Terrorist groups are increasingly using cyberspace and digital communication channels to plan and execute attacks.

Yesterday Federal Bureau of Investigation (FBI) Director Christopher Wray growing concerns over the potential for a coordinated foreign terrorist attack in the United States. During his testimony to the House Oversight Committee, Mr. Wray cited the ISIS-K attack on Crocus City Hall in Moscow in March as an example of the type of threat the bureau is increasingly concerned about.

These details are alarming to the security community and private sector, and demand a proactive approach to combat this threat, including identifying precursors to it in the cyberspace. According to the latest risk assessment by Resecurity, terrorist groups are increasingly using cyberspace and digital communication channels to plan and execute attacks, as well as to conduct recruitment and establish anonymous communication channels (using apps like Session and their alternatives).

Multiple resources created by threat actors have been identified and deployed both in the surface web and the Tor network. This activity was especially notable in Q2 2024, with new resources appearing at the beginning of Q3 2024. In one of the most recent publications, ISIS has published a menacing image online, suggesting the use of drones as potential bomb delivery systems for an attack on the Paris Olympics, accompanied by a caption declaring the start of the “Lone Wolves’ Olympics”.

Resecurity has also observed a spike of illegal content related to educational materials related to explosives spreaded on the Dark Web. At some point, such content is promoted under umbrella of the “anarchy” ideology encouraging youth to get involved in illegal activities. Making such information available using Dark Web means created a significant threat for society. By July 2024, the number of such resources indexed by Resecurity is almost doubled compared to previous timeframes. This may highlight the growing effort to distribute such illegal content before important events. It is expected that such activity may amplify by the the elections in the United States, with the intention of sowing chaos and radical activity. July 13, 2024, multiple resources were detected spreading information about Telegram bots providing instructions and details on accessing illegal content related to explosive devices.

Besides efforts by law enforcement and public sector agencies to combat terrorism, there are many challenges on the shoulders of the private sector in managing online platforms, marketplaces, social media, and other resources. According to experts, one of the key issues is tracking high-risk individuals who may misuse financial services, such as banks, e-commerce platforms, and payment networks, to engage in illegal activities, including money laundering and terrorism financing. Unfortunately, the abuse management and trust & safety teams of popular online platforms are not always able to react quickly enough or proactively identify such profiles at an early stage due to a lack of visibility and limited resources, which is exploited by threat actors.

Additional information is included in the report published by Resecurity:

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, Terrorist Activity)

A security researcher discovered that a secret FBI’s terrorist watchlist was accidentally exposed on the internet for three weeks between July 19 and August 9, 2021.

The security researcher Bob Diachenko discovered a secret terrorist watchlist with 1.9 million records that were exposed on the internet for three weeks between July 19 and August 9, 2021.

In July, Diachenko discovered an unsecured Elasticsearch cluster containing 1.9 records of sensitive information on individuals, such as names, country citizenship, gender, date of birth, passport details, and no-fly status.

The list is extracted by the , a database used since 2003 by US feds and other agencies to track individuals who are “known or reasonably suspected of being involved in terrorist activities.”

 The copy of the TSC database was discovered by the expert on a Bahrainian IP address.

“The exposed Elasticsearch cluster contained 1.9 million records,” . “I do not know how much of the full TSC Watchlist it stored, but it seems plausible that the entire list was exposed.“

“Each record in the watchlist contained some or all of the following info:

• Full name
• TSC watchlist ID
• Citizenship
• Gender
• Date of birth
• Passport number
• Country of issuance
• No-fly indicator”

At the time of this writing is not clear if the unsecured server was operated directly by the a U.S. government agency, a third-party, or in the worst case by a threat actor that obtained it.

Diachenko immediately reported his discovery to the U.S. Department of Homeland Security (DHS) and the instance of the database was taken down about three weeks later. It is a long period a circumstance that suggest that the server was not directly operated by the FBI.

“On July 19, 2021, The exposed server was indexed by search engines Censys and ZoomEye. I discovered the exposed data on the same day and reported it to the DHS.” continues the expert.

“The exposed server was taken down about three weeks later, on August 9, 2021. It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it.”

The exposed DA was also indexed by search engines Censys and ZoomEye, this means that other people could have had access to the secret list.

