United Nations S/2023/549

Security Council Distr.: General

25 July 2023

Original: English

Letter dated 24 July 2023 from the Chair of the Security Council
Committee pursuant to resolutions 1267 (1999), 1989 (2011) and
2253 (2015) concerning Islamic State in Iraq and the Levant
(Da’esh), Al-Qaida and associated individuals, groups, undertakings
and entities addressed to the President of the Security Council

I have the honour to transmit herewith the thirty-second report of the Analytical
Support and Sanctions Monitoring Team pursuant to resolutions 1526 (2004) and
2253 (2015), which was submitted to the Security Council Committee pursuant to
resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in
Iraq and the Levant (Da’esh), Al-Qaida and associated individuals, groups,
undertakings and entities, in accordance with paragraph (a) of annex I to resolution
2610 (2021).
I should be grateful if the attached report could be brought to the attention of
the members of the Security Council and issued as a docu ment of the Council.

(Signed) Vanessa Frazier

Chair
Security Council Committee pursuant to resolutions 1267 (1999),
1989 (2011) and 2253 (2015) concerning Islamic State in Iraq
and the Levant (Da’esh), Al-Qaida and associated individuals,
groups, undertakings and entities

23-12695 (E) 260723

*2312695*
S/2023/549

Letter dated 30 June 2023 from the Analytical Support and

Sanctions Monitoring Team addressed to the Chair of the Security
Council Committee pursuant to resolutions 1267 (1999), 1989 (2011)
and 2253 (2015) concerning Islamic State in Iraq and the Levant
(Da’esh), Al-Qaida and associated individuals, groups, undertakings
and entities

I have the honour to refer to paragraph (a) of annex I to resolution 2610 (2021),
by which the Security Council requested the Analytical Support and Sanctions
Monitoring Team to submit, in writing, comprehensive, independent reports to the
Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and
2253 (2015) concerning Islamic State in Iraq and the Levant (Da’esh), Al -Qaida and
associated individuals, groups, undertakings and entities, every six months, the first
by 31 December 2021.
I therefore transmit to you the Monitoring Team’s thirty-second comprehensive
report, pursuant to annex I to resolution 2610 (2021). In formulating the report, the
Monitoring Team considered information it received up to 16 June 2023. I also note
that the document of reference is the English original.

(Signed) Justin Hustwitt

Coordinator
Analytical Support and Sanctions Monitoring Team

2/23 23-12695
 S/2023/549

Thirty-second report of the Analytical Support and Sanctions

Monitoring Team submitted pursuant to resolution 2610 (2021)
concerning ISIL (Da’esh), Al-Qaida and associated individuals
and entities

Summary
The threat of terrorism remains high in conflict zones and relatively low
elsewhere. The situation is dynamic and, while the threat is suppressed in some
conflict zones, the resilience of terrorist groups means that there is a risk of resurgence
in certain circumstances.
The large population remaining in camps in the north-east of the Syrian Arab
Republic are a factor in that risk. Further progress has been made in the repatriation
of residents but, at the current rate, the risk will persist for several more years. The
overwhelming majority of the residents are Iraqi or Syrian.
The Sahel and the Democratic Republic of the Congo continue to cause concern
as the level of violence and threat increases in those regions. Member States are
concerned that terrorist groups will exploit the current instability in the Sudan, with
implications for conflict zones in Africa.
The impact of counter-terrorist operations against Islamic State in Iraq and the
Levant (ISIL, QDe.115) has been particularly significant with the deaths of Ali Jasim
Salman Muhammad al-Juburi on 24 February, who oversaw the ISIL general
directorate of provinces, and Bilal al-Sudani on 25 January, who played a key
financial role in the ISIL Al-Karrar office. The reported killing of the overall leader,
Abu al-Husain al-Husaini al-Qurashi, in April has not been confirmed.
The structures of Al-Qaida and ISIL (Da’esh) continually adapt to pressure on
the core leadership, with regional affiliates exercising operational autonomy.
Islamic State in Iraq and the Levant-Khorasan (ISIL-K, QDe.161) continues to
pose significant threat within Afghanistan, and Member States are concerned about
its potential to develop external operations capability and to project a threat into the
region and beyond.
Globally, more terrorist groups have developed an unmanned aerial systems
capability. In parts of Africa, more destructive, and greater use of, improvised
explosive devices has been observed.
Terrorist groups continue to demonstrate an ability to generate significant
revenues and agility and innovation in the use of new financial technologies.
Member States should be encouraged to propose designations under the ISIL
(Da’esh) and Al-Qaida sanctions list. The overall trend in approved listings is
downwards.
Reporting by Member States on the implementation of all aspects of sanctions
measures remains limited.

23-12695 3/23
S/2023/549

Contents
Page

I. Overview and evolution of the threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

II. Regional developments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
A. Africa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
B. Iraq and the Levant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
C. Arabian Peninsula . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
D. Europe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
E. Asia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
III. Impact assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
A. Resolutions 2199 (2015) and 2462 (2019) on the financing of terrorism . . . . . . . . . . . . . . 18
B. Resolution 2347 (2017) on cultural heritage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
C. Resolution 2396 (2017) on foreign terrorist fighters, returnees and relocators . . . . . . . . . 19
IV. Implementation of sanctions measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
A. Travel ban . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
B. Assets freeze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
C. Arms embargo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
V. Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
VI. Monitoring Team activities and feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4/23 23-12695
 S/2023/549

I. Overview and evolution of the threat

1. The threat posed by Al-Qaida (QDe.004), Islamic State in Iraq and the Levant
(ISIL, also known as Da’esh) and affiliated groups continues to be high in conflict
zones and neighbouring Member States. The threat remains relatively low elsewhere.
The situation is far from static, however, with significant shifts in several theatres
during the reporting period.
2. Counter-terrorist operations in Iraq and the Syrian Arab Republic, Mozambique
and Yemen have significantly suppressed or constrained terrorists’ capabilities
domestically and their ability to mount external operations. In the Sahel and the
Democratic Republic of the Congo, the level of violence and threat continues to rise,
with regional implications. In Somalia, significant success in counter-terrorist
operations has been mirrored with increased attacks by Harakat Al-Shabaab
Al-Mujaahidiin (Al-Shabaab, SOe.001), with the Al-Qaida-affiliated group remaining
strong and resilient.
3. Despite significant attrition of the ISIL (Da’esh) leadership in Iraq and the
Levant, the group remains resilient and the risk of resurgence should counter-terrorist
pressure ease is real. The reduction in the group’s activity is assessed by many
Member States to be both enforced and deliberate. The group has adapted its strategy
and has exercised caution in choosing battles that are likely to result in limited los ses,
while rebuilding and recruiting from camps in the north-east of the Syrian Arab
Republic and from vulnerable communities, including in countries neighbouring the
core conflict zone. The large population present in the camps and detention centres in
the north-east of the Syrian Arab Republic constitutes a major threat to the region and
beyond. The successful military targeting of the leadership continues to be critical in
keeping ISIL on the defensive, but the group’s ability to adapt its modus operandi and
embed itself within local populations, giving it time to regroup, enables its resilience ,
causing vulnerability to terrorist threat. ISIL also continues to take advantage of the
lack of coordination between various counter-terrorism forces in the region, in a
fractured political environment.
4. The situation in Afghanistan has become more complex, with Member State
concerns increasing about the ability of Islamic State in Iraq and the Levant-Khorasan
(ISIL-K, QDe.161) to project a threat into the region, and further afield into Europe.
Tehrik-e-Taliban Pakistan (TTP, QDe.132), emboldened by the Afghan Taliban’s
assumption of power as the de facto authorities, derives advantage from its presence
in Afghanistan for its operations across the border into Pakistan. There is growing
reporting that other sanctioned terrorist groups are using support to TTP as a means
to evade control by the Afghan Taliban. Some Member States expressed concern that
greater Taliban control of such groups could result in some elem ents aligning more
closely with ISIL-K.
5. The trend of counter-terrorist pressure prompting ISIL (Da’esh) and Al-Qaida
to adopt flatter, more networked and decentralized structures has continued, with
operational autonomy in the affiliated groups. Member States have little evidence of
command and control of the affiliates from the core leaderships. The questions of
titular and executive leadership at the core of both Al-Qaida and ISIL (Da’esh) remain
unresolved, but have not had an impact on the level of violence perpetrated by the
affiliated groups and their perceived success.
6. The media apparatus of both ISIL (Da’esh) and Al-Qaida very effectively
propagandizes the operations of their affiliates in conflict zones, reaching a wide
audience, with the aim of radicalizing, gaining support and recruits, and inspiring
attacks beyond conflict zones. While the previously well-developed external
operations capability of both the ISIL (Da’esh) and Al-Qaida core groups remains

