(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. Last week, CEP researchers found that the main Telegram channel used by the Nordic Resistance Movement still had advertisements enabled despite the group’s June 14 listing by the U.S. government as a Specially Designated Global Terrorist (SDGT).
CEP researchers also located a video released by ISIS-K-linked al-Azaim Media that condemned the Taliban and advocated attacks against Shiites. Al-Azaim Media also released an online poster on June 20 that encouraged lone actor attacks using knives. Pro-ISIS online communities celebrated the June 23 attack in Dagestan, where 20 people were killed by gunmen in an attack on a police station, synagogue, and Orthodox church, despite no group having claimed the attack at the time. A pro-ISIS online group also released the second guide in a series regarding the use of commercially obtainable drones, and a pro-ISIS tech group offered general tips regarding account security.
Additionally, CEP researchers located a series of online posters made by al-Qaeda in the Arabian Peninsula’s al-Malahem Media that encouraged lone actor attacks and cyber-attacks, suggesting targeting persons, commercial centers, and infrastructure.
CEP researchers also found two announcements related to the Active Club movement, the first declaring the creation of a chapter in the Czech Republic and the second, from the movement’s Southern California chapter announcing that the “Frontier” fight night and networking event would occur again in August 2024. Members of a private Terrorgram chat also shared instructions for making explosives on June 26.
Nordic Resistance Movement Telegram Channel Still Has Ads Enabled Despite SDGT Designation
CEP researchers found ads on a Telegram channel belonging to the Nordic Resistance Movement (NRM) on June 25, 26, and 28. The ads were for two channels, one advertising a cryptocurrency and the other offering advice on buying cryptocurrency. Telegram claims that 50% of advertising revenue is shared with the channel owner. On June 28, the NRM channel had over 8,500 subscribers.
NRM was labeled a Specially Designated Global Terrorist (SDGT) by the U.S. State Department on June 14. The SDGT listing forbids transactions between U.S. persons and listed entities. Telegram is based in Dubai, not the United States; however, the ads on an NRM Telegram channel raise questions regarding Telegram’s sharing of advertising revenue with channel administrators and whether terrorist or extremist groups may be receiving money this way.
As of June 27, CEP researchers have located 28 extremist Telegram channels that contained advertisements. Thirteen ads promoted a cryptocurrency, nine claimed to be for cryptocurrency markets, and the remaining channels advertised various right-wing conspiracy theories, video games, an alleged betting website, cryptocurrency news, and a crypto wallet. Ads have previously been located on the main Active Club channel and a channel belonging to a French chapter, the main White Lives Matter channel, and channels that spread white supremacist and fascist content.
“Telegram should take actions necessary to prevent terrorist and extremist groups from using the communications app to generate funds, whether one dollar or one thousand dollars,” said CEP researcher Joshua Fisher-Birch. “Telegram’s general lack of content moderation cannot extend to services that allow revenue generation. This is especially serious following the State Department’s SDGT listing of the Nordic Resistance Movement, which seeks to prevent the funding of terrorist organizations.”
Screenshot of the Nordic Resistance Movement Telegram channel with an advertisement and a Telegram notice that 50% of revenue goes to the channel administrator. Screenshot taken on June 26.
ISIS Al-Azaim Media Video Condemns Taliban, Encourages Attacks on Shiite Muslims
On June 27, ISIS-K-linked al-Azaim Media released a video also bearing the logo of the pro-ISIS al-Hadid propaganda group that condemned the Taliban and encouraged attacks on Shiites. The video, titled “The Followers of Al-Yahud (The Followers of the Jews),” specifically stated that the Taliban were not followers of the true Islamic path, had not instituted religious law, had invited diplomats back to Afghanistan and promised them protection, receive money from the U.S., and want U.N. recognition. The Taliban acting Minister of Foreign Affairs, Amir Khan Muttaqi, was shown stating that Afghan Shiites would be protected because of shared nationality.
The video also accused the Taliban of killing women and children in Parwan Province. The Taliban were also condemned for making deals with the United States and China. Video footage contrasted summit meetings with clips of aerial attacks in Gaza by the Israeli Defense Force and photos showing the destruction of Uyghur mosques.
ISIS-K al-Azaim Media logo in the video. Screenshot taken on June 27.
ISIS-K Al-Azaim Media Encourages Knife Attacks
On June 20, an ISIS-K-linked al-Azaim Media poster located on RocketChat encouraged lone actor attacks in the West and Israel using knives. The post used gory images from a notorious ISIS video released in November 2016 that included a tutorial where a masked ISIS executioner instructed the viewer on knife tactics while using the weapon on a restrained person.
