The Resilience and Internationalisation of ISIS Somalia

Summary

Despite being territorially and numerically limited in scope, ISIS Somalia has emerged as a key enabler within the global terror ecosystem and a successor to ISIS Central. It has systematically exploited illicit channels, complex terrains, maritime insecurity and socio-political fault lines to sustain its relevance, despite sustained counter-terror pressure and jihadist rivalries.

Introduction

ISIS Somalia has gradually expanded beyond the Puntland region and financed global terror attacks and operations through its al-Karrar Network (which oversees operations in Mozambique and the Democratic Republic of Congo, or DRC, as well) since the group’s inception in October 2015. The network itself was established in 2018. ISIS Somalia was formed as a faction from Harakat Al Shabaab Al Mujahidin, or al-Shabaab, an al-Qaeda affiliate, with 30 fighters. It later established itself as a prominent ISIS affiliate, embedding itself within the administrative and financial framework.

As a localised group with a transnational threat profile, it has consistently attracted foreign fighters, primarily from the Arab world, thereby amplifying its visibility.[1] While the semi-autonomous state of Puntland appears to be its primary base, it also has some operational cells based out of Mogadishu, Somalia’s capital.

Notably, its contribution to reportedly financing the suicide bombing at the Hamid Karzai International Airport in Kabul in August 2021 initially thrust it into the spotlight.[2] Considered one of the most reliable sources of revenue generation and distribution for the remnants of the central ISIS and its various affiliates, ISIS Somalia increased its monthly revenue from US$ 100,000 to US$ 360,000 between 2023 and 2024. By 2023, it had begun managing the monthly transfer of US$ 25,000 in cryptocurrency to the Islamic State in Khorasan Province (ISKP) in Afghanistan.[3]

This leads to a defining question: how did a localised violent extremist outfit become the central node within ISIS’s transnational ecosystem?

The Transnationalisation of a Localised Terror Affiliate

The Al-Karrar network, which is responsible for overseeing the transfer of funds between different actors within the ISIS ecosystem and the procurement of arms and ammunition, has been viewed by observers as the key driving force behind Africa emerging as the primary ISIS logistical hub. This demonstrates an operational shift from its traditional bastions in West Asia, primarily Syria and Iraq.

After all, by December 2025, this network had built the capacity to transfer tens of thousands of US dollars monthly to various organisational members operating across different geographical regions.[4] The group sustained its terror financing momentum by generating approximately six million US dollars over a span of two years, despite sustained pressure from ideological rivals, state authorities and their international partners.[5] This strategy aligns with one of ISIS’s central doctrinal objectives of Bāqiyah wa Tatamaddad, or Remaining and Expanding.

One of the prominent ISIS Somalia leaders, Bilal al-Sudani, who was neutralised in an American strike in 2023, was instrumental in cultivating terror financing networks in South Africa before he was eliminated. Notably, South Africa has been developed as an informal ISIS hub to redistribute financial capital to Uganda, Kenya and Tanzania, thereby expanding and sustaining ISIS’s reach. Some analysts have claimed that ISIS members have also used Tinder for terror financing operations, using fake profiles and photographs of lesser-known South African celebrities.[6] This has expanded the group’s use of unconventional illicit financing avenues.

However, it is important to recall that, despite diversification of terror financing avenues, hawala has remained one of the most sought-after and accessible means of raising and distributing illicit finances. Approximately US$ 325 billion is reported to have been transferred internationally (illicit and genuine remittances) using hawala networks.[7] Its dual-use nature has made it increasingly challenging for authorities to regulate this mode of monetary exchange, thereby creating an environment conducive to non-state actors evading scrutiny and financing extremist operations.

Moreover, recent reports about the dismantling of a cell associated with ISIS Somalia, with its operational zone ranging from Spain to Morocco in March 2026, point towards ISIS Somalia becoming transnational in its approach, inciting individuals to commit deadly attacks, especially in the wake of the latest phase of the Gaza conflict. Such an assessment must be contextualised within the perspective introduced by experts such as Lucas Webber.

Webber had recently argued that:

…the March 2026 Morocco-Spain cell could be read as part of the broader architecture through which IS-S content circulates into diaspora communities, sympathisers seek to move towards active combat zones, and intermediaries help connect would-be recruits to Islamic State nodes abroad, including in Somalia.[8]

Following the organisational defeat of ISIS Central, it has consolidated itself as one of the key cogs in the broader ISIS ecosystem. Notably, its resilience must be contextualised within Puntland’s geographical framework, which has facilitated its endurance for over a decade.

