CYBER CALIPHATE FOR RECRUITMENT
Hussain helped to develop the ISIS recruitment network over a swath of social media outlets and encrypted messaging clients. ISIS is not the first extremist group to rely on social media. Cassettes were passed around in the 1970’s. In the 1990’s, select Al-Qaeda operations were broadcast on satellite TV. After September 11, 2001, Osama Bin Laden likewise broadcast some speeches via satellite channels. However, modern social media is far more pervasive and ubiquitous than former mediums. Every teenager and most adults have one or more accounts on the various platforms. ISIS and other groups can freely publish videos on YouTube, lectures on Soundcloud, manifestos on Facebook, and propaganda on Twitter. The defining difference is that ISIS recruitment is more effective at social media than other extremist groups. They have developed processes to keep their feeds and links alive when their accounts are taken down and they have even developed Android applications such as “ Dawn of Glad Tidings ” to distribute their message more effectively. According to Richard Stengal, the Under Secretary for Public Affairs and Public Diplomacy, by May 2016, Twitter has publically taken down over 200,000 accounts, YouTube has supposedly taken down millions of videos, and Facebook has hundreds of people working to remove ISIS content. Nevertheless, despite the combined opposition of over 60 countries and global organizations, as of 2016, ISIS remains a persistent global threat.
ISIS survives by recruiting new fighters into its ranks, from the areas it occupies and from foreign nations. Americans may naively believe ISIS recruitment on these platforms to be ineffective or impractical, yet intelligence agencies and the terrorists themselves disagree. In May 2016, the German criminal police and internal intelligence published a study of the more than 800 individuals who have left Germany for Syria or Iraq for ideological motives. In a May 28, 2016 interview with NPR, security analyst Adrian Schtuni estimated that approximately 1000 individuals from the Balkans have recently joined ISIS or Jabhat al-Nusra. He predicts around 5000-6000 individuals have been recruited from Western Europe. Overall, it is believed that ISIS recruitment has persuaded 20,000-30,000 recruits to join their caliphate since June 2014. However, some believe that recent airstrikes affecting revenue streams and recent domestic counter-propaganda efforts may have decreased monthly recruiting efforts to around 200 militants per month instead of the 1500-2000 recruits per month estimated last year. ISIS tends to appeal to “poor unfortunate souls” and “troubled youths,” with a sense of community and an aggressive ideology. Alarmingly, the stereotypical antisocial, disgruntled youth targeted by ISIS, is also the stereotype for young script kiddies. As it faces increasing opposition in cyberspace and as its seized technology breaks down, technology savvy personnel will increasingly become the most valuable resource to ISIS. It is imperative that opposing forces prevent ISIS from recruiting educated or talented individuals.
Thanks to its publications and strong communication structure, ISIS members exhibit decent operational security and increasingly strong cyber-defensive capabilities. If the group obtains the personnel capable of offensive cyber capabilities, then the threat that it poses to the world will be greatly amplified because it will be able to infiltrate targets’ systems, collect information to plan attacks, disrupt operations, and otherwise terrorize its adversaries from anywhere on the globe.
Cyber Caliphate:
Even though it was not endorsed by ISIS, the Cyber Caliphate is believed to be the coordinated effort of Junaid Hussain. Some contend that the organization is an unaffiliated supporting group, while others believe that the group is a Russian misinformation campaign. The former theory is credible, because Hussain died before the official declaration of unification of the affiliate groups. Hussain was the connection between many of the recruits and teams. It seems likely that some information was lost when he died. The latter theory is based around indicators of compromise discovered in the TV5Monde attacks attributed to ISIS. As discussed later in this publication, it is possible that the Russian APT 28 infected the same system as ISIS and it is possible that APT 28 infected a system and masked their presence by framing the Cyber Caliphate.
The .vbs files contain a VBScript that causes the victim machine to verbally inform the victim of the infection by repeating a message from the attacker. Traditionally, the vocal reminder that files are encrypted jars victims and pressures them into making the irrational decision to pay the ransom. A Cyber-Jihadist group could alter the message to spew propaganda in order to incite panic, increase notoriety, or otherwise harass the victim. The audio message continues to repeat until the victim either pays the ransom or removes all of the VBS files from the system.
In response to his death and in response to increased cyber-attacks from the United States and Anonymous on ISIS, four pro-ISIS groups, the Sons of Caliphate Army, the Caliphate Cyber Army, the Ghost Caliphate Section, and the Kalashnikov E-Security Team, merged into the United Cyber Caliphate (UCC) in April 2016. The UCC is predominately capable of hacking soft targets, such as Twitter accounts, and spreading propaganda or defacing websites. While none of the groups incorporated possessed sophisticated capabilities, their unification has resulted in an increased interest in coordinating and conducting cyber-attacks against governments and organizations. It is possible that the shared coordination will enable the collective to learn more skills and increase their sophistication; however, it is more likely that the Cyber-Jihadists will purchase malware, will rely on malware-as-a-service, or will outsource stages of an attack to mercenary hackers.