Cyber Threat Actor: Cyber Caliphate

The threat actor known by the aliases Cyber Caliphate, United Cyber Caliphate and Caliphate Cyber Army is described in the source material as an ISIS‑affiliated hacking group whose activities have been traced to Iraq. The aliases reflect the group’s self‑identification with the Islamic State and its claim to operate in a cyber capacity on behalf of that organization. Public reporting consistently links the actor to a series of low‑complexity attacks that blend data leaks, website defacements and social‑media hijacking to further extremist messaging.

Targeting observed in the referenced incidents spans a range of sectors and regions, including a U.S. library association, a Christian church, a New Jersey transit authority police unit, a United Kingdom solar energy firm, French and U.S. military personnel, a French international television network, a U.S. news magazine’s Twitter account, a Malaysian airline’s website, a U.S. television station and a newspaper’s Twitter account. The actor’s stated objectives, as expressed in the incidents, involve disseminating jihadist propaganda, disrupting services, retaliating against perceived opponents such as the hacktivist group Anonymous, and exposing personal information of individuals associated with governments, militaries or organizations viewed as adversaries. Retaliatory motives are explicitly cited in several summaries, such as leaking military data in response to Anonymous trolling, leaking data after a drone strike that killed an extremist, and posting threats related to U.S. military actions in Muslim‑majority regions.

Observed tactics, techniques and procedures include the exploitation of SQL injection vulnerabilities to obtain data from a library association’s database, the use of automated scanning tools to identify vulnerable websites such as the solar energy firm’s site, and the compromise of social‑media accounts through stolen login credentials as seen in the compromises of television station and newspaper Twitter feeds. The actor has disseminated stolen data via Arabic file‑sharing platforms and encrypted messaging channels, and has used Telegram to post links to leaked files. Website defacements have involved replacing homepages with jihadist videos, Arabic text or images such as a lizard accompanied by a reference to a missing flight. The group has also hijacked broadcast signals to interrupt a television network’s transmission and replace its content with propaganda, and has used PasteBin to share documents allegedly taken from government servers. Claims of having hacked FBI databases are mentioned in the reporting, although these assertions are presented as the actor’s own statements rather than independently verified facts.

Representative operations highlighted in the material include the May 2016 leak of personal data from an Arkansas library association following an SQL injection, the April 2016 defacement of a Lamont Christian Reformed Church website with a threatening jihadist video, the February 2016 release of personal information belonging to New Jersey Transit Authority police officers obtained from a vendor, the January 2015 hijacking of a French international television network’s broadcast to spread Islamic State propaganda, the January 2015 takeover of Newsweek’s Twitter account to post threats against the U.S. president and his family, the January 2015 defacement of Malaysia Airlines’ website with a lizard image and a reference to the missing MH370 flight, the January 2015 hijacking of a Delmarva television station and the Albuquerque Journal’s Twitter accounts to post propaganda and share stolen documents via PasteBin, and the December 2015 leak of French and U.S. military personnel data in retaliation for Anonymous‑led trolling campaigns. The actor’s affiliation is explicitly tied to the Islamic State, with the various aliases serving as public proclamations of that allegiance, and the available sources note an Iraqi origin for the group without asserting any broader state sponsorship or criminal‑network connections.