Pro-IS Transnational Networks Step Up Online Fundraising Efforts, Successfully Extricating Foreign IS Women and Children from Syrian Detention Camps in Post-Assad Syria

Mona Thakkar and Anne Speckhard

Since the ouster of the Assad regime, IS has sought to exploit Syria’s fragile transitional governance period, marked by sectarian violence, US military drawdown, and other internal security problems, to escalate its attacks. Most of its claimed attacks this year have reportedly been in SDF-held areas of northeastern Syria, where the detention centers holding IS inmates and the detention camps holding the families of IS fighters are located. In line with its breaking the wall campaign, IS, since December 2024, has also attempted to stage similar attacks like its 2022 brazen attack on Al-Sina prison to free its comrades. One of the recently foiled plots included an attack on the Raqqa prison in April 2025, which, as per SDF, involved an IS cell including foreign operatives. Further, the group’s entrenched presence in Al-Hol camp is also evident in the arrests of many senior IS operatives and recruiters during recent security raids, the cohesive network of its female supporters, and the alleged recent escape and smuggling of IS operatives out of the Al-Hol camp. This was facilitated by the swift redeployment, reorganization of its cells, and the reinforcement of smuggling routes following the intensified U.S. airstrikes on its positions in December 2024 after Assad’s fall.

Meanwhile, the stalled talks between the SDF and the Syrian interim government over the SDF’s military integration into the Syrian army and the SDF’s push for autonomy over northeastern Syria has cast uncertainty over the future management and the fate of the prisons holding around 8500 IS fighters —and ostensibly around 38,000 IS women children in Al-Hol and Al-Roj camps. Amidst this backdrop, capitalizing on the security gaps, the group and its financial networks, since February, through their reinvigorated fundraising campaigns, have facilitated the escape of an increasing number of third-country IS women and teenage boys out of the camps. Between February and July 2025, ICSVE tracked nearly 50 Telegram channels run by IS women in multiple languages, who coordinated these fundraising efforts with jihadist support networks in Central Asia, the Middle East, and Europe. The results of this monitoring are discussed extensively in this report.

Also relevant here is the Trump administration’s $117 million cut in humanitarian aid to detention camps, funding that covered data collection, security database analysis, and salaries for camp staff and guards—reductions that have possibly fueled increasing escapes. Beleaguered camp guards, paid in local wages and totally uncertain about their financial futures, easily fall prey to smuggling bribes from IS women who receive large amounts of money via hawala transfers into the camp. The major impetus for the escapes, as per the online accounts of IS women, is “reliable smuggling routes”  that opened after the fall of the Assad regime and lower smuggling rates falling from $30,000 to as low as between 14,000–18,000  for extricating a woman and a child out of the Al-Hol camp into Idlib.

The legal future of IS women detainees is bleak, with some Western countries increasing repatriations and others still doing nothing, leaving the women to ascertain their best future options. These women online report that escapes from the heavily monitored and difficult-to-flee al-Roj camp have increased, with more than 40  Russian women escaping since March—each paying approximately $25,000, with costs rising by an additional $10,000 if accompanied by two children. They claim that since March, women in larger batches also came out of the Al-Hol camp. In this context, Idlib province has emerged as a safe refuge for these female IS fugitives, where they claim they can under assumed identities live a normal “Islamic life” meaning practicing conservative Islam. They claim that many women have refrained from escaping to Turkey for the past year due to the greater risk of getting apprehended amidst the current security dynamics and the incredibly high smuggling fees. Interestingly, women have also reported that IS women living in different sections of the Al-Hol camp, who in the recent months have been increasingly repatriated, are also fleeing with their families for as little as $3,000. 

IS women probably correctly express concern that their perceived window for escape is closing with the anticipated handover of these facilities to Syria’s interim government, which will subsequently facilitate their immediate repatriation.  Radical women online reject repatriation, insisting that “believers should never“ willingly choose dar al-kufr (the land of unbelievers) over Sham (Syria, where they believe the Islamic State will be or is now reestablished), despite facing trials, as this would mean giving up on living their faith under shariah and bearing separation from their children.  The escape window appears momentarily opened as the SDF is alleged to have accepted substantial bribes in exchange for facilitating the release of IS women, motivated by fears of losing their primary leverage with the West: control over IS detention facilities that have been key to preventing the group’s resurgence.

