Cyber Threat Actor: Ibraheem Ahmed Al Bayati

Ibraheem Ahmed Al Bayati, also known by the alias Abu Qital al Jihadi al Mansur, is a U.S. citizen who resided in Richmond, Texas at the time of his arrest. He came to public attention in September 2020 after being charged with making a bomb threat against the University of Houston during a Zoom lecture. According to the criminal complaint, he identified himself with the ISIS‑linked alias, interrupted the class by stating that the university would be bombed in a few days, uttered an Arabic phrase meaning “the Islamic State will remain,” and displayed a gesture associated with ISIS before leaving the call. Federal authorities arrested him following an investigation by the FBI Joint Terrorism Task Force, and he faces charges of conveying false information to destroy by means of fire or explosives and making a threat over interstate commerce, which carry potential sentences of up to ten and five years respectively.

The incident reveals that Al Bayati’s activity was directed at the education sector, specifically targeting a university setting within the United States. His stated objective appeared to be disruption, as he sought to instill fear through a false bomb threat rather than pursue financial gain or espionage. The tactics he employed included exploiting a videoconferencing platform to deliver the threat, using verbal statements and a symbolic gesture to affirm allegiance to ISIS, and attempting to recruit individuals online by facilitating a pledge to the group. No malware families, specific initial access vectors, or specialized tooling were referenced in the reporting; his methods relied primarily on social communication and online outreach to extremist sympathizers.

Attribution to a broader terrorist network is not established beyond his self‑identified alignment with ISIS and his claimed role as a recruiter for the organization. The case was prosecuted by the U.S. Attorney’s Office for the Southern District of Texas with assistance from the Department of Justice’s counterterrorism section, indicating a domestic law‑enforcement response rather than a state‑sponsored or consortium‑linked operation. The September 2020 Zoom lecture threat stands as the sole publicly reported operation associated with Al Bayati, illustrating how an individual can use accessible digital platforms to convey extremist messaging and attempt to mobilize support while facing federal terrorism‑related charges.