Introduction
It is well known that the Islamic State and its branches effectively use internet-based strategies to disseminate their propaganda and ideology. The organisation has long employed both written and visual media, including English-language magazines, to showcase its actions and mobilise supporters. These online magazines play a crucial role in legitimising the group’s violent actions and sanctifying its concept of jihad. One of the online magazines published by the Islamic State Khorasan Province (ISKP) is Voice of Khurasan.
This magazine, which ISKP continues to publish regularly, has garnered significant attention from both the media and the academic community, resulting in the preparation of several scholarly studies. Some of these studies have indicated that IS and ISKP are attempting to collect donations through cryptocurrency via this magazine. However, these investigations have not focused on the communicative aspects, which are crucial elements of IS’s online strategies, nor on the methods of communication employed. Therefore, this Insight analyses ISKP’s terrorist financing and communication tactics through Voice of Khurasan, which is accessible for registered academic researchers through jihadology.net.
Review of Voice of Khurasan
This Insight begins with a descriptive examination of the 40 issues of Voice of Khurasan. The descriptive analysis focuses on the publication dates, the number of pages in each issue, and key linguistic metrics, including the total number of words, sentences, unique words, and words used only once in each issue.
To date, 40 issues of Voice of Khurasan have been published, and the magazine continues to be published. The first issue was released in January 2022, and since then, the magazine has been consistently published on a monthly basis. However, in certain months, two issues have been released. This discrepancy is due to the differences between the Hijri (Islamic) calendar and the Gregorian calendar. The most recent issue reviewed in this Insight, Issue 40, was published in October 2024.
Table 1: Descriptive Analysis Results
There is no consistent pattern of word count, sentence count, or page count across the issues. For instance, the 4th issue contains only ten pages, whereas the 38th issue is comprised of 93 pages. Furthermore, there is over a 20,000-word difference between the shortest and longest issue (Issues 4 and 38, respectively). Issue 4, the shortest issue, contains the fewest words (4,168), sentences (102), unique words (504), and single-use words (314), while Issue 38, the longest, holds the highest counts across all these categories.
Following the descriptive analyses, this study conducted focused reviews on donations and communication within the Voice of Khurasan, which are its primary areas of emphasis. In this context, the first examination addressed donations. Unlike previously published IS magazines, such as Dabiq and Rumiyah, Voice of Khurasan includes a dedicated section on donations for the first time. This section was first introduced in Issue 29, published in September 2023. Prior to the donation request, verses ten and 11 of the As-Saf surah from the Quran were cited to establish a religious basis for the request. These verses served as the foundation for donation requests in all issues, except Issue 30.
In most issues, donation requests are found on the penultimate page, with the exception of Issue 30. The magazine specifically requests donations to be made using the Monero (XMR) cryptocurrency. For individuals wishing to donate in Monero, both the Monero wallet address and a QR code linked to the Monero wallet address are provided.
Figure 1: Donation Request Page in Issue 29
Although a donation request is included in Issue 30, the accompanying photo, the wording of the request, and the placement on the page differ from those in other issues. In Issue 30, the donation request appears on the last page. Additionally, unlike in other issues, neither the As-Saf surah nor any other surah from the Quran is referenced. Instead of featuring a photo of an ISIS militant, as seen in other issues, Issue 30 highlights a photograph depicting the aftermath of an Israeli attack in Gaza, which serves as the central theme of the issue.
Figure 2: Donation Request Page in Issue 30
Following the explanation of their financing tactics, the communication channels and methods used in Voice of Khurasan were analysed. The section on communication was first introduced in Issue 15, which provided details on how communication would occur between sympathisers and Al Azaim Foundation, the media arm of ISKP. It was noted that two different applications must be used for communication purposes, and several specific steps should be followed. In this context, Telegram and Rocket.Chat are the applications used to communicate with recruits and supporters.
It can be observed that communication addresses were shared between issues 15 and 40, with the exception of issues 20 and 30. Although the Telegram and Rocket.Chat applications were used as communication methods throughout these issues, it was found that Telegram IDs changed regularly. For instance, one ID was used from Issue 15 to Issue 21, after which it changed in Issue 21 and remained in use until Issue 31. Similarly, the ID changed again in issues 33, 34, and 38. Additionally, QR codes were introduced in Issue 33. The primary reason for the frequent changes in IS’s Telegram ID is Telegram’s regular banning of IS accounts, which necessitates the creation of new accounts by IS.
Notably, in Issue 15, which is the first issue to share communication addresses, the page explaining these addresses and the communication process is located at the end of the issue. Subsequent issues provide the necessary contact information on the second page. However, only the Telegram ID is shared in subsequent issues, and the specific communication steps outlined in Issue 15 are omitted.
Figure 4: Contact Information in Issue 21
What do These Findings Mean?
IS has solicited donations in the Monero cryptocurrency (XMR) since the 29th issue of the Voice of Khurasan magazine. Furthermore, to justify the donation request on a religious basis, a Quranic verse from As-Saf was almost always cited. These findings align with previous research. However, prior studies do not provide a detailed explanation of why the magazine began soliciting donations after Issue 29.