Pro-ISIS Online Community Celebrates Dagestan Attack
Pro-ISIS communities on Telegram and RocketChat celebrated the June 23 attack in the Republic of Dagestan in Russia. As of June 27, no group has claimed credit for the attack where 20 people were killed, including 16 law enforcement officers and an Orthodox priest. Gunman targeted a police station, a synagogue, and an Orthodox church. Pro-ISIS Internet users noted with approval that a high-ranking police officer was killed, a synagogue was attacked, and the ensuing gun battle between the attackers and security forces lasted eight hours.
Online Pro-ISIS Group Releases Second Guide on Commercially Available Drones
On June 19, an online pro-ISIS group released a guide regarding the components of a quadcopter drone. The seven-page manual included notes on the drone’s components, such as rotors, batteries, flight control system, GPS, etc., noting that learning basic functionality was crucial to becoming a good pilot, building drones, and conducting repairs.
The guide is the second in a series released by the same pro-ISIS group. The first guide was released on April 28. Links were spread in a pro-ISIS RocketChat room. There is no indication that the online group has any connection to official ISIS propaganda outlets. Guides and manuals on attack methods can educate potential assailants but also amplify threats, especially during periods of heightened media attention.
ISIS supporters have previously purchased drones and components bound for ISIS in the Middle East. In December 2023, a man in Coventry, United Kingdom, was sentenced to life in prison for terrorism offenses after building a drone using 3D-printed parts that he planned to give to ISIS operatives. Pro-ISIS propaganda has also previously encouraged the use of drones in committing terrorist attacks.
Pro-ISIS Tech Group Posts General Account Security Tips
On June 25, the pro-ISIS Qimam Electronic Foundation (QEF) posted general tips on PasteThis.To for strengthening account security. The list was composed of common-sense practices, such as using strong, unique passwords, two-factor authentication, making sure that security patches are current, using antimalware software, and avoiding phishing emails and public Wi-Fi. The PasteThis.To link was spread via RocketChat.
Qimam Electronic Foundation logo. Screenshot taken on June 27.
Al-Qaeda in the Arabian Peninsula Releases Series of Images Encouraging Terrorist Attacks
Between June 11 and 19, al-Qaeda in the Arabian Peninsula (AQAP) released a series of 34 posters on ChirpWire bearing the logo of the group’s al-Malahem Media, encouraging lone actor attacks in the West. The posters, titled “Inspire Tweets,” referencing the AQAP publication Inspire Magazine, encouraged selecting targets such as commercial centers to damage the economy, transportation infrastructure, and “major criminals” in the West. Several posters also noted that all should participate in the fight against the U.S., including the young and old, and that religiously mandated fighting was the best of deeds. Regarding methods, one post noted that knives were a good substitute for firearms or explosives, and another post stated that cyber-attacks were as crucial as physical attacks, noting that the Internet was of prime importance to Western countries. AQAP also encouraged attacks against the U.S. for the latter’s support of Israel. One poster noted that people should not try to negotiate with politicians.
“Inspire Tweet” from AQAP al-Malahem Media. Screenshot taken on June 24.
Czech Republic Active Club Announces Formation
On June 21, a Czech Republic branch of the white supremacist Active Club movement announced its formation on Telegram. The first Active Club in the country, channel admins posted photos of five individuals boxing. The initial message announcing the creation of the group was shared by several Telegram channels that promote Active Clubs and other white supremacist groups, including one channel with over 22,000 subscribers. While the Czech Republic chapter’s channel had only 95 subscribers five days after it was posted, the message had received over 5,600 views.
Southern California Active Club Announces August Fight Event
On June 14, the Southern California Active Club chapter announced “Frontier 24,” an invite-only private fight night in August. Previous “Frontier” events held in the San Diego area in 2022 and 2023 have featured participants from Active Clubs across the country as well as members of Patriot Front and serve as networking events as well as sites for generating propaganda footage. Banners and logos from a chapter of the Hammerskins have been visible in propaganda videos released after the two previous events.
Image advertising August 2024 fight event. Screenshot taken on June 27.
Member of Terrorgram Chat Shares Explosives Instructions
On June 26, the user of a Terrorgram-affiliated Telegram chat shared instructions for the homemade manufacture of a high explosive. Other posts in the chat glorified white supremacist terrorists, such as the perpetrator of the March 15, 2019, Christchurch attack, and promoted antisemitism, anti-Muslim sentiment, and racism, as well as content directly encouraging individuals to commit acts of violence. The private chat has less than 100 members. On April 26, the British government proscribed the Terrorgram Collective as a terrorist organization.