The ‘Power’ of Geography

According to the United Nations Security Council’s Thirty-seventh report of the Analytical Support and Sanctions Monitoring Team, submitted pursuant to Resolution 2734 (2024) concerning ISIL (Da’esh), Al-Qaida, and associated individuals and entities, released in February 2026, resilience is not always equivalent to organisational strength or the capacity to execute large-scale attacks. The report notes

Notwithstanding the recent reduction in threat due to counter-terrorism operations, ISIL (Da’esh) in Somalia retained significant capacity for resilience, operating highly mobile cells to avoid territorial collapse. The group relied on deep sanctuaries, caves, and smuggling routes to persist under pressure, with the mountainous terrain of Cal Miskaat and its proximity to coastal routes enabling fighters to evade detection and regroup easily.

ISIL (Da’esh) in Somalia continued to raise funds from their businesses; however, the ports of Bosaso, Qandala, and Ba’ad had become so heavily securitised that they were no longer able to collect revenue from those areas. Access to residual funds sustained the group despite its current operational challenges.[9]

Resultantly, what makes this affiliate significant within the ISIS ecosystem is that it has been able to mitigate its constraints in terms of its physical capacity to challenge Puntland’s forces and al-Shabaab, despite being geographically limited to its base in the Cal Miskaat mountains, a 2,000-metre-tall range east of the Gulf of Aden, and carrying out limited terror strikes. Furthermore, what has aided its endurance is the complex, mountainous terrain, which allows its fighters to fall back and consistently regroup.

As part of its investigation into ISIS Somalia’s stronghold, Sky News highlighted some of the fundamental challenges security forces face in neutralising the threat posed by the terror affiliate, beginning from the base of the Cal Miskaad range, the violent extremist stronghold:

There are no roads, only occasional dirt tracks, and they often make their way along dry riverbeds. The vehicles often break down, and they inch along, with an advance team of deminers walking ahead of the convoy, sweeping the tracks for bombs buried by militants and booby traps hidden in coarse bushes. Soldiers use camels or donkeys to carry weapons and equipment – and ferry out the dead and injured.[10]

This is as the group seeks to use this geographical advantage to regroup, replenish its organisational strength, which, as per the United Nations, currently stands somewhere between 200 and 300, and launch targeted attacks.[11] It is entirely probable that these extremists, who would have gained battlefield and weapon-handling experience operating under fringe or mainstream militant movements within other conflict zones, could now be applying these to destabilising Puntland.

However, there are some conflicting figures reported by international media outlets. It has been claimed that ISIS Somalia’s organisational strength had expanded to 1,000 by February 2026, marking a surge from 200–300 fighters it reportedly had recruited by 2016.[12] What is concerning is that today, there appears to be an absence of scope to devote greater resources for HUMINT and digital surveillance to launch simultaneous air, land and sea operations, in consultation with local security forces, to draw the terrorists out from their strongholds and into areas that would place counter-terror strategists and armed personnel on a more advantageous plane.

While geography has enabled the group’s survival, alone it is insufficient to explain its continued relevance and sustained threat profile.

ISIS Somalia’s Enduring Threat

The group’s relevance is largely attributed to its logistical efficiency, which has allowed it to expand its control over the internal affairs of ISIS affiliates in DRC and Mozambique, as well as operate as the primary financial intermediary between global ISIS affiliates and ISIS Central. Additionally, while the geography of a region shapes a state and non-state actor’s military strategies, other considerations have an equally important impact.

For example, one of the key vulnerabilities confronting local security forces is mounting resource constraints.[13] Counter-terror campaigns lack sufficient budget allocation to bolster military readiness and training to address guerrilla-style security threats. It appears that, given al-Shabaab’s visibility as a prominent security threat, countering the threat posed by ISIS Somalia has been relegated to a secondary concern, especially for the federal government. Simultaneously, the federal leadership has struggled to combat such localised threats due to repeated, devastating attacks by al-Shabaab at regular intervals, targeting law enforcement agencies, civilians and key infrastructural buildings in the heart of Somalia’s capital.

