S/2023/95

United Nations

Security Council

Distr.: General
13 February 2023
Original: English

Letter dated 13 February 2023 from the Chair of the
Security Council Committee pursuant to resolutions 1267 (1999),
1989 (2011) and 2253 (2015) concerning Islamic State in Iraq andthe Levant (Da’esh), Al-Qaida and associated individuals, groups,
undertakings and entities addressed to the President of the
Security Council
I have the honour to transmit herewith the thirty-first report of the Analytical
Support and Sanctions Monitoring Team pursuant to resolutions 1526 (2004) and
2253 (2015), which was submitted to the Security Council Committee pursuant toresolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in
Iraq and the Levant (Da’esh), Al-Qaida and associated individuals, groups,
undertakings and entities, in accordance with paragraph (a) of annex I to resolution
2610 (2021).
I should be grateful if the attached report could be brought to the attention of
the members of the Security Council and issued as a document of the Council.
(Signed) Vanessa Frazier
Chair
Security Council Committee pursuant to resolutions
1267 (1999), 1989 (2011) and 2253 (2015) concerning IslamicState in Iraq and the Levant (Da’esh), Al-Qaida and associatedindividuals, groups, undertakings and entities

22-29555 (E)130223*2229555*

S/2023/95

Letter dated 30 December 2022 from the Analytical Support andSanctions Monitoring Team in accordance with paragraph (a) ofannex I to resolution 2610 (2021) addressed to the Chair of the
Security Council Committee pursuant to resolutions 1267 (1999),
1989 (2011) and 2253 (2015) concerning Islamic State in Iraq andthe Levant (Da’esh), Al-Qaida and associated individuals, groups,
undertakings and entities
I have the honour to refer to paragraph (a) of annex I to resolution 2610 (2021),
by which the Security Council requested the Analytical Support and Sanctions
Monitoring Team to submit, in writing, comprehensive, independent reports to the
Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and
2253 (2015) concerning Islamic State in Iraq and the Levant (Da’esh), Al-Qaida andassociated individuals, groups, undertakings and entities, every six months, the firstby 31 December 2021
I therefore transmit to you the Monitoring Team’s thirty-first comprehensive
report, pursuant to annex I to resolution 2610 (2021). In formulating this report, theMonitoring Team considered information it received up to 19 December 2022. The
Monitoring Team also notes that the document of reference is the English original.
(Signed) Justin Hustwitt
Coordinator
Analytical Support and Sanctions Monitoring Team

2/22

22-29555

S/2023/95

Thirty-first report of the Analytical Support and Sanctions
Monitoring Team submitted pursuant to resolution 2610 (2021)
concerning ISIL (Da’esh), Al-Qaida and associated individuals
and entities
Summary
The threat from Al-Qaida, ISIL (Da’esh) and affiliated groups remains high inconflict zones and neighbouring countries. It remains relatively low in other areas,
but both groups continue to aspire to project threat.
Africa has emerged in recent years as the continent where the harm done byterrorism is developing most rapidly and extensively. Two of the three most dynamic
ISIL affiliates are in Africa, and the continent has seen the greatest growth in ISIL
affiliates, with several groups expanding their radius of influence often acrossnational borders. ISIL continues its efforts to exploit regional and local grievances
throughout the continent for propaganda purposes, publicizing related events andattacks to enhance its global footprint. Equally, Al-Qaida’s most successful affiliate
in Somalia, Al-Shabaab, continues to grow in strength and reach as the group’s most
brutal affiliate, and Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM) has been able toexpand its operations in West Africa and the Sahel.
It is noteworthy that relatively few of the individuals associated with thesegroups are subject to sanctions pursuant to Security Council resolution 1267 (1999).
Sanctions are one of the tools to reduce the developing threat, impede the movementof foreign terrorist fighters in the region and limit terrorist access to funding. The
context of Al-Qaida- and ISIL-related terrorism on the continent is complex,
exploiting and exacerbating pre-existing conflicts.
Issues of leadership were significant during the reporting period. ISIL corecontinues to be under pressure, with attrition in its leadership and depleting resources.
It has proven resilient, but morale is low. The group is strengthening through its
affiliates beyond Iraq and the Syrian Arab Republic: in Africa and with the aggressive
agenda of Islamic State in Iraq and the Levant – Khorasan (ISIL-K) in Afghanistan,whose rivalry with the Taliban will continue to have a destabilizing effect in
Afghanistan and the region. Most of the attacks by ISIL-K are against the Taliban. A
new leader of ISIL was killed after barely eight months in charge. The function ofleader has become almost totemic, a rallying point for the wider group. For the time
being, ISIL core continues to produce leaders who meet this need, and members ofaffiliates pledge allegiance swiftly and without question, not anticipating close
operational direction.
Member States’ predominant view is that Sayf al-‘Adl is now the de facto leaderof Al-Qaida, representing continuity for now. But his leadership cannot be declaredbecause of Al-Qaida’s sensitivity to Afghan Taliban concerns not to acknowledge thedeath of Aiman Muhammed Rabi al-Zawahiri in Kabul and the fact of Sayf al-‘Adl’s
presence in the Islamic Republic of Iran. His location raises questions that have abearing on Al-Qaida’s ambitions to assert leadership of a global movement in the faceof challenges from ISIL.

22-29555

3/22

S/2023/95

Contents
Page

I.

Overview and evolution of the threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5II.

Regional developments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6A.

Africa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6

B.

Iraq and the Levant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11C.

Arabian Peninsula . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13

D.

Europe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14

E.

Asia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

Impact assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17

A.

Resolutions 2199 (2015) and 2462 (2019) on the financing of terrorism . . . . . . . . . . . . . .

17

B.

Resolution 2347 (2017) on cultural heritage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18

C.

Resolution 2396 (2017) on foreign terrorist fighters, returnees and relocators . . . . . . . . .

19Implementation of sanctions measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

A.

Travel ban . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

B.

Assets freeze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

C.

Arms embargo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

V.

Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

VI.

Monitoring Team activities and feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

III.

IV.

4/22

22-29555

S/2023/95

I. Overview and evolution of the threat
1.
The threat posed by Al-Qaida, the Islamic State in Iraq and the Levant (ISIL,
also known as Da’esh) (QDe.115) and affiliated groups and individuals remains highin conflict zones and neighbouring Member States. In Africa, the geographic spreadand incidence of violence related to both groups have increased. Propaganda efforts
by Al-Qaida (QDe.004), ISIL (Da’esh) and their affiliates have become moresophisticated and prolific, often detailing conflict between the groups and theircommanders, reflecting competing ideologies, competition for sources of revenue andefforts to inspire and recruit followers. Operations mounted by Islamic State in Iraq
and the Levant – Khorasan (ISIL-K, QDe.161) in Afghanistan have been designed tochallenge regional security and the credibility of the Taliban as guarantors of security
both domestically and internationally. Both Al-Qaida and ISIL (Da’esh) continue toaspire to project threat beyond conflict zones. Member States are concerned about
this, and about violence and instability spreading deeper into Africa, and potentiallyoutwards from Afghanistan into neighbouring countries.
2.
Several Member States have drawn a distinction between ISIL (Da’esh), which is
focused on claiming a physical “caliphate” holding territory, and Al-Qaida, which ismore focused on an ideological agenda, thus posing a greater threat in the longer term.
As the Analytical Support and Sanctions Monitoring Team has noted in previous
reports (see S/2022/547, para. 4), two of the most dynamic ISIL networks are in
Africa. Member States have noted that the situation in the Sahel region is particularly
worrying because of increased violence, especially against civilians, the extension of
the area in which armed groups are operating and the complexity of the local context.
Terrorist groups exploit local disputes to recruit fighters and establish themselves infragile communities.
3.
In this region, Al-Qaida- and ISIL (Da’esh)-related acts are often intertwinedwith pre-existing conflicts that are exploited by these terrorist groups. This presents
challenges for effective application of the 1267 sanctions regime. The Monitoring
Team, through its engagement with Member States, will assist in listing of individuals
who meet the criteria for designation within the sanctions regime, where such listings
might achieve a beneficial effect.
4.
The question of leadership of both ISIL (Da’esh) and Al-Qaida has been a
preoccupation of Member States during this reporting period, both as a marker of theresilience of the groups, but also as an indicator of ideological and operational
direction. The identity of the ISIL leader, Abu al-Hassan al-Hashemi al-Qurashi(reported by some Member States to be also known as Sayf Baghdad and Abdal Rahman al-Iraqi), was not confirmed when the group announced on 30 November his
death the previous month. The new leader was announced as Abu al-Husain al-Husaini
al-Qurashi, and his true identity is not yet known.
5.
The loss of ISIL leaders has become normalized within the group and is reflectedin the tone of the announcement of Abu al-Hassan’s death. Member States noted
numerous immediate pledges of allegiance to the new leader, Abu al-Husain, by ISIL
affiliates far and wide without specific knowledge of his identity or qualities as aleader. The pool of potential leaders in Iraq and the Syrian Arab Republic who cou ld
be presented as having the right lineage and operational experience is sufficiently
deep to weather the steady attrition in the group’s leadership in the short term.
Member States also noted a decline in morale among ISIL core personnel. Affiliates
outside Iraq and the Levant expect and value continuity in leadership from ISIL core,
which the organization delivers.
6.
For Al-Qaida, the most significant development was the death of its leader, Aiman
Muhammed Rabi al-Zawahiri (QDi.006) in a kinetic strike on 31 July, which was
22-29555

