Encrypted Messaging App is Platform of Choice for Terrorist Group to Call for Violence

The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. This week’s edition reveals a Telegram channel that called for lone actor terrorist attacks in London, alongside other online websites that host ISIS videos and propaganda online.

“Encrypted messaging applications such as Telegram are infamously a terrorists’ platform of choice for the dissemination of online extremist content,” said CEP researcher Joshua Fisher-Birch. “In the case of Telegram, as CEP has previously noted, the messaging application’s public-facing and private components are essential in allowing extremists the ability to propagate themselves online.  Telegram has for years faced criticism for the flagrant misuse of their platform – and the ease with which ISIS content is continuously found shows that they are not serious about dealing with the issue.”

Notorious Pro-ISIS Telegram Channel Calls for Lone Actor Terrorist Attacks in London

The pro-ISIS Telegram Channel “Lone Wolves” was re-activated on Thursday, February 21. The channel’s calls for lone actor terrorist attacks at several landmarks in London were briefly available online before it was shut down. The channel is extremely similar to the notorious “Lone Muhjahid” Telegram channel, whose creator, Husnain Rashid, was sentenced to life in prison with a minimum of 25 years for encouraging terrorist attacks against the British royal family.  

The “Lone Wolves” channel’s profile photo was a photo of Rashid that is widely available across the media. “Lone Wolves” included advice on explosives, knife attacks, vehicle attacks and poisons. A great deal of the information in the channel was taken from ISIS’s Rumiyah magazine and Al Qaeda in the Arabian Peninsula’s Inspire magazine. “Lone Mujahid” also suggested several U.K. locations for attacks. The tactic is a low-cost way to spread fear, encourage violence and pressure the government to spend resources.

  Image on the “Lone Wolves” Telegram channel encouraging terror attacks located on February 21, 2019. The channel was removed that same day.

Pro-ISIS Arabic-Language Video Released with English and Spanish Subtitles

A pro-ISIS video, titled “The Path,” was released on several websites on February 18. The pro-ISIS Muntasir Media group produced the Arabic video, which included subtitles in both English and Spanish. It addresses criticisms of ISIS from Muslim religious and political leaders, and condemns the military campaign against ISIS. The video also includes multiple pieces of recycled footage from official ISIS propaganda videos, including footage of combat and the execution of a prisoner. In addition to Telegram, the video was released on at least three websites: Dropbox, Zippyshare and the Internet Archive. Three days later, the video was still available on Telegram and the Internet Archive.

“The Path” on the Internet Archive on February 21, three days after it was originally uploaded.

New Pro-ISIS Video Released on Several Websites

On February 20, the pro-ISIS Abd al-Faqir Media group released a new video titled “Holding Firm the Pledge.” The video includes a speech by one of ISIS’ now deceased leaders, Abu Muhammad al-Adnani, who emphasizes ISIS’ enduring nature and encourages perseverance. The video includes edited footage from official ISIS propaganda videos. The video includes stock footage of Mecca, Jerusalem and Istanbul, all edited to include the ISIS flag on flagpoles. The video concludes with two statements, “Stay strong my muwahid brother … for this is their last campaign,” and “Join the camps of the mujahideen in Iraq.” In addition to Telegram, the video was released on at least seven other websites: Anonfile, Top4top, Nofile.io, Streamable, Myspace, Transfer.sh and Vidio.  Approximately one day later, the video was still available on six websites: Anonfile, Top4top, Nofile.io, Myspace, Transfer.sh and Vidio.

“Holding Firm the Pledge,” by the pro-ISIS Abd al-Faqir Media group on the video streaming site Vidio. Located on February 21, 2019.

ISIS Supporters Use Propaganda Website to Target Bengali-Speaking Communities

An active pro-ISIS website in Bengali was located this week. The site’s registrar is Dominio, which is owned by Freenom. It has posted ISIS videos (some with Bengali subtitles) that encourage terrorist attacks besides disseminating propaganda photo sets and other pieces of ISIS content. ISIS propaganda videos on the site embed content from several streaming services like: Myspace, Vimeo, Liveleak, Wistia and Nicovideo.jp.  The site has been posting content since September 2018, posting 45 pieces of content in February 2019 alone.

Pro-ISIS “Soon, Soon” encouraging terrorist attacks.  The video, posted on February 11, 2019, is embedded on the ISIS site from Myspace.

Distribution of Accounts for VPNs on TechHaven Platform

A pro-ISIS chat on the TechHaven/Rocket Chat communications platform has been distributing emails and login information for accounts with the virtual private network (VPN) service Nord. VPNs allow for individuals to shield their IP addresses in an attempt to conceal their location. The chat user posted several Gmail, Hotmail and Yahoo email addresses, with passwords and expiration dates for Nord services.  Expiration dates range from March 2019 to January 2026. The long-term nature of these accounts suggests that these email accounts are using paid accounts with Nord.

Rocket Chat chatroom on the pro-ISIS TechHaven network, sharing email accounts with activated Nord VPN accounts. Located on February 21.