23-12695 5/23
S/2023/549

diminished and largely constrained, the ambition and intent of both groups to recover
and project a threat beyond conflict zones is clear. Al-Qaida in particular claims, and
has demonstrated, strategic patience.
7. The dynamic between Al-Qaida and ISIL (Da’esh) affiliates in the field is
environment dependent. While there are some very rare examples of coordination, or
even cooperation, there is an ideological gulf between the two groups. Where they
are not forced into direct confrontation they can coexist, pursuing independent
agendas. Where they compete for resources, territory, and hearts and minds, as in the
Sahel, they can come into violent conflict, which becomes the paramount objective
of the group, with operations against government and other targets moving to the
second order. Member States registered concern about greater fluidity in Afghanistan
where relationships and affiliations have a longer history and are more complex. The
distinctions between members of Al-Qaida and affiliated groups, including TTP, and
ISIL-K are at times blurred at the edges, with individuals sometimes identifying with
more than one group and a tendency for people to gravitate towards the dominant or
ascending power.
8. Terrorist methodology has evolved. The use of unmanned aerial systems
continues to proliferate, with Al-Qaida in the Arabian Peninsula (AQAP, QDe.129)
using them effectively. As indicated in the present report, there is greater use of
improvised explosive devices, with greater effect, in conflict zones in parts of Africa.
While not a widespread trend, it is worth noting that some Member States provided
examples of terrorists’ interests in using toxins in their attack methodology. Member
States also noted that ransoms paid to terrorist groups to secure the release of
kidnapped hostages had enabled terrorist groups to improve their capabilities,
resulting in loss of life in further terrorist attacks.
9. Although the implications are not yet clear, several Member States observed
that the current conflict in the Sudan has prompted a renewed focus on the long
presence and historic activities of both Al-Qaida and ISIL (Da’esh) in that country.
They voiced concerns that both groups would seize upon the opportunity presented
by political and military instability and advance terrorist agendas, with potentiall y
serious implications in African conflict zones. Joint regional counter-terrorism
operations remain critical in this regard.

II. Regional developments

A. Africa

Central and Southern Africa

10. In Mozambique, the deployment of regional forces in Cabo Delgado Province
(S/2022/83, para. 9), continues to have a significant impact on Ahlu Sunna
wal-Jama’a (ASWJ, not listed), disrupting its leadership, command structures and
bases. Regional Member States estimate that ASWJ has between 180 and 220 battle -
hardened adult male fighters. Since January, Mozambican and regional forces have
killed between 44 and 65 fighters and commanders. Member States note that
displaced fighters have formed small and medium-sized cells, adapting to current
conditions, presenting few opportunities for exploitation and scarce access to
resources. Consistent attacks over the past two years and the subsequent displacement
of villagers, farmers and civilians have resulted in the near collapse of informal
businesses in nearby towns and a cessation of meaningful production by the small -
scale farmers on which ASWJ are reliant for provisions during their raids and rampant
lootings.

6/23 23-12695
 S/2023/549

11. Following the launch of Operation Vulcão IV, 1 there has been an escalation in
clashes between ASWJ and deployed regional forces on both sides of the Messalo
River, central Cabo Delgado. Since January, forces have killed a senior ASWJ
Commander, Abu Fadila, in Nguida (Macomia district), Issa Wachi (senior
commander in Nangade) and Mustapha (senior commander in Macomia district).
Clashes have mostly centred on engagements between ASWJ and the forces of the
Southern African Development Community Mission in Mozambique (SAMIM) and
Mozambique with Member States reporting a notable decrease in deaths and attacks
on civilians in the past six months.
12. There are clear signs that insurgents are trying to cultivate social and economic
relationships with the local community in the hope of normalizing their pr esence and
sustaining themselves, which Member States assess to be a sign of local, mostly self -
generated funding with little evidence of ASWJ receiving any significant external
funding.
13. The ASWJ leadership structure includes Abu Yasir Hassan (not list ed), a
Tanzanian national serving as the spiritual leader of the group, and operations leader,
Bonomade Machude Omar (not listed, Mozambique national) from Macomia, who
has extensive knowledge of the terrain. Foreign terrorist fighters originate from the
United Republic of Tanzania, Kenya and, to a lesser extent, the Democratic Republic
of the Congo, Somalia and Uganda. Regional Member States maintain that there is
no clear evidence of “command and control orders” from ISIL over ASWJ.
14. In the Democratic Republic of the Congo, Operation Shujaa, the joint military
operations by Congolese and Ugandan forces against the Allied Democratic Forces
(ADF, CDe.001), continue to disperse ADF beyond its traditional strongholds,
expanding its area of operation. Operation Shujaa has targeted ADF senior
commanders, strongholds and fighters. One Member State reported that in two months
424 ADF operators were killed, 81 captured and 115 abductees rescued. In Mwalika
Valley, in February, forces of Operation Shujaa targeted and killed the head of the
political wing of ADF, its third most senior leader and former head of operations,
Mulalo Seguja (aliases Ssegujja and Fezza).
15. Despite Operation Shujaa, attacks by ADF persist unabated. In North Kivu, the
situation has worsened significantly due to the use of lethal improvised explosive
devices and some of the bloodiest attacks to date. On 15 January, ADF detonated an
improvised explosive device at Lubiriha Church in Kasindi, Beni territory. The
explosion killed 16 and injured more than 60 civilians. Member States assess that the
improvised explosive device was the largest, most powerful bomb ever used by ADF,
killing the highest number of victims in a single explosion. The bomb weighed
between 7 and10 kg and was made using urea nitrate and metal shrapnel, enhancing
its blast radius and lethality.
16. Member States report that the bomb was built by ADF Commander, Abwakasi
(not listed), who used his network to procure explosives to make larger and more
dangerous bombs, with the express intent to cause maximum civilian casualties.
Abwakasi also built the bomb that was detonated in a busy marketplace in Ma
Campagne, Beni town, on 25 January. While that bomb was much smaller, between
500 and 700 grams, it injured 18 civilians, including 10 children. Fragments
recovered indicate that the bomb was detonated either by a radio -controlled device or
a timer.

__________________
1
Joint operations of Mozambican and deployed regional forces.

23-12695 7/23
S/2023/549

17. In one week in March, ADF had killed more than 80 civilians in North Kivu
Province. By the end of the month, more than 150 civilia ns overall had been killed,
the total killed rising to more than 500 in the past six months.
18. Meddie Nkalubo (not listed) and Abwakasi are assessed by Member States to be
the key orchestrators of the most lethal attacks in the eastern Democratic Republi c of
the Congo and Uganda.
19. ADF is assessed to have between 1,500 and 2,000 adult male fighters under the
leadership of Seka Baluku (alias Musa Baluku, CDi.036). Notwithstanding pledges
of allegiance by ADF to ISIL, several regional Member States refute any “command
and control” links between ADF and the ISIL core.