As of early 2023, IS’s core income began to decline as the organisation lost millions of dollars due to pressure from anti-ISIS Coalition forces. The Coalition’s efforts also disrupted financial support for ISIS members in Syria and Iraq. For instance, in January 2023, the United States and Türkiye jointly dismantled a money transfer network that IS had been using to transfer hundreds of thousands of dollars for its activities. Moreover, money transfers by IS supporters are now closely monitored in many countries, resulting in numerous arrests in this context.
As a result of these developments, although IS continues to rely on traditional and informal methods such as hawala, it has increasingly turned to digital currencies like Bitcoin, Tether, and Ethereum in recent years to facilitate rapid transactions and evade detection. However, the use of cryptocurrencies such as Bitcoin and Ethereum by ISIS and its supporters has declined due to the implementation of advanced blockchain tracking techniques by security agencies worldwide. Consequently, IS has shifted its focus to alternative cryptocurrencies, notably Monero. Monero is regarded as a safer option for organisations like IS because it is more challenging to trace compared to popular cryptocurrencies such as Bitcoin. In Monero transactions, the sender’s and recipient’s information remains anonymous by default. Specifically, Monero employs three critical technologies—Stealth Addresses, Ring Signatures, and RingCT—which ensure that the sender, recipient, and transaction amount are concealed. As a result, both parties remain anonymous and are not subject to surveillance by security agencies. For these reasons, as of September 2023, IS began collecting donations through the Voice of Khurasan magazine and Monero to secure the necessary funds while evading the close scrutiny of security agencies.
The second significant finding presented in this Insight is that starting from the 15th issue, the Voice of Khurasan implemented a communication strategy that involves the combined use of Telegram and Rocket.Chat applications for communication and interaction purposes. This raises the question of why IS and its supporters rely on both Telegram and Rocket.Chat instead of exclusively using one of these platforms. Once it became evident that IS and its affiliates were heavily using Telegram, the platform began actively combating ISIS-related channels. In the third quarter of 2024 alone, law enforcement agencies from various countries removed a total of 35,634,916 items from Telegram and shut down 323 channels affiliated with three terrorist organizations, including ISIS. Of these, 34,602,606 pieces of content and 189 channels were directly linked to ISIS. These closures and monitoring efforts compelled ISIS to seek alternative applications, with Rocket.Chat emerging as a key platform.
One of the primary factors contributing to IS’s adoption of Rocket.Chat is its setup and functionality, which make individual user accounts less susceptible to suspension compared to encrypted messaging platforms such as Telegram. Furthermore, Telegram’s centralised data storage contrasts with Rocket.Chat’s decentralised structure, making Rocket.Chat a more attractive option for IS and its supporters. However, despite the increasing popularity of Rocket.Chat among IS supporters, the organisation has not abandoned Telegram.
Currently, IS employs a multi-step communication method that integrates both Telegram and Rocket.Chat, which it considers to be more secure. For instance, IS supporters who wish to register for IS-related channels on Rocket.Chat are required to send registration requests through Telegram bots. Additionally, the Telegram IDs used for such purposes are frequently changed to avoid detection and monitoring by law enforcement agencies.
Conclusion and Recommendations
In light of the analysis, it is evident that IS’s innovative use of digital technology for fundraising and communication, as exemplified by the Voice of Khurasan magazine, presents evolving challenges for individuals, nations, security agencies, and technology companies. To counter these threats effectively, tech companies must adopt a proactive, multi-faceted approach. Furthermore, it is crucial for tech companies to collaborate with governments and relevant governmental institutions. One practical recommendation is to enhance cooperation with national and international bodies to identify and disrupt financial networks that support terrorism, particularly those exploiting cryptocurrencies such as Monero. Companies specialising in blockchain analysis should be encouraged and incentivised to develop and implement advanced, privacy-centric tracking methods that monitor suspicious transactions while still respecting legitimate privacy rights.
Another innovative solution involves enhancing the detection and shutdown of propaganda dissemination. While platforms like Telegram are actively working to dismantle IS-affiliated channels, the emergence of decentralised platforms such as Rocket.Chat highlights the necessity for a more adaptive response. Technology companies could invest in AI-driven monitoring systems that are capable of identifying harmful content, even within encrypted or decentralised environments. Furthermore, developing cross-platform communication protocols to monitor shifts in user behaviour across various services could be essential.
Additionally, a global standard for responsible reporting mechanisms should be established, allowing users to report potential terrorist activities without jeopardizing their safety. In conclusion, the fight against the digital strategies employed by groups like IS requires ongoing innovation. By harnessing advanced technologies and promoting international collaboration, technology companies can play a crucial role in dismantling the virtual infrastructure that underpins modern terrorism, thereby ensuring a safer digital environment for everyone.
Note: This Insight has been prepared as part of a project supported by the Scientific and Technological Research Council of Türkiye (TÜBITAK).
Dr. Ahmet Yiğitalp Tulga is a Postdoctoral Researcher in the Department of Diplomacy at National Chengchi University, Taiwan (R.O.C.). He earned his PhD at National Sun Yat-sen University, Taiwan (R.O.C). His research primarily focuses on public opinion, the role of ISIS’ online propaganda, social media-terrorism relations, social media strategies of terrorist organisations and the effects of these strategies on people. His personal website: https://ahmettulga.blogspot.com/