(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. As part of an ongoing propaganda video series, ISIS released four new videos last week of their fighters pledging allegiance to the group’s new leader. ISIS also announced an attack in the new self-proclaimed Sahel province in Mali, claiming in the announcement that dozens of Malian soldiers were killed and injured. Online ISIS supporters praised the knife attack in Be’er Sheva, Israel on Telegram, Hoop, and RocketChat. A pro-ISIS Matrix server was hacked by an unknown group; the hack was confirmed by ISIS supporters on Hoop, RocketChat, and Telegram.
In addition, an online store affiliated with the white supremacist Rise Above Movement encouraged their followers to create fake mainstream social media accounts. Finally, CEP researchers discovered a neo-Nazi accelerationist book on Google Drive.
Four ISIS Videos Released on Multiple Websites
ISIS released four new videos on March 21, March 22, March 24, and March 25 as part of the propaganda video series showing their fighters pledging their allegiance to the group’s new leader Abu Hasan al-Hashimi al-Qurashi.
The first video, released on March 21 from the group’s self-proclaimed Khurasan province, showed 17 different sets of fighters pledging allegiance to the new ISIS caliph. The video was spread on Telegram, RocketChat, and Hoop, and links were spread on PasteThis.To. The video was also posted on at least 14 different websites. Approximately 72 hours later, the video was still available on four websites: Facebook, the Internet Archive, Top4top, and Mail.Ru. Facebook and Mail.Ru removed the video after CEP reported it.
The second video, the sixth in the series, was released from ISIS’s self-proclaimed Pakistan province on March 22. The video shows ISIS fighters pledging their allegiance to the group’s new leader and proclaiming the caliphate as the only legitimate form of government. The video was posted on RocketChat, Hoop, and Telegram and was additionally spread on at least 19 other websites. Approximately 48 hours later, the video was still available on 14 websites: Facebook, the Internet Archive, Anonfiles, Bayfiles, Download.gg, Drop.Download, the IPFS distributed web platform, File.Cm, Nextcloud, Transfer.Sh, UsersDrive, Ufile.io, Dreamlink.cloud, and Zippyshare. Anonfiles, Bayfiles, and Facebook removed the video after CEP reported it.
On March 24, ISIS released the seventh video in their series from the group’s self-proclaimed Sinai province, showing two different groups pledging their allegiance to al-Qurashi. In addition to Telegram, Hoop, and RocketChat, the video was uploaded to at least 15 other websites. Approximately 24 hours later, the video was available on eight sites: Facebook, File.Cm, File.Fm, FromSmash, GoFile.Io, the IPFS distributed web protocol, Streamable, and the Internet Archive. GoFile.Io, Streamable, and Facebook removed the video after it was reported by CEP.
The eighth video in the series, from ISIS’s self-proclaimed India province, was released on March 25 on at least 14 websites in addition to Telegram, Hoop, and RocketChat. Approximately 72 hours later, the video was available on four websites: Facebook, the Internet Archive, the IPFS distributed web protocol, and FromSmash. Facebook removed the video after it was reported by CEP. Shortly after the video was uploaded, the Microsoft One Drive, File.Fm, GoFile.Io, and Streamable removed copies following the reporting of content from CEP.
In all four cases, the Internet Archive made the video only accessible to logged in users after CEP reported the video.
ISIS video on Facebook from the group’s self-proclaimed state in Pakistan, screenshot taken March 24, 2022.
ISIS Announces Creation of Sahel Province
On March 22, ISIS announced an attack in the new self-proclaimed Sahel province in Mali in an Amaq News post, in which they claimed that dozens of Malian soldiers had been killed or wounded in an assault on a military base. ISIS in Mali had previously been included in the terrorist group’s self-proclaimed West Africa province. The new province might also include ISIS groups operating in Niger and Burkina Faso and potentially other countries in the region. The declaration of a new Sahel Province could indicate growing regional importance, the desire for a more independent leadership structure in the area, an attempt to capitalize on France’s withdrawal from Mali, or the creation of new provinces under the direction of the terrorist group’s new leader Abu Hasan al-Hashimi al-Qurashi. On Telegram, ISIS online supporters praised the new province and hoped it would mean more ISIS activity in the region.
ISIS Online Supporters Praise Attack in Be’er Sheva, Israel
ISIS online supporters praised the March 22 knife attack in Be'er Sheva, Israel by Mohammed Abu al-Kiyan, who was killed after murdering four people and injuring two in a vehicle and knife attack at a gas station and mall. According to Israeli authorities, Abu al-Kiyan had been a known ISIS supporter and had served time in prison for planning to join ISIS in Syria in 2015.
Online ISIS supporters on Telegram, Hoop, and RocketChat glorified the attacker and specifically praised him for conducting an attack in Israel. An ISIS supporter on Telegram stated that the group's supporters should conduct attacks on civilians, including children, in their home countries.
Online Pro-ISIS Chat Allegedly Hacked
An unknown group or individuals allegedly hacked a pro-ISIS Matrix server on March 22. ISIS online supporters on Hoop, RocketChat, and Telegram confirmed the hack and advised their followers not to use the Element messaging platform, to delete accounts on the hacked website, and to improve their cyber security through the use of VPNs. ISIS supporters claimed that the website that hosted the Matrix server was not properly secured and that messages and sensitive information could potentially be exposed. ISIS supporters on RocketChat posted contact information for answering cybersecurity questions and warned against individuals identified as alleged cybersecurity specialists who were reportedly compromised.
Rise Above Movement Linked Clothing Brand Encourages Setting Up Social Media Accounts for Spreading Propaganda
On March 20, a clothing brand and online store affiliated with the white supremacist Rise Above Movement and active club movement encouraged their followers to create fake mainstream social media accounts to spread videos, photos, and Telegram and website links. The post stated that this would be an opportunity to reach a broader audience and get individuals involved with online activism. The store offered $25 in credit for every 100 followers a propaganda account received, with bonuses for larger follower counts. The group also posted a website for temporary access to fake phone numbers for account creation.
Neo-Nazi Terrorist Book Located on Google Drive
CEP researchers located a neo-Nazi accelerationist book on Google Drive on March 24. The text was initially released on June 16, 2021, and calls for acts of terrorism, including mass shootings, attacks on infrastructure, and the targeting of individuals based on their race or religion. Google Drive did not remove the document after CEP reported it.