5/22

S/2023/95

confirmed by the United States of America. Neither Al-Qaida nor the Taliban formallyacknowledged the death. The presence of al-Zawahiri in central Kabul at the time, in abuilding reported by Member States to belong to the Haqqani Network (TAe.012),
demonstrated an ongoing and cooperative relationship between Al-Qaida and the
Taliban. His death has raised the questions of succession and its impact on the threat
posed by Al-Qaida.
7.
No announcement has been made on succession and there was a paucity ofreporting from Member States on speculation or rivalry within Al-Qaida itself. In
discussions in November and December, many Member States took the view that Sayf
al-‘Adl 1 is already operating as the de facto and uncontested leader of t he group.
Assessments varied as to why his leadership had not been declared. Some flagged that
al-Zawahiri’s evident presence in Kabul had been an embarrassment for the Taliban,
which is seeking legitimacy as a governing authority, and that Al-Qaida chose not toexacerbate this by acknowledging the death. However, most judged a key factor to be
the continued presence of Sayf al-‘Adl in the Islamic Republic of Iran. This raiseddifficult theological and operational questions for Al-Qaida. One Member State
rejected claims, reports and assessments regarding the presence of any Al-Qaida
affiliate or dependent in the Islamic Republic of Iran.

II. Regional developments
A.

AfricaCentral and Southern Africa
8.
In Mozambique, the deployment of regional forces in Cabo Delgado Province(S/2022/83, para. 9), has had a significant impact on Ahlu Sunna wal-Jama’a (ASWJ)(not listed), disrupting its leadership, command structures and bases. While there wasan initial proliferation of small-scale attacks by compact isolated units, mostly looting
for provisions, the trajectory of the conflict has changed significantly. Regional
Member States estimate that ASWJ has seen its forces reduced to 280 adult malefighters, from an initial 2,500 fighters. In the past six months, operations by deployed
forces have resulted in the deaths of 70 to 120 fighters and commanders. Member
States note that surviving fighters are hardened combatants, able to move and strikestrategically, relying on independent and well-established local networks for support,
skills and a flow of foreign fighters.
9.
ASWJ fighters showed enhanced strategic and tactical coordination, forcing theoverextension of regional forces, by launching attacks against civilians, internallydisplaced persons, safe havens and strategic mining concerns in northern, central andsouthern Cabo Delgado. Member States noted that cells attacked police armouries forweapons and raided villages for provisions, regularly engaging in beheadings andhigh levels of violence. Insurgents also attacked high-value international mining andenergy operations involving some of the world’s largest graphite and ruby mines andthe country’s largest solar power plant. While local fatalities are generally decreasing,such attacks have serious economic consequences and result in massive displacementof vulnerable populations.
10. ASWJ fighters made a strong push southward, with insurgents opening a newtheatre of conflict in Ancuabe and Chiure districts, launching attacks as far south as
Nampula Province, while engaging in persistent attacks in northern districts ofMacomia, Nangade and Muidumbe. During the reporting period, districts at theepicentre of attacks were Ancuabe and Macomia. Between June and July 2022 alone,__________________
1

6/22

Listed as Mohammed Salahaldin Abd El Halim Zidane (QDi.001), also known as Sayf al-‘Adl.
22-29555

S/2023/95

161,046 persons were displaced owing to attacks in Ancuabe and Chiure districts. Of
the 946,508 internally displaced persons in Northern Mozambique, over half arechildren.
11. On 14 July 2022, regional forces captured Sheik Assane Base (also known as
Base Catupa), a significant ASWJ camp in Macomia, killing their leader, Sheik
Assane, a Tanzanian national. Bonomade Machude Omar, the operations commander,
managed to escape. The raid resulted in the seizure of significant ledgers on finances,membership, communication equipment and weaponry. In total, 600 hostages were
freed in the joint operation.
12. ASWJ is led by Abu Yasir Hassan (not listed), a Tanzanian national serving as
the spiritual leader of the group. Member States assess that the group is composed ofsemi-autonomous cells that do not adhere to a strict hierarchical command structure,making them agile and adept to change. Member States noted that Hassan had been
injured in a car accident but was recovering after treatment. The leadership’s
longstanding relations with seasoned foreign fighters linked to regional networks inEast and Central Africa has only enhanced the assimilation of battle -hardened
insurgents into their ranks. Foreign terrorist fighters are from Kenya and the United
Republic of Tanzania and to a lesser extent from the Democratic Republic of theCongo, Somalia and Uganda.
13. Regional Member States are of the view that there is no clear evidence of“command and control orders” from ISIL over ASWJ. ISIL more recently referred to
ASWJ as a separate affiliate, ISIL-Mozambique.
14. In the Democratic Republic of the Congo, joint military operations by
Congolese and Ugandan forces against the Allied Democratic Forces (ADF, CDe.001)
have dispersed ADF into smaller units throughout their area of operation in eastern
Democratic Republic of the Congo. Following raids on strategic camps, ADF pulled
out of strongholds near the Ugandan border and headed westwards, widening thetheatre of conflict from the Ugandan border to western Ituri Province, with attacks
taking place as far west as Ituri’s Mambasa Territory and as far south as the capital ofNorth Kivu Province, Goma. Within four months of Operation Shujaa, 2 ADF had
expanded its range of coverage and influence from 2,820km 2 to 8,200km 2 .
15. ADF also increased attacks in and near Butembo. It carried out a successful
prison break in Butembo, North Kivu, on 10 August 2022, freeing 800 prisoners.
Member States assessed that, while 112 prisoners had been recaptured and another120 had refused to join ADF, the majority had been forcibly assimilated into thegroup. This was a significant injection of fighters and, over time, they risked
becoming hardened ADF combatants. ADF also staged two bombings in Butembo on
6 September and 3 October, targeting national intelligence offices and a commercial
cinema, respectively.
16. ADF perpetrated its first suicide attack in Goma on 7 April 2022. Six persons
were killed and more than a dozen injured when a woman, a Tanzanian national,
detonated an explosive vest she was wearing in a bar in Katindo military camp.
Member States assessed that an ADF network in Goma had received instructions from
Meddie Nkalubo (not listed) (S/2022/83, paras. 15 and 17), and Abu Akassi by phone.
Nkalubo had provided instructions on operating the explosive vest and the use of thetrigger mechanism. Member States assessed that the explosive vest bore the same
signature as the device used in the 25 December 2021 bombing in Beni. Nkalubo is__________________
2

22-29555

A joint operation against ADF by Democratic Republic of the Congo and Uganda forces ineastern Democratic Republic of the Congo.
7/22

