A bearded and bedraggled Kjartan Sekkingstad was released Saturday on a remote southern island after what analysts said was almost certainly a payment in the thousands of dollars after the Abu Sayyaf demanded millions.
The Philippine and Norwegian governments have denied paying ransom for the release of Sekkingstad, while highlighting their efforts to secure his freedom after the kidnappers had beheaded two of his fellow hostages, both Canadian.
Security analysts said the Abu Sayyaf would never release a hostage without ransom.
"There was a ransom payment negotiated by intermediaries of the family with diplomatic help. My information is 30 million pesos [$625,000, ed.] was paid," said Rodolfo Mendoza, senior analyst of Manila based Philippine Institute for Peace, Violence and Terrorism Research.
"Hostage-taking is the Abu Sayyaf's fund-raising activity," Mendoza, a former police general, told AFP.
Sekkingstad's brother Odd Kåre Sekkingstad declined to comment when asked by AFP about reports of a ransom.
His sibling was abducted by the Abu Sayyaf from a tourist resort in September 2015, alongside a Filipina who has been freed, and the two Canadians who were beheaded in April and June.
Philippine authorities have said the Norwegian was freed due to a military offensive which President Rodrigo Duterte ordered against the militants, and with the help of a separate Muslim rebel group holding peace talks with the government.
Duterte himself had said last month that 50 million pesos ($1 million) had been paid for Sekkingstad's release.
"The Norwegian, that's already paid," Duterte told reporters.
"I don't know [where the money came from], maybe my bank," he said in jest when asked who paid the ransom.
Zachary Abuza, a Southeast Asian security expert at the National War College in the United States, told AFP there was no doubt ransom was paid.
"The [Abu Sayyaf] did not release him out of the goodness of their hearts... governments have to deny paying ransoms, as it incentivises more hostage-taking. But often governments will use third parties."
The payment would allow Abu Sayyaf to buy more guns through the black market, Abuza added.
The Abu Sayyaf, blamed for the nation's worst terror attacks, is a loose network of militants formed in the 1990s with seed money from Osama bin Laden's Al-Qaeda network.
Based in remote Muslim-populated southern islands of the mainly Catholic Philippines and listed by the US as a terrorist organisation, some of its leaders have since pledged allegiance to the Islamic State group.
In 2014 the Abu Sayyaf boasted of receiving 250 million pesos for two German hostages it freed after six months in captivity.
In 2013 the militants also released an Australian ex-soldier after holding him for 15 months, with a local politician who acted as a negotiator saying ransom was paid.