Terrorist Propaganda as Financial Infrastructure

How Islamic State and al-Qaeda Media Ecosystems Enable Terrorist Finance

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Propaganda ecosystems function as parallel trust infrastructures, enabling extremist organisations to coordinate financial activity outside formal financial systems. While extremist propaganda is typically studied as a tool for recruitment or ideological dissemination, these ecosystems also perform a critical financial function as generators of the reputational legitimacy and interpersonal trust necessary for decentralised financial networks to operate.

Over the past decade, violent extremist groups—particularly those affiliated with the Islamic State and al-Qaeda—have leveraged digital propaganda ecosystems to construct increasingly sophisticated parallel financial systems. Through repeated messaging, reputational signalling, and networked communication, these ecosystems enable dispersed actors to authenticate intermediaries, coordinate fundraising, and move resources across geographically fragmented spaces.

This Insight argues that extremist propaganda ecosystems function as trust infrastructures that enable decentralised terrorist financing systems to operate outside formal financial institutions. If propaganda ecosystems generate the trust required for decentralised financial coordination, then disrupting these trust nodes may offer earlier intervention points than traditional transaction-level counter-terrorist financing measures.

The Role of Trust in Institutional and Extremist Financial Systems

Across economic theory, there is broad agreement that financial systems depend on trust. Whereas formal financial systems rely on institutional trust generated by legal frameworks and regulatory institutions that govern banks and financial intermediaries, extremist networks are formally excluded from these channels. This exclusion has forced terrorist groups to build parallel systems that generate trust, enabling the financial coordination required to sustain operations—beginning with propaganda ecosystems.

From a financial perspective, these trust-generating ecosystems enable groups to solicit funds directly while identifying supporters with fundraising potential or financial expertise. At the same time, the rapid expansion of financial technologies—including cryptocurrencies and other fintech tools—has reduced the friction associated with transferring funds across informal networks, allowing extremist actors to mobilise financial resources more rapidly across geographically dispersed stakeholders. Finally, the shared narratives and reputational trust generated within these propaganda ecosystems allow larger organisations to both co-opt local militant groups with independent revenue streams and coordinate financially across otherwise fragmented networks.

To these ends, extremists leverage network-based trust as a substitute for formal institutional trust, enabling financial coordination across informal systems.

Case Studies: Propaganda-Enabled Financial Systems

The following cases illustrate how extremist propaganda ecosystems have contributed to the rise of parallel financial infrastructures used by terrorist groups. While these examples are limited to IS- and AQ-affiliated groups, they are not exhaustive.

Islamic State: Global Financial Facilitation Networks

Although IS affiliates lost the vast majority of their territorial holdings and operational revenue between 2014 and 2019, the broader global organisation has remained resilient in large part due to the continued dissemination of online propaganda. Safe havens such as Afghanistan allowed the organisation’s most active branch—the Islamic State Khorasan Province (ISKP)—to produce and distribute videos, press releases, and its monthly magazine The Voice of Khorasan across platforms including Telegram, Rocket.Chat, Instagram, Facebook, X, and Pinterest.

Beyond ideological messaging, these propaganda ecosystems play a critical role in generating trust across geographically dispersed supporters and operatives. Repeated messaging, shared narratives, and reputational signalling help establish a sense of authenticity and legitimacy within the network. In the absence of formal financial institutions, this reputational infrastructure reduces uncertainty about potential intermediaries and collaborators across geographically vast networks.

With these trust networks in place, the Islamic State organisation has been able to construct sophisticated cross-border financial systems that sustain its global operations. Many of these financial activities were centred in the Cal Miskaad mountain range of Puntland, Somalia, where the group’s al-Karrar office coordinated fundraising and financial transfers across Africa and Asia before a 2025 series of U.S. airstrikes and local military operations disrupted the hub. Arrests of financial operatives in Europe and the United States suggest elements of this architecture were already operating across multiple jurisdictions, suggesting a move toward a more decentralised model of interconnected trust nodes.

Islamic State propaganda ecosystems support these parallel financial systems in three primary ways. The first is direct fundraising, with outlets such as The Voice of Khorasan and individual operatives soliciting donations directly from supporters, often through QR codes linked to cryptocurrency transfers. Because these appeals circulate within trusted propaganda communities, potential donors face fewer informational barriers when deciding whether to contribute. Evidence shows that financial and propaganda roles intertwine: for example, French police arrested a man in November 2025 in relation to financing and disseminating propaganda for the ISKP.