East Africa
20. In Somalia, the Government has embarked on a strong military offensive against
Al-Shabaab. While Al-Shabaab suffered significant losses from targeted airstrikes
and military operations against its leadership and fighters, Member States assess that
Al-Shabaab’s financial and operational capacity remains undiminished, with an
estimated 7,000 to 12,000 fighters. Al-Shabaab generates $100 million per annum
from its taxation of all aspects of the economy of Somalia.
21. Al-Shabaab continues to kill government officials, soldiers, law enforcement
officers and international peacekeepers. Over the past six months, its focus has been
on strategic targeting of Somali military and African Union Transition Mission in
Somalia (ATMIS) bases. In its most lethal attack, over 500 Al -Shabaab fighters
attacked an ATMIS base in Bulo Marer, killing a significant number of Ugandan
forces. The group continues to stage targeted attacks both domestic ally and in
neighbouring States, including incursions into Kenya.
22. Member States assess that Al-Shabaab is preparing for the second phase of the
Government’s offensive, which is aimed at targeting the group in southern Somalia,
and that Al-Shabaab will exert greater effort to protect its traditional support base of
the South-west, Middle and Lower Juba regions, which might be very taxing on
government forces.
23. ISIL in Somalia has a presence in Puntland. Member States note, however, that
the group does not have the capacity to control large terrain or the capacity to
undertake significant operations owing to continued attacks by Al -Shabaab. ISIL in
Somalia is estimated to have between 100 and 200 fighters. ISIL in Somalia hosts the
Al-Karrar office (S/2022/547, para. 24), headed by the emir of ISIL in Somalia, Abdul
Qadir Mumin (not listed).
24. On 25 January, key ISIL financier, Bilal al-Sudani, was killed in a United States-
led operation in northern Somalia. Al-Sudani was responsible for expanding ISIL
activity in Africa. He played a significant role in supporting key elements of a network
of financial hubs that operate in Africa, and beyond, through the Al -Karrar office.
25. Several Member States assess that revenue streams to the Al-Karrar office
emanate from a country bordering the former so-called caliphate, with one Member
State emphasizing that 100 per cent of money to Al-Karrar flowed through that
country. Notwithstanding, some Member States maintain that Al-Karrar generates its
funds through the exploitation of various sectors of the economy in northern Somalia.
Other Member States report that the strength of Al-Karrar is overestimated, noting
that funding to the Al-Furqan office far exceeds revenue flows to Al-Karrar.
26. Several Member States registered concern that well-established terror groups
would exploit political instability and violence in the Sudan. The ISIL cell in the
Sudan, fully operational since 2019, is headed by Abu Bakr al-Iraqi (Iraqi national).

8/23 23-12695
 S/2023/549

The veteran leader of ISIL (Da’esh) in Iraq was delegated the authority by the ISIL
core to establish a logistical and financial base in the Sudan from which transit and
investment would take place. The ISIL cell has between 100 and 200 fighters, who
are seasoned operators, but act as facilitators for logistical movements and
transactions.
27. Abu Bakr Al-Iraqi, a businessman, had registered a variety of businesses using
false identities in the Sudan and Türkiye. According to a Member State, he operates
several money exchange businesses and a travel/tourism agency in Türkiye and holds
substantial investments in the Sudan.
28. Member States warn that North African fighters use the Sudan as a hub for
arrival and onward transfer to southern Libya, Mali and West Africa.

West Africa
29. With weakening centralized command of ISIL (Da’esh) and Al -Qaida, the
African branches of these organizations now play a critical role despite their
increasing autonomy, particularly in the context of local agendas. The area of
operations of Jama'a Nusrat ul-Islam wa al-Muslimin (JNIM, QDe.159) is expanding
and strengthening beyond Mali, particularly into Burkina F aso. Positioning itself as
a political player, JNIM is increasing pressure on local authorities to ensure a role in
the event of negotiations. JNIM is thus developing a strategy which, while not
diverging from Al-Qaida’s doctrine, is in fact moving away from the group locally. In
this respect, it is important to note that JNIM does not systematically use the Al -Qaida
flag in its communications or on the battlefield; rather, it displays its own banner to
mark its singularity.
30. JNIM has experienced certain difficulties. Because it recruits from diverse
communities, JNIM has a significant challenge in managing potentially divergent
agendas between different ethnic constituencies. Sustaining cohesion and coherence
has become a priority for the leadership. Contrary to what might have been expected,
JNIM does not currently appear able to counter expansionist intentions of Islamic
State in the Greater Sahara (ISGS, QDe.163) in the tri-border area of Burkina Faso,
Mali and the Niger. Despite the mobilization of various katiba or battalions
(Timbuktu, Gao and Kidal in Mali; and Gourma in Burkina Faso) and the support of
non-terrorist Tuareg militia, JNIM is suffering heavy losses and no longer seems able
to resist the steady advances of ISGS.
31. The declining strength of JNIM in the east in the face of ISGS advances
contrasts with its enhanced position in Burkina Faso and central Mali. Completing its
move into the Kayes, Koulikoro and Sikasso regions, JNIM has encircled the Malian
capital thereby consolidating its control of the area between the capital and the
western and southern borders. It has augmented its authority in Mali through various
katiba (Timbuktu, Kidal, Gao), which are reasserting local political influence through
conflict arbitration, policing, and community dispute resolution. The Katiba Macina
(not listed but founded by Amadou Koufa QDi.425 and mentioned in the list entry for
him), which exploits the Malian army’s weaknesses, is securing its position despite
the expanded presence of international non-State actors who appear unable to reverse
this trend, notwithstanding ongoing operations. Central Mali remains a safe operating
base for operations directed at Burkina Faso and the southern part of the Sahel.
32. The Katiba Macina is an important, almost semi-autonomous, force essential to
JNIM. In cooperation with Ansarul Islam (not listed), Katiba Macina’s actions in
Burkina Faso have benefited from unresolved local conflicts and the increasing
stigmatization of Fulani communities. As a result, it is difficult at times to distinguish
between offensive action by JNIM and clashes between local communities.

23-12695 9/23
S/2023/549

33. JNIM maintains constant pressure on the forces of Burkina Faso in the southern
border regions of Burkina Faso and is seeking to strengthen its po sitions, notably in
the north-east of Benin, on the border with the Niger, and Togo.
34. ISGS is central to advancing ISIL core goals, despite significant losses of its
leadership to JNIM attacks. It seeks to expand territory for logistical and recruitment
purposes but faces challenges on several fronts. The recent deadly fighting with JNIM
and the actions of international forces in 2022 and 2023 resulted in the loss of
significant leaders, such as Oumeya Ould Albakaye and Ousmane Illiassou Djibo
(alias Petit Chapori). The command structure, although currently uncontested, is
primarily of Arab origin. The emir (Mohamed Ibrahim al-Salem al-Shafi'i, also known
as Aba al-Sahrawi, not listed), and his deputy are of Arab heritage while the rest of
the leadership is Fulani, as are most of the fighters. These imbalances represent
potential vulnerabilities in the event of internal dissension, as the group has difficulty
in federating the different Fulani components owing to fratricidal fighting with the
Fulani of the Katiba Macina. ISGS has been forced to fight on several fronts
simultaneously, constraining the group’s advances and making it difficult to obtain
supplies.
35. ISGS, nevertheless, remains resilient, acknowledges its losses and is
multiplying its initiatives to break out of its isolation and extend its area of operations.
Since the end of the truce with the Government of the Niger, there has been an upsurge
in violence attributable to ISGS. It has targeted the areas of Sanam, Filingué, Tahoua
and Abala in the Niger, to the north-west of Niamey, with urban centres as potential
targets. Efforts to establish and strengthen a logistics corridor with Nigeria appear
tenuous, but these efforts do serve to expand the pool for recruiting fighters and
securing logistical supply from Nigeria, possibly through an enhanced relationship
with Islamic State West Africa Province (ISWAP, QDe.162). Many Member States
cite significant risks of the tri-border area becoming a sanctuary and base for
recruitment that could expand to Nigeria; Mali remains a base of operations for action
within Burkina Faso and the Niger.
36. Finally, in Nigeria, ISWAP, led by Abu Musab al-Barnawi (not listed), is a
growing threat, with porous borders with the Niger that facilitate the transit of fighters
and weapons. In this respect, one Member State considers that greater collaboration
between ISGS and ISWAP is a serious concern as the run-up to the establishment of
a new territorial caliphate.