These online fundraising efforts for IS women in the camps are predominantly led by those foreign women who themselves managed to escape in recent months and a year ago. Motivated by shared ideological commitments, collective experiences, and enduring social bonds formed by living together under the IS caliphate and subsequently in the camps, these female IS fugitives have made the “liberation” of those still held a key objective.

One such case highlights how these networks function in practice: a stern English-speaking IS woman smuggled out of al-Hol in 2020  through the Telegram channel blends IS propaganda and ideological messaging as she raises smuggling capital for those still in camps. Her posts invoke her memories of utopian life under the IS caliphate governed by Sharia, contrasting it with “Al Sharaa’s corrupt, un-Islamic governance policies”, reproaching his catering to the West and Shia minorities–the latter a view shared by many conservative Muslims worldwide. Along with long commentaries glorifying the role of muhajir IS fighters— mainly from Europe— and long-winded posts on Instagram promoting hijrah to IS Wilayah (governorates) in Africa, the channel also disseminated jihadist literature aimed at indoctrinating Muslim women. Booklets like  Oh Sisters in Tawheed (Sisters in Monotheism), urged women to embrace roles as spouses or widows of ‘mujahid IS fighters,’ in accordance with IS ideology. This hardline IS supporter also, since January 2025, claimed to have facilitated the escape of three other women soliciting crypto donations in Monero, Ethereum, and USDT TRC 20. In parallel, she has also acted as a financial intermediary for official IS operatives in Syria, claiming to have direct contact with them. Similarly, other English-speaking pro-IS women networks also aided in raising $3500 for an Iraqi IS supporter and her two children, claiming that the Iraqi women have long played a vital role in coordinating and distributing aid money for foreign women living in the separate, more robustly surveilled sections of the Al-Hol camp. Many women who now vocally reject repatriation also face growing pressure from their families, who have cut off financial assistance for these women. (Figure 3) 

In cryptocurrency, the use of stablecoins like USDT (Tether) on the Tron blockchain network has been the preferred cryptocurrency choice for IS and other militant actors due to its price stability in comparison to other volatile currencies like Bitcoin, fast transactions, and minimal fees. For the donors unfamiliar with crypto, they are mainly asked to send money to hawala offices and intermediaries in Istanbul through Western Union and Ria money transfer services. An IS detainee who ran hawala networks under the Caliphate, interviewed by ICSVE in 2023, explained that any money that makes it to Turkey has essentially made it into Syria via such networks. However, donors from Europe have increasingly exercised caution and refrained from sending transfers into Turkey, asserting that this would invite the scrutiny of law enforcement agencies. 

The escaped IS women fugitives living illegally in Syria express anger at the delayed arrival of funds, claiming they have to rely on informal remittance and money transfer offices in Syria that provide them with rotational disposable cryptocurrency wallets, and  Euro and dollar-based PayPal accounts. These informal money transfer offices and traders likely rely on rented PayPal accounts belonging to collaborators, unsuspecting intermediaries in the West, and other safe jurisdictions, as PayPal does not operate in Syria. This has prompted IS women to request that donors send additional funds to cover the heavy commission charged by the Syrian money transfer offices on each transfer. The  PayPal accounts frequently appearing in these fundraising operations over the period of the last four months were linked to a common Austrian phone number, suggesting that a centralized entity or common financial network was managing multiple accounts. Paypal transfers under the “Friends and Family option” above $50, were accepted to cover the high transaction fees with the strict guidelines of avoiding use of any Islamic terms like Sadaqah (i.e., Islamic charity) or references to Syria to bypass PayPal’s fraud detection systems and escape regulatory oversight.

Equally notable is the use of formal banking systems, with the pro-IS English networks widely circulating the bank transfer details of IS-linked intermediaries in Europe in their private Telegram channels. In one latest case, these networks routed transfers for the IS women in Syria through an obscure crypto-fiat ramping service known to operate in Switzerland via its Maerki Baumann & Co. AG account of a private bank registered in Zurich. ICSVE has withheld the name of the Swiss crypto platform linked to money laundering for IS networks, citing security concerns. These beneficiary details were circulated in one of the Telegram channels.  Similarly, last year, donations were laundered via an ostensible front business —Aqua Creative Global Limited in Copenhagen — through their offshore bank account registered with the European banking institution Banking Circle SA’s Copenhagen Branch. These findings lent credence to the fact that the formal European banking systems remain vulnerable to manipulation and abuse by militant actors. This reach also extends into the Middle East. In 2024, funds were illicitly channeled through an obscure Dubai-based business presenting itself as an import/export general trading firm, directing the money to their account at Wio Bank PJSC, a UAE-based digital platform bank. 

