Hacking for ISIS: The Emergent Cyber Threat Landscape By Laith Alkhouri, Alex Kassirer, & Allison Nixon April 2016 Hacking For ISIS Contents Click on a title to navigate to the page Introduction ...........................................................................................................................................2 Cyber Caliphate ...................................................................................................................................3 Islamic State Hacking Division .......................................................................................................6 Islamic Cyber Army ............................................................................................................................9 Rabitat Al-Ansar ................................................................................................................................ 12 Sons Caliphate Army ...................................................................................................................... 15 United Cyber Caliphate .................................................................................................................. 17 Techniques, Tactics, & Procedures (TTPs) .............................................................................. 20 The Future of ISIS’s Cyber Capabilities .................................................................................... 24 Conclusion .......................................................................................................................................... 25 Hacking For ISIS Introduction s the Islamic State (ISIS) has grown neither advanced nor do they over the past two years, so too has demonstrate sophisticated targeting; A its media machine, global support, however, the severity of cyber attacks and online channels. This unprecedented supporting ISIS will likely not remain at this expansion has now come to include level of relative unsophistication. capabilities to inflict damage over the Internet, which came to light when its For the vast majority of its existence, the supporters began coordinating and pro-ISIS hacking landscape was organizing cyber attacks on Western composed of at least five distinct targets. Highlighting this newfound desire groups that launched campaigns in to cause virtual harm was the brief 2014 support of the terror group. Although takeover of Twitter accounts run by US operating under different appellations for CENTCOM and Newsweek. nearly a year and a half, there was evidence that these groups, and the individuals who In the wake of the aforementioned Twitter constitute them, overlapped or coordinated takeover, which was claimed by an with one another in certain campaigns, ISIS-supportive hacking collective called pooling their resources and manpower. the “Cyber Caliphate,” two implications This culminated in the April 4, 2016, that would prove to further change an announcement of a “United Cyber already evolving jihadi landscape unfolded. Caliphate” following the formal merger Firstly, the hacking attacks launched in of several groups. However, as these support of ISIS generated global groups have operated as individual entities attention and afforded ISIS increased for the majority of their existence, this publicity. Secondly, like-minded individuals paper will reflect that history, first exploring and groups found new ways to target the most prominent actors on an individual Western interests. As such, new basis, followed by a look into the nascent concerns regarding ISIS’s cyber “United Cyber Caliphate” collective. capabilities emerged. Regarding this coordination, however, it is At the center of the conversation has been important to note that because the whether ISIS’s cyber prowess is a real pro-ISIS hacking effort is still an unofficial threat or exaggerated. Given the attacks endeavor, neither acknowledged nor that resulted in the CENTCOM and claimed by ISIS itself, it is still poorly Newsweek Twitter accounts being organized (and likely under-resourced), compromised, it appears that ISIS’s which often leads to conflicting messaging supporters maintain somewhat of an among the relevant actors. This existing coordinated cyber campaign that inconsistency is best illustrated by the way aims at launching attacks on targets of these groups identify themselves in claims opportunity, typically those that are of credit, a trend that this paper will explore considered low-hanging fruit. Nonetheless, in more detail. the group's overall capabilities are 2 Hacking For ISIS Spearheaded by a Lone ISIS Fighter Obtaining Sensitive Documents Efforts to launch, grow, and improve the The data provided by the hackers on the “Cyber Caliphate” brand, and thus the ISIS potential compromise