Over the past decade, Islamic State (IS) has repeatedly adjusted the way it teaches technical skills, responding both to changes on the ground and to the increased scrutiny across online platforms. Once the group lost the territory that had enabled it to run workshops and training camps, its supporters had little choice but to move their instructional efforts into digital spaces. However, this shift didn’t slow them down; instead, it led to a steady stream of improvised guides, short tutorials and how-to posts that circulated through encrypted communication channels. Earlier material often revolved around basic IED construction and other improvised weapons, but in the last few years, there has been a noticeable shift towards drones and the ways off-the-shelf systems can be adapted for reconnaissance and attacks.
Within this newer wave of content, one IS supporter has become particularly noticeable. Active on encrypted messaging platforms since mid-2023, he first gained attention for sharing material on homemade explosives. But in April 2024, he shifted gears and began releasing a drone-focused series titled Modern Warfare.
This Insight will examine what Modern Warfare reveals about how IS and its supporters now approach technical training. It will look at how this fragmented, step-by-step method fits into broader shifts in Islamic State’s online learning culture, how encrypted platforms help keep these materials circulating, and what all of this means for technology companies trying to stop their services from being used for extremist purposes.
Evolution of IS’ Technical Instruction Ecosystem
Following the fall of the Caliphate, which enabled in-person training camps and workshops, IS shifted its technical instruction online, where a loose network of supporters began circulating improvised weapons guides and tutorials for operational and technical improvement. Instead of long, polished manuals, the trend shifted toward shorter posts and guides, and occasional videos that answered technical questions from followers. These contributors weren’t necessarily part of IS’ hierarchy; many were hobbyists or technically inclined supporters who enjoyed problem-solving and wanted to remain relevant to the movement.
At the same time, the broader landscape of consumer technology was changing. Cheap quadcopters, open-source flight-control software, and basic soldering tools became widely available, and most of this gear didn’t require specialist training. IS fighters had already experimented with drones years earlier in Iraq and Syria, but those early efforts relied heavily on improvisation and battlefield experience. There was no consistent teaching material behind it, and what existed tended to be scattered across different platforms.
As IS’ structure fragmented, the way it shared knowledge broke too. The organisation stopped producing big “everything you need to know” documents and instead started releasing small, single-topic lessons. This format had obvious advantages. Short files are easier to hide and harder for platforms to detect, and they suit an audience spread across dozens of countries using whatever tech they can safely access. A five-page guide on wiring a flight controller or choosing a radio module attracts far less scrutiny than a complete drone-weaponisation manual.
Encrypted platforms helped this shift along. Telegram, Element, and other services became spaces where IS supporters could trade tips, troubleshoot equipment issues or compare setups without needing to know each other personally. Some channels started to look less like propaganda hubs and more like improvised maker communities. People asked questions, posted fixes, and shared equipment lists the same way hobbyists do, just with a very different goal in mind.
It was in this environment that more formal “teachers” began to stand out. Anyone capable of producing consistent, easy-to-follow material quickly attracted attention. Instead of one-off tips, these individuals began releasing content that looked more like short courses. The appearance of the contributor in question fits neatly into this pattern: a technically confident user creating a clearer pathway through the scattered drone advice circulating in IS-aligned spaces.
Where and How the Manuals Circulate
The way these manuals move through online spaces says just as much about the current state of IS’ technical ecosystem as the content itself. Following the release of the first issue in April 2024, they were fairly easy to find. Supporters circulated them through familiar hosting sites: MediaFire, the Internet Archive, JustPaste.it, and a handful of similar platforms that have long been used to share extremist material. Links would be posted in multiple channels, mirrored repeatedly and re-uploaded whenever they were removed. This open distribution wasn’t unusual; for years, the wider IS supporter network relied heavily on public hosting services to circumvent the short lifespan of their content on mainstream platforms.
Screenshot: Manual Hosting Platforms.