“It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it,” adds Diachenko.

This data leak could have a serious impact on the homeland security, the watchlist includes individual who represents a potential threat for the US even if they have yet to be charged of terrorism and other crimes.

“In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families.” says the researcher. “It could cause any number of personal and professional problems for innocent people whose names are included in the list,”

Cases, where people  for refusing to become an informant, aren’t unheard of.

Diachenko believes this leak could therefore have negative repercussions for such people and suspects.

“The TSC watchlist is highly controversial. The ACLU, for example, has for many years  the use of a secret government no-fly list without due process,” concludes the researcher.

Follow me on Twitter: and

(SecurityAffairs – hacking, FBI)

[adrotate banner=”5″]

[adrotate banner=”13″]

The Islamic hacker Ardit Ferizi, who is serving 20 years for giving his support to Islamic State group has been granted compassionate release.

Ardit Ferizi, aka Th3Dir3ctorY, is the hacker that supported the ISIS organization by handing over data for 1,351 US government and military personnel.

Ferizi is the first man charged with cyber terrorism that was extradited to the US early this year.

He was charged with hacking crimes and providing support to a terrorist organization. The 20-year-old man was accused of supporting the ISIS terrorist organization, he was the subject of extradition from the Malaysian government, where he lived. The man of Kosovar origin was studying computer science in Malaysia.

He was arrested in Malaysia in September 2015 and transferred to the US to face trial. Ardit Ferizi has been sentenced to 20 years in a U.S. prison. According to the US investigators, he provided the data to the popular IS militant Junaid Hussain, which disclosed it on the web. The collaboration between the IS hackers Hussain and Ferizi started in April 2015, according to the US authorities.

Now the hacker has been granted compassionate release because of the COVID-19 pandemic and will be placed in ICE custody for prompt deportation, a federal judge ordered Thursday.

U.S. District Judge Leonie M. Brinkema in Alexandria signed the order to the Bureau of Prisons to immediately place Ferizi in a 14-day quarantine before releasing into the custody of Immigration and Customs Enforcement so he can be deported to Kosovo.

“U.S. District Judge Leonie M. Brinkema in Alexandria signed the order reducing the sentence of Ardit Ferizi to time served. Brinkema also ordered the Bureau of Prisons to immediately place Ferizi in a 14-day quarantine to ensure he’s not infected with the coronavirus. At the end of the quarantine, Ferizi will be released into the custody of Immigration and Customs Enforcement so he can be deported to Kosovo, the judge ordered.” the Associated Press.

The 2016 sentence ordered that Ferizi (24) will remain on supervised release for 10 years. Ferizi explained in a motion written from the prison that his asthma and obesity placed him at greater risk for COVID-19.

Ferizi explained that the special restrictions at the prison require him to check in with staff every two hours, exposing him at the risk of being infected due to the contact with guards.

“Brinkema initially at a hearing in October, citing concerns that he might resume hacking if released, among other issues. Prosecutors had opposed Ferizi’s release.” concludes AP News.

(SecurityAffairs – hacking, ISIS)

[adrotate banner=”5″]

[adrotate banner=”13″]

The hacker who shared with the ISIS personal data of more than 1,300 U.S. government and military personnel will remain in a federal prison.

Ardit Ferizi, aka Th3Dir3ctorY, is the hacker that supported the ISIS organization by handing over data for 1,351 US government and military personnel.

Ferizi is the first man charged with cyber terrorism that was extradited to the US early 2016.

The man was charged with hacking crimes and providing support to a terrorist organization. The 24-year-old man was accused of supporting the ISIS terrorist organization, he was the subject of extradition from the Malaysian government, where he lived. The man of Kosovar origin was studying computer science in Malaysia.

He was arrested in Malaysia in September 2015 and transferred to the US to face trial.

Now Ardit Ferizi has been sentenced to 20 years in a U.S. prison. According to the US investigators, he provided the data to the popular IS militant Junaid Hussain, which disclosed it on the web. The collaboration between the IS hackers Hussain and Ferizi started in April 2015, according to the US authorities.

The details of the Ferizi’s case are described in s court filings [].

Leaked data included names, e-mail addresses, passwords, locations and phone numbers of 1,351 U.S. military and other government personnel.