Similarly, in June, two new English language pro-IS Telegram channels run by male IS propagandists claiming to be in Syria, solicited donations for IS fighters in Iraqi prisons and women recently escaped from camps in Syria for covering their living expenses. These channels have also extensively commented on the operational trajectory of the group in Syria, condemning the recent “ targeting and killing of IS operatives” in the raids conducted by US-led coalition forces and Syrian security forces bolstered in al-Bab, Northern Syria. They push the narrative that these IS fighters are financially struggling, putting at risk their safety and that of their families for upholding “the law of God”. Citing financial hardship, they appealed for donations for injured IS fighters in combat in Syria. One such campaign sought $6,000 for an operative requiring prosthetic hand surgery while implicitly stating that the “young muwahhid brother was injured in a battle while carrying out a task to help the weak.” This illustrates how IS-affiliated English-language networks, led by foreign male propagandists and women based in Syria, play a strategic role in aiding the group’s broader objectives.

On the other hand, Russian IS women have been the most vocal supporters of the group, circulating their daily fundraising collection reports with iconography of IS flags and nasheeds (i.e., Islamic chants) as a testament of their ideological commitment along with disseminating the Russian translations of IS’s old online magazines of Dabiq, Rumiyah and speeches of IS leaders. They have also denounced Russian-speaking jihadist scholars critical of IS who rallied behind Ahmed Al Sharaa’s governance policies,  seeking theological guidance from IS Qadis (judges) on the matters of voluntary repatriation versus escaping or refusing repatriation.  As a part of their indoctrination efforts, they solicited monthly donations for teaching children Quran, Arabic, Russian, and “Sharia courses” inciting them to vandalize playgrounds and educational facilities run by UN and other Western NGOs  in camps, claiming that these are meant to brainwash and corrupt the faith of  “future mujahideen”.

Unlike their English-speaking counterparts, escaped Russian IS women have led a more structured and synchronized crowdfunding efforts, unitedly raising money on a case-by-case basis, culminating in the release of ostensibly many Chechen Russian women since January. These campaigns, led by Russian fugitives, appear to be running in close coordination with Russian diaspora communities of jihadist supporters in Europe, with the fundraising ecosystem revealing a transnational character.  One such joint campaign between March and July 2025 claimed to have raised around $25,000 cumulatively for freeing an Egyptian IS  woman supporter and her teenage sons and five orphans under her care. Claiming that smuggling of underage children doesn’t incur any added costs, Russian women were tasked with collecting around $15,000 for the release of the Egyptian woman, while the supporter networks in Europe collecting for the release of teenage boys with one-time donations amounting to as much as $4000. 

PayPal accounts used for accepting transfers were linked to German phone numbers, with most of the donations arriving as bank transfers to the IS intermediaries in Germany. These transactions involved Germany’s largest public savings bank (Sparkasse) chain with transfers to the intermediaries to their Sparkasse bank accounts in the branches of Ostprignitz-Ruppin in Brandenburg and in Saalfeld-Rudolstadt in Thüringen, Germany. Cash donations were handed over in Germany, Austria, and Turkey alongside the use of Ukrainian, Turkish bank cards, and European fintech platforms like Revolut. This ecosystem also expanded to Russia, with funds predominantly being channeled through Russian banking giants like SBER and T Bank, along with routing funds through Turkish banks like Kuviyet Turk.  Similarly, in July, a fundraiser of $ 17,000 was opened to smuggle a Russian teenage boy out of the SDF-run Orkesh rehabilitation center — where some young males have been placed after separating them from IS women — with the mother having raised $6,000 to facilitate his escape. 