North Africa
37. Both ISIL (Da’esh) and Al-Qaida in North Africa are assessed to be weak, but
conditions for a potential resurgence persist. Returning foreign terrorist fighters and
the impending release of prisoners whose sentences are ending are the most
significant threat to the region. In Algeria, Al-Qaida in the Islamic Maghreb (AQIM,
QDe.014) shifted further south to the Sahel (northern Mali). Jund al -Khilafah in
Tunisia (JAK-T) (QDe.167) faces challenges due to lack of funding and the killing of
its most prominent leaders, with currently around 15 members spread out in western
Tunisia in ech-Chambi and Samama Mountains.
38. In Morocco, authorities dismantled five terrorist cells during the reporting
period, with the arrest of 25 individuals, several of whom maintained coordination
with the ISIL core or ISGS. The most significant cell, whose members planned to rob
banks and attack vital security infrastructure, was disrupted on 15 March.
39. In Libya, Islamic State in Iraq and the Levant-Libya (ISIL-Libya, QDe.165)
maintains a strong presence in southern Libya, where the group con tinues to exploit
social discontent while collaborating with organized crime groups that control illicit
trafficking activities. ISIL-Libya continues to recruit from communities in the south,

10/23 23-12695
 S/2023/549

seeking to infiltrate local tribes. Member States estimate the g roup’s strength between
300 and 500 fighters. One Member State reported the increasing focus of ISIL in
Libya on recruiting scientists capable of making biological materials (such as poison)
or handling sophisticated technological devices, with a view to c arrying out terrorist
attacks. Another Member State indicated that the “Army of the Sahara” ( S/2023/95,
para. 35) was trying to maintain its position in the central and southern regions of the
country, in the absence of unified government authorities.
40. The deteriorating security situation in Fezzan and illicit trafficking networks
allowed ISIL-Libya to reorganize itself in certain areas including Awbari, Sabha,
Umm al-Aranib, Murzuk, Qatrun, Fuqaha’, Uwaynat, al-Shuwayrif, as well as in
Haruj, Akakus and Haruj al-Aswad mountains. The group opted for a clandestine
modus operandi, changing positions when needed and settling in mountainous areas
of Akakus, Tibesti and Lake Qar’un, where it can access water. On e Member State
noted that ISIL-Libya’s objective in Fezzan was to strengthen its ranks in the Sahel
and West Africa provinces through training and logistical support.
41. Several ISIL terrorist cells were dismantled by Libyan security services,
including the arrest of a 20-year-old Libyan engineer on 21 January, who planned to
target gas supply pipelines using armed drones, in collaboration with the ISIL core.
His seized belongings revealed a handbook with instructions on the manufacturing of
toxins and biological materials.
42. One Member State reported that ISIL-Libya had created four structural
subgroups: security, led by Al-Hajj Ibrahim (Libyan, not listed); fighters, led by “Abu
Yasir” (Egyptian); explosive manufacturing, led by Hashem Abu Sedra (Libyan , not
listed); and military commission, led by Abu Mu’awiya a-Sudani (Sudanese, not
listed). These groups are divided between Sabha, Murzuq, Umm al-Aranib, Qatron,
Zala and Hun city.
43. Al-Qaida in Libya is embedded with Libya’s tribal groups, particularly in
southern Libya, its stronghold and a crucial area for logistical support to the Sahel.
Its strength is estimated at 150 to 200 fighters in Awbari, Sabha, Uwaynat and Ghat.
In Awbari and Ghat facilitation networks led by Tuareg provide logistical support for
Al-Qaida. Some cells move regularly between Libya, Mali, the Niger and the Sudan.
One Member State reported ad hoc cooperation between ISIL (Da’esh) and Al -Qaida
in Libya, notably in the South, through the exchange of fuel and food and the use of
common messengers for communications.
44. Terrorist activities by Ansar Bayt al-Maqdis (ABM, not listed) in Egypt continue
to decrease mainly due to counter-terrorism pressure by Egyptian authorities in the
Sinai, which contained ABM presence locally and largely dismantled its core
structure and leadership cadres. The group was forced to withdraw to the west and
south-west of the northern Sinai Peninsula following significant personnel losses. It
struggles to perform high-profile attacks, such as the 30 December 2022 attack on an
army checkpoint in Ismailia, which was assessed by some Member States as an act of
desperation. The active strength of ABM has declined; one Member State noted it to
be in the tens of members, while others estimate it to be between the low and mid
hundreds. Egyptian public investments and infrastructure programmes in the Sinai
Peninsula and the authorities’ outreach to local communities have contributed to a
reduction in local grievances, which had previously enabled ABM to recruit.

B. Iraq and the Levant

45. The ISIL (Da’esh) core continues to face leadership challenges due to ongoing
counter-terrorism pressure. On 24 February, ISIL General Directorate of Provinces
leader, Ali Jasim Salman al-Juburi (Iraqi, aliases Abu Sara al-Iraqi, Kafush), was

23-12695 11/23
S/2023/549

killed in an air strike in the north-west of the Syrian Arab Republic. His death is
assessed by Member States as a significant blow to the group, describing him as its
shadow leader. Abu Sara influenced ISIL strategy, played a key role in personnel
assignment, including the previous two ISIL leaders, and directed external operations
and finances. Nevertheless, his loss appears to have disrupted the group only for the
short term. One Member State noted his potential successor as Ammar Mohamed
Ibrahim al-Juburi (not listed, Iraqi, aliases Abu Zeinab, Abu Hamudi). Other
leadership losses included Khalid ‘Aydd Ahmad al-Juburi (responsible for planning
attacks in Europe), and Abd-al-Hadi Mahmud al-Haji Ali (responsible for planning
terrorist and kidnapping operations in Middle East and Europe).
46. On 30 April, Türkiye reported killing ISIL leader, Abu al-Husain al-Husaini
al-Qurashi, in Afrin, subsequently identifying him as a Syrian -born individual,
holding the alias of Abdul-Latif. Member States could not confirm the leader’s death,
with one identifying the deceased as only the security leader in the group’s Syrian
branch. Some Member States dismissed the possibility of a non-Iraqi overall ISIL
leader. The operation was undertaken by Türkiye following indications that he aimed
to relocate to another Syrian region and had started to take extreme safety measures
following Abu Sara’s death. The real identity of Abu al-Husain remains unconfirmed
by Member States.
47. Leadership attrition led the ISIL core to adopt a flat command and control
structure; the role of the overall leader has become less relevant to the group’s
functioning. Leadership losses affected ISIL operations in the core conflict zone, as
the group failed to launch attack campaigns during the month of Ramadan, which
previously triggered a surge in ISIL activity.
48. Nevertheless, ISIL is assessed to remain resilient, commanding between 5,000
to 7,000 members across the two countries, most of whom are fighte rs. The group
deliberately adopts a strategy to reduce attacks and use guerrilla tactics, while
reorganizing and recruiting. While most senior ISIL (Da’esh) leaders remain in the
north-west of the Syrian Arab Republic, the group is relocating some key figu res,
including in Dara’a, where the Sharia commander and several Arab leaders are located
and, to a lesser extent, central Badia and the Syrian-Iraqi border area with Anbar
governorate, where the group is increasing activities and exploiting the porous bor der.
The ISIL presence in Dara’a is estimated at several hundred fighters.
49. In Iraq, counter-terrorism pressure by Iraqi forces continues to result in reducing
ISIL activities and suppressing the threat. 2 Nevertheless, the group maintains its low-
grade insurgency, exploiting security gaps along the Kurdistan region of Iraq to enable
attacks and resupply its cells and elements in desert and mountainous areas. The group
is operating under the direction of Abu Abd al-Qader (Iraqi), succeeding his
predecessor, Abdallah Makki Muslih al-Rafi’i (Iraqi, alias Abu Khadija, not listed),
who now supervises the Iraqi-Syrian zone along with the “Bilad al-Rafidayn” regional
office. Al-Rafi’i’s role within ISIL has become more important.
50. Operations were contained in rural areas while attacks in urban centres were
less frequent. ISIL (Da’esh) maintained its presence in its strongholds around
Salaheddin, north of Baghdad (Tarmiya), Diyala and Kirkuk, particularly in the
Hamrin mountains where most ISIL (Da’esh) in Iraq branch leaders are present
(including Wadi al-Shay) and al-Anbar province, including Wadi Hauran, which is a
refuge to reorganize and restructure. One Member State noted ties between ISIL and
organized crime groups in Mosul, Kirkuk, Tikrit and Ramadi.
51. In Iraq, ISIL (Da’esh) is organized into eight units: administration, media,
sharia, procurement, finances or economy, groundwork, explosive manufacturing and
__________________
2
Some Member States estimated ISIL strength in Iraq to be as low as 600 to 1,000 fighters.

