Ransom, gold, and spoils of war: Islamic State Mozambique's new cash flow

✓ ACLED is the world’s most trusted source of conflict information >

Over the past eight years, Islamist insurgents in northern Mozambique’s Cabo Delgado province have proved to be resilient in the face of significant counter-insurgency operations. At their peak in 2021, they controlled the port town of Mocímboa da Praia and briefly occupied Palma, situated 80 kilometers to the north and home to a planned liquefied natural gas (LNG) project. In 2021, military intervention by forces from Rwanda and the Southern African Development Community (SADC) greatly denuded the group from its peak of up to 3,000 members, as estimated by SADC, to less than 300 today, according to the United Nations.¹ 

Yet Islamic State Mozambique (ISM) remains resilient. In 2025, it was active in all but one of Cabo Delgado’s 17 districts and undertook operations in neighboring Nampula and Niassa provinces. While the group has successfully remained in place and is adapting its tactics in response to intervention, a recent focus on raising revenue and other resources domestically suggests it sees a potentially expansionary future for itself. 

This report quantifies and describes how ISM raises funds domestically and maintains a supply of arms and ammunition to maintain its operations. It shows how, in 2025, ISM undertook measurable steps to arm itself and access new sources of finance through continued arms and equipment seizures, as well as ransom and extortion for cash. Significantly increased activity around artisanal gold mining sites suggests the group may also be trying to exert control over that sector. The findings point to the breadth of measures that need to be taken — including security sector reform, tightened finance and banking security, and better mineral resource management — for the Mozambican state and its security partners to block ISM’s access to resources. Whether this is part of a plan to strengthen the group and expand its influence, or represents a decline in external financing from the Islamic State (IS), is not yet clear.

Islamic State financing and Mozambique

IS’s financing model is based on local revenue-raising by individual provinces, with provision for some external financing through international IS networks.² To raise finance locally, larger provinces with effective territorial control can implement systems of taxation. IS West Africa Province, for example, has an annual income of over $190 million US dollars from three distinct forms of taxation, according to one report.³ As early as 2022, ISM had expressed a desire to implement systematic taxation, but without control of any significant territory, it has not been able to put this in place.

External financing for African provinces, particularly in the Democratic Republic of Congo and Mozambique, has come through the al-Karrar office managed by IS Somalia, with evidence for this since at least 2018.⁴ Findings of both the Bridgeway Foundation and the Security Council indicate that the funding ISM has received is neither significant in scale nor regular in frequency, and much less than that sent to the Central Africa Province in DRC. It is also unpredictable, particularly as it relies on trust-based hawala money transfer services, physical delivery of cash from South Africa and Tanzania, and international transfers through mobile money networks.⁵ 

External financing was likely essential in ISM’s early years, when it needed to support up to 3,000 militants. With a force now estimated at a 10th that size, there is greater scope for reliance on local sources of finance. Al-Karrar financing may have been affected by intensified operations against IS structures in Somalia by Puntland forces, with support from the United States and the United Arab Emirates, that started in early 2025. These factors may underlie the significant increase in ISM’s ransom and extortion activities, a sure source of cash, and increased mining-related activity (see graph below). 

Kidnapping, ransom, and extortion

Ransom and extortion for cash is now a significant feature of ISM’s activity. Prior to 2024, ransom and extortion were a minor part of the group’s activities. In the early years of the insurgency, ACLED records few events where people were kidnapped for ransom or there had been a clear case of extortion. That may mask other ad hoc cases of theft or extortion as fighters pass through settlements. It may also not cover all cases of abduction in rural communities. However, in such cases, those kidnapped are taken as temporary labor, forced recruits, or for the payment of very modest ransoms. By the end of 2025, it had become a significant feature in the data, quadrupling from its 2024 level, and accounting for around 10% of all ISM activity for the year (see graph below). Typical actions include using roadblocks to stop and detain people, vehicles, and goods on roads, as well as hijacking fishing boats and crews on the coast. Occasionally, individuals are kidnapped during attacks on villages and later released for ransom. 

Kidnapping for ransom at roadblocks is particularly lucrative. In one week in March 2025, ISM may have raised over $3,000 from kidnapping and extortion at roadblocks on the N380. These ransom amounts are very high, particularly in such a poor socioeconomic environment. However, reports from victims, sources in the area, and mainstream media are consistent. The amounts may not be unusual internationally either. In Burkina Faso in 2022, ransoms paid to Jama’at Nusrat al-Islam wal-Muslimin ranged from $500 for small traders to$22,000 for government officials.⁶ Such payments are, however, not a predictable source of income, and are typically raised in short campaigns after which security on particular stretches of road is enhanced. 