At the beginning of the year, new pro-IS Arabic language crowdfunding Telegram channels led by Arab IS women from inside Al-Hol also resurfaced, circulating pledges of allegiance to IS caliph Abu Hafs al-Hashimi al-Qurashi, while acknowledging they receive assistance from the official IS operatives in Syria, through what they call as “Office of Martyrs and Prisoner Release.” They also criticized those IS women who voiced support for Ahmed al-Sharaa claiming that they would set them free. These Arab IS women have been in close contact with Iraqi IS propagandists online who, while predominantly providing humanitarian aid, also raised in July $4,500 to smuggle out a high-risk female Iraqi IS supporter and her children, reporting that “camp authorities thwarted their escape multiple times”.  Donors for this campaign were provided unique recipient codes linked to the transfer or remittance office in Bochum, Germany, which served to anonymize both the sender and the identity of the financial intermediary. The recent UN report also noted that IS is reportedly using ‘safe drop boxes’ at money exchanges to later retrieve funds exclusively through passwords or coded references. 

Apart from cryptocurrency donors, in Iraq could send donations with mobile recharge credit top-ups using Iraqi telecom providers like Zain, Asiacell, and Korek with a minimal top-up of around 5,000 IQD ($3.80), which could be either converted into crypto or exchanged for cash through local traders and delivered to the detainees in Syria. One IS propagandist active on Facebook, Abu Bashir Al-Shami, running similar fundraising initiatives, received donations in cryptocurrency and through intermediaries in Germany. He has regularly threatened online critics of IS women, disseminating manuals of DIY bomb-making guides, target selection on Facebook inciting attacks against the enemies of IS. Similarly, these Arabic-speaking propagandists also directed their supporters to the nascent pro-Arabic IS media advocacy outlet “Jihad in the Path of Allah”. This media outlet has been soliciting crypto donations for the official IS operatives in Iraq and Syria, claiming that they send these funds to a trusted IS Syrian operative, referring to him as a “working brother” issuing receipts of donations to build credibility with supporters.

ICSVE found that these Arabic networks used a common TRC-20 address in their campaigns, revealing a closely interconnected fundraising ecosystem. The Blockchain Score Chain intelligence tool reveals that the USDT TRC-20 address between March and July 2025 transacted over nearly more than $100,000  of transfers to blacklisted addresses banned by Tether for suspicious activities, along with interacting with Hezbollah, Palestinian Islamic Jihad, and Houthis-linked addresses flagged by Israel’s National Bureau for Counter Terror Financing. (NBCTF) and Iranian crypto exchanges like Nobitex. Many large amounts of illicit transfers were broken into multiple smaller transactions under $1 sent across, a smurfing tactic widely used to avoid detection. These transactions also link to U.S. and EU-sanctioned exchanges like Russia-based Garantex and Cambodia’s firm Huione Pay, an exchange widely used by cyber heists and North Korean hackers, demonstrating that the crypto address used by Arabic IS-linked networks was a part of a larger illicit financial ecosystem.

Similarly, since March 2025,  the fundraising campaigns for securing smuggling aid for the pro-IS Uzbek and Russian women supporters have been primarily driven by Islamic State in Khorasan Province (ISKP’s)  Al-Azaim Uzbek media wing and linked propagandists.  One of the Uzbek women who was in contact with ISKP operatives claimed that she escaped from Al-Hol in early August. The Uzbek ISKP network also sought to raise  $5,800 to “legally” prevent the transfer of a teenage Uzbek boy—separated from his imprisoned IS mother in Baghdad prison —from an orphanage to an “adult education center,”  while also admitting that they helped finance the escape of IS Uzbek. Russian and Ukrainian women last year.

What’s particularly noteworthy is that Al-Azaim’s various media branches—including the Uzbek, Russian, Turkish, and Pashto wings —appear to coordinate their informal crowdfunding campaigns, often reusing the same USDT- TRC 20 addresses. The UN report also points to the decreased use of Monero by ISKP in their public-facing crowdfunding initiatives due to its delisting from major centralized exchanges, and crypto conversion issues, while relying predominantly on USDT TRC 20, along with recently endorsing the use of bitcoin in its Voice of Khorasan magazine. The monitoring of the wallets used by ISKP revealed that funds were channeled through centralized exchanges like Binance, Bybit, and Kraken, along with widely employing non-custodial crypto-swapping services such as ChangeNOW, FixedFloat, Cash App, and Total coin. IS supporters are reportedly also using Telegram’s @Wallet, which is the official crypto wallet bot built into Telegram. It began as a Toncoin wallet and now supports other coins like Bitcoin and USDT, thus showing increased sophistication in the use of cryptocurrency for money laundering to obscure the financial flows. 