12/23 23-12695
 S/2023/549

prisoner release, across 10 Iraqi regional divisions, some of which have been
combined owing to insufficient resources. The group is becoming increasingly risk -
averse to personnel losses, with plans to release its prisoners and recruit from
vulnerable communities.
52. In the Syrian Arab Republic, ISIL (Da’esh) operates under the “Holy Land”
regional office and exploits areas where counter-terrorism pressure is weak. The
group continues to wage asymmetric attacks albeit at a relatively lower frequency,
mainly in Homs, Dayr al-Zawr, Raqqah, Hama and Hasakah. Ongoing military
pressure has largely contained the group in the central Badia which, while a haven for
ISIL (Da’esh) for training and reorganizing, is characterized by difficult terrain and
lack of critical infrastructure, thereby limiting the group’s ability to operate or
disseminate propaganda effectively. Small cells undertook regular attacks, including
in north Palmyra and eastern Hama. ISIL (Da’esh) continued to use the north -east to
rebuild, recruit, and try to release key leaders from prisons.
53. ISIL continues to view the north-west as a potential gateway to Türkiye and a
haven where it can blend into the population. Hay’at Tahrir al-Sham (HTS) 3 remains
the terrorist group exerting effective control in the area. HTS still commands between
7,000 and 12,000 fighters, including approximately 1,000 foreign terrorist fighters.
The group maintains its local expansionist vision, conducting through its armed wing
an offensive against armed factions affiliated with the Government of the Syrian Arab
Republic in rural Aleppo and other surrounding villages, including the city of Afrin.
The group is largely self-financing (S/2023/95, para. 46).
54. Khatiba al-Tawhid wal-Jihad (KTJ, QDe.168) continues to be the most capable
Central Asian terrorist group operating under an HTS umbrella. KTJ and financial
intermediaries, including Kubilay Sari (not listed) received funds from donors on
behalf of KTJ fundraisers for the purchase of materiel, including night vision goggles,
in addition to facilitating fund transfers to the benefit of HTS.
55. The Eastern Turkistan Islamic Movement (QDe.088), also known as the
Turkistan Islamic Party (ETIM/TIP), in the Syrian Arab Republic remains closely
linked with HTS. The group mainly operates in Idlib Province. One Member State
reported that the group’s overall strength was on the rise, and that ETIM/TIP has
increased military training and upgraded its combat weapons, and actively opens
channels to infiltrate into a neighbouring country and Central Asia. The group
reportedly sent members to Africa and South Asia to establish training camps and
staging posts there, and plan attacks on Chinese nationals and agencies.
56. Hurras al-Din (HAD, not listed) continues to face challenges due to HTS
previous arrests of key leaders and successive targeting and killing of senior figures.
The group is led by Samir Hijazi (alias Abu Hammam al-Shami, not listed) assisted
by a shura council that includes sharia leader Sami al-Uraydi (not listed). Some
Member States reported that HAD reorganized its relationship with HTS, who
released key leaders under the condition that they would cooperate locally and not
plan external operations. Reportedly, HAD did not comply but rather took advantage
of long-standing links with armed factions in Idlib, including Ansar al-Tawhid (not
listed), to relocate HAD fighters to other areas. One Member State noted the
aspiration of HAD to enhance its armed drone capabilities. HAD strength is estimated
to be between 1,500 and 2,000 fighters, mostly in Idlib and Latakia, with a small
presence in Dara’a.
57. Current ISIL (Da’esh) setbacks in the core conflict zone are largely attributable
to effective counter-terrorism pressure. The ongoing successful targeting of ISIL
leadership is important. The group’s ability to embed within local populations remains
__________________
3
Listed as Al-Nusrah Front for the People of the Levant (QDe.137).

23-12695 13/23
S/2023/549

a challenge. ISIL continues to take advantage of security loopholes and lack of

coordination between various counter-terrorism forces, establishing conditions that
could enable a rapid revival should pressure ease.

C. Arabian Peninsula

58. Al-Qaida in the Arabian Peninsula (AQAP, QDe.129) continues to face setbacks
and leadership losses due to sustained counter-terrorism pressure and has been drawn
further into the Yemeni conflict. Nevertheless, AQAP persists as a threat in Yemen
and the region. As the most combat-ready terrorist group, it maintains ambitions to
conduct external operations and to establish control over major ports in the Gulf of
Aden.
59. AQAP incurred serious leadership losses in their sharia, media and improvised
explosive device production cadres. On 26 February, a drone strike on a house in
Hsoun al-Jalal in Ma’rib Governorate killed Hamad bin Hamoud al-Tamimi, among
the top AQAP leaders. The targeted house was the site of previous meetings of AQAP
leader Khaled Batarfi (not listed). The strike also killed Abu Nasser al-Hadhrami, who
dealt with media and financial matters. One of the group’s prominent explosive
manufacturing experts was also targeted by a drone strike on 30 January in Wadi
Ubaydah in Ma’rib Governorate. Following these strikes, certain AQAP elements
sought safety by moving from Wadi Ubaydah to urban areas in the city of Ma’rib
itself. Supporters’ messages of solidarity with AQAP were circulated online,
including reportedly by Taliban members in Afghanistan.
60. These leadership strikes have damaged AQAP operational capabilities in the
short term. Nevertheless, while the cadre of experienced leaders is depleting, Member
States assess that AQAP maintains its ability to train new leaders to undertake the
tasks of those killed. The precise size of AQAP remains difficult to measure, owing
to its embedded nature within local tribes, and is estimated in the low thousands.
Some Member States assessed it at between 3,000 and 4,000 individuals, combining
active and passive elements. Most AQAP top leaders are in Wadi Ubaydah, while
some moved to other safe areas, including in Hadramawt, Shabwa and Abyan.
61. Some Member States reported the presence in Yemen of the son of Sayf al -Adl
(QDi.001), Khaled Mohammed Salahaldin Zidane (not listed), while others noted
planning for his relocation to Yemen, causing some controversy among AQAP
leaders. One Member State indicated that he has overseen the AQAP media arm since
2020 and is married to the daughter of an influential tribal leader. It also noted that
this reflects Sayf al-Adl’s objective to tighten control over AQAP and its media arm
given financial difficulties and differences between the conflicting wings in the group.
These are led by Khaled Batarfi, a Saudi national, an d Saad ben Atef al-Awlaki, who
enjoys the support of some Yemeni tribes. Leadership losses might necessitate the
restructuring of AQAP, and senior positions could be given to elements affiliated with
Sayf al-Adl.
62. In January, AQAP transferred some of its field operations to one of its camps in
Shabwa and shifted other activities to the Mahfad district in Abyan. The group
continued its attacks in Shabwa and Abyan, mainly in retaliation for the “arrows of
the east” counter-terrorism initiative that had launched its second phase in January.
AQAP resorted to the use of armed drones in some attacks in the Musayn’ah district
in Shabwa, possibly showing sensitivity to the risk of excessive losses of personnel
during operations. One Member State reported that Ho uthi elements provided AQAP
with the drones and were training their members to use them. AQAP has sought to
develop its aerial capability and seems to have made progress. Attacks on maritime
targets remain an aspiration for AQAP but progress has been slowe d by resource

14/23 23-12695
 S/2023/549

constraints. AQAP media publications remain their most powerful tool for outreach
and radicalization. The group continued its efforts to recruit sympathizers and
released video messages from Batarfi during the reporting period.
63. Islamic State in Iraq and the Levant-Yemen (ISIL-Yemen, QDe.166) maintained
minimal activity. Its strength is estimated to be around 100 fighters, who coordinate
with ISIL-Somalia, especially for logistical purposes. One Member State noted that
ISIL-Yemen is working on a new organizational structure and had called leaders to a
meeting in Shabwa in May. It also noted opportunistic cooperation and profit -sharing
between AQAP and ISIL-Yemen in kidnapping-for-ransom operations.

