Muslim activists 'hack Isis mailing list hours after terrorists claimed it was unhackable'

Muslim hackers claim they have attacked Isis’s propaganda network and published a list of almost 2,000 subscribers’ email addresses in the latest blow to the online “caliphate”.

After numerous cyber attacks and official takedowns targeting its Amaq “news agency”, a message appeared on Friday night claiming security had been increased.

“In response to recent events, we have imposed more stringent security measures on our systems,” said the email in Arabic. “We can now handle email attacks or any type of hack.”

For a Muslim hacking collective called Di5s3nSi0N, which said it disabled the automated email service last month, it was “challenge accepted”. Less than three hours later, another email was sent out to Amaq subscribers, but this time displaying the hackers’ logo and a warning. “We have hacked the full ‘secure’ email list for Amaq,” it said. “Daesh...shall we call you dogs for your crimes or snakes for your cowardice? We are the bugs in your system.”

The email contained a list of 1,784 subscribers’ email addresses, which were redacted but have been partially verified by The Independent.

open image in gallery

“Challenge complete – too easy!” Di5s3nSi0N activists wrote on Twitter. “2,000 email subscribers hacked from Amaq...what is next?”

Amaq is one of Isis’s key outlets, issuing claims for international terror attacks as well as updates from battles across the Middle East, Africa and Asia.

Increasing crackdowns forced Amaq’s website to retreat from mainstream platforms to rapidly shifting websites and encrypted messaging services, and its automated email service had been one of the last reliable channels.

At the time of writing, cyber attacks had disabled updates on Amaq’s current website, its Tumblr account was outdated and the only platform it remained able to operate was on the Telegram messaging service.

As Isis territory has been retaken on the ground, seeing Syrian forces push into the last town held by militants this week, governments and activists have been taking on its sophisticated media network.

The Di5s3nSi0N attack was part of the group’s #silencetheswords campaign, which it claims will culminate next week.

It is among the vigilante hacking collectives targeting Isis’ websites and servers, which have continued to relay propaganda to its followers despite a mounting international crackdown.

The shadowy collective has a mission statement reading: “We the steadfast youth of ahlus-Sunnah wal-Jammah [Sunni Muslims] are back to break Daesh.”

Di5s3nSi0N members describe Isis as traitors who worship a “false caliph” in their leader Abu Bakr al-Baghdadi. They has been hacking websites hosting Isis propaganda including Halummu news agency, al-Furqan video outlet and al-Bayan online radio station.

Members of CtrlSec and End of Daesh have also been launching operations and tweeting updates tweet using the #OpIsis and #OpIceIsis hashtags.

Previous attacks have been anyone attempting to view the Amaq website met with malicious software disguised as an update, able to activate cameras, steal files, read phone messages, detect GPS locations and collect contacts from unsuspecting jihadis.

Meanwhile, group called Daeshgram has been working to sow discord and confusion among Isis supporters by setting up accounts issuing convincing fake statements.

open image in gallery

“Isis supporters on Telegram are very confused which one is fake and which one is real,” an activist told The Independent. “They usually fail in guessing and join the fake ones thinking they are real.”

Some of Daeshgram’s posts mock Isis fighters, appearing to show them gathering to watch videos of bikini-clad women, while others aim to undermine the group’s messaging.

It has used fake al-Bayan radio broadcasts to distribute information about Isis’s battlefield losses and defections, as well as highlighting the number of informers and spies.

The group’s propaganda agencies have issued warnings over forgeries and attempted to direct followers to official accounts, rather than the “campaign by the enemies of Allah to distort the image of the Islamic State”, but Daeshgram says its posts continue to be shared.

While online activists continue their attacks, platforms including Facebook, Twitter and YouTube have been increasing efforts to identity and remove extremist content and the UK’s Counter Terrorism Internet Referral Unit has removed hundreds of thousands of pieces of terrorist material.

But Isis has been finding ways to evade detection on Telegram and other sites, with a recent report finding that jihadi content was accessed more frequently in the UK than anywhere else in Europe.

Analysts say huge losses for Isis on the ground have damaged its ability to maintain its propaganda output, with its flagship monthly Rumiyah propaganda magazine several weeks overdue.

Following the declaration of the so-called Islamic State in early 2014, the group’s main aim was for supporters to migrate to its territory in Syria and Iraq. It produced countless glossy propaganda videos, images, magazines and websites in multiple languages attempting to depict a utopia, frequently showing farming, food and money being distributed to the poor and children playing.

But good news has been increasingly hard to come by as militants have been driven out of every major stronghold, leaving outlets to post infrequent battlefield updates from the desert around the Syria-Iraq border, and from smaller branches in countries including Afghanistan, Egypt and the Philippines.

Senior Isis propagandists have also been targeted by the US-led coalition, seeing spokesman Abu Muhammad al-Adnani among those killed last year.

Amid accelerating territorial losses and crackdowns on supporters attempting to reach it, Isis has switched its propaganda effort to inciting global terror attacks – a risk that officials say shows no sign of slowing.

Charlie Winter, a senior research fellow at the International Centre for the Study of Radicalisation and Political Violence (ICSR), said Isis can now “barely get out 20 pieces of media a week” – down from more than 200 in 2015.

“Isis may be less productive than ever, but the quality and ambition of its propaganda remains head and shoulders above that of its rivals,” he wrote for the BBC. “Indeed, in spite of the pressures the group is facing on the ground in Syria and Iraq, the trickle of instructional materials on how to plan terror attacks still emerging online could prove extremely dangerous.”

Update: Analysis has shown that Di5s3nSi0N used a program to falsely make its emails appear to be coming from the same address used by Isis. It has continued to send emails to some Amaq subscribers but it remains unclear whether the addresses have been obtained through hacking or found in the public domain.