S/2023/95

assessed by regional Member States to be the orchestrator of attacks in eastern
Democratic Republic of the Congo and Uganda.
17. The ADF is assessed to have between 1,500 and 2,000 adult male fighters. Under
the leadership of Seka Baluku (alias Musa Baluku, CDi.036). ADF has notably
fractured around Baluku’s strong allegiance to ISIL (S/2022/83, para. 13).
Notwithstanding the pledges, several regional Member States refute any “commandand control” links between ADF and ISIL (Da’esh) core.
East Africa
18. In Somalia, the Government embarked on a strong military campaign in the fightagainst Harakat Al-Shabaab Al-Mujahidin (Al-Shabaab, SOe.001). While Al-Shabaab
suffered some losses from targeted airstrikes against its leadership and fighters,
Member States reported that some of Al-Shabaab’s largest-scale attacks had takenplace more recently. Al-Shabaab has killed over 500 civilians, government officials,
soldiers, law enforcement officers and international peacekeepers in the past six
months. In its most lethal attack, Al-Shabaab detonated car bombs near the Ministryof Education compound in the capital, Mogadishu. The twin blasts killed 121 people
and injured 333 others. Al-Shabaab has also staged several deadly hotel sieges.
Member States assess that the group continue to extend its territorial advances bot hdomestically and in neighbouring States, noting multiple cross-border incursions into
Ethiopia.
19. Member States estimate that Al-Shabaab commands between 7,000 and 12,000
fighters and remains undiminished in capacity. Member States assessed that Al Shabaab generated between $100 million and $150 million per annum from its
taxation of all aspects of the economy of Somalia (S/2022/83, para. 20) and used atleast 25 per cent of its revenue for military purchases.
20. ISIL in Somalia has a presence in Puntland. Member States note, however, thatthe group neither has the capacity to control large terrain, owing to continued attacks
by Al-Shabaab, nor possesses the capacity to undertake large-scale sophisticatedattacks. ISIL in Somalia is estimated to have between 200 and 250 fighters. ISIL in
Somalia hosts the Al-Karrar office (S/2022/547, para. 24), headed by the Emir of ISIL
in Somalia, Abdul Qadir Mumin, a former leader within Al-Shabaab who had pledged
allegiance to ISIL in October 2015.
21. Member States assessed that the Al-Karrar office acted as a financial hub,transmitting funds to affiliates. Several Member States noted that the Al-Karrar officefacilitated ISIL-K financially by sending $25,000 worth in cryptocurrency every
month. Member States assessed that ISIL Somalia generated $100,000 per monththrough extortion of the shipping industry and illicit taxation. However, Member
States had not presented any definitive information on the exact source of financial
flows into the Al-Karrar office.
West Africa
22. Against the backdrop of the rise of terrorist groups in the region, Member States
noted a deterioration of the security situation in the Sahel since the departure from
Mali of several foreign forces that had helped to contain the threat. Although thoseforces were no longer fully adapted to the interwoven nature of the conflicts, theirdeparture created a capability deficit that had been exploited by terrorist groups toincrease their effectiveness and mobility and to expand their area of influence. 3__________________
3

8/22

The Monitoring Team was not able to visit the Sahel countries during the reporting period. It
wishes to do so in 2023.
22-29555

S/2023/95

23. In central Mali and north and east Burkina Faso, Jama’a Nusrat ul -Islam wa alMuslimin (JNIM, QDe.159) is establishing itself as the central authority in theabsence of strong governance. One Member State contended that written works byAbdelmalek Droukdel (QDi.232) (reportedly deceased) demonstrated how the group
established influence within the community by exploiting pre-existing rivalries.
Several Member States noted that the group had exploited the frustrations ofvulnerable and underrepresented communities, such as the Tuareg and Fulani. The
result was a strong ethnic polarization fuelling violence without knowingly
contributing to the aims of JNIM. Several Member States reported that the activities
of non-State actors or local militia in Mali and Burkina Faso exacerbatedintercommunal tensions and facilitated the recruitment of fighters by JNIM or IslamicState in the Greater Sahara (ISGS, QDe.163).
24. In southern and central Mali, Katiba Macina (not listed), an affiliate of JNIM,
was particularly active, and its leader, Amadou Koufa (QDi.425) was pursuing astrategy of radicalization among the Fulani community. Several Member States
reported that the group was sending its cadres to the border with Mauritania and north west of Bamako to carry out actions to control communication routes and collecttaxes.
25. There was a decrease in violence against civilians around Mopti and Ségou,where, under the aegis of Katiba Macina, agreements had been reached between the
Fulani and Dogon communities, which included recruitment clauses. Nevertheless,
Katiba Macina’s violent actions had spread eastward to Sikasso, on the border with
Burkina Faso.
26. JNIM and its affiliates were thus increasing their pressure from rural areas andisolating cities to force the authorities to negotiate. However, several Member States
noted that the capture of major towns would come at a cost for JNIM, which iscurrently focused on targeting ISGS.
27. Member States also noted a sharp increase in violence in northern and eastern
Burkina Faso. JNIM and its affiliates, particularly through the strong presence ofAnsarul Islam (not listed), have sought to control the north-south communication axis
in the east of the country. The N18 road leading to Togo and Benin and crossing theprovinces of Gnagna and Fada Ngourma was particularly targeted.
28. While ISGS experienced a slowdown of its operations in 2021 owing to attrition
within its command structure and subsequent internal dissent, several Member States
are now seeing a sharp increase in violence since the appointment in 2022 of the newleader, Abba al Saharawi (not listed). The central media arm of ISIL (al-Furqan)
capitalized on the claims by ISGS of operational success against JNIM, as evidenced
during the assault on the town of Telatai in September 2022. ISGS is extending attacks
into Gao, the west bank of the Niger River and towards northern Burkina Faso. It has
increased recruitment within the Fulani community by exploiting the frustrations anddifferences they have with the Daoussak community, with one Member State noting theheightened capacity and resilience of ISGS.
29. Owing to its expansion and the community tensions it fuels, ISGS must fightthe security forces of the Sahelian countries, as well as JNIM, which concentra tes its
forces in eastern Mali, and Tuareg militias, such as the Groupe d’autodéfense desTouaregs Imghad et leurs alliés (GATIA) and the Mouvement pour le salut de
L’Azawad (MSA), which, according to one Member State, has no choice but tomobilize in the face of its attacks.
30. The deteriorating security situation is spreading rapidly southward to Togo andBenin, where JNIM or its affiliates are now conducting attacks and could seek toreproduce the same pattern of leveraging and exploiting community tensions. Less
22-29555

9/22

S/2023/95

affected by this violence, Ghana could become the next target of JNIM, according toseveral Member States.
31. Both ISGS and JNIM finance themselves through the levying of taxes, such as
zakat, to fund the recruitment of fighters. They also take advantage of security forces’
weaknesses and are able to seize weapons during attacks on barracks.
North Africa
32. Islamic State in Iraq and the Levant – Libya (ISIL-Libya, QDe.165) continues
to face challenges following strikes against its positions in southern Libya, which
eliminated important field commanders. This has caused the group to redeploy toseveral cities in the south, including Fazzan, Sabha, Awbari, Murzuq, umm al -Aranib,
Qatrun, Ghadwah and Fuqaha’, as well as to mountainous areas, such as Akakus andJabal al-Aswad.
33. ISIL-Libya continues to be resilient, exploiting the local political crisis andeconomic decline in the south, while maintaining cooperation with tribal elements
involved in smuggling and illicit trade, which attract new fighters. 4 The groupfinances itself from arms smuggling in southern Libya, taxes on illicit trade routes
and kidnapping for ransom, in addition to small and medium-sized enterprises in
Sahel towns run by their sympathisers, especially in western Libya.
34. ISIL-Libya is led by Abdulsalam Darkullah (not listed), who recently changed
the organization’s deployment strategy in southern Libya, dividing its fighters into
six main cells of 30 to 40 individuals. The group also uses foreign fighters from
Ghana, Kenya, the Niger, Nigeria and the Sudan.
35. One Member State indicated that the Sahara Army, formed in 2016, is affiliatedwith ISIL. It is led by Abdulaziz Mahwaz Al-Jamal and aims to establish a “caliphate”
in Libya. It accounts for around 1,400 fighters, including sleeper cells that possessmortars, portable grenade launchers and small arms. This potential association might
indicate that ISIL-Libya is stronger than previously estimated.
36. Al-Qaida in Libya utilized the city of Awbari as a pivot to other active terrorist
organizations in the Sahel, including JNIM. Al-Qaida had intensified its efforts totransfer fighters from the Niger to Libya and settle them around the town of Awbari,where they were hosted by Faknan Targhi (head of security) and placed in guest
houses by Hasan Awshi (alias Abu Talhah al-Targhi) and Muhammad Sidi Umar, all
not listed.
37. In southern Libya, Al-Qaida depends on a strategy of intermarriage andembedding with local tribes to maintain legitimacy. Expansion plans focused on
Sahel-Saharan countries, in particular northern Mali, and cities vital to its activities,
including Awbari and Ghat, where local cells facilitated logistics.
38. Counter-terrorism pressure by Egypt in the Sinai had reduced the presence ofAnsar Bayt al-Maqdis (ABM) locally. Nevertheless, the group remained active andresilient, targeting local communities and Egyptian security forces. Its strength isassessed by Member States at around 1,000 fighters. It mainly concentrates in thenorth, with a recent shift from the north-east to the north-west, likely attributed topersonnel issues. One Member State noted that western regions offered escape routes
to the Sinai Mountains in the south. The reduction of ABM capabilities was credited
to Egyptian public investments and infrastructure programmes in the Sinai Peninsula.
Some Member States noted the improved capability of ABM in perpetrating terrorist__________________
4