The ISIS-linked hacker obtained the data by hacking into the US web hosting company’s servers on June 13, 2015.

The US authorities suspected that Ferizi is a member of a Kosovan hacking team known as KHS, he used the pseudonym of “Th3Dir3ctorY”. The KHS breached a database of a US retailer was able to identify the records belonging to military and government personnel.

The Kosova Hacker’s Security (KHS) hit numerous organizations across the world, including Serbian Government websites, Israeli websites under the #OpIsrael campaign, The Interpol, IBM Research, Hotmail, US National Weather Service Website and numerous targets in Ukraine.

I wrote about Ferizi in October 2015, when the man was arrested by Malaysian authorities because for the first time ever the US Justice Department has charged a suspect for terrorism and hacking (cyber terrorism).

Ferizi was pleaded guilty on June 15, 2016, now is  at a federal prison in Lewisburg, Pennsylvania, and is scheduled for release in 2032 if he gets credit for good behavior.

Ferizi asked a federal judge in Alexandria to release him from prison due to his health status.

“In a handwritten motion from prison, he said his asthma and obesity place him at greater risk of contracting COVID-19.” reads the published by Associated Press. “He also said special restrictions at the prison require him to check in with staff every two hours, increasing his contact with guards and his risk of contracting the virus.”

Now prosecutors refused the request of hacker and opposed his release. The U.S. District Judge Leonie Brinkema rejected Ferizi’s request at a hearing Tuesday, the authorities believe that the man could teiterate his criminal activity.

(SecurityAffairs – hacking, ISIS)

[adrotate banner=”5″]

[adrotate banner=”13″]

US military claims to have disrupted the online propaganda activity of the Islamic State (ISIS) in a hacking operation dating back at least to 2016.

In 2016, the US Cyber Command carried out successful operations against the online propaganda of the Islamic State (ISIS), this is what emerged from declassified national security top-secret documents released on Tuesday.

The  have been release under a Freedom of Information Act request.

According to the documents, the US Cyber Command “successfully contested ISIS in the information domain,” its operations had a significant impact on online radicalization and recruitment of the terrorist organization.

The first offensive hacking operation dated back 2016 and dubbed “Operation Glowing Symphony” was detailed in the documents released by the National Security Archive at George Washington University.

“Today the National Security Archive is releasing 6 USCYBERCOM documents obtained through FOIA which shed new light on the campaign to counter ISIS in cyberspace.” reads a published by the National Security Archive at George Washington University. “These documents, ranging from a discussion of assessment frameworks to the 120-day assessment of Operation GLOWING SYMPHONY, reveal the unprecedented complexity of the operation, resulting challenges in coordination and deconfliction, and assessments of effectiveness.”

The offensive Operation Glowing Symphony was carried out in November 2016 by Joint Task Force Ares (JTF-Ares), it mainly aimed at disrupting ISIS propaganda efforts by hacking or hijacking online social media accounts, and taking down websites used by the terrorist organization to spread propaganda.

The documents reveal the result of a 120-day assessment US Cyber Command conducted after the completion of Operation Glowing Symphony.

The assessment pointed out problems faced by the US cyber units, including the challenges of storing a huge amount of data contained in the hacked ISIS servers and accounts and the difficulty in coordination with other coalition members and US government agencies.

The Operation Glowing Symphony was approved in 2016 by president Barack Obama. It was initially approved for a 30-day period in late 2016, but it was later extended.

Operation GLOWING SYMPHONY is considered an important mileston in the counter-terrorism efforts and demonstrates the efficiency of the US offensive cyber capability against online propaganda of the Islamic State (ISIS).

“Operation GLOWING SYMPHONY was originally approved for a 30-day window, but the a July 2017  reported the operation’s extension to an unknown date. Whether the operation is currently ongoing or not, it is public knowledge that JTF-ARES continues to operate.” continues the post. “It is also increasingly apparent that the counter-ISIS mission, JTF-ARES, and Operation GLOWING SYMPHONY are viewed within the US military’s cyber-warfighting community as not just a chapter in counter-terrorism and ‘low-intensity conflict’, but as demonstrations of the nation’s offensive cyber capability and a model for conducting an .”

