Jihadi Networks Fundraise for Islamic State Families in Syrian Camps Using Cryptocurrency and Russian Banks

Over the past several weeks, Russian-speaking jihadist Telegram channels have shared banking details for Islamic State (IS) supporters to donate money — purportedly earmarked for IS families detained in Syria — including QIWI digital wallets, a crypto wallet, and an account at Russia’s largest bank, Sberbank, raising concerns that transnational pro-IS online networks are raising funds to launch attacks and traffic Islamic State families out of detention camps.

The dynamic echoes an existing multichannel Tajik-speaking network collecting funds for the same cause. One network facilitates a Telegram channel called “Devotion and Loyalty” and a discussion group named “Protectors of Ummat.” Over the past few months, this group has risen to prominence within the online ecosystem of Tajik Islamic State supporters and appears to bridge Islamic State Khurasan Province (ISKP) members in Afghanistan with elements in Tajikistan, Russia, and Syria.

It runs a multifaceted operation facilitating recruitment and financing, produces propaganda, and hosts an online discussion platform for Islamic State supporters. It also promotes violence against Central Asian countries, and the discussion channel hosts bomb-making videos and other tutorials on how to construct and store weapons.

Devotion and Loyalty has recently expanded its outreach and started hosting hangouts using Telegram’s video chat feature.

Following our initial investigation of the network, its operations and channels came under pressure through almost daily channel bans for Telegram’s terms of service violations for promoting terrorist content. The group’s financial operations were likewise disrupted when their QIWI bank wallets were frozen, presumably by the financial institution itself.

However, the associated network has rebuilt their apparatus after two months of relentless online assault, including the killing of rising propagandist Yusuf Tajiki, a central figure in their efforts, reportedly by a Taliban mole.

A fundamental theme of both the Devotion and Loyalty and Protectors of Ummat channels is the plight of Islamic State fighters in prisons and the suffering of their families in Syrian detention camps. The territorial military defeat of the Islamic State’s caliphate in Iraq and Syria caused mass displacement of IS families, plus uprooted and further decentralized the movement, leading to a reversion to guerilla tactics in the area and the development of a kind of global “virtual caliphate.”

The fall of Baghuz, Syria, in March 2019 is a solemnly significant historical event in the movement’s lore and represents the group’s last stand against the military coalition comprised of its global and regional enemies. The consequent and continuing humanitarian crisis involving IS families remains a central focus of a vast online ecosystem focused on reminding followers of the mass suffering in Middle Eastern detention camps and taking action to help ameliorate this by raising funds for basic necessities or escape via human smuggling.

Our investigation into the latest Russian-speaking networks indicates their use of QIWI bank wallets and promotion of their cause on Telegram as well as Instagram. They raise money for various needs allegedly including medicine, food, and, alarmingly, to help people escape the camps. They justify that the latter action is imperative to ensure the youth are not repatriated to "disbelieving lands" and can continue perpetuating the Islamic State cause as the future of the movement.

One network called Slaughtered Nation has been on Telegram since at least January 2022 and has almost 700 members. Its primary operation seems to be urging sympathizers to donate funds that it says will aid families of IS fighters in Syria.

In a recent posting, the Telegram channel uploaded a video of a woman, her face obscured, speaking Russian and asking sympathizers to donate. She claims that her daughter is suffering from a kidney disease and bleeding and that several children at the camp have died. Other posts show pictures of meat earmarked for residents of the al-Hol camp in Syria; some include instructions on how to send money and on how to help residents escape the camp.

Children and alleged donations are frequently featured in the images. This tactic aims to generate sympathy from the support base but also reassures the donors that their gifts are employed for benevolent causes.

Multiple postings asking for donations include a QIWI account and a crypto wallet address to collect funds in USDT — a cryptocurrency pegged to the U.S. dollar. In one posting, a phone number with an Azerbaijan country code is attached to one of the QIWI wallets, which enables would-be donors to find the account.

Several photos posted over a period of a few months show sums of money, including dollars, placed with a placard that read the name of the channel and the date, presumably when the money was received.

On the channel’s Instagram account (provided in the Telegram channel’s profile bio) multiple posters in Russian, Arabic, and English have been uploaded. Not only do they include a QIWI wallet number and the USDT crypto wallet, but also an account number at Sberbank, Russia’s largest financial institution.

This is the first observed instance of a pro-IS Telegram channel operating multiple fundraising accounts over three different money transfer platforms. On August 16, the channel indicated that one wallet had a balance of almost 33,457 Russian rubles, roughly $545. Taking into consideration the sums of money already donated to families (if we were to believe the posters are authentic), it is likely that an amount in the lower thousands of dollars has been donated.

This is not a particularly sophisticated fundraising campaign, but it is a persistent one and requires regular account management and handling.

The plight of Islamic State families in Middle Eastern detention facilities and humanitarian camps looms large in the movement’s consciousness. Thus, as long as these families remain in these camps, IS supporters will continue to exploit technology to develop and maintain transnational financial networks, while there is a risk that these fundraising apparatuses are leveraged for offensive attack purposes.