10/22

From southern Libya, as well as Algeria, Chad, Mali, Mauritania, Nigeria, the Sudan, Tunisia,
and mercenaries from Chadian and Sudanese op position groups active in southern Libya.
22-29555

S/2023/95

acts, such as in the village of Jalbanat in August and the targeting of the Egyptian
26th Military Brigade in July.
39. In Morocco, the terrorist threat persists. Several terrorist plots targeting security
service facilities using explosives, firearms or knives had been thwarted. Terrorist
cells operating clandestinely online were a cause of growing concern, with recent
arrests producing evidence of operational planning. In the rest of North Africa, ISIL and Al-Qaida-affiliated groups remained constrained, owing in part to counterterrorism pressure, particularly in Algeria and Tunisia, as well as the move ment ofsome fighters to the Sahel.

B.

Iraq and the Levant
40. ISIL (Da’esh) continues to suffer substantial leadership losses in Iraq and the
Syrian Arab Republic, with the November 30 announcement of the death of ISIL
leader Abu al-Hassan al-Hashemi al-Qurashi and succession of Abu al-Husain alHusaini al-Qurashi as the new leader. His death occurred during operations on 15 to
17 October 2022 in Jasim, Dara’a governorate, southern Syrian Arab Republic.
41. The former leader was identified by a few Member States under the aliases“Abdal-Rahman al-Iraqi” and “Sayf Baghdad”; the identity behind those aliases wasreported as Nur al-Din Abdul’ilah Mutni (Iraqi, not listed). His status and identity
were confined to a limited circle, and he reportedly did not have a deputy. The identityof the newly announced leader remains unknown. One Member State portrayed him
as an ISIL veteran of Iraqi origin who likely will continue the same strategy of his
predecessor.
42. The Syrian ISIL leadership branch also suffered setbacks, with the deaths of its
leader, Maher al-Agal, in July in north-west Syrian Arab Republic, and one of his
deputies, Abu-Hashum al-Umawi, in October in northern Syrian Arab Republic, inoperations mounted by the United States. Several other ISIL leaders or facilitators were
killed or captured, including through arrests by Türkiye. One Member State indicatedthat Juma’a Awwad Ibrahim al-Badri (not listed) had also been detained along with, orshortly after, the arrest of Bashar Khattab Ghazal al-Sumaida’i (not listed), ruling bothout as the former ISIL leader.
43. Although the attrition of leadership weakened ISIL core, Member States assess
the group to remain resilient. ISIL is estimated to have 5,000 to 7,000 members andsupporters spread between the two countries, roughly half of whom are fighters.
44. In the Syrian Arab Republic, ISIL is attempting to move its leadership away fromareas of enhanced counter-terrorism pressure, spreading its cells of around 15 to 30
individuals across the country, including in the south, notably in Dar‘a, while
maintaining hideouts west of the Euphrates River. The group continued its guerrilla
warfare tactics, waging asymmetric attacks against Syrian government forces, Syrian
Democratic Forces and civilians, with operations concentrated in Dayr al -Zawr andHoms governorates, reaching Hama, Hasakah and Raqqah. The central (Badiyah) desert
continues to be strategic to ISIL, to train and reorganize.
45. One Member State cited ISIL links with facilitation networks that wereconnected with the north of the Syrian Arab Republic and that operated from aneighbouring country. These included the provision of logistical support andguesthouses in exchange for payment. The guesthouses are usually headed by women,
often unaware of their guests’ identities, and are organized in different cat egories
according to the countries of origin of the ISIL members.
46. In Idlib, the Al-Nusrah Front for the People of the Levant (also known as Hay’at
Tahrir al-Sham, HTS, QDe.137) remains the predominant Al-Qaida affiliate,22-29555

11/22

S/2023/95

commanding between 7,000 and 10,000 fighters, including around 1,000 foreign
fighters. HTS maintained a locally oriented focus and sought to expand its presence
beyond Idlib, as manifested in its October expansion towards Afrin. The groupexercised a harsh governance system through arbitrary arrests and use of torture.
Despite the group’s attempts to portray a disassociation from Al-Qaida, some HTS
leaders eulogized al-Zawahiri. HTS generated income mainly from controlled
territory, benefiting from its monopoly on public services, and trading commodities,
in addition to taxation, extortion, online donations and community fundraising
campaigns. Its monthly earnings from trading fuel and energy through the front
company Watad Petroleum (see S/2021/68, para. 16) and its subsidiaries were
estimated at approximately $1.5 million.
47. Khatiba al-Tawhid wal-Jihad (KTJ, QDe.168) remains the most capable Central
Asian terrorist group acting under the HTS umbrella, with its strength increasing toapproximately 800. HTS was reported to view negatively the listing of KTJ on the
ISIL (Da’esh) and Al-Qaida sanctions list in March 2022 and renamed KTJ to Liwa
Abu Ubayda.
48. According to several Member States , the Eastern Turkistan Islamic Movement(ETIM, QDe.088), also known as the Turkistan Islamic Party (TIP), worked closelywith HTS in Idlib. One Member State reported that the two groups had conductedjoint training on uncrewed aerial vehicles and other weapons. Accordi ng to that
Member State, in October, ETIM/TIP had dispatched dozens of people to join HTS’fight against the Syrian National Army in Aleppo and had seized Afrin district. It hadprocured weapons in large quantities and had strengthened military training. One
Member State reported that the group had trained more than 500 minors,
indoctrinating the ideology of “armed liberation of East Turkistan” , two hundred ofwhom had enrolled in the order of battle and had participated in front -line armed
patrol missions. The group actively recruited Chinese nationals from ISIL in the
Syrian Arab Republic.
49. The other major Al-Qaida branch, Hurras al-Din (HAD, not listed), led by Samir
Hijazi (aliases Abu Hammam al-Shami, Faruq al-Suri, Abu Hammam al-Askari, notlisted), 5 maintained a low-profile presence, including in the south of the Idlib deescalation zone and north of Latakia. No significant change in its leadership wasreported. Some Member States assess the group’s strength at 1,500 to 2,000 6 fighters,
while others estimate it at 300 to 500 active fighters. The continuous pressure by HTS
on HAD hampered its operational capabilities, reportedly forcing a move from Idlib
to areas further north, closer to Türkiye. The group still aspires to attack the We st but
faces difficulties in securing financing. One Member State indicated that HAD
receives direct instructions from Sayf al-‘Adl.
50. In Iraq, the ISIL insurgency remains effective. The group maintained its ability
to perpetrate attacks despite Iraqi counter-terrorism efforts that had killed around 150
ISIL operatives this year. The group operated in rural mountainous areas, profitingfrom the porous Iraqi-Syrian border.
51. The frequency of ISIL attacks in Iraq slightly abated during the reporting peri od.
Some Member States indicated that ISIL seeks, under the direction of its leader in
Iraq, Abdallah Makki Muslih al-Rafi’i (alias Abu Khadija, not listed), to deliberately
reduce visibility, to rebuild and recover from losses. ISIL maintains its
manoeuvrability to evade attacks by Iraqi forces.
__________________Samir Hijazi is believed to be the son-in-law of Sayf al-‘Adl (QDi.001) (see S/2021/68,
para. 17).
6
One Member State noted half of the fighters were from Algeria, Egypt, Jordan, Morocco, Tunisia
and Central Asian countries.
5

