by anonymous individuals in limited volume and with titles often containing a combination of legitimate phrases such as “islomiy darsliklar” (Islamic textbooks), “islom tarixi” (history of Islam), and “islomiy darslar” (Islamic lessons/courses). While propaganda video lectures by notorious ideologues of KTJ, “Akhluddin Navkotiy” and the late “Abu Saloh,” or KIB’s “Abu Yusuf Muhojir,” would have previously been uploaded predominantly in video format, now such lectures tend to appear on social media platforms mostly in the form of audio. Their visual publications do not explicitly promote violence, and their titles and descriptions do not contain the specific words that may result in the posts being flagged to content moderators.
Another case fitting the pattern discussed above is that of Farrukh Furkatovitch Fayzimatov, an Idlib-based Tajik militant who goes by the nom de guerre of “Faruq Shami.” Fayzimatov has emerged as a prominent financier of HTS in recent years. He has conducted active propaganda campaigns via social media platforms aimed at recruiting new members and collecting donations among Russian and Central Asian speaking internet users.24 His audio and video publications posted on a blogging site that publishes the content created by various HTS-linked groups from Russia and other Commonwealth of Independent States (CIS) countries have often provided some preliminary fundraising guidelines and contact information of HTS-linked individuals’ encrypted communication accounts. In July 2021, the U.S. Treasury Department added Fayzimatov to its Specially Designated Nationals List as an HTS-linked financial facilitator in Syria.25 His case will be discussed in detail further down.
Islamic State-related Cases
In contrast to the Central Asian HTS-affiliated entities and individuals described above, Islamic State-linked Central Asians in Syria, Iraq, and Afghanistan have not created specific Central Asian groupings with their own propaganda wings. Instead, Islamic State-affiliated Central Asian fighters have relied on various Islamic State media wings to produce propaganda content. Despite this, the Islamic State has outperformed HTS-linked Central Asians in terms of overall numbers of channels that they run on various online social media platforms.26 Over years of monitoring relevant jihadi online media, the author has not seen any evidence to suggest that the Islamic State or its regional branch in Afghanistan created and maintained web/blogging sites to constantly disseminate propaganda in Central Asian languages. Studies conducted by Julia Sweet as part of her PhD dissertation submitted to the State University of New Jersey in 2020 suggested a similar pattern within Russian-speaking Islamic State groups. While describing the Islamic State as “being mainly a social media project,” Sweet highlighted that she had not seen any significant website or blog run by the Islamic State’s Russian-speaking networks since 2016.27
Instead, the launch by Central Asian Islamic State-linked militants of several channels on Telegram in local languages suggests that their fundraising calls and contacts sharing mainly take place on public channels that they have created on various secure messaging apps including Telegram itself.28 Such public channels allow the ‘one-way’ broadcast of messages to followers.29 Researchers have noted that the Islamic State’s Tajik fundraising propaganda might also have been disseminated on Instagram alongside such appeals on Instagram in Russian.30
Step 2: Encrypted Communication
Ensuring the secure online transfer of funds is a priority for terrorist groups. Otherwise, their fundraising practices and operational security as well as the identities of their financiers would be in danger of detection by law enforcement agencies.31 Unlike in the first stage, fundraising efforts in this stage are usually therefore performed privately in encrypted messengers. As such, there is scarce information on the specifics and content of such interactions. Given this limitation, this study cannot grasp the entire complexity of terrorists’ use of encrypted communication services. Instead, it provides a preliminary observation on some aspects.
Central Asian terrorist groups and terrorist individuals have encouraged their supporters to contact them directly via online encrypted messaging services such as Element, Telegram, Tutanota, WhatsApp, Wickr, Wire, and Zello in order to make contributions.32 They have provided the phone numbers or usernames associated with their accounts on these platforms in public posts to facilitate this communication.33 The author’s analysis of a series of videos uploaded by the aforementioned Fayzimatov on a Russian-language blogging site from 2020 to 2021 implies that after establishing contact with interested users through initial interactions, militants apparently first study donors’ backgrounds, financial circumstances, and level of ability to use certain fund transfers methods before passing on detailed fund-moving safety guidelines within the identified transfer method. For instance, in a video appeal released on January 22, 2021, Fayzimatov claimed that “through direct and private communications,” he would give “necessary consultations” to potential donors depending on their level of knowledge and location.34 Within the indicated period (between 2020 and 2021), Fayzimatov organized at least 10 rounds of fundraising drives. Each video he uploaded got from 100 to 300 views.35
In the earlier videos, Fayzimatov encouraged HTS sympathizers to communicate with him via Telegram, WhatsApp, and Wickr if they wished to send money to the group. However, he subsequently asked his pool of online supporters to use Wire instead of Wickr, as he believed the latter was “run by security services.”36 He also suggested Element, an end-to-end encrypted messenger that uses the Matrix’s Olm/Megolm crypto protocols, and Tutanota, a German end-to-end encrypted email provider, as secure communications systems while providing his contact addresses for both.37 The WhatsApp number he shared had a country code of Poland.38 However, it was unclear if this number was his personal WhatsApp account or not.