(SecurityAffairs – OP Glowing Symphony, ISIS)

[adrotate banner=”5″]

[adrotate banner=”13″]

US authorities arrested Thomas Osadzinski, a student at DePaul University, because he allegedly built a custom Gentoo Linux distro for ISIS.

Thomas Osadzinski (20), a student at DePaul University, Chicago, was arrested because he allegedly built a custom Gentoo Linux distro for ISIS, he could now face up to 20 years in prison.

The Chicago student is suspected to have provided propaganda content that supports the Islamic State terrorist group (ISIS).

Osadzinski developed a Python script to that allows supporters and members of the organization to automatically save ISIS propaganda material shared through social media.  The student shared his script with members of the organizations in order to help spreading the ISIS’ propaganda, he also offered them the use of bots to automate the process on a large-scale.

Osadzinski also began developing a lightweight Gentoo Linux distro for the terrorist organization.

“I will began a new and very valuable project, I will be developing a custom Gentoo Linux version designed for ansar [ISIS supporters] it can run on any computer and will be very lightweight, fast and secure.” the student told to an undercover FBI agent in an online discussion in March .

The student aimed at hardening the Linux Gentoo distro to prevent hacks from the intelligence agencies that he defined as “crusader intelligence agencies.”

Osadzinski provided another FBI undercover agent a screenshot of the Gentoo Linux distro he was preparing, promising that it would be “available for the ansar [ISIS supporters] very soon.”

“It will be very secure, in sha allah it will only browse [Social Media Platform 1]. When there are less things installed the operating system is harder to hack,”

The student was not able to complete his work because of the difficulty in studying for hardening the Linux distro.

According to Cyberscoop, to  also worked for two months as a software tester for Blackberry Cylance.

The student, if will found guilty for distributing propaganda material to support ISIS, will dace up to 20 years in prison.

(SecurityAffairs – ISIS, Gentoo Linux)

[adrotate banner=”5″]

[adrotate banner=”13″]

CheckPoint uncovered an extensive surveillance operation conducted by Iranian APT actor and tracked as Domestic Kitten aimed at specific groups of individuals.

Researchers at security firm CheckPoint uncovered an extensive surveillance operation conducted by Iranian APT actor and tracked as Domestic Kitten aimed at specific groups of individuals.

Cyber spies used malicious mobile apps that collect sensitive information on the target device and implements specific features to spy on the victims, such as recording the surrounding voices.

The attackers are spying on Iranian individuals that are Kurdish and Turkish natives, and ISIS supporters.

“Through the use of mobile applications, those behind the attack use fake decoy content to entice their victims to download such applications, which are in fact loaded with spyware, to then collect sensitive information about them.” reads the published by CheckPoint.

“Interestingly, these targets include Kurdish and Turkish natives and ISIS supporters. Most interesting of all, though, is that all these targets are actually Iranians citizens.”

The list of information collected from the compromised devices is long and includes:

• contact lists
• call records
• text and multimedia messages
• browser history and bookmarks
• geographical location
• photos
• recordings of nearby conversations
• list of installed apps
• clipboard content
• data on external storage

The threat actor uses decoy applications which are believed to be of interest to the targets. The researchers discovered ISIS branded wallpaper changer, “updates” from the ANF Kurdistan news agency and a fake version of the Vidogram messaging app.

All the applications used in the campaign have the same certificate that was issued in 2016, the researchers confirmed that the extensive and targeted attacks are going on since 2016 and, until now, have remained under the radar due to the artful deception of the attackers towards their targets

The wallpaper changer aimed at the ISIS supported is designed to lure them by offering ISIS-related pictures to set as the screen background.

Data exfiltrated from the victim’s device are transferred to the C&C server via HTTP POST requests, it is encrypted with the AES algorithm and can be decrypted with a device ID that is unique for each victim.

One of the applications connects firmwaresystemupdate[.]com that is a newly registered website that was seen initially to resolve to an Iranian IP address but that later switched to a Russian address.

CheckPoint published the victim distribution, the cyberspies infected devices of at least 240 users most of them are Iranians (97%), the remaining are from in Afghanistan, Iraq and Great Britain.