12/22

22-29555

S/2023/95

52. Activities in Iraq were concentrated in two areas: a “logistical theatre” in Anbar,
Nineveh and Mosul Governorates; and an “operational theatre” comprising Kirkuk,
Diyala, Salah al-Din and North Baghdad. One high-profile attack occurred on 18
December in Kirkuk that led to more than 10 casualties. ISIL attacks in these areas
underscored the importance of maintaining enhanced cooperation between Iraqi and
Peshmerga forces. The group continued to target Iraqi security forces, community
leaders and civilians, mainly via armed assaults and improvised explosive device
detonations.
53. Despite current setbacks, the risk remains of an ISIL resurgence in the core
conflict zone. Neighbouring countries are also vulnerable to ISIL-directed or -inspired
attacks. One Member State reported that, on 26 October, an ISIL (Da’esh) fighter
attacked the Shah-e-Cheragh Shrine in Shiraz, Islamic Republic of Iran, killing 15
people, including 3 children. ISIL (Da’esh) claimed responsibility in its weekly
magazine.
54. The potential for the group’s reach to extend beyond the immediate region
persists, making continued international coordination on countering ISIL essential,
particularly in northern Syrian Arab Republic.

C.

Arabian Peninsula
55. Al-Qaida in the Arabian Peninsula (AQAP, QDe.129), operating in Yemen under
the leadership of Khalid Batarfi (not listed), faces ongoing setbacks owing tosustained counter-terrorism pressure and internal frictions. The group continued to
exploit the conducive environment to rebuild and expand local operations to attack
coalition and foreign forces. Notwithstanding setbacks, AQAP persisted as a local andregional threat that could extend further abroad.
56. AQAP maintained a presence mostly in Hadramawt, Shabwah, Ma’rib, Bayda’and Abyan Governorates, with sleeper cells in Mahrah, the Hadramawt coast, Adenand Lahij. While it is difficult to assess the precise size of AQAP owing to its
integration with certain local tribes, the estimate of its strength ranges from the low
thousands to 2,500 to 3,000 fighters. One Member State described Batarfi as anineffective leader, unable to provide suitable financial and logistical means for AQAP.
The leadership cadre includes Ibrahim Mohamed al-Banna (security), Ibrahim Ahmed
al-Qosi (sharia) and Sa'ad bin Atef al-Awlaki (operations), all not listed.
57. AQAP had increased attacks in the southern governorates of Shabwah and
Abyan, mainly in retaliation for the “arrows of the east” initiative that had begun inAugust. This may be indicative of the tendency of AQAP to intensify efforts underpressure rather than change strategy. One Member State indicated that the attacks
underscored the threat that AQAP posed and its offensive ambitions in the southerngovernorates. The group’s attacks had been covered in AQAP media outlets, which
continued to incite lone actor attacks in the Gulf region and the West. Member Statesconsider AQAP media productions a major radicalization tool.
58. To mitigate infiltration, AQAP increasingly relies on a decentralized structure
allowing each cell to operate independently, connected through specific individuals
responsible for security. AQAP cooperated with Al-Shabaab and a network of
associated individuals in smuggling weapons. A few Member States noted amovement of fighters from Somalia to Yemen, and possibly vice versa, but with noclarity as to purpose. One Member State cited opportunistic cooperation between
Houthis and Islamic State in Iraq and the Levant-Yemen (ISIL-Yemen, QDe.166) inaddition to AQAP (see S/2022/547, para. 53).

22-29555

13/22

S/2023/95

59. AQAP derives revenues from robbery, including of banks and exchange
companies, as well as smuggling weapons and petrochemicals and counterfeit
currencies. To secure additional funding, the group increased kidnapping for ransom
operations (with AQAP reportedly reducing its cut to one fifth). AQAP is recruiting
to replenish its ranks and reinforce tribal support.
60. ISIL-Yemen claimed one attack in July after slipping into near-obscurity. Somefighters pledged allegiance to the new ISIL leader, but the group is expected to continue
to decline, outperformed by AQAP. The group has no leader, and internal disputes
appear significant. Fighters in Bayda’ and Aden Governorates formed sleeper cells,
while leaders utilized safe havens in Shabwah and Ma’rib. One Member State assesses
ISIL-Yemen’s strength at around 250 fighters, most of whom are AQAP defectors. The
sharia official, Nasir Muhammed ‘Awad al-Ghidani al-Harbi, and the media official,
Abdul Aziz al-Shedri, are not listed. One Member State noted coordination between
ISIL-Yemen and ISIL-Somalia in the smuggling of weapons and operatives.

D.

Europe61. Member States described the threat of terrorism in Europe as endogenous,
stemming from self-radicalized individuals. Although ISIL propaganda has lost
momentum and peer influence, the new pro-Al-Qaida English-language magazine,“Mujahideen in the West”, produced by Hurras Al-Tawheed, caters to a younger
audience of prospective adherents and continues to incite lone-actor operations in
Europe. Member States noted attacks within prisons by self-radicalized inmatestargeting prison officers. One Member State noted with growing concern the threat
from former convicts of terror-related crimes who continue radical ideology
following their release.
62. Member States flagged the threat of returning foreign terrorist fightersreinventing themselves as recruiters to form homegrown cells on European soil. Most
are individuals skilled in radicalization and directly linked to central commands inconflict zones. In October, the Spanish National Police dismantled an ISIL cell in
Melilla, Spain, that had indoctrinated and recruited more than 50 minors whom theygathered in different public parks and mosques in the city; 13 individuals werearrested in Melilla and Granada, Spain, and two in Nador, Morocco. Two of thedetainees had previously been convicted of recruiting fighters and sending them to
Mali. The cell, whose leader was the imam of the Assalam mosque in Melilla, hadestablished a well-organized infrastructure that produced and disseminated ISIL
propaganda on different digital platforms.
63. Several Member States expressed concern that the Balkans provided a route forterrorists to gain access to European territory undetected. In August, the Spanish
National Police arrested two foreign terrorist fighters from North Africa who hadjoined Al-Qaida in the Syrian Arab Republic in 2014, had gained combat experiencein conflict zones and had travelled by irregular means across Türkiye, Bulgaria,
Serbia, Hungary and Austria. They had used migrant smuggling networks in Serbia,
which had provided them with forged passports to enter the Schengen zone. One
Member State stressed the additional challenge of intercepting foreign fighters
travelling overland from the Balkans through the Schengen zone, compared withthose returning by sea, who are subject to biometric controls upon arrival at theMediterranean coast.
64. Member States noted the abuse of terror-linked non-profit organizations that are
not listed. Al-Bashaer, an Egyptian non-profit registered in Türkiye with a likely
affiliate organization in the Syrian Arab Republic, had been instrumental intransferring funds under the guise of humanitarian aid for orphans in eastern Ghouta,

14/22

22-29555

S/2023/95

Syrian Arab Republic, from Spain-based donors coordinated by Fares Kutayni toknown members of a HTS militia in Idlib, led by Manaf Kutayni (both individuals
not listed) for the purposes of recruiting and training future terrorist fighters.
65. Member States noted the implications of repatriation policies in Western Europe
and the risk of female returnees indoctrinating others, especially minors, t hereby
questioning the effectiveness of existing rehabilitation and reintegration programmes.
Prosecutors from one Member State highlighted the challenge of establishing thenationality of Syrian Arab Republic-born children of their citizens, whose legal status
remains unresolved in many European countries, and its impact on civil rights andreintegration policies.
66. In the context of the recently concluded trials for the 2015 Paris attacks, as wellas the 2016 attacks in Brussels and Nice, France, one Member State noted thechallenge in denying defendants a platform to portray themselves as victims orheroes, thereby feeding terrorist propaganda, while also discouraging participation in
terrorism through judicial processes.