The second function is coordination and network formation. Cryptocurrency transfers and hawala transactions are frequently arranged through encrypted messaging platforms such as WhatsApp by operatives who likely initially connected through propaganda communities on other social media platforms. In this sense, propaganda ecosystems act as authenticators, helping participants identify trusted intermediaries and facilitating financial coordination across dispersed networks.

The third function is integration, with the broader organisation inspiring local jihadist groups with independent revenue streams to join and contribute. Examples include the Islamic State Southeast Asia Province (ISEAP) in the Philippines and Islamic State–Mozambique, both of which operate locally embedded revenue systems while maintaining ties to the broader Islamic State network. In such cases, joining broader financial networks allows these groups to receive funds to expand their attacks or revenue generation, and contribute back to the larger organisation.

Figure 1: Image from the ISKP’s Voice of Khorasan magazine soliciting crypto donations in Monero

Al-Qaeda: Legitimacy, Trust, and Decentralised Finance

Al-Qaeda’s (AQ) global propaganda ecosystem provides the ideological legitimacy and reputational signalling necessary to sustain parallel financial systems across geographically dispersed affiliates. Unlike the Islamic State’s more centralised attempts to coordinate global operations, AQ’s model relies heavily on regional trust nodes that maintain operational autonomy while benefiting from the broader legitimacy of the organisational banner and its propaganda channels. This structure allows locally embedded militant groups to generate revenue independently while remaining integrated into a wider transnational network.

Jama’at Nusrat al-Islam wal-Muslimin (JNIM), an AQ affiliate formed in 2017 through the consolidation of several militant factions operating across the Sahel, illustrates how this model co-opts disparate groups with multiple revenue streams under a parallel financial system. JNIM operates a patchwork of revenue-generating activities tied to illicit timber extraction, artisanal gold smuggling, cattle rustling, taxation of local populations, and narcotics trafficking.

These revenue streams are largely decentralised and embedded in local economies. However, the broader al-Qaeda narrative ecosystem provides legitimacy and cohesion across geographically dispersed factions, allowing multiple militant groups and revenue systems to operate under a shared organisational framework that enables its expansion as a single entity. This combination of propaganda-based legitimacy and locally embedded revenue streams has contributed to JNIM’s rapid expansion across the Sahel.

Open-source evidence demonstrates decentralised revenue generation under a shared JNIM/al-Qaeda framework. Rather than relying on a centralised treasury, these networks operate through a distributed network anchored by the broader al-Qaeda propaganda ecosystem. Through shared narratives, ideological legitimacy, and reputational signalling, this propaganda infrastructure allows geographically dispersed factions to generate and deploy revenue locally while remaining integrated within a wider militant network under the direction of key trust nodes.

JNIM’s decentralised structure resembles the model employed by the Italian ’Ndrangheta criminal network, in which semi-autonomous local groups generate large-scale revenue independently while remaining connected through shared structures rather than centralised financial control – allowing them to largely evade global enforcement for decades. While the scale of JNIM’s finances is far smaller, the comparison highlights how decentralised networks built on trusted intermediaries can sustain resilient financial ecosystems without centralised treasury structures.

A more centralised version of this model can be observed in Somalia through al-Shabaab (AS), which joined AQ in 2012 and generates approximately US $100 million in annual revenue, making it the wealthiest affiliate in the AQ network. AS has developed a structured financial system built around taxation, illicit charcoal trading, diaspora remittances, and intermediaries operating in Gulf financial corridors, East Africa, and Iran.

Despite stronger internal governance than many AQ affiliates, AS’s financial resilience still depends on trust networks reinforced through propaganda and reputational legitimacy. These networks facilitate revenue generation – particularly through diaspora remittances – while evidence also indicates AS reinvests a portion of proceeds into propaganda dissemination. In effect, propaganda functions not only as a communication tool but as a financial infrastructure, sustaining trust, reinforcing legitimacy, and enabling continued resource mobilisation across the broader AQ ecosystem.

Figure 3: AQ-aligned JNIM (red) has expanded rapidly since its 2017 formation, controlling more territory in the Sahel than all other militant groups in the region combined.