“Indeed, these surveillance programs are used against individuals and groups that could pose a threat to the stability of the Iranian regime. These could include internal dissidents and opposition forces, as well as ISIS advocates and the Kurdish minority settled mainly in Western Iran,” CheckPoint concludes.

(Security Affairs –  Domestic Kitten, surveillance)

[adrotate banner=”5″]

[adrotate banner=”13″]

A coordinated effort of law enforcement agencies (law enforcement authorities of the European Union Member States, Canada, and the USA) hit the Islamic State propaganda machine.

European law enforcement agencies coordinated by Europol conducted an unprecedented multinational cyber operation against the Islamic State’propaganda machine.

Authorities have “punched a big hole” in Islamic State’s propaganda machine, they targeted news agencies and radio stations in a two-day takedown operation.

“On 25 April 2018 law enforcement authorities of the European Union Member States, Canada and the USA launched a joint action against the so-called Islamic State (IS) propaganda machine in order to severely disrupt their propaganda flow.” read the press release published by Europol.

“The takedown operation was coordinated by the European Union Internet Referral Unit (EU IRU) within the European Counter Terrorism Centre (ECTC) at the Europol headquarters.” 

: Takedown of Islamic State propaganda machine in international operation coordinated by Europol. Amaq – the main mouthpiece of the terrorist organisation – among those knocked down offline https://t.co/S59CFh8V9e pic.twitter.com/G5sCTvVrIH

— Europol (@Europol)

The operation hit Islamic State media outlets, including the Amaq and Nashir news agencies and al-Bayan radio.

The authorities seized the servers and are analyzing data to identify the administrators behind principal media outlets.

“With this groundbreaking operation we have punched a big hole in the capability of IS [Isis] to spread propaganda online and radicalise young people in Europe.”  said Rob Wainwright, executive director of Europol.

This isn’t the first time Europol and other agencies target Islamic State propaganda machine since 2015 they have conducted numerous operations to shut down the infrastructure used by the terrorists.

“This shows that by working together we can stamp out the poisonous propaganda Daesh [Isis] has used to fuel many of the recent terror attacks in Europe. For too long the internet has been open to terrorists and those who seek to do us harm. Those days are coming to an end thanks to this type of co-ordinated global work.” said the EU security commissioner, Julian King.

(Security Affairs – Europol, online terrorist propaganda)

[adrotate banner=”5″]

[adrotate banner=”13″]

GCHQ director Jeremy Fleming announced this week that the U.K. has launched a major cyberattack on the Islamic State (IS) terrorist organization.

According to the spy chief, the GCHQ the attack was launched in collaboration with the U.K. Ministry of Defence and has distributed operations of the Islamic State.

The UK intelligence believes this is the first time it “systematically and persistently degraded an adversary’s online efforts as part of a wider military campaign,”

Fleming explained that UK cyber experts have operated to disrupt online activities and networks of the Islamic State, and deter an individual or group.

“These operations have made a significant contribution to coalition efforts to suppress Daesh propaganda, hindered their ability to coordinate attacks, and protected coalition forces on the battlefield,” GCHQ chief told an audience at the Cyber UK conference in Manchester.

“In 2017 there were times when Daesh found it almost impossible to spread their hate online, to use their normal channels to spread their rhetoric, or trust their publications. Of course, the job is never done – they will continue to evade and reinvent. But this campaign shows how targeted and effective offensive cyber can be,” 

Mr. Fleming did not reveal details of the cyber attacks because it was “too sensitive to talk about,” he praised the success of such kind of operations against a threat that is to spread propaganda.

“Much of this is too sensitive to talk about, but I can tell you that GCHQ, in partnership with the Ministry of Defence, has conducted a major offensive cyber campaign against Daesh.” added Mr. Fleming.

“These operations have made a significant contribution to coalition efforts to suppress Daesh propaganda, hindered their ability to coordinate attacks, and protected coalition forces on the battlefield. But cyber is only one part of the wider international response. This is the first time the UK has systematically and persistently degraded an adversary’s online efforts as part of a wider military campaign.”

The US CYBERCOM and Europol have also been conducting cyber operations against online activities of the Islamic State.

Mr. Fleming has also spoken about Russia defining its cyber activity as an “unacceptable cyber-behaviour” that was a “growing threat” to the West.