E.

Asia
Central and South Asia
67. Afghanistan remains the primary source of terrorist threat for Central and South
Asia. It originates from groups including the Islamic State of Iraq and the Levant Khorasan (ISIL–K, QDe.161), Al-Qaida (QDe.004), Tehrik-e Taliban Pakistan (TTP,
QDe.132), as well as ETIM/TIP, Islamic Movement of Uzbekistan (IMU, QDe.010),
Islamic Jihad Group (QDe.119), Khatiba Imam al-Bukhari (KIB, QDe.158), Khatiba
al-Tawhid wal-Jihad (KTJ, QDe.168), Jamaat Ansarullah (not listed) and others.
These groups enjoy greater freedom of movement in Afghanistan owing to theabsence of an effective Taliban security strategy.
68. ISIL-K portrays itself as the primary rival to the Taliban de facto administration,with its strategic focus on Afghanistan and beyond in the historical Khorasan region.
Its main goal is to portray the Taliban as incapable of providing security in the
country. By targeting diplomatic missions, ISIL-K seeks to undermine therelationship between the Taliban and neighbouring countries. The 5 Septe mber attackon the Russian Embassy in Kabul was the first against a diplomatic presence inAfghanistan since the Taliban took control; in December, ISIL-K claimed attacks
against the Pakistan Embassy and a hotel that accommodated Chinese nationals. It
also threatened to launch terrorist attacks against Chinese, Indian and Iranianembassies in Afghanistan. Apart from high-profile attacks, ISIL-K conducts low-levelattacks nearly daily, causing fear in local communities, targeting Shia minorities toundermine Taliban Pashtun authority and challenging nascent security agencies.
69. Regional Member States estimated current ISIL-K strength at between 1,000
and 3,000 fighters, of whom approximately 200 were of Central Asian origin, butother Member States believed that number could be as much as 6,000. Core ISIL-K
cells are located primarily in the eastern Kunar, Nangarhar and Nuristan Provinces of
Afghanistan, with a large cell active in Kabul and its environs. Smaller groups had
been detected in the northern and north-eastern Badakhshan, Faryab, Jowzjan,
Kunduz, Takhar and Balkh Provinces. Since Balkh is one of the most economicallydeveloped provinces in the north, it remained of primary interest to ISIL -K in termsof revenue generation. One Member State reported that ISIL-K had started smuggling
narcotics, which was a new development.
70. The ISIL-K magazine “Voice of Khorasan” releases propaganda in Pashto,
Persian, Tajik, Uzbek and Russian languages; recent outreach in Tajik and Uzbek was

22-29555

15/22

S/2023/95

noteworthy following a man named Rashidov, an Uzbekistan national, joining the
ISIL-K media wing. With the goal of recruiting from ethnic groups in the region andstrengthening the group’s capabilities, ISIL-K had recruited Rashidov online while
he was working in Finland as a labour migrant, before moving to Afghanistan. ISIL-K
used the teachings of Syrian Arab Republic-based radicalizing ideologist Abu
Mohammad Qosoni (Khodjihonov). The propaganda of the Tablighi Jamaat
movement in Kyrgyzstan, the only country in Central Asia where it is not banned,
was spreading to neighbouring countries. Ethnic Uzbek and Tajiks were targeted forrecruitment, with approximately 200 Uzbekistan nationals reportedly joining groups
in the Syrian Arab Republic since the beginning of 2021.
71. Member States reported no significant change in Al-Qaida’s strength since theprevious report. Despite the announcement by the United States of the killing of Al Zawahiri, ties between Al-Qaida and the Taliban remain close, as underscored by theregional presence of Al-Qaida core leadership and affiliated groups, such as Al-Qaida
in the Indian Subcontinent (not listed). It was expected that Al -Qaida would remain
in Afghanistan for the near future. According to one Member State, Al-Qaida-linked
Katiba Umer Farooq (Red Unit) was possibly being re-activated in Kunar and Nuristan
Provinces following the return of Abu Ikhlas al-Masri, Al-Qaida’s operationscommander who had been captured in Kunar Province in 2010. It also reported that
he had resumed leadership after his release following the Taliban takeover.
72. On 2 September, IMU leader “Usmon” (Madumarov Kholimzhon
Paradayevich), a Tajikistan national, was killed by unknown attackers. He was
succeeded by “Noman” (Samatov Mamasoli), the IMU deputy, who had previously
been in charge of finance. Several Member States reported that ETIM/TIP continued
its relocation from Badakhshan to Baghlan Province, establishing operational sites
and arsenals there. One Member State noted cooperation between ETIM/TIP and
ISIL-K, despite the fact that historically the former had aligned with Al -Qaida.
According to that State, the groups had exchanged personnel and planned joint
operations, with ETIM/TIP providing military instructors to ISIL-K and sending
members to join its operational unit responsible for tracking Chinese nationals andcarrying out attacks. On 29 July, they had plotted in Kabul to purchase weapons andconduct terrorist attacks against Chinese targets in Afghanistan. Both groups had
jointly published Uyghur-language propaganda posters. Whether such cooperation
between the groups was strategic or opportunist required further study.
73. Some Member States reported developments in the relationship between
ETIM/TIP and TTP, with the former providing TTP with intelligence and explosive
devices and the latter pledging support to ETIM/TIP as it infiltrated Pakistan. One
Member State reported that ETIM/TIP cooperated with Jamaat Ansarullah and IMU
on redeploying some of its armed forces in Badakhshan in September.
74. Several Member States reported that the Taliban takeover in Afghanistan had
emboldened TTP to escalate attacks against Pakistan. On 28 November, TTP
announced the end of the May ceasefire with the Government of Pakistan following
the killing of two senior TTP commanders in Afghanistan. According to one Member
State, while there had been a decrease in attacks against Pakistani security forces inthe early months of the ceasefire, that number had increased gradually as TTP
consolidated its presence in Afghanistan. In August, Abdul Wali Rakhib (alias Omar
Khalid Khurasani), a founding member and military commander of TTP, was killed
along with two other TTP leaders in Paktika Province, Afghanistan. He was reportedly
succeeded by Mukarram Shah (alias Umar Khorasani, not listed). According to one
Member State, on 14 July, TTP announced its decision to approve the application of“Majeed Brigade” to join TTP.

16/22

22-29555

S/2023/95

South-East Asia
75. Terrorist activity in South-East Asia remained low during the reporting period,
notwithstanding the sizable presence of terrorist groups associated with ISIL,
including the Abu Sayyaf Group (ASG, QDe.001), and Jemaah Islamiyah (JI,
QDe.092), which has historically worked with Al-Qaida. In Malaysia, curfews on the
Sabah coast has curbed incursions by ASG. ISIL carried out attacks in September andcalled for fighters in Indonesia, Malaysia and Singapore to join the group. JI, which
is not affiliated with ISIL, continued to focus on recruitment and the infiltration ofIndonesian institutions.
76. One Member State noted that porous borders presented a threat from returning
foreign terrorist fighters in the tri-border area in the Sulu and Celebes Seas,
comprising Sabah state in the east of Malaysia, the Philippines and Indonesia. North
African individuals linked to Al-Qaida seeking to relocate to South-East Asia
presented a threat to the region. Concern exists that those individuals could form thebasis for new terrorist activities. ISIL-South-East Asia (QDe.169) remains heavily
reliant on funds from ISIL core to increase propaganda activities and attacks.
77. According to one Member State, counter-terrorism forces had dealt a blow to
the Indonesian Timur Mujahidin group when one of the group’s senior commanders,Jaid (alias Pak Guru), was killed in September in the Central Sulawesi province.
Furthermore, the Indonesian counter-terrorism unit Densus 88 had arrested 17
members of JI and 15 members of Jamaah Ansharut Daulah (QDe-164) during Julyand September 2022. Indonesia also identified five Indonesian ISIL fighters that had
transferred money from Indonesia and Türkiye for individuals in the Deir Al -Azur
and al-Hawl camps for recruitment activities involving minors. World Human Care(not listed), a non-profit organization established by the Indonesian Mujahidin
Council (not listed) provided funds and weapons to ISIL fighters in the Syrian Arab
Republic.
78. In the Philippines, collaboration between former insurgent groups and security
forces had resulted in the arrest in July and August of four militants from the Maute
Group (not listed) and the arrest of two members of the Hassan Group (ISIL affiliated). In addition, a lack of support among the population and the harshconditions in Mindanao had resulted in the surrender of eight militants from the Maute
Group and another from the Hassan Group, who received amnesty from theGovernment. In November, the attrition of militants due to counter-terrorism
operations had led to the surrender of 150 ASG members in Mindanao in exchange
for amnesty. In October, an ASG subcommander, Indang Susukan, was killed at ahigh-security prison in Zamboanga City.