Online crowdfunding campaigns run by Fayzimatov have drawn inspiration from reward-based marketing techniques. For instance, in a video appeal issued on January 22, 2021, he announced an online fundraising campaign to purchase motorbikes for jihadi fighters.39 One of the distinctive features of this drive, which was conducted in several rounds, was that it was organized in the form of a contest. After the end of each round of competition, the names of the winners were penned down on the motorcycle fuel tank as an appreciation.40 According to Fayzimatov, this would serve as a “witness in the Judgement Day” that the sender had made his/her contribution to “jihad.” Fayzimatov also mentioned that participants in this online contest would be judged based on two main criteria: the level of secureness of the tool/mode proposed by the sender to transfer the money, and the amount of the donations.41 By encouraging donors to offer their own way of safe transfers, Fayzimatov was tapping into the possibly deeper know-how of interested supporters on making money transfers.
Fayzimatov claimed that as a result of these campaigns, a total of seven motorcycles and one car were purchased for use in the mountainous environment of Syria.42 He stated that some of these motorcycles would be used by the so-called inghimasi forces, well-trained shock troops who are deployed to launch surprise raids into fortified enemy positions.43 The videos suggest that the funds raised have been used to purchase small weapons for HTS fighters and media equipment for Fayzimatov who presents himself as a “media activist.”
Another case of Central Asian jihadis using encrypted communication to fundraise was the Tajik Islamic State cell allegedly plotting attacks against U.S. and NATO military bases in Germany before German police moved in to make arrests in April 2020.44 The cell members used Telegram and Zello to organize and coordinate some of their fundraising and fund-moving operations across Europe, Turkey, and Syria under guidance received from their handlers in Afghanistan and Syria.45
In another case in Germany, an unnamed 29-year-old Tajik citizen was accused in February 2023 of being a member of the Islamic State and having mediated financial aid for widows and orphans of ‘martyred’ Islamic State members in Syria and Iraq as well as for female prisoners linked to the group in Syria and Iraq.46 The Tajik man reportedly established contact with both prisoners and donors in early 2020. As of March 2023, the Tajik man was at liberty in Mecklenburg-Western Pomerania with the presumption of innocence being applied until the conclusion of the criminal proceedings.47
Russia has also seen radicalized Central Asian migrants using encrypted messaging apps for fundraising. According to the verdict issued by the Court of Appeal of the Supreme Court of the Russian Federation on June 5, 2020, a cell of Islamic State supporters in Russia led by a Tajik citizen, Giyeyev Shodruz, transferred 7,000 Russian roubles (nearly 130 U.S. dollars) to a Tajik Islamic State operative in Afghanistan in September 2017 via an undisclosed payment method after receiving instructions from this operative via Zello.48 The cell members, comprised of citizens of Russia, Tajikistan, and Uzbekistan, were ultimately sentenced up to 17 years in prison.49
Zello appears to have become a platform of choice for certain Central Asian jihadis. According to Tajik authorities, Sayvaly Shafiev, a notorious Afghanistan-based Tajik Islamic State commander who is also known as “Abubakri Muvakhkhid” or “Mauaviya,” has used Zello in his propaganda targeting of Tajik migrant workers in Russia.50 Concerned over the increasing usage of Zello by Tajik militant groups, Tajikistan’s State Committee for National Security (GKNB) went so far as to call Zello an “extremist” platform.51
Step 3: Online Payment
The third step in the process is the completion of the transaction via online payment. According to the available open-source information, jihadis in the Central Asian region have used cryptocurrencies (Bitcoin, Lightcoin, Tether), digital payment services (QIWI, E-Wallet, Western Union, Ria), and online bank transfers.