of a Fusion Center community’s cyber reputation, were led by demonstrate that the actors had access to a British actor named Junaid Hussain some number of "UNCLASSIFIED//FOR (a.k.a. Abu Hussain Al Britani). Formerly OFFICIAL USE ONLY" and "LAW “TriCk” of TeaMp0isoN fame, Hussain fled ENFORCEMENT SENSITIVE" products as the UK to join ISIS in 2013, after serving a recently as November 26, 2014. It is prison sentence for hacking Tony Blair. possible that this data was stolen from Armed with the technical knowledge and associated email addresses receiving law relevant experience, Hussain utilized his enforcement bulletins. position as a member of ISIS to recruit hackers and cultivate his “Cyber Data thus far provided, however, is not Caliphate,” all while on the ground in ISIS’s sufficient enough to establish the full self-proclaimed capital, Raqqa. compromise of the Fusion Center. Hussain’s Legacy Continues Despite his background, the hacking Nonetheless, this group demonstrated at collective supporting ISIS under Hussain’s least a basic level of credibility and Further exemplifying Hussain’s legacy is direction―until he was killed in an August capability, proving to have the capacity to his wife, Sally Jones (aka Umm Hussain 2015 drone strike in Raqqa―was still launch follow-on attacks against the same Britaniya). Attempting to carry on her late unsophisticated and less productive than or similar organizations weeks after the husband’s mission, she maintains a prolific what might be expected of an effort led by original compromise. and violent social media presence; for a former Western hacking group leader. instance, she released, “the address & This is in part due to Hussain’s inability to details of US Military target no.2 also one provide the ISIS cyber community with a Post-Junaid Hussain of America's most decorated soldiers,” network of other hackers; Hussain’s prior Sgt. 1st Class Dillard Johnson on October contacts largely were unsympathetic to his Although Junaid Hussain was targeted and 8, 2015. Making very clear why she Cyber Caliphate increasingly radical ideology, leading to the killed in an August 2015 drone strike, released the information, Britaniya dissolution of his “hacking rolodex.” temporarily slowing ISIS supportive proclaimed, “Once again I leave these hacking activities, the group’s notoriety is details online to cause havoc in his life & (Caliphate Cyber Army CCA) something future jihadists will likely for my brothers and Al-Qaeda in the U.S to capitalize on to launch further cyber eventually hunt him down & kill him.” The first of the pro-ISIS hacking groups emerged after ISIS attacks. declared its Caliphate in the summer of 2014. In addition to the Proving this desire to carry on without its aforementioned hijacking of Newsweek and CENTCOM’s Twitter former leader, it is now evident that the accounts, the group identifying itself as the “Cyber Caliphate” group replaced Hussain with claimed credit for a string of attacks that generated global British-educated businessman and publicity. On January 6, 2015, for instance, the group launched computer expert, Siful Haque Sujan, a cyber attacks on a number of US targets, including the city of 31-year-old Bangladeshi whose role was Albuquerque, New Mexico; the Facebook and Twitter profiles for brought to light after he too was targeted the Albuquerque Journal; WBOC News (which serves the Delmarva and killed in an American drone strike in Peninsula in Delaware, Maryland, and Virginia); and a Fusion Center Raqqa, Syria, on December 10, 2015. in Tennessee, although that allegation was not fully substantiated. Photo: Junaid Hussain (a.k.a. Abu Hussain Al Britaini) 3 4 Hacking For ISIS Spearheaded by a Lone ISIS Fighter Obtaining Sensitive Documents Efforts to launch, grow, and improve the The data provided by the hackers on the “Cyber Caliphate” brand, and thus the ISIS potential compromise of a Fusion Center community’s cyber reputation, were led by demonstrate that the actors had access to a British actor named Junaid Hussain some number of "UNCLASSIFIED//FOR (a.k.a. Abu Hussain Al Britani). Formerly OFFICIAL USE ONLY" and "LAW “TriCk” of TeaMp0isoN fame, Hussain fled ENFORCEMENT SENSITIVE" products as the UK to join ISIS in 2013, after serving a recently as November 26, 2014. It is prison sentence for hacking Tony Blair. possible that this data was stolen from Armed with the technical knowledge and associated email addresses receiving law relevant experience, Hussain utilized his enforcement bulletins. position as a member of ISIS to recruit hackers and cultivate his “Cyber Data thus far provided, however, is not Caliphate,” all while on the ground in ISIS’s sufficient enough to establish the full self-proclaimed capital, Raqqa. compromise of the Fusion Center.