That pattern has changed noticeably. Since October 2024, the manuals no longer circulate via public links. Instead, they sit behind a layer of personal interaction, and the only way to obtain them now is by contacting the person responsible for publishing them. This shift, from broadly accessible download links to controlled, one-to-one access, reflects a tightening of operational security and a growing awareness of how quickly open files can be tracked, archived or used for takedown purposes.
Screenshot: List of all Modern Warfare Issues.
Encrypted communication platforms, particularly RocketChat and some invite-only spaces on other services, now act as the main hubs for the series. These channels function like quiet technical corners within a much larger ecosystem: small groups of users trading troubleshooting advice, discussing components, and circulating material privately rather than broadcasting it. In these settings, the manuals are not widely advertised; instead, they are quietly referenced or mentioned in passing when someone asks for drone-related guidance. This keeps them out of researchers’ sight and reduces the risk that automated systems will detect related file-sharing activity.
The decision to restrict access has several practical advantages for IS. First, it prevents the manuals from travelling too far beyond the intended audience, which reduces the chance of infiltrators or monitoring bots collecting them. Second, it creates a sense of exclusivity; users feel they are receiving information directly from a trusted source rather than stumbling across a random download. And third, it makes the material more resilient. A single public link can be taken down instantly, but a privately shared file, sent directly from one user to another, leaves far fewer digital traces.
This more controlled circulation also mirrors shifts seen across other extremist communities (p. 56). As hosting platforms have become faster at moderating harmful content, groups have adapted by reducing their reliance on large, publicly accessible repositories. Instead, they have turned to closed ecosystems where content spreads slowly but more securely. In the case of this drone series, that approach clearly worked: only the covers continued to circulate widely, while the actual manuals became much harder to obtain.
By pairing modular content with restricted distribution, the creator has effectively built a small but steady technical pipeline. Each issue can be shared quietly with vetted users, while the series as a whole remains difficult for outsiders to map. It is a distribution strategy that favours durability over reach, and one that fits neatly within IS’ broader move toward smaller, less visible online communities.
Understanding the Six-Part Drone Series
The documents analysed in this section were gathered through continuous open-source monitoring of IS-affiliated media channels and file-sharing platforms on which the group circulates its technical publications. Notably, these drone manuals appear in both Arabic and English versions, often with identical layouts.
A closer look at the six-part Modern Warfare series shows that it is far more than a loose collection of drone-related tips. Together, the manuals form a structured curriculum that steadily guides readers from basic UAV concepts to assembling and modifying drones for operational use. Each issue builds deliberately on the one before it, moving from introductory material into hands-on construction, firmware modification and, eventually, the integration of payload mechanisms. The progression makes it clear that the series is intended to function as a complete training pathway rather than a set of isolated technical notes.
The First Issue: The Various Types of UAVs.
Issue One introduces the different types of UAVs, outlining the fundamental distinctions between fixed-wing platforms, multirotors and hybrid systems. Its tone is deliberately accessible, aimed at readers who may only have experience with simple consumer drones or none at all. This early grounding becomes necessary as the manuals gradually shift into more technical territory.
The Second Issue: Main Components of Drones.
Issue Two examines the anatomy of drones: frames, motors, power distribution, and other essential components. It prepares the reader for the more practical work that appears later by explaining how these pieces fit together and how design choices affect lift, endurance and stability.
The Third Issue: Drone Controls and Communications.
Issue Three shifts the focus from hardware to operation. It covers flight controls, radio systems, communication links and the basics of configuring flight-controller software. This establishes the knowledge needed for subsequent manuals, which expect the reader to understand more advanced drone techniques and troubleshoots.
The Fourth Issue: Building a FPV Drone.
Issue Four represents the transition from theory to practice. It walks readers through building a First-Person View (FPV)-capable drone and testing basic flight behaviour. This is where the learner begins to apply the principles introduced in earlier issues and lays the groundwork for integrating more advanced functions.
The Fifth Issue: Adding a Camera System to a Drone.