Furthermore, clan-based loyalties play a fundamental role in several African societies, including Somalia. ISIS Somalia has frequently tapped into this strategic advantage to sustain its smuggling networks and generate revenue, even amid sustained counter-terror pressure. One of the parallel tracks adopted by the terror affiliate has been to unlawfully mine and export gold and charcoal from the coastal Bari region in Puntland. As per revelations made by Mohamed Abdirahman Farole, Puntland’s Minister of Environment and Climate Change, “ISIS employed protection schemes, unlawful gold extraction, and charcoal trafficking to accumulate no less than $10 million monthly.”[14]

This reflects a case of widening state incapacity, structural fragility, and law-and-order deficit.

Such figures signal a disproportionality in the government’s capacity to crack down on illicit revenue flows. What further strains the security landscape is that ISIS Somalia has, despite repeated raids or military campaigns, sustained and expanded its illicit financial channels to include money laundering, piracy, illegal fishing and online fundraising.

This indicates that hard-power measures to curb terror financing have yielded only limited results. Despite the US$ 10 million reward announced by the United States Department of Justice for information leading to the disruption of al-Karrar’s terror financing operations, such incentives have had limited success.[15] This is because they have a limited impact on a population that has refused to cooperate due to fear or clan and tribal loyalties that outweigh financial incentives.

Despite the United States launching raids in January 2023 to disrupt its financial network, ISIS Somalia has continued rebuilding its revenue pathways, potentially reverting to its prior strategies of revenue generation through extortion, and thereby posing an enduring threat under the leadership of its Emir, Abdulqadir Mumin, who has consistently evaded capture.[16] Under Mumin, ISIS Somalia has also expanded its focus to exploit the absence of regulations to monitor activities on cryptocurrency platforms and crack down on illicit financial activities.

Mumin’s strategic leadership must also be viewed as a critical factor reinforcing ISIS’s organisational sustenance. Arguably, he has also been at the forefront of deploying decentralised guerrilla sub-groups that use their mobility to navigate across the Cal Miskaad mountains, making their surveillance and neutralisation a challenging prospect.

Its resilience, despite territorial setbacks and limited organisational strength and media presence vis-à-vis al-Shabaab, therefore requires renewed attention. Al-Shabaab, despite inflicting widespread devastation against symbols of state authority, including key ministries and intersections, as well as launching attacks against civilian targets, has remained largely constrained to East Africa in its scope. However, ISIS Somalia has not only been able to stage targeted attacks within an already fragile security landscape. Still, it has also externalised its operations by providing material, financial and logistical support on a transnational basis.

This process has continued despite the heavy losses it has sustained against Puntland’s forces under Operation Hilaac since November 2024, as well as military strikes carried out by the US in support of Mogadishu. Reportedly, the US carried out nearly 60 counter-terror strikes on ISIS Somalia hideouts last year.[17]

As per official claims, the territorial control previously exercised by the outfit has been considerably reduced, with forces allegedly ‘reclaiming much of the territory previously held by the group in the Calmiskaad mountains’ due to coordinated efforts by American and Puntland forces.[18] However, as observed with the enduring threat posed by ISIS, territorial losses or reductions in numerical strength cannot be equated with the absence of threat at either a macro or micro level. Therefore, Somalia’s fragmented landscape, which first emerged with the onset of the civil war in the 1980s, has further unravelled due to persisting sectarian tensions, the absence of national cohesion, an ineffective federal government, and rising fatalities and infrastructural damage caused by competing Islamist groups vying for power.

In addition to exploiting governance deficits and the absence of stringent regulatory mechanisms to curb illicit financial flows, ISIS Somalia has the potential to tap into the digital domain, like its parent organisation, to ensure its continued relevance. One of the emerging trends within the ISIS ecosystem that ISIS Somalia and the broader al-Karrar network could exploit is reducing dependence on the embedded privacy features of encrypted platforms such as Telegram for coordination, recruitment and radicalisation activities. This is especially relevant given the growing global recognition of the need to leverage technological advancements to bolster counter-terror campaigns, requiring states to move beyond conventional security doctrines.

