(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. Last week, a white supremacist accelerationist Telegram channel posted a message with advice for individuals planning future terrorist attacks. The message was shared on at least three other channels, and a similar message, posted by a notorious account connected to a neo-Nazi website was viewed almost 500 times. Also on Telegram, CEP researchers discovered a regional Proud Boys channel that posted information doxing the host of a recent drag event.
Additionally, more than a dozen Twitter accounts posting various antisemitic, racist, and extreme-right content were located. Also, a neo-Nazi website that had previously extensively promoted the work of James Mason announced that it was severing ties with him.
CEP researchers also located pro-ISIS content on various websites. On Telegram, RocketChat, and a cloud storage site, the pro-ISIS Al-Azaim Media Foundation released issue 17 of the web magazine “Voice of Khurasan.” In a sample of pro-ISIS content on Facebook, CEP found 10 profiles that posted a variety of ISIS and pro-ISIS propaganda, including a full-length official ISIS video. Finally, the pro-ISIS tech group Qiman Electronic Foundation (QEF) offered supporters assistance on a bulletin board website if they had lost data due to ransomware.
White Supremacist Accelerationist Telegram Channel Offers Advice for Potential Lone Actor Terrorists
On November 2, a notorious white supremacist accelerationist Telegram channel offered advice for individuals planning future terrorist attacks. The message advised a strategy of surveillance and training before an act of violence and warned that all preparations should be kept secret. The Telegram channel is private, meaning the number of followers is hidden. At least three additional channels shared the message. The same day, a different statement that also encouraged lone actor attacks and secrecy in planning was shared by several Telegram channels, including the main channel for a neo-Nazi website linked to the AWD/NSO successor organization NSRF. The message was viewed almost 500 times within five days.
Proud Boys Chapter Doxes Host of Drag Event on Telegram
CEP researchers located a regional Proud Boys Telegram channel that posted information doxing the host of a recent drag event in a different state. The alleged home address and social media profile of the owner of the company hosting the event was published on the Telegram channel, which has over 200 followers. The same channel has previously posted that if you are “a heterosexual of European descent,” LGBTQ people “wish to destroy you and your way of life.”
Extreme-Right, Antisemitic, Racist Twitter Accounts Created on Twitter
In the first week of November, CEP researchers located over a dozen Twitter accounts created in October 2022 that posted various antisemitic, racist, and extreme-right content. These posts occurred simultaneously as rumors regarding the potential loosening of Twitter’s rules on hateful conduct and a growth in hate speech on the social media site. CEP located eight accounts that promoted the white supremacist and antisemitic National Justice Party and posted racist, conspiratorial, and antisemitic content that included Holocaust denial and promotion of the white genocide conspiracy theory. Six of the eight accounts were removed by November 7.
CEP researchers also located a Twitter account that began posting on October 28, tied to a notorious white supremacist Telegram channel allegedly operated by former Canadian Proud Boys. The Twitter profile, advertised on the Telegram channel, posted antisemitic content and promoted Holocaust denial and racism. The Twitter account also posted content supporting the neo-Nazi Nationalist Socialist Club, including clips from the group’s propaganda videos. The account had over 800 six days after it was created. The account was removed by November 7.
An account was also located that promoted a regional white supremacist active club.
Antisemitic meme “The Happy Merchant” posted by a Twitter account on October 28 that also promoted the National Justice Party.
Neo-Nazi Website Breaks Ties with James Mason
On October 30, a neo-Nazi website that has previously extensively promoted the work of James Mason announced that they were severing ties with the notorious author of Siege, calling him an “underhanded asshole.” The website authors stated that they could no longer work with Mason due to negative statements and accusations he made against Atomwaffen Division (AWD) and National Socialist Order (NSO), now National Socialist Resistance Front (NSRF) leaders and working with a former NSO member who was kicked out of the group allegedly for pedophilia. The website additionally stated that Mason had also been having an affair with his friend’s wife and was angry that content he authored was not posted on the website. The site stated that they would focus on other projects in the future, including publishing a book by NSLF members, but noted that this was a “sad time” for them. In September, the site posted a blog announcing the creation of the NSRF and its goals of the elimination of all Jews, non-whites, and LGBTQ people. The website was originally launched in May 2020.