D. Europe

64. The situation in Europe remains stable, with a slight increase in the number of
attempted terrorist acts thwarted by European security services since the end of 2022.
According to one Member State, some attackers aspired to use explosives and
chemical toxins.
65. Most lone-actor attacks are conducted by individuals not directly affiliated with
ISIL or Al-Qaida, who have radicalized independently of social interaction and appear
to be triggered by acts of hostility towards Islam. The fact that soft targets and places
of worship have been the predominant choice for most attackers represents an
additional challenge for counter-terrorism services. On 5 January, 15 individuals,
reportedly inspired by ISIL-K instructions to carry out attacks against the Swedish
and Dutch Consulates in Istanbul and Christian and Jewish places of worship, were
arrested in Türkiye. On 25 January, a machete-wielding individual, after undergoing
a rapid self-radicalization process, killed a sexton and injured a priest at two Catholic
churches in Algeciras, Spain.
66. In addition to the January incitement campaign of the ISIL core’s media
apparatus calling for terrorist attacks against Christians in retaliation for incidents of
Qur’an burning in Europe, the enhanced media and operational capabilities of ISIL -K
risk inspired more lone actors in the region. Member States assess that ISIL -K might
pursue high-impact operations against Western countries and their interests abroad in
the medium term, as evidenced by the recently disrupted attack in Strasbourg, France .
67. Some Member States noted a new route used by foreign terrorist fighters
traveling from countries in Southern Europe to the Sahel. A joint security operation
conducted in January by the Central Bureau of Judicial Investigations of Morocco
and the General Commissariat of Information of the National Police of Spain
dismantled an ISIL-affiliated terrorist cell composed of three individuals operating in
the two countries who sought to carry out terrorist attacks after having failed to reach
ISIL strongholds in the Sahel region and despite having links to ISIL recruiters and
facilitators there.

E. Asia

Central and South Asia

68. Assessments of Al-Qaida, ISIL-K and other terrorist groups in Afghanistan were
addressed in detail in the Monitoring Team’s fourteenth report on the Taliban
(S/2023/370). Member States reported that Afghanistan remained a place of global
significance for terrorism, with approximately 20 terrorist groups operating in the
country. One Member State assessed that the goal of those terrorist groups is to spread
their respective influence across the regions and to build theocratic quasi -state
entities.

23-12695 15/23
S/2023/549

69. The relationship between the Taliban and Al-Qaida remains close and symbiotic.
For the most part, Al-Qaida operates covertly in Afghanistan to help promote the
narrative that the Taliban comply with agreements not to use Afghan soil for terrorist
purposes. Under the patronage of high-ranking officials of the de-facto Taliban
authorities, Al-Qaida members infiltrate law enforcement agencies and public
administration bodies, ensuring the security of Al-Qaida cells dispersed throughout
the country.
70. Al-Qaida’s capability to conduct large-scale terror attacks remains reduced
while its intent remains firm. The group uses Afghanistan as an ideological and
logistical hub to mobilize and recruit new fighters while covertly rebuilding its
external operations capability. Al-Qaida is in a reorganization phase, establishing new
training centres in Kunar and Nuristan Provinces. Member States assessed that
Al-Qaida would likely remain dormant in the short term while developing its
operational capability and outreach. Al-Qaida leaders seek to strengthen cooperation
with regional terrorist groups of non-Afghan origin located in Afghanistan, including
the Islamic Movement of Uzbekistan (IMU, QDe.010), ETIM/TIP and Jamaat
Ansarullah (not listed), intending to infiltrate and establish strongholds in countries
in Central Asia. One Member State assessed that the mid- to long-term prospects of
Al-Qaida depend on the overall situation in Afghanistan. Should Afghanistan descend
into chaos and insecurity, the base for Al-Qaida would likely strengthen. Should the
country achieve stability, Al-Qaida would likely seek to shift the core to other
theatres, such as Yemen or North Africa.
71. Some Member States assessed Sayf al-Adl as most likely to succeed Aiman
al-Zawahiri and reportedly still in the Islamic Republic of Iran. The Al -Qaida core in
Afghanistan remains stable at 30 to 60 members, while all Al-Qaida fighters in the
country are estimated to be 400, reaching 2,000 with family members and supporters
included. Al-Qaida in the Indian Subcontinent (AQIS, not listed) has approximately
200 fighters, with Osama Mehmood (not listed) being the emir. One Member State
assessed that Al-Qaida is shaping AQIS to spread its operations into neighbouring
Bangladesh, Indian Administered Jammu and Kashmir, and Myanmar. That Member
State also noted that certain limited elements of AQIS are ready to either join or
collaborate with ISIL-K.
72. Members States assessed ISIL-K as the most serious terrorist threat in
Afghanistan and the wider region, benefiting from increased operational capabilities
inside Afghanistan. ISIL-K is estimated to have from 4,000 to 6,000 members,
including family members. Sanaullah Ghafari (alias Shahab al-Muhajir, QDi.431) is
viewed as the most ambitious leader of ISIL-K. One Member State reported that
Ghafari was killed in Afghanistan in June. This remains to be confirmed. Mawlawi
Rajab (QDi.434) is the leader of external operations for ISIL -K.
73. ISIL-K is becoming more sophisticated in its attacks against both the Taliban
and international targets. The group was focused on carrying out a strategy of high-
profile attacks to undermine the Taliban’s ability to provide security. Overall, ISIL -K
attacks demonstrated strong operational capability involving reconnoitre,
coordination, communication, planning and execution. Furthermore , attacks against
high-profile Taliban figures in Balkh, Badakhshan and Baghlan Provinces, raised
ISIL-K morale and boosted recruitment.
74. Member States assess that Tehrik-e-Taliban Pakistan (TTP, QDe.132) is gaining
momentum in its operations against Pakistan. Since the reunification with several
splinter groups, TTP has aspired to re-establish control of territory in Pakistan after
being emboldened by the Taliban takeover in Afghanistan. The group is focused on
high-value targets in border areas and soft targets in urban areas. TTP capability is
assessed as not matching its ambition, given that it does not control territory and lacks

16/23 23-12695
 S/2023/549

popular appeal in the tribal areas. In June, certain TTP elements were relocated away
from the border area, as part of the Taliban’s efforts to reign in the group under
pressure from the Government of Pakistan. Member States are concerned that TTP
could become a regional threat if it continues to have a safe operating base in
Afghanistan. Some Member States registered concern that TTP might provide an
umbrella under which a range of foreign groups operate, or even coalesce, avoiding
attempts at control by the Taliban. One Member State noted the possibility of AQIS
and TTP merging. It assessed AQIS to be providing guidance to TTP for conducting
increased attacks within Pakistan. It was also reported that ETIM/TIP training camps
in Kunar Province were being used for TTP fighters.
75. Some Member States estimate that the strength of ETIM/TIP varies between 300
and 1,200 fighters in Afghanistan. Regional countries reported that the group
continued to acquire weapons and created new bases in Afghanistan. The group
actively expanded the scope of its operations and built operational bases and
armouries in Baghlan Province, while retaining its presence in Badakhshan, Takhar,
Kunduz, Baghlan, Logar, Kunar and Sari Pul Provinces. ETIM/TIP continues to
recruit fighters of various nationalities in an effort to internationalize. One Member
State reported that the group formulated a long-term plan to train young fighters, with
hundreds already trained; engaged in drug trafficking to raise funds; and actively
carries out mining activities and smuggling to provide logistical support for the group.
Some Member States reported that the group had developed links with ISIL-K, jointly
publishing propaganda posters, and reported some ETIM/TIP members joining
ISIL-K operations.

South-East Asia
76. Increased counter-terrorism pressure in the region accounted for the relatively
low number of terrorist attacks during the reporting period. Successful counter-
terrorism operations against ISIL-South-East Asia (ISIL-SEA, QDe.169) and Abu
Sayyaf Group (ASG, QDe.001), especially in the Philippines, provide a reminder of
the residual threat due to the substantial number of terrorists remaining in the region.
Two Member States noted a slight increase of terrorist activity in the region. ISIL
emissaries actively promote their ideology and the inclusion of part of the region into
the “great caliphate”, exploiting unresolved territorial, cultural and religious
differences. Recently, there has been a tendency to strengthen cooperation between
the main terrorist groups in South-East Asia, including those under the ISIL (Da’esh)
banner.
77. Faharudin Hadji Benito Satar (aliases Abu Zacharia and Jer Mimbantas), the so-
called emir of ISIL-SEA and former leader of the Maute Group (known as Dawlah
Islamiya, not listed), as well as Joharie Sandab (alias Abu Morsid), who oversaw the
group’s logistics and finances, were killed in Philippine operations. One regional
Member State reported the intention of ASG to conduct a massive attack in Mindanao
in retaliation for Abu Zacharia’s death and to attain the release of his detained wife
and children.
78. One regional Member State noted the deaths of ASG leader, Radullan Sahiron
(QDi.208), in late March in Patikul, Sulu Province, Philippines; and an ASG leader,
Nurudin Muddalan, in a clash with police in Basilan province on 13 June.
79. Two regional Member States reported the arrest of three Uzbek individuals (not
listed), members of KTJ, for attacks on 24 March on a police station in north Jakarta,
in which an immigration official was killed and four others were injured. The
individuals had travelled from Istanbul, transiting throug h Abu Dhabi and entering
Indonesia via Malaysia, where they stayed for almost a month.