III. Impact assessment
A.

Resolutions 2199 (2015) and 2462 (2019) on the financing
of terrorism
79. Member State estimates of ISIL (Da’esh) cash reserves held in the Syrian Arab
Republic and Iraq range from $25 million to $50 million, with several assessing that
reserves are depleting. ISIL finances support affiliates and members around the world,
as well as recruitment and propaganda operations, and help to secure the release ofdetainees from prisons and internally displaced persons camps. The largest ISIL
expense, however, is payment of salaries to fighters and financial assistance tofamilies of deceased and imprisoned fighters, which reach hundreds of thousands of

22-29555

17/22

S/2023/95

dollars. While the financial structure of ISIL has proven resili ent against leadership
removal, current pressure on the organization is resulting in a decline in revenues.
80. Furthermore, counter-terrorism operations place ISIL revenue streams underpressure, with ISIL core’s expenses for weapons, ammunition, training and salaries
outpacing its income. Fundraising therefore has become critical for the organization.
Scarcity of resources has resulted in declining morale.
81. Revenue generation methods vary according to the location of ISIL affiliates(i.e., illicit trade in natural resources), but funds are raised primarily throughextortion, looting, donations, zakat and kidnapping for ransom, which has increased.
One Member State noted that ISIL raises funds from drug trafficking, specificallyfenethylline (Captagon). ISIL still controls illegal commercial routes and taxes
smugglers of weapons and narcotics and human traffickers. Some Member States
contended that oil smuggling continued as a revenue source in some ISIL areas, suchas Libya and the Syrian Arab Republic. One Member State reported that ISIL has
begun laundering money through investments in legitimate businesses, such as hotels
and real estate in Iraq and the Syrian Arab Republic. ISIL had reportedly also used
livestock theft to raise money and create instability among tribes.
82. Hawala and mobile money services continued as the dominant means used by
ISIL to move money, along with cash couriers, currency exchanges, secure payment
systems and virtual assets. ISIL is increasingly using virtual currencies, especially“stable coins”. One Member State noted the use of one (Tether) with transactions
greater than $100,000 to fund ISIL-K, demonstrating increased sophistication in theuse of lesser-known privacy-enhanced cryptocurrencies. ISIL continued to fundraiseon social media platforms, often using creative means, such as the exchange of video
gaming points to fiat currency. Some Member States observed that ISIL directedfinancial donations online, instead of having supporters travel to conflict zones, andthat ISIL sought to develop in-house communication technologies.
83. Of particular note, Iraq had its first known conviction in a terrorist financing casesince the adoption of its 2005 terrorist financing law. Muhammad Abd-al-Qadir Mutni
Assaf Al-Rawi, the head of the Al-Rawi financing network, was sentenced to life
imprisonment in March for moving funds and conducting black market exchange
operations (see S/2021/655, para. 68).

B.

Resolution 2347 (2017) on cultural heritage
84. No specific incidents were reported during the reporting period, althoughconnections between transnational organized criminal networks and terrorist
organizations have been observed in the trade of cultural property.
85. The illicit trade in cultural heritage, used to finance terrorism, benefits from alack of transparency and trafficking in unmonitored spaces. The ease of cross-bordertransfers and storage of cryptocurrencies makes the market suited to illicit transfersof money, potentially facilitating the financing of terrorism. Income from trading in
antiques and other cultural treasures stolen from conflict zones enables terroristgroups to support recruitment and strengthen their operational capacity to carry out
terrorist attacks. Furthermore, cryptocurrencies, gaming platforms, social media andhawala are exploited to market and traffic antiquities.
86. One Member State highlighted that terrorist organizations continue to exploit
cultural heritage by collecting “taxes” or permitting excavation. Areas around the
Bamiyan cliff in Afghanistan, where the Buddha niches are located, suffered looting
and illegal excavations. Mitigating the risk of Al-Qaida profiting from the illegal tradein antiquities, art trade associations from Australia, Czechia, France, Germany, Italy,

18/22

22-29555

S/2023/95

Spain, the United Kingdom of Great Britain and Northern Ireland and the UnitedStates joined efforts to prevent the illicit trafficking in cultural heritage fromAfghanistan and Central Asian countries. Member States expressed caution about thepossible trade in Afghan looted artifacts. Several Member States noted the key rolethat the Council of Europe Convention on Offences Relating to Cultural Property canplay in limiting terrorist revenues by criminalizing the illicit excavation, destruction
and damage of cultural heritage.

C.

Resolution 2396 (2017) on foreign terrorist fighters, returnees
and relocators
87. Although there had been some progress with repatriation programmes, Member
States noted no significant improvement as regards the situation in camps anddetention centres, in particular in the north-east of the Syrian Arab Republic(S/2022/547, paras. 88–91). The security and humanitarian risks continued to begrave, and the situation was volatile, with serious potential consequences for both theregional and global threat landscape. Concerns remained acute, including that thecamps were producing the next generation of ISIL (Da’esh) fighters.
88. Prison break operations led by ISIL to replenish operational and leadershipcadres remained a serious risk. However, one Member State assessed that, despite
releasing 100 to 300 detainees, on balance ISIL had lost significant militarycapabilities in its January 2022 attack on the prison in Hasakah (ibid., para. 91). It
was still working to rebuild that capability.
89. In north-east Syrian Arab Republic, the operation mounted in late August by
Syrian Democratic Forces to eradicate ISIL facilitation networks in the al-Hawl camp
resulted in over 200 arrests of ISIL-related members, the discovery of tunnels and theconfiscation of weapons. While the operation degraded ISIL capabilities in the camp,
the group continues to use the camp for recruitment.
90. Assessments of the number of Iraqis, Syrians and foreign terrorist fighters incamps and prisons varied but were broadly consistent with previous reports.
Assessments of the number of foreign terrorist fighters at large in the Syrian Arab
Republic and Iraq range from 2,000 to 3,000. The absence of foreign troops in
Afghanistan limits the country’s appeal for these fighters as a theatre of conflict.
Member States reported no significant flow of foreign terrorist fighters from the
Syrian Arab Republic to Afghanistan, owing in part to the ban by HTS on its members
leaving the Syrian Arab Republic, the absence of any call by influential preachers andthe Taliban’s discomfort with the risks of transfers of foreign terrorist fighters, as
existed in the 1990s and early 2000s. Several Member States reported that someforeign terrorist fighters in Afghanistan had received domestic identity documents(tazkiras) from Taliban de facto authorities. Afghanistan remained at tractive as a safe
haven, rather than a front.
91. Member States noted that, since 2019, four Central Asian countries – Kazakhstan,
Kyrgyzstan, Tajikistan and Uzbekistan – had repatriated 1,320 Central Asian
nationals from camps in the Syrian Arab Republic and prisons in Iraq, mostly womenand children who had previously lived under ISIL. Repatriated women and children
were provided with medical, psychological, financial and social assistance in theirrespective countries, including access to educational and social programmes, housing
and employment. Member States assessed that such measures mitigated potential
terrorist risks in the medium and long term.