Ransoms are usually paid through one of the mobile money services operated by mobile networks such as Vodacom’s M-PESA, Movitel’s e-Mola, and Tmcel’s mKesh. Insurgents ask victims to transfer money to mobile money accounts likely controlled by ISM collaborators in urban areas. At the other end of the transactions, ISM collaborators need to withdraw ransom payments promptly, before victims can share the recipient number with the authorities. For such a system to work, ISM collaborators must be able to register new SIM cards and open mobile money accounts attached to them frequently enough to allow transfers to take place without being traced. This process likely involves fake identities and suggests that security practices in SIM card and mobile money account registration have broken down. 

Such actions also have a wider impact. First, the sums demanded, often equivalent to hundreds of dollars, are a considerable cost for victims and those in their family and personal networks who help them pay. Second, they greatly restrict the movement of goods that are vital to maintaining and rebuilding the province’s economy. Finally, they restrict the supply of humanitarian goods and services. For example, in August 2025, humanitarian support to Macomia, Quissanga, Muidumbe, Mocímboa da Praia, Meluco, and Metuge districts was suspended due to the risk of aid workers encountering ISM roadblocks.⁷ 

In 2024 and 2025, ransom and extortion were concentrated on the N380 highway. In 2025 alone, over one-third of all such ISM actions took place on this road, particularly on the stretch between Macomia town and Awasse village (see map below). Similarly, hijacking and kidnapping along the N380 spiked twice in 2025, with seven events recorded in March and 10 in August. ISM’s capacity to carry out such actions on that stretch of road is surprising, given that there are at least five military outposts along the N380 between Macomia town and Awasse village. However, ACLED research has shown how inaction by security forces stationed along this route leaves civilians at risk. It is also clear that the ineffectiveness of the security forces in this area allows ISM to raise considerable sums of money that presumably support its operations provincewide. 

The concentration of activity on the N380 is not only due to the documented failure of security measures along that route, but also the high rewards available from hijacking valuable vehicles carrying passengers with access to cash. In one incident in June 2025, ISM stopped at least one truck for which the group demanded a ransom of 250,000 Meticais ($4,000 at the time). At least 10 bus passengers were also stopped in the same incident and released after paying ransoms of up to $600 each, according to one victim.⁸ The amounts reported in that incident are consistent with reports from victims involved in other such incidents. In March 2025, an Islamic religious leader was among a number of bus passengers kidnapped at an ISM roadblock. He reported that he was released on payment of a $600 ransom, while non-Muslim captives had to pay five times as much. 

However, since August 2025, ACLED records just two such incidents on that road. This is likely due to a combination of more regular military escorts along the road, which business representatives demanded, and more risk-averse behavior by individuals and transporters. However, hijacking, kidnapping, and extortion have continued elsewhere in Cabo Delgado. This includes areas where ISM has an established presence, such as the Macomia coast, and areas where its presence is more sporadic and the security presence weaker, such as Meluco and Montepuez. 

Artisanal and small-scale mining

The mining and trade of gemstones and gold have long been assumed to be a source of funding for ISM, though evidence has been scarce. The first in-depth study of the insurgency, published in 2019, alleged links between insurgency leaders and figures involved in gemstone trading and mining from both Mozambique and the Great Lakes region.⁹ More recently, the Mozambican authorities claim that captured insurgents had both gold and gemstones in their possession, and that the group has raised approximately $30 million from ruby mining alone.¹⁰ That figure is likely significantly exaggerated. Nevertheless, ISM’s increased activity in mining areas indicates that it is becoming a more significant source of income. 

In Cabo Delgado, gold and gemstone mining is concentrated in the southern districts of Ancuabe, Meluco, Montepuez, and Balama. According to the Observatório do Meio Rural, the artisanal and small-scale mining sector employs up to 10,000 people as buyers, suppliers, transporters, or service providers. These unlicensed operations attract small investors and workers from across northern Mozambique and East Africa. Isolated mines in southern Cabo Delgado operate on the margins of state control, yet are connected to international markets through informal supply chains that feed formal and informal gold and gemstone markets.¹¹ 

Our analysis is restricted to events with mentions of known mine sites, interactions with miners, gold, and the principal gemstones of ruby and tourmaline. Such events have been primarily in Meluco and Montepuez districts, as well as in Ancuabe, although less so (see map below). Data indicate that the group’s presence in mining areas is becoming more pronounced, and that its importance to the group is growing. 