Cryptocurrencies: Bitcoin, Lightcoin, and Tether
The use of cryptocurrencies by Central Asian groups and individuals has thus far been limited. Despite this, there are some concerning trends. On April 18, 2019, the SITE Intelligence Group reported that HTS had called Bitcoin the “Currency of the Future Economy” in its online propaganda magazine and released a 26-minute video of an “HTS cleric discussing its compliance with Shariah-law.”52 As part of HTS’ network in Syria, Fayzimatov reportedly collected several thousand dollars in Bitcoin (BTC) and other cryptocurrencies transferred from multiple U.S., Russian, Asian, and European exchanges through various online crowdfunding campaigns.53
One of the earliest promotions of cryptocurrency transfers by Fayzimatov came in the aforementioned video uploaded on January 16, 2021, in which he announced that the collected funds would be used to purchase motorbikes and automatic rifles for the inghimasi force.54 He listed Bitcoin, Lightcoin, and Tether as options for crypto transfers by prospective donors.55 e However, in a video statement released on March 31, 2021, he claimed that the amount of the cryptocurrencies that he received was negligible and only a handful of people had made contributions.56 Expressing his regrets that the collected amount was so small, he asked his followers to contact him via his contact addresses on Telegram and Wire that he provided to consult with him on whether such collections should be continued or not.57 Via such consultations, he was seemingly trying to understand why the collected cryptocurrencies were so minimal.
Within the HTS alliance, there is a small jihadi unit named Malhama Tactical. With some Central Asians in its ranks, the Chechen-led Malhama Tactical has been part of a significant network engaged in bitcoin transfer run by various al-Qaida-affiliated groups in Idlib.58 According to the U.S. Department of Justice (DOJ), two BTC addresses that were shared by Malhama Tactical on Twitter were part of a cluster that received approximately 0.19501359 BTC (about 5,330 U.S. dollars as of April 2023) via 15 transactions between July and November 2019.59 According to the DOJ, the group transferred about 0.03839 (about 1,100 U.S. dollars currently) BTC to an al-Qaida-linked cluster in October 2018.60 Often posing as charities, al-Qa`ida, HTS, and their affiliates operating in Syria have used Facebook, Telegram, Twitter, and other online platforms to collect bitcoin donations mainly through crowdfunding.61 A significant portion of these donations were laundered through BitcoinTransfer, a crypto exchange hub based in Idlib.62
Besides Malhama Tactical, KTJ is another unit within HTS that has started receiving payments in cryptocurrencies from radicalized Central Asian individuals to support its activity. On January 17, 2023, the Supreme Prosecutors’ Office in South Korea initiated a criminal case against two Central Asian individuals—an Uzbek and a Kazakh national—on charges of transferring financial aid to KTJ in cryptocurrency.63 The Uzbek suspect, who settled in South Korea as a refugee in 2018, had allegedly raised about 10 million won ($7,700) in cash from his “fellow accomplices” in towns such as Yeongam in the country’s South Jeolla Province since August 2021 and transferred the collected funds to KTJ after converting the funds to USDT (or Tether) through a Hong Kong-based cryptocurrency exchange.64 Similarly, the Kazakh detainee, who had reportedly moved to South Korea in 2019, allegedly collected one million won ($766) and delivered the funds to KTJ after exchanging the money to cryptocurrency.65 While prosecutors did not provide further details to clarify if and how the detained duo coordinated their activities, this fundraising campaign was allegedly assisted by seven unnamed foreigners. South Korea deported five suspected accomplices to their home countries in December 2022 whereas deportation procedures for the remaining two are still yet to complete.66 South Korean authorities also noted that this was the first case in which foreign residents in South Korea were found to have funded a terrorist group in cryptocurrencies.67
Although some Central Asian militant groups and individuals operating in Syria have shown some interest in and made some attempts at fundraising in cryptocurrencies as discussed above, there is little indication that they have turned to this type of fundraising en masse. Fayzimatov’s acknowledgment that the volume of cryptocurrencies he collected through various campaigns was tiny suggests that Central Asian militants and their supporters do not really use or understand how to use such virtual currencies.
