(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. Last week, pro-ISIS groups on Telegram and RocketChat urged followers to commit terror attacks in Europe and Sweden specifically, following a Quran burning in Stockholm and a second planned burning earlier this month. Al-Qaeda in the Indian Subcontinent also called for attacks on a propaganda website affiliated with the group. CEP researchers also located a statement from the pro-ISIS al-Azaim Foundation condemning Iran’s execution of two men convicted for the Shah Cheragh shrine attack, a pro-ISIS Telegram channel disguised as an open-source intelligence reporting account, six pro-ISIS accounts on Meta-owned Instagram, and two pro-ISIS accounts on TikTok. One of the Instagram accounts posted a clip from a 2015 execution video. The two TikTok accounts posted multiple videos, URLs for pro-ISIS propaganda websites, Amaq propaganda photos, and one account posted photos from a notoriously brutal execution video.
In addition, the pro-ISIS tech group Qimam Electronic Foundation released four guides on PasteThis.To and spread via RocketChat. The guides described how to use VPNs, provided guidance for applications with open access to smartphone microphones, and explained methods and tactics that adversaries may use to obtain passwords.
CEP researchers also located three clips of the Christchurch terrorist attack video on Twitter, and two additional accounts on Twitter and four on TikTok that glorified the shooter. The TikTok accounts posted memes, video clips, and recreations of the attack video on Minecraft. Other TikTok accounts circulated a white supremacist propaganda video from the British group Patriotic Alternative and propaganda from the Atomwaffen Division and promoted the Hammerskins.
Further, an online bookstore that uses web services from GoDaddy and Amazon recently announced a sale of James Mason’s book Siege, which advocates for acts of terrorism and has been required reading for several extreme-right groups.
Additionally, a previously deleted neo-Nazi Telegram channel allegedly operated by former members of a Canadian Proud Boys chapter celebrated 13,000 followers on July 11 by thanking its followers for connecting white supremacists and growing their radical movement.
Finally, Rinaldo Nazzaro appeared on a new podcast where he spoke about his own path to radicalization, promoted antisemitism, and described his creation of The Base.
Al-Qaeda, Online Pro-ISIS Propaganda Calls for Attacks in Sweden
CEP researchers located propaganda made by several online pro-ISIS groups calling for attacks in Sweden in response to the June 29 burning of a Quran outside of a mosque in Stockholm and then again on July 12 in response to a planned Quran burning that did not occur. Messages in a pro-ISIS Telegram channel called for individuals to commit terrorist attacks using whatever methods were available. Content was located on Telegram, RocketChat, and pro-ISIS websites.
The propaganda and hashtags were similar to messages located in February, which were posted by pro-ISIS online propaganda outlets in response to Quran burnings in Sweden and the Netherlands.
In a press release on June 30 released on their propaganda website, al-Qaeda in the Indian Subcontinent also called for attacks in Sweden and Europe in response to the Quran burning. The communique stated that “freedom of expression” was a “farce and an empty idea” to disguise “crusader” ideology as secularism.
Pro-ISIS propaganda located on Telegram calling for terrorist attacks in Sweden. Screenshot taken on July 11, 2023.
Pro-ISIS Group Condemns Iranian Executions of Alleged Shah Cheragh Attackers
On July 13, the pro-ISIS al-Azaim Foundation released a statement on Telegram and pro-ISIS websites condemning Iran for executing two men for allegedly carrying out the October 26, 2022, attack on the Shah Cheragh shrine. Iran publicly hung two men, Mohammed Ramez Rashidi and Naeem Hashem Qatali, on July 8 after convicting them of carrying out the attack. The al-Azaim statement proclaimed that the executions would lead to a “storm of revenge.”
Pro-ISIS Telegram Channel Disguised as OSINT Account Located
CEP researchers located a pro-ISIS Telegram channel disguised as an open-source intelligence (OSINT) reporting account. The account was specifically advertised in a pro-ISIS chat on the RocketChat platform by the Telegram channel administrator, and the Telegram channel has a mirror within the same pro-ISIS RocketChat environment. The channel was created in May 2023 and has posted content related to the Russian invasion of Ukraine and global ISIS operations, including Amaq propaganda photos.
Pro-ISIS Content Located on Instagram
CEP researchers located six pro-ISIS accounts on Meta-owned Instagram in a sample of content found on July 12. The six accounts posted a variety of clips taken from official ISIS propaganda videos, as well as unofficial pro-ISIS content. One account posted a video on June 17, 2023, that showed ISIS fighters executing alleged gay men in Syria by throwing them off a tall building. ISIS released the original footage in August 2015.
The video had 118 likes within 26 days and covered the ISIS logo on the top right of the screen with an Instagram like symbol. CEP also located clips from a recent propaganda video released on June 25. CEP reported the content to Instagram on July 13. Two accounts, including the account that posted the video from August 2015, were removed by July 17, but four accounts remained on the platform.
ISIS video located on Instagram on July 13, 2023. The video was removed immediately after CEP reported it.
Pro-ISIS Tech Group Releases Four Guides For Improving Operations Security
The pro-ISIS tech group Qimam Electronic Foundation released four guides on PasteThis.To and spread via RocketChat. All four posts are meant to increase operations security.
The first guide, released on July 3, contained a series of tips on using VPNs and advised users to avoid services that keep customer data. The second guide, released on July 5, provided advice concerning security regarding smartphone applications that access the device’s microphone. The guide released on July 11 contained a list and explanations of different internet protocols. The final guide, released on July 13, included a list of ways adversaries could obtain passwords.