23-12695 17/23
S/2023/549

80. One Member State reported that “Jihad al-Mahdi fi Bilad al-Arakan”
(approximately 300 militants) was increasingly active in Myanmar’s border regions.
The group has already established ties with terrorists in the region, hoping to open a
broad front in South-East Asia and create a basis for the formation of an Islamic
caliphate in the region.
81. ISIL-affiliated groups in South-East Asia generate revenue locally. In some
cases, they support ISIL networks in the Middle East, with some exploiting the
charitable sector to raise funds for terrorist activities in Indonesia. ISIL in the
Philippines continues raising its own funds using the formal financial sector to
transfer fiat currencies, with increased use of virtual currencies.

III. Impact assessment

A. Resolutions 2199 (2015) and 2462 (2019) on the financing
of terrorism

82. As noted in the Monitoring Team’s thirty-first report (S/2023/95), revenue of

the ISIL core (QDe.115) continues to decline due to ongoing counter-terrorism
pressure in Iraq and the Syrian Arab Republic. The Team previously reported
estimates of between $25 million and $50 million being available, but some Member
States believe the amount to be significantly less and diminishing. Notwithstanding
military operations successfully targeting ISIL leaders, significant cash reserves
remain at the disposal of the group; physical reserves of cash buried in Iraq and the
Syrian Arab Republic are excavated and then smuggled out.
83. The leadership losses that ISIL has suffered include at least two in charge of
financial operations – Ali Jasim Salman Muhammad al-Jaburi, on 24 February, and
Bilal al-Sudani (alias Suhayl Salim Abd-El-Rahman, Abu-Faris), on 25 January.
Al-Sudani’s role in facilitating transfers from the Al-Karrar office to ISIL affiliates is
a significant loss of expertise. Some Member States assess Al -Karrar in Somalia as
remaining an important hub in transferring funds.
84. ISIL continues to use funds to pay family members of ISIL fighters who are
killed and in prison and to secure the release of prisoners, but reports about declining
revenue and the resulting pressure on the group persist. Member States note sporadic
payment to leaders and the lack of payment to fighters as an indication of the need to
increase limited funding. ISIL leaders continue to emphasize the importance of
fundraising.
85. While the source of funding depends on the local circumstances in which each
terrorist group operates, extortion and kidnap-for-ransom remain the primary means
of ISIL (Da’esh) and Al-Qaida for raising funds. Where groups control territory, illicit
taxation of the population by exploiting the collection of zakat prevails. In Somalia,
Al-Shabaab engages in a range of activities to generate as much revenue as
$100 million per annum, including through kidnapping, businesses, coercion of fees
from residents and illegal charcoal smuggling. JNIM, ISGS and AQAP sources of
funding include kidnap-for-ransom, gold panning, smuggling, arms trafficking, cattle
rustling, poaching, levies on economic activity and taxes on goods shipments, on
transport services and on escort or protection services.
86. Other methods of financing consist of online fundraising platforms and
donations. ISIL-Somalia raises funds through criminal activities, including illegal
fishing and black-market smuggling, sometimes smuggling in collaboration with
Al-Shabaab and AQAP. ISIL-West Africa extorts local agricultural businesses and

18/23 23-12695
 S/2023/549

fishing operations in Lake Chad and engages in kidnap-for-ransom operations in

Nigeria, raising significant sums.
87. Member States registered concern about the continued use of kidnap-for-ransom
operations by terrorist groups to generate revenue. They noted that payment of
ransoms through intermediaries had significantly enhanced terrorist capability,
resulting in loss of life. In cases in which a difficult political decision not to pay
ransom had been taken, while hostages had tragically been killed, no further hostages
of that nationality had been taken by the group and terrorist capabilities had not been
enhanced. Such payments are contrary to Security Council resolution 2133 (2014).
88. Concerning the delivery of funds, traditional methods continue to be
predominant, particularly hawalas or cash couriers but mobile wallets are
increasingly utilized (S/2023/95, para. 82), including in East Africa and Iraq,
highlighting the potential need to address how anti-money-laundering and countering
the financing of terrorism measures can be implemented to deal with risks of misuse.
ISIL also provides members with prepaid phone cards or rechargeable cards that can
be sold for cash. ISIL also is reported to be using regional versions of cryptocurrency
and stable coins. ISIL has been increasingly using virtual assets for international
funds transfers. These funds transfer methods allow ISIL leadership to support
militant operations, recruit and maintain a loyal cadre of supporters and secure the
release of its members from detention.
89. Member States observe that terrorist groups continue to demonstrate great
capacity for innovation and agility in the use of new methods and technologies in
financing their operations, including the use of Bitcoin and crowdfunding. One
Member State cites as an example a terrorist cryptocurrency project created for the
collection of funds on the dark web in cryptomoney and disseminated in several
languages.

B. Resolution 2347 (2017) on cultural heritage

90. No specific incidents were noted during the reporting period. Although
connections between transnational organized criminal networks and terrorist
organizations have been observed in the illicit trafficking of cultural property, all
reported cases were exclusively linked to organized crime networks. One Member
State reported that ISIL continued to benefit from the illegal export of valuable
cultural objects from Iraq and the Syrian Arab Republic.

C. Resolution 2396 (2017) on foreign terrorist fighters, returnees

and relocators

91. Although there has been significant progress in repatriation efforts in the first
six months of 2023, with a reported 14 countries repatriating their nationals, the
challenge of the camps and detention centres in the north-east of the Syrian Arab
Republic and the risks they generate persist. One Member State flagged the Cubs of
Caliphate, who were child soldiers recruited between 2014 and 2017, now referred to
as Generation Caliphate. The latter includes adolescents recruited in the overcrowded
Hawl camp, dominated socially by ISIL (Da’esh). They are characterized now as a
generation that is more operationally experienced, more extreme and more organized,
judged to pose heightened threat in the near future. One Member State noted children
being recruited within the camp for ISIL (Da’esh) suicide operations. Hawl is not the
only camp of concern.

23-12695 19/23
S/2023/549

92. The spread of nationalities in the camps and detention facilities is still w ide,
with a number of European passport holders believed to be in the Hawl camp, along
with Central Asians, Arabs from North Africa and the Gulf, and others. Most of the
estimated remaining population of 55,000, however, were reported to be either Syrian
(47 per cent) or Iraqi (49 per cent). This represented a large Arabic population from
the region, of which a significant percentage was radicalized, very close to the Iraqi
border. Women and children account for around 90 per cent of the remaining
inhabitants of Hawl, while children under the age of 18 constitute approximately
60 per cent of the overall population.
93. Iraq has now repatriated almost 5,000 individuals from the camps, in 10 waves.
At the current pace of repatriation of all nationalities, however, the risks associated
with that single camp, and others, will persist for several more years. Disease and
harsh conditions have caused some loss of life. There were also several instances
reported of ISIL (Da’esh) moving funds to enable group members to leave the camps
for operational objectives. The reintegration of repatriated families has proved
challenging in some cases and requires continued support to build community
acceptance. One Member State suggested that a unified mechanism, under the
auspices of the United Nations, could better support Member States’ efforts to
facilitate repatriation from the camps.
94. There are approximately 11,000 ISIL (Da’esh) prisoners in Syrian Democratic
Forces prisons, including approximately 2,000 foreign terrorist fighters of around 70
nationalities, and more than 3,500 Iraqis. There were limited reports of attacks on
prisons, or prison breaks, during the reporting period, but Member States reported
that ISIL (Da’esh) continued to aspire and plan to do carry out such actions. It was
essential for the group to replenish the leadership, experience and operational
capability being lost to air strikes. One Member State emphasized a specific threat to
Raqqah prison motivated by difficulties in finding new recruits. That Member State
also noted concerns that high-risk prisoners were released as a result of bribery or
corruption. Some Member States flagged that the volatile military situation in the
north-east of the Syrian Arab Republic, where there were some 40 detention facilities,
and the impact of earthquakes in early 2023, heightened concerns about the possibility
of detainees being able to rejoin ISIL (Da’esh) ranks.
95. It is difficult to make an accurate estimate of the number of foreign terrorist
fighters at large in the core conflict zone. One Member State estimated the number
associated with ISIL to be approximately 1,000, with 90 per cent in the Syrian Arab
Republic. Estimates of foreign terrorist fighters fighting with HTS in the north-west
of the Syrian Arab Republic ranged from 1,000 to over 2,000. Some Member States
saw a small-scale flow of fighters away from the core conflict zone, including to
Africa, Europe, Central Asia and South-East Asia. This included foreign terrorist
fighters from North Africa returning to their home region, which could enhance
capabilities of groups in West Africa and the Sahel.