Issue Five introduces camera systems. This includes guidance on configuring a stable imaging feed. The emphasis on reconnaissance and visibility provides the operational context for the final stage of the series, where accuracy and situational awareness become essential.
The Sixth Issue: Attaching a Drop Mechanism.
Issue Six brings all the previous material together by providing step-by-step instructions on the process of assembling and activating a payload-release mechanism. The level of detail, down to screw dimensions, 3D-printed components, firmware commands and test procedures, reflects a manual intended for practical implementation, not theoretical study.
Screenshots from Modern Warfare: Issue Six.
When seen as a complete sequence, the series forms a coherent training pipeline that incrementally builds competence. Each manual adds a layer of understanding that feeds into the next, allowing someone with a limited technical background to progress from basic drone familiarity to assembling a functional, payload-capable system. The structured nature of the manuals, combined with their step-by-step format, makes the series accessible, replicable and discreetly effective, a design that fits the broader shift toward decentralised, low-visibility technical instruction.
Conclusion and Recommendations
The way this drone series has been created and shared shows how much extremist technical training has evolved in the years following IS’ territorial collapse. Instead of circulating large manuals on open platforms, instruction is now divided into small, digestible pieces and passed quietly through private, encrypted groups. That shift means companies can no longer rely on spotting obvious files or clear-cut keywords; the useful signals now sit in the behaviour surrounding the material rather than in the content itself.
For encrypted communication platforms, the challenge is recognising the dynamics of small technical circles. Manuals rarely appear in open channels, so platforms should pay attention to patterns such as one user repeatedly acting as an intermediary, groups centred on narrow technical subjects, or discussions referring to files that never surface publicly. None of these signals is definitive, but together they can point to controlled distribution networks.
Cloud-storage providers face a similar dilemma. The complete manuals may not reach their servers anymore, but the traces around them sometimes do: covers, teaser images or placeholder files that look ordinary. Repeatedly seeing these uploads, or those tied to the same small group of accounts, can provide early hints of a more controlled distribution system operating elsewhere.
Drone manufacturers and flight-control software developers will also need to adjust how they think about misuse. The series shows how quickly inexperienced users can learn advanced skills using standard hardware and open-source tools. Companies may need to pay closer attention to patterns, such as repeated attempts to modify firmware, repeated support queries about payload capacity, or clusters of users experimenting with the same bypasses.
The same applies to online makers and FPV communities. Posts about soldering, servo installation or flight tuning appear constantly in legitimate hobbyist spaces. The issue arises when these questions form a highly structured sequence, mirroring the step-by-step progression of a build rather than casual experimentation. Moderators don’t need to police every technical conversation; they simply need clearer guidance on when a thread feels too systematic or aligned with a known workflow.
Across all of these sectors, the main takeaway is straightforward: extremist learning has become quieter, more modular and far more embedded in everyday digital activity. Companies will need to adjust their expectations accordingly. Instead of looking for a single harmful document, they’ll need to pay attention to the patterns, habits and breadcrumbs that form around these small fragments of instruction. That’s where the real indicators now sit, and where early intervention is most likely to work.
Taken together, this drone series offers a window into how technical capability is being rebuilt within dispersed extremist networks. It shows that innovation no longer depends on formal structures or centralised oversight, but can emerge from individual contributors who package complex skills into accessible, incremental lessons. Understanding how these small instructional ecosystems take shape and how they evolve around widely available consumer technology will be essential for anticipating the next wave of adaptations across similar online environments.
—
Muskan Sangwan is a Threat Intelligence Analyst at StealthMole and previously worked as a Senior Counter-Terrorism Intelligence Analyst at the Terrorism Research and Analysis Consortium (TRAC). She specializes in terrorism and extremist ecosystems with special focus on Islamic State (IS) operations, jihadist and far-right movements, the crime–terror nexus, and the growing intersection of cyber threat intelligence and dark-web activity.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.