In contrast, many German-language crowdfunding networks that until last year also gathered smuggling capital for the release of IS women, seem to have been cracked down upon due to increased scrutiny and arrests of financial facilitators in Germany who illicitly operated as a part of a larger European network that aided these IS women in Syria. Currently, only one channel, “Sisters in Tent” remains active, primarily securing funds for humanitarian aid for German as well as Iraqi and Syrian IS women, with inquiries regarding sending smuggling aid directed to private chats on Telegram to evade scrutiny. This network predominantly accepts cryptocurrency donations and also circulates learning guides on secure and low-cost transfers using Binance and Trust Wallet, along with providing the option of personally handing over donations to intermediaries in Berlin. This marks a shift from last year, when German networks openly advocated for routing funds through IBAN transfers above $100. This included the use of a front jewelry business entity in Brussels via Wise—framed as silver ring purchases, and through intermediaries in London to their Revolunt account in the UK. Until last year, these networks also financed German IS women repatriated from the camps in Syrian for covering their legal fees. The donations were accepted through the German Stadtsparkasse bank account. Recently, the networks also provided the option of making deposits via ‘Rewe Geld’ — referring to payment services offered by REWE, a major German supermarket chain —particularly through gift cards, vouchers, and cash-handling at checkout— allowing funds to be moved outside conventional banking rails for misuse.

Another channel, Free the Sisters, has for years provided financial support to IS members detained in Germany and other extremists through novel ways. This includes using the generated proceeds through the sale of translated theological literature authored by jihadist figures like Anwar al-Awlaki and ʿAbdullāh ʿAzzām for providing legal assistance for detainees, mainly via PayPal donations to an individual named Siryar Dundar. The books cost around €20 to €30. A critical enabler in this ecosystem is the Swedish fintech platform Klarna, which allows third parties to settle invoices with deferred payments, with these networks exploiting the Klarna platform to cover the rent, utility bills, and medical costs of the IS detainees and their families, saying that this way they could bypass law enforcement scrutiny. Similarly, the aid pleas for IS women on crowdfunding platforms such as GoFundMe were disguised as humanitarian aid for “widows” or “orphans, and “mujahid brothers” with these crowdfunding websites having largely failed to detect and take down such aid campaigns for the IS detainees in time.  Similarly, the widespread use of crowdfunding platforms amongst the IS networks is also reinforced by the case of a Canadian man named Khalilullah Yousuf, who raised over $15,000 through a GoFundMe for sending money overseas for the benefit of IS, falsely claiming that the donations were for Palestinians in Gaza and for religious events. Similarly, Arabic-speaking pro-IS and Russian networks in July opportunistically disseminated fundraising pleas claiming to provide food parcels, water tanks to Gaza’s aggrieved Muslims under the intensified aerial bombardment of Israel with these funds being potentially directed to help the IS women detainees. 

Despite facing constant shutdowns of their Telegram channels and weeks of disrupted internet services in Al-Hol, IS women have remained resolute in their fundraising efforts, collecting thousands of dollars required for escape in some cases in less than 3 months. Lamenting their restricted presence on Telegram, which widely disrupts their fundraising endeavours, these actors have resorted to using more secure encrypted messaging applications like Signal, Session and Simplex for correspondence with donors, along with maintaining a robust, sustained presence on Instagram. This study thus demonstrates how IS- linked transnational networks have developed a decentralized, adaptive, financial ecosystem—exploiting loopholes in European, particularly German banking systems, employing cryptocurrencies and DeFi protocols, mobile prepaid cards, online gaming platforms, fintech platforms like Revolut, crowdfunding sites, internal online payment transfer applications and hawala networks—to move funds with relative ease, impunity and minimal detection. IS-led financial networks’ ongoing aggressive fundraising efforts enable a resilient financial system for the group, enabling the release of the female IS supporters and male fighters, bolstering the group’s border recruitment and operational objectives. As demonstrated, IS women fugitives —often still committed to the cause of IS, by serving as propagandists and financial facilitators, raising children as the next generation of jihadist fighters contribute to the group’s larger operational and recruitment goals. They thus pose a potent threat to the stability of the new Syria as well as to their home countries.  Rigorous monitoring of these fundraisers is imperative, as it could thus yield vital intelligence to dismantle the group’s enduring financial infrastructure. This requires coordinated international cooperation between law enforcement, financial institutions, and intelligence agencies to block emerging channels of IS’s illicit financing.