“We’ll continue to expose Russia’s unacceptable cyber behaviour, so they’re held accountable for what they do, and to help Government and industry protect themselves. The UK will continue to respond to malicious cyber activity in conjunction with international partners such as the United States. We will attribute where we can.” added Flaming.
“And whilst we face an emboldened Russia, we also see the tectonic plates in the Middle East moving. We see Iran and its proxies meddling throughout the region. The use of Chemical Weapons in Syria. We’re watching the dispersal of Daesh fighters. Serious Crime Gangs smuggling people from Eastern Europe and Northern Africa.”

Flaming also cited the NotPetya ransomware attack on Ukraine that both UK and US attributed to Russia.

“They’re not playing to the same rules,” Mr Fleming concluded. “They’re blurring the boundaries between criminal and state activity.”

(Security Affairs – Islamic State, terrorism)

[adrotate banner=”5″]

[adrotate banner=”13″]

The UE issued new recommendations to tackle illegal content online, it asked internet companies to promptly remove terror content from their platforms within an hour from notification.

On Thursday, the UE issued new recommendations to internet companies to promptly remove “harmful content,” including terror content, from their platforms.

“As a follow-up, the Commission is today recommending a set of operational measures accompanied by the necessary safeguards – to be taken by companies and Member States to further step up this work before it determines whether it will be necessary to propose legislation.” reads the fact sheet published by the European Commission.

“These recommendations apply to all forms of illegal content ranging from terrorist content, incitement to hatred and violence, child sexual abuse material, counterfeit products and copyright infringement.”

It is a call to action for the tech firms and social media giants to take down “terrorist content” within an hour of it being reported, the recommendation is directed to major services including YouTube, Facebook, and Twitter.

These platforms are daily abused by terrorist organizations like Islamic State group, the EU’s recommendations follow the demands of the nations participant at the 2017 G7 Summit held in Taormina, Italy, that urged action from internet service providers and social media giants against extremist content online.

The European Commission is teaming up with a group of US internet giants to adopt additional measures to fight web extremism, but at the same time, it warned it would adopt consider legislation if the Internet firms will not follow the recommendations.

“While several platforms have been removing more illegal content than ever before — showing that self-regulation can work — we still need to react faster against terrorist propaganda and other illegal content,” said the commission’s vice-president for the Digital Single Market Andrus Ansip.

“This content remains “a serious threat to our citizens’ security, safety, and fundamental rights,” 

What is illegal offline is also illegal online. Limited liability system under EU's law already works well – it should stay in place. My statement at press conference on fighting illegal content online: https://t.co/c8atYaU59e pic.twitter.com/suFyfIsQSV

— Andrus Ansip (@Ansip_EU)

The European Commission recognized the results achieved by internet firms in combatting illegal content, but the adversaries are very active and there is still a lot of work to do.

“significant scope for more effective action, particularly on the most urgent issue of terrorist content, which presents serious security risks”.

The European Commission pretends that terrorist content should be taken down within one hour of being reported by the authorities, it also urges more strictly monitoring and proactive actions against the illegal content.

The EU suggests the adoption of automated detection systems that could support tech firms to rapidly identify harmful content and any attempt to re-upload removed illegal content.

The new recommendations specifically address also other types of harmful illegal content such as hate speech and images of child sexual abuse.

“Illegal content means any information which is not in compliance with EU law or the law of a Member State. This includes terrorist content, child sexual abuse material (Directive on combating sexual abuse of children), illegal hate speech (Framework
Decision on combating certain forms and expressions of racism and xenophobia by means of criminal law), commercial scams and frauds (such as Unfair commercial practices directive or Consumer rights directive) or breaches of intellectual property rights (such as Directive on the harmonisation of certain aspects of copyright and related rights in the information society).” continues the EC.
“Terrorist content is any material which amounts to terrorist offences under the EU Directive on combating terrorism or under national laws — including material produced by, or attributable to, EU or UN listed terrorist organisations.”

According to the commission, internet firms removed 70 percent of illegal content notified to them in the preceding few months.

(Security Affairs – European Commission, terror content)

[adrotate banner=”5″]

[adrotate banner=”13″]