Pro-ISIS Web Magazine “Voice of Khurasan 17” Released
On November 1, the pro-ISIS Al-Azaim Media Foundation released issue 17 of the web magazine “Voice of Khurasan.” The main article criticized the Taliban and Hamas as nationalist organizations sympathetic to Iran and linked to Qatar. The same piece accused Iran of using both the Taliban and Hamas as a counterbalance to ISIS in the Middle East and criticized the Taliban for their failure to institute religious law and continuation of relations with the government of China, despite their persecution of the Uyghurs. The magazine also contained a biography of the ISIS fighter who committed the March 2020 attack on a Sikh Gurdwara in Kabul, Afghanistan, which killed 25 people and injured eight. Other articles condemned Yusuf al-Qaradawi, following secular law, and advised the reader to participate in fighting and eventual martyrdom. Additional articles advocated strict modesty for women and criticized French colonial policies in North Africa and during the Algerian War of Independence.
In addition to Telegram, RocketChat, and a cloud storage site, the web magazine was released on at least seven other websites. Twenty-four hours later, the web magazine was available on five websites: Anonfiles, FastFileUpload.Com, Files.Fm, MediaFire, and the Internet Archive. AnonFiles, Files.Fm, and MediaFire removed the web magazine after CEP reported it. The Internet Archive made the file only accessible to logged in users after CEP reported it.
Article in “Voice of Khurasan” issue 17
Pro-ISIS Content Located on Facebook
In a sample of content located on November 3, CEP researchers found 10 pro-ISIS Facebook profiles. The accounts posted a variety of ISIS and pro-ISIS propaganda, including a full-length official ISIS video, pro-ISIS videos, clips from ISIS videos, recently released Amaq news videos, text-based propaganda, photos, and audio statements. The 10 accounts had an average of 349 friends or followers, ranging between four and 990. CEP reported the 10 accounts to Facebook on November 3. Approximately 24 hours later, all 10 profiles were still online.
One account also posted contact information for the Telegram bot for the al-Saqri Foundation, which publishes manuals on the manufacture and use of explosives, poisons, and other weaponry.
Al-Saqri Foundation message posted on Facebook. Screenshot taken on November 3, 2022.
Another account posted a full-length, previously released ISIS video modified to evade detection and removal. Video images were doubled, colors were altered, but ISIS logos remained in the video. The video “Inside the Caliphate 8” encourages acts of lone-actor terrorism, including the use of explosives and vehicular attacks. The video had accumulated 88 views, four reactions, and 13 comments in the 25 days after it was uploaded. CEP reported the video to Facebook on November 3, but it was still online approximately 24 hours later.
The modified ISIS video “Inside the Caliphate 8” on Facebook. Screenshot taken on November 3, 2022.
The video was originally released by ISIS’s Al Hayat Media Center on October 30, 2018. The upload that CEP found was added to Facebook on October 9, 2022. CEP located and reported a copy of the same video on another Facebook profile in September 2020.
Among the propaganda that CEP located included an Amaq news video celebrating the ISIS-claimed attack on October 26 at the Shah Cheragh Shrine in Iran, where 15 people were killed and more than 40 wounded.
Pro-ISIS Tech Group Offers Assistance Removing Ransomware
In a post on a bulletin board website, the pro-ISIS tech group Qimam Electronic Foundation (QEF) advised supporters to contact them if they lost data due to ransomware. The post included a list of potential attack programs. QEF has previously issued warnings regarding Facebook data breaches, recommended email providers, and warned about potential malware vulnerabilities.