Digital Payment Services: QIWI Wallet, YandexMoney, Western Union, and Ria
The Russian payment services providers QIWI Wallet and YandexMoney have been popular modes of money transfer for terrorist supporters among Central Asians at home and abroad. Terrorism financiers often use QIWI as it allows transfers without inclusion of sensitive bank account details, and without opening a bank account in the first place. Transfers are done at a dedicated QIWI kiosk or via smartphone. QIWI is available in Kazakhstan, Tajikistan, and Kyrgyzstan, as well as in Russia.68
For instance, a terrorist cell that involved Kyrgyz and Tajik citizens operating across Kyrgyzstan and Turkey exchanged transactions via QIWI and Western Union amounting to a few thousand U.S. dollars from 2014 and 2015.69 One of the cell members, whose national identity was not publicly disclosed, was wanted on terrorism charges in Belgium.70 The cell members reportedly received instructions from their contact in an unnamed terrorist group via Zello.71 Around the same time, an Islamic State recruitment cell run by Kazakh and Kyrgyz citizens in Kazakhstan transferred more than $19,000 via Western Union in eight tranches before its disruption by authorities.72
In recent years, there have been a significant number of counterterrorism financing cases in Russia involving Central Asians using digital payment systems. In August 2018, the Russian Supreme Court sentenced a Tajik citizen named Abduraim Bobomurodov to six years in a general-security penal colony for financing the Islamic State.73 According to the court documents, Bobomurodov—while residing in Russia—transferred about $90 to an Islamic State member in Turkey using QIWI, WebMoney Transfer, and YandexMoney.74 There was an unwitting middleman in Russia who helped Bobomurodov complete this transfer.75 Notably, Bobomurodov was a member of an Islamic State-related channel on Zello, where he received instructions and details on how and where to send the money.76
The above-discussed HTS-affiliated terrorist Fayzimatov reportedly has also received transfers via digital payment systems. In April 2021, an investigation by Russia’s security agencies into a group of suspected jihadi terrorists in Crimea established that one of the suspects sent money to Fayzimatov with QIWI and YandexMoney in several tranches to finance the activities of HTS.77 YandexMoney, which has recently rebranded itself as YooMoney, is the second-largest electronic payments service in Russia and one of the most popular in the Commonwealth of Independent States.78
On April 22, 2021, a court in Russia’s Novosibirsk sentenced an Uzbek citizen to eight and a half years imprisonment after finding him guilty of transferring money to KTJ in Syria via QIWI Wallet.79 In February 2022, it was reported that authorities in Kazakhstan had begun an investigation of an unnamed citizen after being alerted by QIWI Wallet’s monitoring team about his or her alleged transfer of funds to militants in Syria.80
As a number of researchers have documented, various Telegram groups run by Tajik-speaking recruiters have collected money among migrant laborers in Russia to send to Islamic State militants in Afghanistan and the wives and children of Islamic State fighters stranded in detention camps in Syria and Iraq.81 Donors have used QIWI to make transfers. Most transactions have been made in small amounts (under 1,000 rubles, or 17 U.S. dollars), presumably so as to not attract suspicion from monitoring specialists.82
There was also a case in which Central Asian individuals used Ria Money Transfer, an international money remittances service, to fund terrorism. In 2019, Swedish police disrupted an Islamic State cell in the country. Investigations established that the cell, which brought together predominantly Uzbeks immigrants, planned an attack in Stockholm.83 Investigations revealed that from January to May 2018, the cell had transferred approximately 95,000 Swedish kronor (about $9,400) to the Islamic State in Syria through a middleman in Turkey who was identified in Swedish court documents as Shavkat Gaziev.84 The cell used Ria Money Transfer to deliver this amount to Gaziev in 12 tranches.85
Online Bank Transfers
In December 2021, a court in South Korea convicted a Russian citizen for establishing contact with a member of Jabhat al-Nusra (the HTS predecessor group in Syria) through unnamed online social networking platforms and sending 2.94 million Korean won (around $2,500) to the group through fraudulent bank accounts to help its activities.86 The convicted man reportedly conducted the money transfer at the request of a friend in Kyrgyzstan.87 The case illustrated one of the ways Central Asian individuals have attempted to disguise transactions.
South Korean authorities had previously arrested some Central Asians on similar charges. For instance, in November 2019, South Korean police detained an illegal Kazakh immigrant who allegedly collected money from three other foreign workers and transferred money worth about $1,000 to an unnamed Central Asian terrorist group.88 In May 2017, a local Uzbek magazine reported about a group of detained Uzbek nationals who had sent funds to a madrasa and charity foundation run by a KIB-linked preacher in the Zeytinburnu neighborhood in Istanbul, Turkey, while working in South Korea.89 The case illustrated how schools and charity organizations can be used as fronts in terrorism financing.
In a case in Russia, in January 2019, the country’s Supreme Court sentenced a Tajik citizen named Naim Makhmadaliev to five years in prison for being a member of an Islamic State support cell that conspired to attack a military truck on one of Moscow’s highways.90 Makhmadaliev transferred 2,400 rubles ($40) to the bank account of one of the cell members who then ordered a remote-controlled relay in the Alibaba e-commerce site to manufacture an improvised explosive device (IED) to be used in the planned attack.91
Conclusion
Central Asian terrorist groups and individuals have been exploring new and more secure ways of funding their activities. As part of these efforts, they are increasingly relying on modern internet-enabled technologies as means to reach out to their potential supporters among both Central Asia’s domestic population and its immigrant communities abroad to collect money.
