Cyber Threat Actor: The Cyber Army of the Khilafah

The Cyber Army of the Khilafah, also known as the Islamic Cyber Army, operates as a cyber threat actor aligned with ISIS objectives. Publicly documented activities indicate a focus on retaliatory operations and intimidation campaigns, primarily targeting entities perceived as opposing ISIS interests. The group’s operations demonstrate coordination with ISIS propaganda efforts, leveraging cyber intrusions to amplify physical threats and ideological messaging.

This actor has conducted disruptive attacks against Western military targets and Syrian human rights organizations. In December 2015, the Islamic Cyber Army leaked personal data of 160 French and U.S. military personnel—including names, addresses, and contact details—explicitly framing the action as retaliation against Anonymous hacktivist operations. The leak targeted mid-level officials and senior officers, with claims of holding additional unreleased military data. Earlier in July 2015, the same group under its "Cyber Army of the Khilafah" alias hacked the Syrian Observatory for Human Rights, replacing content with a manipulated image depicting the director in an orange jumpsuit akin to ISIS execution victims. This attack included direct threats to silence the Observatory’s documentation of war crimes. Tactics center on website defacements, data leaks distributed through ISIS-linked social media channels, and psychological intimidation through imagery tied to physical violence. No malware families or technical intrusion methods are detailed in available reporting. The group’s operations consistently reinforce ISIS narratives, with explicit affiliations declared in attack claims and corroborated by terrorism monitoring groups like SITE Intelligence.