There are three major sources of western weapons that a group like ISIS might exploit.
- Captured weapons. The U.S. equipped the Iraqi military with many weapons and ISIS has captured large caches of such weapons, such as at Mosul. Additionally, Saddam Hussein and the Assad regime had/have massive caches of small arms which have fallen into ISIS' hands.
- Corruption. While it would be difficult for weapons to be passed directly from a Western country to ISIS, many countries in the region possess western arms, and all it takes is an officer in charge to look the other way for something to disappear.
- State sponsorship. While no one likes ISIS, at least Turkey and Saudi Arabia have made it clear that their number one concern is actually the Assad regime. It is not inconceivable that they have supplied weapons to ISIS, at least indirectly.
It cannot be overstated how much the entire area is awash in weaponry, though. As mentioned before, Saddam Hussein and the Assads acquired staggering amounts of small arms which have since been dispersed. Larger weapons, such as Stinger missiles, don't seem to show up much. Put simply, even 15 years ago there was enough weaponry in the area to fight a very long war (see the U.S. attempt from 2003 to 2011).
Additionally, it is not the case that weapons are hard to make. By way of example, the M2 .50cal Machine gun was designed during WWI and is still in use today. The AK-47 was designed to be produced with only a metal stamp, which do exist in Iraq and Syria. Most semi-automatic and automatic weapons use mechanisms that were designed before heavier than air flight!
It is not likely ISIS is producing weapons, mostly because they already have plenty, but they could. Furthermore, there are plenty of metal shops and milling machines available in both Iraq and Syria.
As backwards Iraq and Syria might be, they are still more advanced than the world was when belt-fed machine guns, assault weapons and other small arms were being produced for WWI and WWII.
The bottom line is arms control is not going to solve the ISIS problem. The only regime that could possibly regulate the arms of the area sufficiently would first have to control the political space ISIS occupies, and that would have already solved the problem.