As detailed in the article, terrorism financing activities by Central Asian groups tend to involve three main stages: fundraising propaganda and contact sharing; communication over encrypted apps between potential donors and recipient militants; and the completion of transactions. It is worth noting that the stages listed and reviewed in this article are likely not unique to Central Asian groups. Rather, this is likely a general and logical method used by other terrorist networks as well. The research of Julia Sweet suggests similar patterns have been observed in the online funding approaches employed by wider Russian-speaking jihadi networks.92
Based on the available data in the public domain, it seems that Telegram and Zello are preferred communication options for Central Asian jihadis. As Fayzimatov’s encouragement of his supporters to use Wire instead of Wickr has shown, when militants perceive one tool to have become riskier, they move to other platforms.
When it comes to the transfer methods, QIWI and E-Wallet have repeatedly been used by Central Asian jihadis.
Despite some apparent interest by Central Asian terrorists in collecting payments in Bitcoin, Lightcoin, and Tether, the usage of virtual currencies appears to be limited at this point—possibly due to the unpopularity of such digital currencies among the general public of the region and existing practical limitations on their day-to-day use.93 However, Central Asian groups’ continuing engagement with bigger militant organizations such as HTS that have experience in using cryptocurrencies may serve as an inspiration and opportunity for them to learn and adopt various new approaches to digital terror financing.
Substantive Notes
[a] There are other Central Asian jihadi groups, such as the Taliban-linked Islamic Jihad Group (ISG) and Jamaat Ansarullah in Afghanistan. There are also Central Asian individuals fighting in the ranks of al-Qa`ida-affiliated Hurras al-Din (HAD) in Syria. Nevertheless, the author has not seen any evidence to suggest whether these entities and individuals have been collecting digital funding from Central Asians or not. See “Twenty-seventh report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations Security Council, February 3, 2021, pp. 15-16; “Thirtieth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2610 (2021) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations Security Council, July 15, 2022, p. 17.
[b] It is worth highlighting that while jihadis have increasingly been using new technologies for terror financing, instances of cash-based jihadi fundraising have not halted. It is not clear the degree to which groups use cash to fund terrorism. Some experts argue that digital payment technologies have a tail that would make it easier for investigators to retrace the digital financial transactions, whereas the use of cash would involve more risk for those collecting the funds, but lesser risk for those who are donating/providing the funds.
[c] In fact, ISK’s media wing, Al-Azaim Foundation, started to produce and publish propaganda content in Kyrgyz, Tajik, and Uzbek on a regular basis on its Telegram channels in 2022. However, it should be noted that when Al-Azaim Foundation was founded in Afghanistan in 2021, its propaganda campaign was run mainly in Pashto, Dari, and Arabic. Subsequently, it has added multiple other languages including English, Hindi, Malayalam, Urdu, and the listed Central Asian languages apparently as part of efforts to expand its multilingual propaganda beyond Afghanistan. Lucas Webber, “Voice of Khorasan Magazine and the Internationalization of Islamic State’s Anti-Taliban Propaganda,” Terrorism Monitor 20:9 (2022).
[d] For the purpose of this article, Central Asia is defined as the area encompassing the five countries of Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, and Uzbekistan.
[e] Forbes Advisor describes Tether, which is also known as USDT, as the largest stablecoin by market capitalization. As with any stablecoin, the value of Tether is pegged to a stable asset like gold, the U.S. dollar, or another fiat currency, which means the coin attempts to maintain the same value as its peg. See Coryanne Hicks, “What Is Tether? How Does It Work?” Forbes, February 21, 2023.
Citations
[1] “Neskol’ko desyatkov faktov finansirovaniya terrorizma presecheno v Kazakhstane” (“Several dozens of terrorist financing facts were suppressed in Kazakhstan”), Kazinform (Kazakhstan), October 21, 2021.
[2] “V Tadzhikistan iz-za rubezha byli dostavleny 50 terroristov i ekstremistov” (“50 terrorists and extremists were brought to Tajikistan from abroad”), Avesta (Tajikistan), February 2, 2022.
[3] “S 2016 goda za finansirovaniye terrorizma osuzhdeny 62 cheloveka” (“Since 2016, 62 people were convicted for financing terrorism”), Gazeta (Uzbekistan), November 29, 2021.
[4] Alexandra Shopenko, “Prizyval finansirovat’ terrorizm: radikal’nogo islamista zaderzhali v Khabarovskom kraye” (“Called for financing terrorism: a radical Islamist was detained in the Khabarovsk Krai”), Komsomolskaya Pravda (Russia), March 2, 2022; “FSB zaderzhala migranta, rasprostranyavshego terroristicheskiye idei” (“FSB detained a migrant who spread terrorist ideas”), News.Ru (Russia), December 2, 2021.
[5] “Kyrgyzstanis suspected of financing terrorist attack detained in Bishkek,” 24.kg (Kyrgyzstan), October 14, 2021.
