Cyberattacks have long been an integral part of the global threat landscape, posing a persistent threat to government institutions and the private sector globally. The motivations and tactics, techniques, and procedures (TTPs) employed by cyber threat actors continue to evolve rapidly, challenging cybersecurity professionals and threat intelligence analysts and requiring constant adaptation of cybersecurity measures.
Recent assessments by the European Union Agency for Cybersecurity (ENISA) (p.4) and cybersecurity firm Mandiant point to a notable intensification of cyber-related incidents since 2022 (p.6). More importantly, this trend is reflected not only in the growing volume of cyberattacks but also in their increasing sophistication, including more advanced malware and the broader use of AI technologies. A significant portion of these assessments attribute this development, at least in part, to ongoing geopolitical conflicts (p.10), particularly the Russo-Ukrainian war and the Hamas-led attack on Israel on 7 October 2023 and the subsequent developments in the Middle East. These dynamics have also been accompanied by a significant expansion of politically motivated hacktivism. Campaign-style hacktivist operations such as #OpUSA, #OpFrance, or #OpIsrael have shown how hacktivism can evolve from isolated cyberattacks into more organised, coordinated campaigns, while the boundaries between state and non-state cyber actors have become increasingly blurred.
Amid these developments, this Insight examines the extent to which the Islamic State in Iraq and al-Sham (ISIS) has developed the intent and capability to conduct offensive cyber operations. It also assesses the evolution of ISIS-linked cyber activity, the role of cyber capabilities within the organisation’s broader strategic priorities, and the potential impact of emerging technologies on the cyber threat posed by ISIS and its supporters.
Early Pro-ISIS Hacktivism
ISIS gained global prominence in June 2014 after declaring its caliphate across captured territories in Iraq and Syria. What hit the headlines, however, was not only the group’s rapid territorial expansion but also its sophisticated use of modern technology and digital space. While most of its online activities focused on recruitment, propaganda, and fundraising, some cases involved cyber operations conducted under the ISIS banner.
Within a few months of the official declaration of ISIS, reporting already indicated cyber activity by ISIS-affiliated groups. In November 2014, the citizen journalist group Raqqa Is Being Slaughtered Silently (RBSS), known for its criticism of ISIS, reported that it had become the victim of a cyberattack involving custom malware. According to Citizen Lab, the incident could potentially be attributed to pro-ISIS hackers based on “circumstantial evidence,” although the involvement of other actors could not be ruled out. No one was officially identified as responsible for the malware attack against RBSS.
ISIS’s early offensive cyber capabilities were associated largely with the emergence of several prominent pro-ISIS cyber actors, particularly the British hacker Junaid Hussain, also known as Abu Hussain Al-Britani. A former member of the hacktivist group TeaMp0isoN, Hussain later joined ISIS in Syria, where he acted as a recruiter, propagandist, and coordinator, seeking to attract technically skilled supporters. Hussain was also associated with the pro-ISIS Islamic State Hacking Division (ISHD), a decentralised unofficial collective of hackers sympathetic to ISIS that emerged in early 2015, and was described in some reports (p.5) as ISHD’s leader. However, it remains unclear how many cyberattacks, if any, Hussain personally conducted while in Syria, as he became known mainly for leveraging others’ technical expertise. The best-known example of this collaboration was his work with Kosovo-born hacker Ardit Ferizi, who compromised a US company’s database and extracted personal information belonging to approximately 1,300 US government and military personnel. Ferizi transferred the data to Hussain, who subsequently published it on X (formerly known as Twitter) as one of the ISHD’s most widely publicised “kill lists,” which called on ISIS supporters to target the individuals identified.
ISHD was not the only group bringing together hackers sympathetic to ISIS. By 2015, several other pro-ISIS hacktivist collectives had emerged, including the Caliphate Cyber Army (CCA) and the Islamic Cyber Army (ICA). While these groups pledged allegiance to or expressed support for ISIS, their operational ties to its leadership were never firmly established. Attribution remained challenging, as hacktivists frequently conceal their identities, affiliations, and sources of external support. The 2015 cyberattack against the French television network TV5Monde illustrates these attribution challenges well; although the attack was initially claimed by the Cyber Caliphate in the name of ISIS, subsequent investigations and public reporting stated that it may instead have been carried out by actors linked to the Russian government.