This increased presence comes as the gold price in particular has surged. Since January 2024, the price of gold on global markets has risen by over 60%. Given this increase, the isolation of mining sites, and the group’s more frequent visits to their locations, it is reasonable to hypothesize that they are looking to exert some control on the sector.

In Meluco district, over 55% of mining-related activity by ISM in 2025 was concentrated around Minhanha and Ravia villages. Minhanha village lies approximately 25 km north of Meluco district headquarters and has been a center for artisanal gemstone mining since at least 2011, with tourmaline being the principal gemstone resource.¹² There are also artisanal gold mines in the area. Ravia village lies about 30 km southwest of Meluco toward Montepuez. Like in Minhanha, there is a mixture of gold and tourmaline mines in the area. ISM was not active in Ravia prior to 2025. 

Yet despite ISM’s increased and concentrated activity around Minhanha and Ravia, in 2025, the group directly attacked mines in those areas on only three occasions. Information from local sources over the course of 2025 suggests that visits to mine sites around Minhanha by insurgents were more frequent. Sources referred to their presence at mine sites on four occasions between December 2024 and March 2025, though these were not confirmed at the time. A sustained presence around mine sites suggests efforts to control the sector, rather than to destroy it. 

The bulk of ISM’s remaining mining-related activity in 2025 has been in Montepuez district, with most of it happening in October. This followed the movement to Montepuez of a group of up to 100 fighters from Muidumbe district at the end of August. Here, the group’s intention to raise funds by exerting control over mining operations was made explicit. On 7 October, at the Ntola gold mine, ISM called a meeting of miners. According to a local source, they stated that they had come to stay but required daily contributions, presumably cash, and threatened to burn property if their demands were not met. They also said they wanted access to gold, according to the source. One week later, they launched one of their rare attacks on another gold mine in the area, destroying property and prompting a police guard on the mine to leave. 

A more regular presence of ISM insurgents at mine sites indicates a failure of the state to provide security. This failure may allow relations between ISM and artisanal miners to develop in a mutually beneficial way, as research by ACLED and GI-TOC has shown in Burkina Faso and Mali. If ISM can set a price for their protection that the artisanal and small-scale mining sector can absorb, and if the state remains absent in such areas, it may well allow for a sustained stream of income.

Because the price of gold has more than doubled on world markets over the past three years, ISM’s heightened interest in the sector is not surprising (see graph below). Mine-site prices are not immediately reactive to world prices: Research by the Observatório do Meio Rural indicates a seasonal pricing system set locally at approximately $33 per gram when gold is abundant and around $47 when scarce in late 2024, equivalent to roughly one-third of the world price at the time.¹³ 

How this translates into income for the group is not clear. There is some evidence of forced payments from miners, and no evidence to suggest that the group actively controls any mining operation. The Mozambican authorities claim that ISM militants have been found with gemstones and gold in their possession, suggesting the group may try to enter regional illicit markets.¹⁴ This, however, is likely occurring through local, not international, buyers, exploiting existing trade networks through Tanzania.¹⁵ According to the United Nations Security Council Analytical Support and Sanctions Monitoring Team, ISM raised up to $3,000 in one week in Meluco during the first half of 2025.¹⁶ However, accurately estimating income from this source is challenging. Payments in cash may be regular or seized in occasional attacks. Payments may sometimes be in kind for later sale. In all cases, seizure or exchange occurs in isolated areas and in intimate transactions.

Securing armaments

ISM arms itself through the seizure of weaponry and ammunition in clashes with state forces. This has been a continuing feature of ISM activity throughout the insurgency. Seizure of weapons increased significantly in the second half of 2021, likely in response to military intervention by Rwanda and the Southern African Development Community Mission in Mozambique (SAMIM) (see graph below). In the early months of their intervention, Rwanda and SAMIM targeted ISM bases, seizing large amounts of weaponry and other supplies. 

By the end of 2025, ISM weapons seizures had significantly surpassed the total for 2024 (see graph above). They had also become a much more significant feature of the group’s operations. In 2024, less than 2% of ISM operations involved the seizure of weapons. By the end of 2025, that share had almost doubled.