ISIS supporters have increasingly circulated a manual titled Ghost Protocol on less regulated encrypted chat platforms such as Rocket Chat, encouraging extremists to prepare for the possibility of Telegram coordinating with law enforcement and state authorities.[19] Key guidelines include bypassing SIM-linked mobile devices that can be traced using GPS and cellular towers, as well as disguising activity on Telegram by using anonymous network servers that obscure identifying markers related to identity, routine, or location. These developments underscore the growing need to reassess what constitutes success in counter-terror operations and how the threat posed by decentralised terror outfits should be evaluated moving forward.

Conclusion

Despite sustained counter-terror pressure imposed by local security forces and their international allies, such as the United States, kinetic strategies have proved insufficient against the natural deterrent posed by Puntland’s mountainous terrain. Therefore, a renewed counter-terror campaign must encompass coordinated intelligence-sharing mechanisms on the movement of foreign fighters, along with a simultaneous, sustained crackdown on illicit financial flows and maritime security threats.

At the same time, the threat posed by the al-Karrar network must be incorporated into the revamped counter-violent extremism and counter-terror financing strategies of countries worldwide. This is because ISIS Somalia is not a Somali or an African problem alone. Finally, there is a growing need for countries, including India, to take note of the concerning developments in Puntland. The nexus of foreign fighters, complex geographical terrain, terror financing, piracy and illicit fishing cumulatively creates a reinforcing network of threats that has the potential to undermine the security of nations from the Horn of Africa to the Indian Ocean Region.

Views expressed are of the author and do not necessarily reflect the views of the Manohar Parrikar IDSA or of the Government of India.

[1] Kathryn Tyson, “The Islamic State in Somalia’s Area of Operations”, Critical Threats, 11 June 2025.

[2] Eric Schmitt, “Ties to Kabul Bombing Put ISIS Leader in Somalia in U.S. Cross Hairs”, The New York Times, 4 February 2023.

[3] Caleb Weiss and Lucas Webber, “Islamic State-Somalia: A Growing Global Terror Concern”, CTC Sentinel, Vol. 17, No. 8, 2024, pp. 12–21.[4] “ISIS-Somalia Leader Mumin Remains at Large in Bari Despite U.S.–Puntland Campaign”, Hiraan Online, 2 December 2025.

[5] “ISIS Somalia Branch Funds Operations with Gold Exports, Amassing Up to $6 Million”, Garowe Online, 12 September 2024.

[6] “ISIS Funding Terrorism with Tinder Scams”, Homeland Security Today, 14 November 2022.

[7] Adam Rousselle, “Combating Islamic State Finance: Somalia and the Pan-African Nexus”, Insights, Global Network on Extremism & Technology, 17 February 2025.

[8] Lucas Webber, “New Spain-Morocco Plot Signals Islamic State Somalia’s Internationalization and Threat to the West”, Militant Wire, 26 March 2026.

[9] “United Nations Security Council’s Thirty-seventh report of the Analytical Support and Sanctions Monitoring Team, submitted pursuant to resolution 2734 (2024) concerning ISIL (Da’esh), Al-Qaida, and associated individuals and entities”, Report, United Nations Security Council, 4 February 2026.

[10] Alex Crawford, “A Warning from Africa: Hunting for ISIS”, Sky News, 23 February 2026.

[11] Ibid.

[12] Ido Levy, “How the Small Autonomous Region of Puntland Found Success in Battling Islamic State in Somalia”, The Conversation, 7 April 2025.

[13] “U.S. Airstrike Targets ISIS Militants in Somalia’s Puntland Region”, Updates, African Security Analysis, 9 July 2025.

[14] “Puntland Official Reveals ISIS Profited $10 Million From Illicit Trade”, Facility for Talo and Leadership, 18 December 2025.

[15] “ISIS-Somalia Financial Disruption”, United States Department of Justice.

[16] “The Islamic State in Somalia: Responding to an Evolving Threat”, Briefing, International Crisis Group, 12 September 2024.

[17] Sahnun Ahmed and Scarlett Barter, “‘We Will Go Wherever They Hide’: Rooting Out IS in Somalia”, BBC News, 16 March 2026.

[18] “Somalia: U.S. Carries Out Air Strike Against ISIS Fighters in Puntland”, allAfrica, 19 March 2026.

[19] Muskan Sangwan, “Operation Ghost Protocol: Infrastructure-Level Evasion in Islamic State Supporter Ecosystem”, Insights, Global Network on Extremism & Technology, 30 March 2026.