[6] Nodirbek Soliev, “The April 2020 Islamic State Terror Plot Against U.S. and NATO Military Bases in Germany: The Tajik Connection,” CTC Sentinel 14:1 (2021).
[7] Carl-Fredrik Eriksson, “David Idrisson, 46, släpps ur häktet i väntan på dom,” Expressen (Sweden), May 24, 2019.
[8] Viktor Mikhaylov, “Grazhdanin Uzbekistana, prozhivayushchiy v SShA, v kontse kontsov, soznalsya v okazanii pomoshchi IGIL,” Stopterror.uz (Uzbekistan), August 16, 2019.
[9] “South Korea accuses Kazakh of financing terror group,” AKIPress (Kyrgyzstan), November 22, 2019; “Avval ish bilan Koreyaga, keyin hijratga yul olganlar” (“First they went to Korea to work, then they decided to do hijrah”), Darakchi (Uzbekistan), May 29, 2017; “Russian sentenced to 1 1/2 years in prison for funding Syrian terrorist group,” Yonhap News Agency, December 1, 2021.
[10] “Terrorism Financing in Early Stages with Cryptocurrency But Advancing Quickly,” Chainalysis, January 17, 2020; Audrey Alexander and Teddy MacDonald, “Examining Digital Currency Usage by Terrorists in Syria,” CTC Sentinel 15:3 (2022).
[11] Kamila Abdukarimova and Sanzhar Aubakirov, “Obzor tekushchey situatsii po protivodeystviyu otmyvaniyu deneg i finansirovaniyu terrorizma v Kazakhstane” (“The review of the current state of combating money laundering and terrorist financing in Kazakhstan”), a bulletin published by the Turan University, issue 4, (2019): pp. 257-260.
[12] Zagira Iskakova and Akmeir Rakymdzanova, “‘O finansovom monitoringe i Kazakhstanskaya model’ finansovaya monitoringa” (‘On Financial Monitoring and Kazakhstan Model’ of Financial Monitoring’), International Journal Of Applied And Fundamental Research 4 (2014): pp. 219-221.
[13] Mukash Israilov (ed.), “Osobennosti natsional’noy sistemy PFTD/LPD Kyrgyzskoy Respubliki” (“Features of the National CFTA/LCI System of the Republic of Kyrgyz Republic”), volume 2: (2019) p. 255; Almaz Bazarbaev, “Protivodeystviye finansirovaniyu terrorizma: ugolovno-pravovoy i kriminologicheskiy aspekty: Po materialam Kyrgyzskoy Respubliki” (“Countering the Financing of Terrorism: Criminal Law and Criminological Aspects: Based on the Materials of the Kyrgyz Republic”), an abstract of Dr. Bazarbaev’s manuscript for a PhD degree, 2004.
[14] Afzal Ashraf and Indira Aslanova, Why We Went to Fight and Why We Returned. Radicalisation and Deradicalisation – Learning from Foreign Terrorist Fighters (Bishkek: Research Centre of Religious Studies, 2021), p. 96.
[15] For instance, Lucas Webber and Laith Alkhouri in their commentary entitled “Jihadi Networks Fundraise for Islamic State Families in Syrian Camps Using Cryptocurrency and Russian Banks” that was published on Militant Wire on September 21, 2022, explore Tajik-speaking Islamic State network’s fundraising activities on Telegram to purportedly support Islamic State detainees in Syria.
[16] Viktor Mikhailov, “Budushcheye uzbekskikh dzhamaatov v Sirii…” (“The Future of Uzbek Jamaats in Syria…”), commentary series published in eight volumes on the CSRT website from March 9, 2015, to January 19, 2021.
[17] Hans-Jakob Schindler, “Emerging challenges for combating the financing of terrorism in the European Union: financing of violent right-wing extremism and misuse of new technologies,” Global Affairs 7:5 (2021): p. 801; Tom Keatinge and Kerstin Danner, “Assessing Innovation in Terrorist Financing,” Studies in Conflict & Terrorism 44:6 (2021): p. 457.
[18] Author’s tracking of websites and online blogging sites used by extremists; Julia Sweet, “Jihadist media networks and virtual propaganda in the Russian cyberspace,” PhD dissertation, Rutgers, The State University of New Jersey, 2020, pp. 55-56, 139-142.
[19] Ibid.
[20] “Number of internet users in the world as of 2022, by region,” Statista Research Department, July 27, 2022.