The Role of Propaganda-Based Trust in Parallel Financial Systems

Across these cases, propaganda ecosystems function as reputational infrastructures that allow decentralised financial systems to operate beyond formal institutions. While windfall events such as ransom payments or major criminal operations can produce large short-term inflows, these funds likely disperse rapidly due to corruption, competition, and operational fragmentation. By contrast, trust-based financial systems built around propaganda-generated legitimacy rely on repeated small transactions and trusted intermediaries. Although these flows may be lower in individual transaction volume, they often produce greater long-term financial resilience by sustaining continuous revenue streams across distributed networks. In these systems, propaganda does not merely support recruitment or ideological messaging; it also provides the reputational infrastructure that enables financial coordination across decentralised trust nodes.

That these groups’ propaganda frequently emulates the visual and stylistic conventions of mainstream media – videos with news-style watermarks and tickers, press releases, and glossy magazines – is not coincidental. Just as news organisations and commercial brands use such formats to signal legitimacy, extremist organisations deploy them to generate reputational trust among dispersed audiences. These audiences, in turn, form trust nodes that link media channels, influencers, and intermediaries, validating financial flows and enabling coordination across decentralised networks.

Figure 4: Proposed typology breakdown of trust node categories across IS and AQ propaganda ecosystems/financial networks.

Implications for Counter-Terrorist Financing: Targeting Trust Nodes

Current counter-terrorist financing strategies focus primarily on transaction-level disruption, including sanctions, asset freezes, blockchain tracing, and financial surveillance. While these approaches remain essential, they largely target late-stage financial activity after financial coordination has already occurred. The deeper structural vulnerability in many extremist financial systems may lie earlier in the lifecycle of these networks—within the trust relationships that enable decentralised actors to coordinate financial activity across dispersed environments.

Viewed through this lens, propaganda ecosystems function not only as ideological or recruitment platforms but also as trust infrastructures that authenticate intermediaries and enable financial coordination. Within these ecosystems, certain actors, channels, or accounts serve as trust nodes—points within the network that signal legitimacy, validate intermediaries, and facilitate coordination among otherwise disconnected participants. Recent assessments by the Financial Action Task Force (FATF) reinforce this dynamic, noting that groups such as ISKP increasingly embed crowdfunding appeals directly within propaganda ecosystems, including encrypted messaging channels targeting diaspora communities.

Recent research also highlights how emerging financial technologies are reshaping the landscape of terrorist financing. Digital assets, encrypted messaging platforms, and decentralised payment rails have created parallel financial infrastructures operating largely outside traditional regulatory oversight. Artificial intelligence tools are increasingly capable of clustering cryptocurrency wallets, identifying laundering typologies, and mapping financial networks that span multiple platforms and jurisdictions. Rather than simply tracing individual transactions, these technologies allow investigators to analyse financial ecosystems as interconnected systems of intermediaries and facilitators.

Amid the emergence of vast illicit financial service ecosystems—as highlighted in a February 2026 FATF report—the longer-term risk may lie in the convergence of decentralised extremist financial networks with these larger criminal service economies, underscoring the need to disrupt the trust infrastructures that sustain them earlier.

When combined with analysis of extremist propaganda ecosystems, AI-enhanced tracing and mapping capabilities may help investigators identify the trust nodes that anchor decentralised financial networks. Wallet addresses, donation links, and financial intermediaries that circulate repeatedly within propaganda communities can serve as indicators of trusted actors within these ecosystems. By linking online behavioural signals with blockchain analytics and financial intelligence, investigators may be able to map the financial networks that emerge from these trust nodes.

This perspective suggests an opportunity for greater collaboration between platforms and national financial intelligence units (FIUs), and financial intelligence tools like blockchain analytics. Social media platforms and messaging services are often the earliest environments where trust nodes emerge, as accounts that repeatedly disseminate propaganda, authenticate intermediaries, or promote fundraising campaigns gain reputational legitimacy within extremist ecosystems. Rather than focusing solely on content removal, platforms could prioritise identifying accounts and channels that function as trust nodes and sharing associated financial indicators—such as wallet addresses, donation links, or payment identifiers—with relevant investigative bodies.

Investigators and researchers may therefore benefit from prioritising several analytical questions:

• Where are the trust nodes within extremist propaganda ecosystems?

• Which actors authenticate financial intermediaries within these networks?

• And how do trusted propaganda channels enable decentralised financial coordination across geographically dispersed actors?

Integrating insights from propaganda analysis, platform data, and financial intelligence may allow investigators to map financial networks emerging from these trust nodes and identify earlier intervention points within decentralised extremist financing systems.