IV. Implementation of sanctions measures

96. The effectiveness of sanctions measures relies on the quality of the ISIL
(Da’esh) and Al-Qaida sanctions list. Member States continue to raise concerns
regarding the lack of identifiers, the possible misspelling of name s and the absence
of biometric information. The Monitoring Team proposed many technical
amendments to the list based on Member States’ information and approved by the
Committee, but only a few of them substantively improved the quality of the list due
to certain reluctance of Member States and other relevant international organizations
to provide updated information about list entities and individuals. The Monitoring

20/23 23-12695
 S/2023/549

Team continues to work on a data validation project approved by the Committee to

identify inconsistencies in the list entries and narrative summaries, ensure the quality
and accuracy of the list going forward, and reduce the number of false positives that
could adversely impact sanctions implementation. Over 100 names have been
reviewed and 30 amendments submitted to the Committee to correct inconsistencies
in the list entries and narrative summaries.
97. In addition, the Team notes the gradual downward trend regarding new listings
to the ISIL (Da’esh) and Al-Qaida sanctions list in recent years, with only 19 listings
since 2020.

A. Travel ban

98. During the reporting period, no travel ban exemption request was submitted to
the Committee, and no information was received from Member States regarding
attempted travel or interdiction of individuals designated on the ISIL (Da’esh) and
Al-Qaida sanctions list.

B. Assets freeze

99. During the reporting period, the Committee received and approved three
requests for assets freeze exemptions.
100. Under Security Council resolution 2610 (2021), the Council called upon all
States to report on measures taken to freeze assets ( S/2023/95 para. 94) and
encouraged Member States to provide greater reporting on the implementation of
sanctions measures. The Team notes that Member States’ reporting on the
implementation of all aspects of sanctions measures remains extremely limited.

C. Arms embargo

101. Member States remained concerned about the proliferation of weapons in

Afghanistan, the Middle East and Africa, in particular the availability of small arms
and light weapons and the increased use of unmanned aerial vehicles and improvised
explosive devices.
102. With the Taliban takeover of Afghanistan, Member States have expressed
concern over the availability of large quantities of weaponry and other military
equipment of the United States of America and the North Atlantic Treaty Organization
(NATO), noting the proliferation of weapons from stockpiles left by former coalition
partners in Afghanistan into neighbouring States. Regional Member States reported
the use of NATO calibre weapons against government forces of neighbouring States,
as well as the transfer of such weapons to listed entities, with an emphasis on TTP,
ISIL-K, ETIM/TIP and Jamaat Ansarullah.
103. In the core conflict zone, ISIL has transitioned from the large -scale production
of improvised explosive devices using self-made explosives, to producing fewer,
simpler and smaller devices. With respect to suicide bombers, Member States assess
that ISIL now only uses suicide vests as a last resort to avoid the unnecessary loss of
operatives. A Member State notes that this situation explains the m ultiple seizures of
unexploded suicide vests in operations. ISIL has more recently added the “Industry
Committee”, which focuses on new avenues for advancement, such as improvised
explosive devices and drones. One Member State reported that ETIM/TIP in the
Syrian Arab Republic was upgrading and developing weapons and equipment,

23-12695 21/23
S/2023/549

including drones. The group’s artillery and unmanned aerial vehicle units are now in
place.
104. Member States assess that AQAP has the capacity to develop improvised
explosive devices and non-conventional explosive devices for external operations,
using experienced explosive experts who train operatives within the group. In April,
AQAP used drones to target security forces in Shabwa Governorate. AQAP
capabilities are assessed to present a threat to the Government of Yemen and foreign
interests, including the impact on maritime trade in this strategic location. AQAP also
has unmanned aerial vehicles smuggled to them and delivered to Abyan Province. In
the past six months, AQAP has undertaken multiple operations using weaponized
drones.
105. In Africa, the use of improvised explosive devices is on the increase. In Somalia,
Al-Shabaab has intensified its use of improvised explosive devices and vehicle -borne
improvised explosive devices. The use by ISIL of drones in northern Iraq has
prompted the development of unmanned aerial vehicles by several Al-Qaida and ISIL-
affiliated groups, which benefit from the sharing of technology and training on their
use. In this regard, Al-Shabaab has recently conducted experimental trials in the use
of commercial mini and microunmanned aerial systems for offensive purposes.
106. In the Sahel, most of the weapons of ISGS originate from the black market or
are captured after attacks against security forces. ISGS also engages in the smuggling
of weapons and receives some of its weapons from abroad, mostly from facilitation
networks in southern Libya. Member States assess that groups in the Sahel also
benefit from weapons recovered from the Malian army following attacks on their
military bases and patrols. In West Africa, JNIM frequently uses improvised explosive
devices, and vehicle-borne improvised explosive devices, and its arsenal includes
machine guns, hand grenades, hand-held anti-tank weapons (including rocket-
propelled grenades) and mortars; however, storage and maintenance remain a
challenge for armed groups in the region.

V. Recommendations
107. The Monitoring Team notes that many list entries and narrative summaries
of the sanctions list are not current. The Monitoring Team recommends that the
Committee encourage Member States to provide updated information along with
supporting documentation to the list entries and narrative summaries and to
respond to annual review requests in a timely manner.
108. The Monitoring Team further recommends that the Committee encourage
Member States to propose new listings and amendments to ensure that the
sanctions list mitigates the threat of terrorism more effectively. The Monitoring
Team notes that proposing States sometimes do not have an adequate
understanding of the procedure and requirements, with adverse impact on listing
proposals. The Monitoring Team promotes best practices and is available to
assist Member States in preparing listing proposals, including through in-
country training and visits.

VI. Monitoring Team activities and feedback

109. In the thirty-first report, the Monitoring Team recommended that the Committee
give urgent attention to persistent problems with the automatic notification to
Member States of changes to the ISIL (Da’esh) and Al-Qaida sanctions list maintained
on the Committee’s website. The accurate and timely uploading of revisions to the

22/23 23-12695
 S/2023/549

list is essential in order to facilitate implementation by Member States of the sanctions

measures.
110. An interim Really Simple Syndications feed tool with limited functionality can
now be found on the main web page of the Security Council
(https://www.un.org/securitycouncil/). Given the critical importance of accurate and
timely changes to the website, the Monitoring Team will request updates from the
Department of Political and Peacebuilding Affairs and the Office of Information and
Communications Technology to be included in quarterly brie fings so that the
Committee may continue to monitor the situation.
111. The Monitoring Team engaged a wide range of Member States in the preparation
of the present report, including by receiving delegations in New York, conducting
country visits and participating in written exchanges. In May, the Team hosted its
largest ever regional meeting of intelligence and security services, with participation
at a very senior level. The dynamic discussions and conclusions from both plenary
and bilateral discussions over three days have significantly informed the report.
Several Member States proposed further expanding the participation in and increasing
the frequency of the meetings.
112. The Team continued to seek information relevant to its mandate and to expla in
and promote the sanctions regime through participation in meetings with relevant
international and regional organizations, members of the private sector and civil
society, as well as in partnership with the Office of Counter-Terrorism, the Counter-
Terrorism Committee Executive Directorate, the Security Council Committee
established pursuant to resolution 1373 (2001) concerning counter-terrorism, and
panels of experts supporting other Security Council committees.
113. The Monitoring Team welcomes feedback on the present report at
[email protected].

23-12695 23/23