[21] “Khatiba Imam Al-Bukhari (KIB),” United Nations Security Council, March 29, 2018; “Designation of Katibat al-Imam al-Bukhari,” U.S. Department of State, March 28, 2018; “Terrorist Designation of Katibat al Tawhid wal Jihad,” U.S. Department of State, March 7, 2022; “Decree on the List of Organizations Recognized as Terrorist and Extremist in the CSTO Member-States,” Committee of Secretaries of the Security Councils of the Collective Security Treaty Organization, June 8, 2016; “The Name of the Organizations or Resource Recognized as a Terrorist,” Ministry of Justice of the Republic of Uzbekistan, March 12, 2019.
[22] “Central Asia: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan,” Counter Terrorist Trends and Analyses 11:1 (2019): p. 67; “Zaderzhannykh uzbekov podozrevayut v popytkakh vyyekhat’ v Siriyu” (“Detained Uzbeks are suspected of trying to leave for Syria”), Radio Azattyk, Novmber 9, 2015; “The Name of the Organizations or Resource Recognized as a Terrorist,” Ministry of Justice of the Republic of Uzbekistan, February 16, 2021; Kumar Bekbolotov, Robert Muggah, and Rafal Rohozinski, “Jihadist Networks Dig In on Social Media Across Central Asia,” Foreign Policy, November 11, 2020.
[23] In the relevant sections of her PhD dissertation, which is entitled “Jihadist media networks and virtual propaganda in the Russian cyberspace” and submitted to Rutgers, The State University of New Jersey in 2020, Julia Sweet makes a similar observation.
[24] “Treasury Designates Al-Qa’ida-Linked Financial Facilitators in Turkey and Syria,” U.S. Department of the Treasury, July 28, 2021; author’s review of websites containing materials published by Fayzimatov; Sweet, pp. 199-208.
[25] Ibid.; “Counter Terrorism Designations; Syria and Syria-Related Designations and Designations Updates,” U.S. Department of the Treasury, July 28, 2021.
[26] Bekbolotov, Muggah, and Rohozinski.
[27] Sweet, pp. 299-300.
[28] Bekbolotov, Muggah, and Rohozinski; Lucas Webber and Laith Alkhouri, “Tajik Islamic State network fundraises in Russia,” Eurasianet, June 13, 2022.
[29] Jon Russell, “WhatsApp copies Telegram to add one-way ‘broadcast’ mode to group chats,” TechCrunch, June 30, 2018.
[30] Webber and Alkhouri, “Jihadi Networks Fundraise for Islamic State Families in Syrian Camps Using Cryptocurrency and Russian Banks.”
[31] Alexander and MacDonald.
[32] Author’s tracking of relevant extremist content on online publicly accessible platforms.
[33] Author’s tracking of relevant extremist content on online publicly accessible platforms.
[34] A Russian-language Islamist extremist blogging site.
[35] Author’s tracking of a Russian-language Islamist extremist blogging site.
[36] A Russian-language Islamist extremist blogging site.
[37] Natasha Lomas, “German secure email provider Tutanota forced to monitor an account, after regional court ruling,” TechCrunch, December 8, 2020.
[38] A Russian-language Islamist extremist blogging site.
[39] Ibid.
[40] Ibid.
[41] Ibid.
[42] Ibid.
[43] Ibid.; Charlie Winter, “Suicide Tactics and the Islamic State,” International Centre for Counter-Terrorism, January 10, 2017.
[44] Soliev.
[45] Ibid.
[46] “Anklage gegen 29-Jährigen wegen IS-Mitgliedschaft,” Süddeutsche Zeitung, February 27, 2023.
[47] Ibid.
[48] “Apellyatsionnoye opredeleniye: N 225-APU20-3” (“Appellate Ruling: N 225-APU20-3”), Supreme Court of the Russian Federation, June 5, 2020; “Svedeniya ob organizatsiyakh i fizicheskikh litsakh, prichastnykh k terroristicheskoy deyatel’nosti” (“Information about organisations and individuals involved in terrorist activities”), Federal Service for Technical and Export Control of Russia, updated July 26, 2022, p. 141.
[49] Ibid.
[50] Bakhmaner Nadirov, “GKNB: Terroristy, gotovivshiye terakty v Dushanbe, osuzhdeny na dlitel’nyye sroki” (“SCNS: Terrorists who prepared terrorist attacks in Dushanbe sentenced to long terms”), ASIA-Plus (Tajikistan), August 1, 2018; “Hukmi sudi şahri Duşanbe nisbati Nosirov Toçiddin Nasriddinovic” (“The verdict of the Dushanbe city court against Nosirov Tajiddin Nasriddinovych”), May 8, 2019; “Twenty-fourth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations Security Council, July 15, 2019, p. 15.
[51] Mekhrangez Tursunzoda, “GKNB Tadzhikistana nazval prilozheniye Zello ekstremistskim” (“The State Committee for National Security of Tajikistan called the Zello app extremist”), ASIA-Plus (Tajikistan), May 22, 2018.