22-29555

19/22

S/2023/95

IV. Implementation of sanctions measures
A.

Travel ban
92. During the reporting period, no travel ban exemption requests were submitted
to the Committee and no information was received from Member States regarding
attempted travel or interdiction of individuals designated on the ISIL (Da’esh) andAl-Qaida sanctions list.
93. The effectiveness of travel ban measures relies on the quality of the United
Nations Security Council Consolidated List. Several Member States noted, however,that challenges remain in guaranteeing that biometric collection systems areinteroperable with national watch lists for the effective screening and interdiction oflisted individuals. Member States continue to raise concerns regarding the lack ofidentifiers, the possible misspelling of names, the absence of biometric informationand the reluctance of some countries to share information regarding listed individuals.
The Monitoring Team has engaged Member States to improve the biometricidentifiers included in the entries of the ISIL (Da’esh) and Al-Qaida sanctions list,
with a link to International Criminal Police Organization (INTERPOL)-Security
Council special notices.

B.

Assets freeze
94. In paragraph 46 of its resolution 2610 (2021), the Security Council called upon
all States to submit an updated report to the Committee on measures taken to freeze
assets and exemptions thereto. A note verbale containing a link to an online form forthe submission of that report was circulated to all Member States on 5 May 2022; thedeadline for receiving the reports was 1 November 2022. Another note verbale wassent on 23 September to remind Member States of the upcoming deadline. In total, 25
Member States reported to the Committee. The Monitoring Team stands ready to brief
the Committee regarding the responses.
95. During the reporting period, the Committee received and approved two requests
for assets freeze exemptions through the focal point for delisting, for basic andextraordinary expenses.

C.

Arms embargo
96. With a spotlight on Africa, Member States noted with concern the proliferationof conventional and improvised weapons on the Continent.
97. Regional Member States noted that, in the Democratic Republic of the Congo,
weapons used by ADF were mostly captured from the Forces armées de la République
Démocratique du Congo (FARDC) in battle, as well as during attacks on armouries.
There was also prolific trafficking in ammunition. In Goma and Beni, eastern
Democratic Republic of the Congo, armour-piercing bullets had been used against
helicopters and the United Nations Force Intervention Brigade. In Northern
Mozambique, weapons had been seized from police armouries in towns that had comeunder attack, with rapid intervention units in Nangade suffering several attacks
recently.
98. Weapons used by ASWJ include: AK-47 rifles, light machine guns –(PKMs),
heavy machine guns, grenade launchers with tripods and optics to target helicopterswith armour-piercing ammunition, grenades, mortars, RPG-7 guns with antipersonnel ammunition to penetrate soft-skin vehicles, explosives, and detonators for

20/22

22-29555

S/2023/95

improvised explosive devices using solar rechargeable cell phone batteries. Member
States noted the construction of improvised explosive devices in ASWJ and ADF
camps, with evidence of batteries, soldered components for improvised explosive
devices and remote detonators being assembled in camps. ASWJ used abducted
women to assemble components. Improvised explosive devices have been usedagainst the Southern African Development Community Mission in Mozambique andRwandan forces in Cabo Delgado Province.
99. Member States assessed that a trainer would have had to have come to
Mozambique to train ASWJ in constructing improvised explosive devices. Explosives
are made of ammonium nitrate (fertilizer). ASWJ has the necessary equipment in thebush, including generators stolen from mining companies and grinding machines forammonium nitrate. In the Democratic Republic of the Congo, the improvised
explosive device techniques used by ADF have advanced, with increased use in cities,
carrying bigger payloads and better triggers, indicating the involvement of outsidetrainers.
100. Member States note that, off the coast of Cabo Delgado, weapons have beendelivered by sea, using floating plastic bags with markers. Buoys with solar-powered
satellite communications transmit their location. Weapons are also transported in fueltrucks using compartmentalized welded platforms, crossing porous borders
throughout the region.
101. With respect to uncrewed aerial systems, or drones, authorities in Mozambique
reported shooting down two ASWJ surveillance drones. Drones had also been usedby ADF. In West Africa JNIM, ISGS and Islamic State in West Africa Province had
used reconnaissance drones for surveillance. The African Union Mission in Somalia
had detected the use of mini/micro uncrewed aerial systems over a military base in
the Middle Shabelle region of Somalia.
102. Member States assessed that members of Al-Shabaab were part of a weaponstrafficking network in Yemen. Al-Shabaab transported improvised explosive device
components, ammunition and arms from Yemen to Somalia via boats. AQAP members
were identified to be part of an Al-Shabaab weapons trafficking network in Yemen,trafficking anti-vehicle land mines, rocket-propelled grenades, AK-47s, machine guns
and sniper rifles with silencers and telescopic sights.
103. ISIL-Somalia members also smuggled weapons from Yemen to Somalia via
dhows using middlemen in Puntland. The middlemen supplied weapons to both ISIL Somalia and Al-Shabaab and have no specific allegiance.

V. Recommendations
104. Many Member States raised with the Monitoring Team concerns that their
Governments, as a matter of policy, use the term “Da’esh” rather than “ISIL” orvariations thereof. Those Member States wish to disassociate Islam from a narrowterrorist group that includes the word “Islamic” in the name it has given itself, as it
could give credibility to its narratives. This creates obstacles for the effective
implementation of the 1267 sanctions regime, as the term “Da’esh” appears lessfrequently in the Monitoring Team’s reports and other communications with States,in line with relevant Security Council resolutions, and in the related list entry.
105. The Monitoring Team wishes to draw the Committee’s attention to Member
States’ concerns and highlights that “Da’esh” does not appear in the relevant li st entryof the Islamic State in Iraq and the Levant (ISIL, QDe.115), with consequent
challenges regarding sanctions implementation. The Monitoring Team would find it
helpful if the Committee could consider how to resolve this issue, perhaps by an
22-29555

21/22

S/2023/95

amendment to the list entry. The Team stands ready to provide any assistance, if
required.
106. The Monitoring Team recommends that the Committee engage with Member
States to explore how existing tools under the 1267 sanctions regime could be utilized
to address the issue of terrorism on the continent of Africa.
107. In its 30th report, the Monitoring Team noted the challenges encountered bysome Member States regarding the quality of the list and implementing changes tothe list in a timely manner (S/2022/547, para. 104). At the time, the Monitoring Team
reported that the issue was being addressed. The Monitoring Team continues to hearfrom many Member States that the problem persists and still has not been addressed.
The Team emphasizes the importance of automatic notification to Member States ofchanges to the 1267 list and recommends that the Committee give this matter its
urgent attention.
108. The Monitoring Team recommends that the Committee engage Member States
to encourage real-time sharing of information on foreign terrorist fighters and listed
individuals, between each other and with the Committee and INTERPOL, in
accordance with relevant Security Council resolutions.

VI. Monitoring Team activities and feedback
109. During the reporting period, as the coronavirus disease (COVID-19) pandemic
has eased, the Monitoring Team resumed its practice of extensive travel for face -toface meetings with Member States. The quality of dialogue between experts in asecure environment, including with intelligence and security agencies, added value.
Greater disruption to complex travel schedules had a negative impact on the
Monitoring Team’s efficiency. The Team requests maximum flexibility within United
Nations travel rules where necessary.
110. The Team continued to seek information relevant to its mandate and to explain
and promote the sanctions regime through participation in meetings with relevantinternational and regional organizations, members of the private sector and civilsociety, as well as in partnership with the Office of Counter-Terrorism, the CounterTerrorism Committee Executive Directorate, the Security Council Committee
established pursuant to resolution 1373 (2001) concerning counter-terrorism, andpanels of experts supporting other Security Council committees.
111. In the reporting period, the Monitoring Team carried out the annual review oflistings under the 1267 regime. In parallel, it conducted a data validation exercise, as
approved by the Committee, starting with the names under annual review, and madeproposals for amendments to the list. In 2023, the Team will continue to conduct data
validation exercises for the rest of the names on the 1267 list, to harmonize existing
inconsistencies and propose further amendments.
112. The Monitoring Team welcomes feedback on the present report at
1267mt@un.org.

22/22

22-29555