Despite these uncertainties, early pro-ISIS hacktivist collectives remained broadly similar in their activities. They maintained an active presence across cyber forums and social media, engaging primarily in publishing “kill lists,” defacement of Western government, media, and commercial websites, social media account hijackings, including accounts belonging to government and military entities, as well as recruitment, propaganda dissemination, and coordinating cyber activities among supporters. Government, academic, and independent cyber threat assessments then indicated that many of these operations relied on publicly available information rather than sophisticated cyber intrusions, with no confirmed evidence that these groups possessed the capability to conduct large-scale offensive cyber operations or attacks against critical infrastructure. In 2017, Lora Shiao, a former director of intelligence at the US National Counterterrorism Center, assessed ISIS’s hacking skills as “minimal,” arguing that the primary motivation of pro-ISIS hackers was intimidation.
Likely in an attempt to coordinate efforts and expand cyber campaigns against ISIS’s adversaries, several pro-ISIS hacktivist groups merged in April 2016 to form the United Cyber Caliphate (UCC), which soon became one of the most prominent pro-ISIS hacktivist collectives. Although the group appears to have remained active until 2019, its activities (p.18) continued to focus largely on relatively simple attacks which intended to maximise publicity and psychological impact rather than cause significant operational damage.
Following the apparent and unexplained decline of the UCC, attempts to maintain pro-ISIS hacktivist activity continued through the successor group Caliphate Cyber Shield (CCS), whose last reported activity appears to have occurred in April 2021 (p.18). Like its predecessors, CCS primarily claimed responsibility for defacing websites, hijacking social media accounts, and disseminating propaganda, while publishing summaries of its alleged cyber operations (p.18) emergence of CCS therefore did not represent a qualitative evolution of pro-ISIS cyber capabilities, but rather a continuation of the operational patterns demonstrated by earlier pro-ISIS hacktivist collectives.
A New Wave of Cyber Threats: Reassessing ISIS’s Cyber Role
By the early 2020s, ISIS no longer controlled the same extent of territory and resources in Iraq and Syria as it had during the first years of its existence, and had largely shifted towards an insurgent model. This context is relevant when assessing its potential to develop a more substantial offensive cyber capability, particularly given the specialised technical expertise and organisational coordination such activity would require.
This does not mean, however, that ISIS supporters have stopped attempting to develop technical expertise or carry out cyberattacks. For example, in November 2022, a message posted in a pro-ISIS social media channel stated that hacktivists from the reportedly ISIS-affiliated group Lebanese Cyber Warriors allegedly targeted a Lebanese pro-Hezbollah website in a cyberattack. Additionally, other ISIS sympathisers have been occasionally observed on encrypted messaging platforms either discussing the need to wage a “cyber jihad” against infidels or explicitly calling for cyberattacks.
In parallel, in January 2024, the US Department of the Treasury designated two ISIS-affiliated cybersecurity experts for providing cybersecurity training and technical support to ISIS leadership and supporters at the time. These cases indicate that while ISIS retains access to skilled technical talent, this does not necessarily point to an organised cyber warfare unit. Rather, this suggests a model in which technical capabilities remain concentrated among a limited number of individuals, as they were at the group’s peak.
Attempts to provide an ideological justification for offensive cyber operations have also appeared in some ISIS-affiliated propaganda outputs, although the so-called “cyber jihad” generally does not appear to constitute a major focus of ISIS official and unofficial media. In its prominent magazine Voice of Khurasan, the Al-Azaim Foundation, a primary media and propaganda arm of the Islamic State’s Khorasan Province (ISKP), has touched upon this topic on several occasions. Through the magazine’s digital bulletin Light of Darkness published in July 2023, ISKP argued that Muslims “can master” browsers, computers and operating systems, seeking to promote the use of modern technologies in Islam. Moreover, ISKP attempted to convey that the use of modern technologies is consistent with how the Prophet Muhammad would have acted under contemporary conditions, while comparing restrictions imposed on ISIS supporters on digital platforms to the challenges faced by early Muslims (p.21) during the persecution by the Quraysh, a dominant tribe in Mecca whose leaders opposed Muhammad and the early Muslim community.
Figure 1: A photo of the cover of the digital bulletin Light of Darkness, published as part of Voice of Khurasan in April 2024 (Obtained from TRACTerrorism).
More broadly, available open-source research has not identified any official ISIS doctrinal publication or fatwas explicitly legitimising offensive cyber operations as of today. Instead, official ISIS messaging has largely focused on propaganda dissemination, operational security, lone-actor terrorism, and the use of social media. The absence of a formal doctrinal framework may indicate that offensive cyber operations have not been institutionalised as a distinct component of ISIS’s jihadist strategy. It should not, however, be interpreted as evidence that ISIS ideologically rejects the use of cyber operations, particularly as guidance does appear in official publications.