Qimam Electronic Foundation guide on “Mistakes to avoid when using a VPN.” Screenshot taken on July 13, 2023.
Pro-ISIS, Content Glorifying Christchurch Attacker and Neo-Nazism Located on TikTok
CEP researchers found multiple examples of extremist content on TikTok in a series of searches on July 13. Researchers located two pro-ISIS accounts that posted multiple videos that included URLs for pro-ISIS propaganda websites, advertised a recently released ISIS propaganda video, included pages from the group’s al-Naba newsletter, and Amaq propaganda photos. One of the accounts posted photos taken from what is widely considered one of ISIS’s most brutal execution videos, released in September 2016.
Four TikTok accounts were located that glorified the perpetrator of the Christchurch terrorist attack. One account posted a meme honoring the gunman. Another account posted a four-second clip from the attack video, which had over 400 views after being online for approximately two weeks. Another account posted a clip showing a recreation of the attack video in the game Minecraft, which had over 8,000 views after it was online for almost 600 days.
An additional account was located that posted a recreation of the May 14, 2022, Buffalo attack in the game Minecraft. The video had over 2,400 views after being on TikTok for 78 days.
Other accounts posted propaganda videos from several white supremacist groups, including a video from the British group Patriotic Alternative, which had over 19,000 views and used a white nationalist slogan, an account belonging to an individual who promoted the Swedish chapter of the Hammerskins, and two profiles that promoted the Atomwaffen Division.
CEP reported all content to TikTok or to relevant national authorities.
Clip on TikTok with almost 2,000 views advertising a recently released ISIS propaganda video and a pro-ISIS propaganda website. Screenshot taken on July 13, 2023.
Clip containing a compilation of Atomwaffen Division propaganda located on TikTok. The video had over 600 views after being on the site for almost 200 days.
Clips from Christchurch Terrorist Attack, Content Glorifying the Attacker Located on Twitter
On July 10, CEP researchers three different clips on Twitter that contained footage from the Christchurch terrorist attack video and two additional accounts that glorified the attacker. One account posted an eighteen-second video on July 6 that included footage from the attack and additional content glorifying the gunman. The video had over 1,400 views within four days and had been retweeted 10 times. A different video that contained footage from the attack video encouraged acts of violence against Muslims in response to riots in France. The video found the same day it was uploaded had over 750 views in less than 24 hours. The final video contained a GIF that edited the attack video to give it a similar layout to the video game Fortnite. The video was uploaded on July 9 and had over 4,200 views and 49 retweets in approximately 24 hours. Two other accounts posted content glorifying the Christchurch terrorist and acts of mass murder.
CEP reported all content to relevant national authorities.
Neo-Nazi Bookstore Sells James Mason’s Siege and Sunglasses to Benefit Neo-Nazi Propagandist
On July 7, a neo-Nazi online bookstore announced the sale of James Mason’s book Siege. The book advocates for acts of terrorism and has been required reading for several accelerationist groups, including the Atomwaffen Division and The Base.
In addition to offering the book by itself, the web shop sold it in a package deal with sunglasses that advertise a neo-Nazi propagandist who has sought to intimidate attendees of drag performances in Ohio and recently announced his intention to build links with extreme right Russian dissident groups.
The web store uses GoDaddy as its registrar, and GoDaddy-owned DomainControl.com as its name server and is hosted by Amazon.
Previously Deleted Neo-Nazi Telegram Channel Celebrates Amassing 13,000 Followers
On July 11, a neo-Nazi Telegram channel celebrated surpassing 13,000 followers on the platform. A previous version of the channel, with over 41,000 subscribers, was deleted from Telegram on May 16, 2022. The channel is allegedly operated by former members of a Canadian Proud Boys chapter and routinely posts racist, antisemitic, anti-Muslim, and anti-LGBTQ content and advocates joining a variety of white supremacist groups, including Patriot Front, the Nationalist Social Club, and active club chapters.
After returning to Telegram following its deletion after the May 14, 2022, Buffalo attack, the channel stated that it was more important than ever to promote the Great Replacement Theory because of the media attention it was receiving.
In the July 11, 2023 message, the channel administrators claimed they played a “pivotal role” in bringing white supremacists together online and in the real world. A statement posted the same day by an Ohio active club chapter praised the larger channel, stating that their support was essential to the growth of their movement and that they had recently recruited an individual who found them through the channel.
Telegram post from Ohio active club chapter praising the larger Telegram channel that just celebrated reaching 13,000 followers over a year after being deleted. Screenshot taken on July 13, 2023.
Founder of The Base Appears on New Podcast
Rinaldo Nazzaro, the founder of The Base who lives in St. Petersburg, Russia, appeared on a new podcast released on July 15, where he spoke about his career in the U.S. intelligence community, becoming radicalized, and creating the neo-Nazi group. Nazzaro claimed that he became antisemitic after “very thorough research” and that this realization helped him reconsider “national socialism and Hitler” in a new positive light. Nazzaro praised the Atomwaffen Division and denied claims that he was affiliated with the Russian government or had worked on domestic counter-terrorism issues in the U.S. He further stated that Russia’s invasion of Ukraine was a “brother war” and that neo-Nazis and others in the extreme right should not be involved, but conceded that “it’s understandable that the Ukrainians don’t want to be invaded.” The podcast was released by a neo-Nazi website that promotes the work of James Mason and Atomwaffen Division successor groups.