Terror Finance Weekly

“Sunlight is the best disinfectant.”

Welcome back.

Today marks two years since the Israeli pager operation, the opening move in a month that changed Hezbollah. Within weeks, the organization lost its leader, Hassan Nasrallah, much of its senior command, and a large share of the arsenal it had spent years rebuilding. Taken together, this was a remarkable run of kinetic achievements.

At CENTEF we have been working the other front. Our analysts modeled Hezbollah the way an equity analyst models a company, line by line, using unit costs, procurement volumes, and open-source intelligence. The first report in the series covers weapons and munitions procurement for fiscal year 2024, from Katyusha rockets and Kornet launchers and missiles, to drones, launch platforms, and pickup trucks.

Further reports in the series will cover the rest of the balance sheet.

If you would like a briefing or an early look at the report, reply to this email.

CENTEF will lead the Terror Financing panel and round-table sessions at ICT’s World Summit 2026, in Herzliya on 5 to 8 October 2026. Additional details on topics and participants will be published in upcoming editions.

Sharon Gal

Chief Executive Officer, CENTEF

 

The Houthis Have Weaponized Maritime Logistics

CENTEF ANALYSIS  ·  7 to 13 September 2026

The global economic landscape faces a new, engineered shock this week.

The Yemen-based Houthis have captured territory bordering the Bab el-Mandeb Strait, effectively granting the Iran-backed militants control over the vital shipping corridor connecting the Red Sea to the Indian Ocean.

This takeover matters immensely because it transforms a critical maritime chokepoint, one that historically handles roughly 12 percent of global trade, into an active conflict zone. The act was generated by Iran, the world’s largest state sponsor of terrorism, and perpetrated by Tehran’s proxy, the Houthis, an internationally designated terrorist organization. The takeover forces commercial fleets and oil tankers to abandon the route and divert thousands of miles around Africa’s Cape of Good Hope. The Houthis have successfully weaponized maritime logistics.

This calculated maneuver skyrockets war-risk insurance premiums, breaks just-in-time supply chains, and threatens to push crude oil prices back above $100 a barrel. It serves as a massive, artificial tax on the global economy, designed to counter Western pressure on terrorists and their supporters.

The territorial grab is occurring as the U.S. Treasury rapidly escalates Operation Economic Outcast. Last week, OFAC effectively grounded Iran’s active aviation sector, heavily targeting airlines like Mahan Air and their international service providers, which the regime relies on to physically smuggle weapons, people (terrorists and advisors), cash, gold and technical means to its terrorist proxy groups. Treasury concurrently eliminated key trade loopholes by indefinitely suspending critical Iran-related general licenses and implemented aggressive civil penalties to punish sanctions evasion. Parallel to these aviation and trade crackdowns, the campaign targeted the financial architecture of what the Iranians coined as "Axis of Resistance", practicaly Teheran's Middle Eastern terrorist proxy network, designating leadership within Iraq-based Kata’ib Hizballah, and exposing their systematic siphoning of the Iraqi state budget to fund Iranian terror operations. Both actions are covered below.

To effectively counter the Houthi stranglehold on international maritime trade, the financial disruption campaign must now zero in on the militants’ localized revenue streams and extortion networks. Moving forward, the U.S. and its allies may seek to implement aggressive secondary sanctions targeting the regional front companies, hawala networks, international exchange houses, and crypto exchanges and wallets that convert Houthi taxation of the Yemeni populance and the support of international humanitarian organizations into hard currency for the terror organization.

Completely cutting off their access to regional and global financial infrastructures, while actively penalizing any maritime or insurance providers that attempt to comply with Houthi transit demands, is essential to degrading their capacity to hold global trade hostage.

ALSO THIS WEEK

OFAC Grounds Iran’s Aviation Sector

U.S. TREASURY / OFAC  ·  September 8, 2026

OFAC effectively grounded Iran’s active aviation sector, targeting carriers including Mahan Air alongside the international service providers that keep them flying. Treasury described the sector as a channel the regime relies on to physically move weapons and cash to proxy groups. The same tranche eliminated trade loopholes by indefinitely suspending critical Iran-related general licenses and imposed civil penalties for sanctions evasion.

Aviation is one of the few illicit logistics channels that cannot simply be re-routed onto a different rail. An aircraft needs fuel, insurance, ground handling, spare parts and overflight permissions, and each of those comes from a company with a name, an address and a jurisdiction. That is why the service providers were named alongside the airlines. The measure of this action will not be the designations themselves but whether third-country handlers and lessors actually withdraw, or whether the work migrates to operators with no exposure to the U.S. financial system.

 

Kata’ib Hizballah Leadership Designated Over Iraqi Budget Siphoning

U.S. TREASURY / OFAC  ·  September 10, 2026

Treasury designated leadership within Kata’ib Hizballah, an organization designated since 2009, and set out what it describes as the group’s systematic siphoning of the Iraqi state budget to fund Iranian terror operations. The action targets the financial architecture of the broader Axis of Resistance rather than a single transaction chain.

This one reaches somewhere sanctions usually cannot. The money is not moving through a correspondent bank that can be cut off; it is public revenue captured through contracts, ministries and payroll before it ever enters an international payment system. Designation can name the individuals and freeze what sits in reach, but the flow itself runs on Iraqi state machinery, and stopping it depends on Baghdad. The complication is that the networks doing the siphoning hold positions inside the institutions that would have to act.

 

OFAC Targets “Xinbi Guarantee” Cyber Scam Network

U.S. TREASURY / OFAC  ·  September 9, 2026

The Treasury sanctioned Xinbi Guarantee, a Chinese-language Telegram marketplace and escrow service that acts as the financial backbone for Southeast Asian cyber scam compounds. Blockchain analytics firms estimate the platform has processed over $24 billion in digital assets and FIAT since 2022. Its illicit escrow infrastructure was used not only by scam centers exploiting vulnerable Americans, but reportedly also by North Korean state-backed hackers moving tens of millions of dollars from major cryptocurrency exchange thefts. The designation was executed alongside immediate law enforcement disruption: the U.S. Secret Service and the DOJ’s Scam Center Strike Force traced and froze over $50 million in USDT held across multiple TRON wallet addresses linked to Xinbi, crippling the syndicate’s operational liquidity in a single day.

An Escrow mechanism is what makes an anonymous criminal marketplace function at all, because it generates trust between two parties that have no reason to trust each other, and thus allows to complete the illicit trade between them. Going after the escrow rather than the sellers attacks the mechanism of trust – the infrastructure required in order to complete such illicit transactions – instead of the participants, which is the more durable target. The freeze on the same day is the part worth noting: forensics and legal authority moved at the same speed for once, rather than the assets clearing three hops before the paperwork arrived. That speed depended on the funds sitting in USDT, whose issuer (Tether) can destroy tokens and replace them centrally on request. The same operation against assets with no centralized incorporated issuer utilizing administrative smart contract backdoors, would have been orders of magnitude more difficult.

About this brief. Terror Finance Weekly is compiled by CENTEF from open-source reporting and primary government releases for research and situational-awareness purposes. Items reflect developments published between September 7 and 13, 2026. Allegations described in designation notices are the issuing authority’s findings and carry a presumption of innocence unless proven in court. Reporting is attributed to the outlets named; the judgments drawn from it are CENTEF’s own. Headlines link to source material where available.