Images of seized weapons released through IS media channels give a good impression of the weaponry that ISM has in hand. The images are typically of small to medium-size machine guns, mortars, and rocket-propelled grenade launchers, with ammunition. Images of fighters, whether posed or in combat, depict them almost exclusively armed with weapons used by the Mozambican military. The exception is the occasional image of rifles seized from the Rwanda Defence Force in a May 2025 clash. 

The consistency of weapons seizures over the years raises questions about the apparent ease with which they are taken. President Daniel Chapo complained of some members of the Defense and Security Forces being willing to “sell out their homeland” and leak details of operations.¹⁷ Information that leads ISM to arms captures would likely command a high price for corrupt military personnel willing to sell it. The risk of operational information leaking has allegedly led to attempts to restrict information sharing within the armed forces. This, ironically, may make soldiers in the field more vulnerable if they are unclear about objectives and immediate plans.¹⁸ There are also organizational capacity issues, with orders reportedly shared erratically on different platforms, ranging from secure methods to popular messaging apps.¹⁹

Maintaining weaponry requires systems to control the supply, storage, and distribution of weapons. Fighters, too, need to be trained in their use. Seven years into the insurgency, the group has certainly developed an internal training capacity. The apparent lack of leakage of weapons out of ISM into, for example, the criminal community suggests effective control mechanisms. Continuing seizures can ensure a basic supply of ammunition. This may be relatively easy to supplement in a country that went through 15 years of civil war following an armed liberation struggle. 

Implications for countering ISM

In 2025, there was a notable increase in ISM’s domestic revenue-raising activities. ISM has significantly increased its activity around artisanal and small-scale mining sites, with documented attempts to raise revenue from the sector. Meanwhile, ISM’s seizure of FADM weaponry has continued, though with a noticeable increase in 2025. Analysis of these developments helps identify a wider set of issues that need to be addressed for counter-insurgency to be successful. They also contribute to our understanding of ISM itself, the extent of its support networks, and the sophistication of its administration. 

Civil authorities face the most wide-ranging challenges. At the core of financing is mobile money, overseen by the Bank of Mozambique. The ease with which ransom payments can be made through mobile money services points to the collapse of security measures related to registering accounts and overseeing transactions. Mozambique is not alone in this. There are considerable trade-offs in tightening controls on mobile money operations. Businesses across eastern and southern Africa, particularly small enterprises, rely on mobile money services for their operations. Placing greater controls on mobile money will directly impact liquidity in the local economy, affecting everything from remittances to humanitarian interventions. It is hard to see how effective controls on the use of mobile money for insurgent financing could be implemented without significant economic impact and extra costs for network operators.

Regarding informal gold and gemstone mining, measures to improve oversight of the artisanal mining sector that supports artisanal and small-scale miners are necessary. Recent attempts at extortion by ISM point to weak support and protection by the state from the threat ISM presents. 

For security forces, there is, of course, a pressing need to maintain security on Cabo Delgado’s main highways. They have demonstrated some success in regaining control of the N380 highway since August. However, extending this to commercial traffic in traditionally ill-served districts such as Meluco, Montepuez, and Balama will remain a challenge. Perhaps more fundamentally, corruption in the armed forces must be addressed. This will likely be a key issue for international partners involved in security sector reform, from Rwanda to the European Union. 

Finally, the findings have some implications for how we understand ISM. Increased cash flow, as well as continued and increasing re-armament, require well-articulated systems for managing assets and finances. According to the Financial Action Task Force, authorities have found evidence that the group has formalized systems for control of assets and cash flows.²⁰ We can assume that, for now, these are resilient. Any significant increase in assets or cash flow could trigger divisions or splits within the group, but there is no evidence of any such divisions. This indicates that mechanisms for controlling assets and managing cash flows are robust enough to secure the resources necessary to sustain both the leadership and the networks that generate the income. 

The findings do not explain why the group has decided to focus more on fundraising in 2025, but a significantly increased cash income indicates that the group has the potential to grow. Cash income allows ISM to attract new recruits and maintain them. It may also enable continued sourcing of arms through corrupt channels in the armed forces and the potential to buy-in specialized equipment, such as drones, or technical assistance, such as for the production of IEDs. However, this is only the case if other income streams remain the same. These include transfers from Somalia and income from small business operations in Mozambique.²¹ If such transfers have declined, increased local financing may simply be to replace them.

ISM remains a significant affiliate of IS — its actions account for over 11% of IS's violent activity globally in 2025. New income streams, whether they replace lost funding or present new opportunities, speak to the group’s resilience and indicate it will remain a challenge for governments in southern and eastern Africa for some years.