Most of the relevant magazine material focuses on operational security and cybersecurity awareness rather than offensive operations. Among other topics, Light of Darkness and Voice of Khurasan have discussed digital footprinting and cyber hygiene, including recommendations to implement two-factor authentication, use VPNs, antivirus software, and secure cryptocurrency transactions, while advising readers to exercise caution to avoid malicious cyber schemes. Similar themes also appear in publications associated with the pro-ISIS Electronic Horizon Foundation (EHF), Qimam Electronic Foundation (QEF), and Ansar Electronic Security (AES). Importantly, this strong emphasis on cybersecurity awareness appears to stem primarily from scrutiny and counterterrorism measures targeting jihadists online.
There are further indications that some pro-ISIS media outlets are attempting to situate cyber warfare within a broader understanding of contemporary conflict and technological competition, while blending historical narratives with ideological and religious messaging. For example, in April 2026, the unofficial pro-ISIS Al-Bengal Media circulated a Bengali-language poster mentioning “cyber warfare”, drawing parallels with the Islamic “Golden Age” and the Abbasid Caliphate, and referring to competition in the age of AI and preparations for future wars. While this does not indicate any corresponding offensive cyber capability or provide a doctrinal justification for cyber warfare, it provides a recent example of cyber warfare entering the discourse of the broader pro-ISIS media ecosystem.
The limited institutionalisation of offensive cyber activity within ISIS’s broader strategy is also consistent with the organisation’s reliance on low-tech and widely available means, including knives, vehicles and arson attacks when encouraging lone-actor terrorism. These attack tools are readily accessible, require little or no specialised training, and can cause significant harm. By contrast, sophisticated offensive cyber operations require advanced technical expertise that relatively few supporters are likely to possess. Under such circumstances, ISIS may rely on skilled individual supporters who acquire their expertise independently before joining or pledging allegiance to the organisation. Junaid Hussain is a notable example of this dynamic. Consequently, ISIS may have prioritised promoting cybersecurity awareness and cyber hygiene while leaving offensive cyber campaigns to a small number of technically capable individuals.
As of today, there are numerous cyber actors in the digital space whose rhetoric can appear as Islamist or, more broadly, pro-Muslim, without attribution to ISIS directly. For example, groups such as Anonymous Sudan, BD Anonymous Team or Muslim Cyber Force have been observed either calling for a “cyber jihad” against alleged anti-Islam adversaries or launching DDoS campaigns in retaliation for alleged crimes against Muslim populations.
Conclusion & Implications
Based on publicly available evidence, there is currently no convincing indication that ISIS central or any of its provinces have developed a sustained capability to conduct sophisticated offensive cyber operations. No publicly reported ISIS-affiliated cyber collective, which might be comparable to the ISHD, has emerged in recent years. No evidence of ISIS cyber operations involving sophisticated intrusion, persistent access, destructive attacks, or attacks against critical infrastructure has been identified.
At the same time, this Insight should not be interpreted as an indication that the group lacks access to cyber expertise. The organisation’s broader ecosystem still includes technically skilled sympathisers, as well as publications dedicated to cybersecurity, anonymity, and digital resilience. The distinction, therefore, is between access to technical skills and the possession of an institutionalised offensive cyber capability.
The proliferation of Cybercrime-as-a-service (CaaS) and AI could further narrow this gap. While AI tools can lower the technical expertise required to carry out cyberattacks, CaaS may allow supporters to outsource technical components of an operation. However, this is unlikely to fully compensate for the lack of established cyber infrastructure and skilled personnel.
Therefore, ISIS’s current limited offensive cyber capability should not be seen as permanent. Any significant expansion of these capabilities would likely depend on ISIS successfully recruiting or attracting technically skilled individuals and gaining access to the resources and infrastructure required for more sophisticated cyber activity. From a counterterrorism and cybersecurity perspective, this emphasises the importance of monitoring ISIS efforts to attract individuals with advanced technical expertise, as well as hacktivist collectives displaying explicit Islamist ideological sympathies, particularly for indications of emerging links with ISIS or potential pledges of allegiance to the organisation. Such actors could provide the group with technical capabilities it currently appears to lack.
Developments in the group’s propaganda and religious discourse, particularly any further attempts to frame cyber warfare and emerging technologies as components of contemporary or future warfare, the emergence of dedicated pro-ISIS cyber collectives, and the adoption of technologies that could facilitate offensive activity, should also be monitored for indications of a potential shift towards a more systematic offensive cyber strategy.
–
Sergey Elkind is a former Israeli intelligence analyst and a geopolitical researcher with expertise in OSINT investigations and online threat environments. His professional interests include the study of jihadist and militant online activity, as well as the analysis of their propaganda materials and techniques. Currently, he is applying his background and skills in the German civic sector, where he coordinates intercultural initiatives that foster dialogue, inclusion and social resilience.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.