Islamic State (IS) terrorist organization and its affiliates are known for their effective use of online propaganda strategies. Its members and supporters use a wide range of textual and audiovisual tools to showcase their activities and mobilize supporters.

Periodicals play a crucial role in shaping the group’s image and promoting its concept of “jihad.” One of the most popular magazines published by the regional branch of IS in Afghanistan is the Voice of Khurasan.

The magazine, which ISKP regularly posts on its online platforms, has attracted considerable attention from experts. Thus, during a study of propaganda activities in the online space, it became known that IS and its branches raise cryptocurrency donations using this magazine.

Another key element of the online strategy of IS branches is the communication aspect.

All of these components taken together allow analysing terrorist financing tools and communication tactics used by ISKP, in this case through its online media.

To date, 40 issues of the Voice of Khurasan have been published. The first issue was released in January 2022, and since then the magazine has been published on a monthly basis. However, sometimes two issues are released in one month: this discrepancy is due to the differences between the Hijri calendar and the Gregorian calendar.

There is no consistent pattern of word count, sentence count, or page count across the issues. For instance, the 4th issue contains only ten pages, whereas the 38th issue is comprised of 93 pages. Furthermore, there is over a 20,000-word difference between the shortest and longest issue (Issues 4 and 38, respectively). 

Before the donation request, the text quoted verses 10 and 11 of Surah As-Saf from the Quran to provide a religious basis for the request. These verses served as the basis for the donation requests in all issues except issue #30.

It must be noted that, unlike previously published IS magazines, such as Dabiq and Rumiyah, Voice of Khurasan includes a dedicated section on donations for the first time. This section was first introduced in Issue 29, published in September 2023. 

Prior to the donation request, verses ten and 11 of the As-Saf surah from the Quran were cited to establish a religious basis for the request. These verses served as the foundation for donation requests in all issues, except Issue 30.

In most issues, donation requests are found on the penultimate page, with the exception of Issue 30. The magazine specifically requests donations to be made using the Monero (XMR) cryptocurrency. For individuals wishing to donate in Monero, both the Monero wallet address and a QR code linked to the Monero wallet address are provided.

Besides the financing tactics, it is important to analyze communication channels and methods used in Voice of Khurasan.

The section on communication was first introduced in Issue 15, which provided details on how communication would occur between sympathisers and Al Azaim Foundation, the media arm of ISKP. 

The supporters mostly use Telegram and Rocket.Chat applications.  Although the Telegram and Rocket.Chat applications were used as communication methods throughout these issues, it was found that Telegram IDs changed regularly.

For instance, one ID was used from Issue 15 to Issue 21, after which it changed in Issue 21 and remained in use until Issue 31. Similarly, the ID changed again in issues 33, 34, and 38. Additionally, QR codes were introduced in Issue 33. 

The primary reason for the frequent changes in IS’s Telegram ID is Telegram’s regular banning of IS accounts, which necessitates the creation of new accounts by IS. What does it mean?

 

As of early 2023, IS’s core income began to decline as the organisation lost millions of dollars due to pressure from anti-ISIS Coalition forces. The Coalition’s efforts also disrupted financial support for ISIS members in Syria and Iraq. 

For instance, in January 2023, the United States and Türkiye jointly dismantled a money transfer network that IS had been using to transfer hundreds of thousands of dollars for its activities. Moreover, money transfers by IS supporters are now closely monitored in many countries, resulting in numerous arrests in this context. 

 

Although IS continues to rely on traditional and informal methods such as hawala, it has increasingly turned to digital currencies like Bitcoin, Tether, and Ethereum in recent years to facilitate rapid transactions and evade detection. However, the use of cryptocurrencies such as Bitcoin and Ethereum by ISIS and its supporters has declined due to the implementation of advanced blockchain tracking techniques by security agencies worldwide. Consequently, IS has shifted its focus to alternative cryptocurrencies, notably Monero. Monero is regarded as a safer option for organisations like IS because it is more challenging to trace compared to popular cryptocurrencies such as Bitcoin. 

In Monero transactions, the sender’s and recipient’s information remains anonymous by default. Specifically, Monero employs three critical technologies—Stealth Addresses, Ring Signatures, and RingCT—which ensure that the sender, recipient, and transaction amount are concealed. As a result, both parties remain anonymous and are not subject to surveillance by security agencies. 

For these reasons, as of September 2023, IS began collecting donations through the Voice of Khurasan magazine and Monero to secure the necessary funds while evading the close scrutiny of security agencies.

Starting from the 15th issue, the Voice of Khurasan implemented a communication strategy that involves the combined use of Telegram and Rocket.Chat applications for communication and interaction purposes. This raises the question of why IS and its supporters rely on both Telegram and Rocket.Chat instead of exclusively using one of these messengers. 

Once it became evident that IS and its affiliates were heavily using Telegram, the platform began actively combating ISIS-related channels. In the third quarter of 2024 alone, law enforcement agencies from various countries removed a total of 35,634,916 items from Telegram and shut down 323 channels affiliated with three terrorist organizations, including ISIS. Of these, 34,602,606 pieces of content and 189 channels were directly linked to ISIS. 

These closures and monitoring efforts compelled ISIS to seek alternative applications, with Rocket.Chat emerging as a key platform. One of the primary factors contributing to IS’s adoption of Rocket.Chat is its setup and functionality, which make individual user accounts less susceptible to suspension compared to encrypted messaging platforms such as Telegram. 

Furthermore, Telegram’s centralised data storage contrasts with Rocket.Chat’s decentralised structure, making Rocket.Chat a more attractive option for IS and its supporters. 

However, despite the increasing popularity of Rocket.Chat among IS supporters, the organisation has not abandoned Telegram. Currently, IS employs a multi-step communication method that integrates both Telegram and Rocket.Chat, which it considers to be more secure. For instance, IS supporters who wish to register for IS-related channels on Rocket.Chat are required to send registration requests through Telegram bots. Additionally, the Telegram IDs used for such purposes are frequently changed to avoid detection and monitoring by law enforcement agencies.

 

Thus, innovative use of digital technology for fundraising and communication, as exemplified by the Voice of Khurasan magazine, presents evolving challenges for individuals, nations, security agencies, and technology companies. 

To counter these threats effectively, tech companies must adopt a complex proactive approach. It is crucial for tech companies to collaborate with governments and relevant governmental institutions. 

One practical recommendation is to enhance cooperation with national and international bodies to identify and disrupt financial networks that support terrorism, particularly those exploiting cryptocurrencies such as Monero. 

Companies specialising in blockchain analysis should be encouraged and incentivised to develop and implement advanced, privacy-centric tracking methods that monitor suspicious transactions while still respecting legitimate privacy rights of users.

Another innovative solution involves enhancing the detection and shutdown of propaganda dissemination. While platforms like Telegram are actively working to dismantle IS-affiliated channels, the emergence of decentralised platforms such as Rocket.Chat highlights the necessity for a more adaptive response. 

Technology companies could invest in AI-driven monitoring systems that are capable of identifying harmful content, even within encrypted or decentralised environments. Furthermore, developing cross-platform communication protocols to monitor shifts in user behaviour across various services could be essential.

Additionally, a global standard for responsible reporting mechanisms should be established, allowing users to report potential terrorist activities without jeopardizing their safety. 

In conclusion, the fight against the digital strategies employed by groups like IS requires ongoing innovation. 

By harnessing advanced technologies and promoting international collaboration, technology companies can play a crucial role in dismantling the virtual infrastructure that underpins modern terrorism, thereby providing a safer digital environment and reducing the risk of radicalization of internet users.