[52] Alexander and MacDonald; “HTS Magazine Promotes Bitcoin as ‘Currency of the Future Economy,’” SITE Intelligence Group, April 18, 2019.
[53] “OFAC Sanctions Syrian-Based Terrorist Financier and Associated Bitcoin Address,” TRM Labs, July 28, 2021.
[54] A Russian-language Islamist extremist blogging site.
[55] Ibid.
[56] Ibid.
[57] Ibid.
[58] “Chainalysis in Action: Department of Justice Announces Takedown of Two Terrorism Financing Campaigns with Help from Blockchain Analysis,” Chainalysis, August 13, 2020; Alessandro Arduino and Nodirbek Soliev, “Malhama Tactical: The Evolving Role of Jihadist Mercenaries in the Syrian Conflict,” Insights, No. 262, June 22, 2021, pp. 7-8.
[59] “United States’ Verified Complaint for Forfeiture In Rem,” United States District Court for the District of Columbia, 2020, p. 13.
[60] Ibid.
[61] “Chainalysis in Action: Department of Justice Announces Takedown of Two Terrorism Financing Campaigns with Help from Blockchain Analysis.”
[62] “Bitcoin Transfer: Syria-based Cryptocurrency Exchange Facilitating Terrorism Financing,” Chainalysis Intelligence Brief, August 2020.
[63] “Foreign nationals arrested for funding terrorist group with crypto,” Korea JoongAng Daily, February 17, 2023; “Foreigners caught funding terrorist group using cryptocurrency,” Korea Times, February 16, 2023.
[64] Ibid.
[65] Ibid.
[66] Ibid.
[67] Ibid.
[68] “IS Militants Use Popular Russian Web Payment System To Raise Cash,” Radio Free Europe/Radio Liberty, May 17, 2015.
[69] “Vzaimosvyaz’ mezhdunarodnogo terrorizma s s transnatsional’noy organizovannoy prestupnost’yu” (“Relationship between international terrorism and transnational organized crime”), United Nations Security Council, 2017, p. 7.
[70] Ibid.
[71] Ibid.
[72] Ibid., p. 6.
[73] “Apellyatsionnoye opredeleniye: No. 201-APU18-30” (“Appellate Ruling: No. 201-APU18-30”), Supreme Court of the Russian Federation, August 7, 2018.
[74] Ibid.
[75] Ibid.
[76] Ibid.
[77] “V Respublike Krym zaderzhany zaderzhany storonniki mezhdunarodnoy terroristicheskoy organizatsii” (“Supporters of an international terrorist organisation have been detained in the Republic of Crimea”), National Antiterrorism Committee of Russia, April 8, 2021.
[78] “‘Yandeks’ zapustil platezhnuyu sistemu vzamen ‘Yandeks.deneg’” (“‘Yandex’ has launched a payment system to replace ‘Yandex.Money’”), CNews (Russia), March 11, 2021.
[79] “V Peterburge arestovan priyezzhiy iz Uzbekistana, obvinënnyy v finansirovanii terroristov” (“A visitor from Uzbekistan, accused of financing terrorists, was arrested in St. Petersburg”), Fontanka (Russia), February 10, 2021.
[80] “V Kazakhstane vyyavili grazhdanina, kotoryy cherez terminal sponsiroval boyevikov v Sirii” (“In Kazakhstan, a citizen who sponsored militants in Syria through the payment terminal was identified”), Sputnik (Russia), February 17, 2022.
[81] Observers such as Lucas Webber and Riccardo Valle have documented this on their respective research outlets of Militant Wire and The Khorasan Diary and Twitter pages. Separately, Vera Mironova has regularly shared relevant updates on her Twitter page.
[82] Webber and Alkhouri, “Tajik Islamic State network fundraises in Russia.”
[83] Viktor Mikhaylov, “Za chto grazhdanin Uzbekistana byl priznan vinovnym v Stokgol’mskom sude” (“What charges a citizen of Uzbekistan was found guilty of in the Stockholm court”), Center for Studying Regional Threats (CSRT), March 10, 2019.
[84] Ibid.
[85] Swedish court documents, 2019.
[86] “Russian sentenced to 1 1/2 years in prison for funding Syrian terrorist group.”
[87] Ibid.
[88] “South Korea accuses Kazakh of financing terror group.”
[89] “Avval ish bilan Koreyaga, keyin hijratga yul olganlar.”
[90] “Apellyatsionnoye opredeleniye: No. 2-36/2018.”
[91] Ibid.
[92] Sweet.
[93] “Crypto Adoption Steadies in South Asia, Soars in the Southeast,” Chainalysis, September 21, 2022.