Cyber Incident Victim: Islamic State
Date:
Feb 2015
Location:
France
Summary
The hacktivist collective Anonymous launched a cyber campaign called #OpISIS targeting the extremist group's online presence, taking down hundreds of social media accounts on platforms including Twitter and Facebook used for recruitment and propaganda dissemination. The operation, conducted with RedCult, exposed accounts linked to terrorist activities and identified individuals allegedly involved in radicalizing youth for combat roles in conflict zones. Anonymous released lists of suspended and active accounts, including Facebook profiles suspected of maintaining contact with operatives in Syria and Iraq, while vowing to continue disrupting the group's digital operations. In response, the extremist organization reportedly circulated guides to circumvent takedowns by repurposing older accounts, as thousands remained active for spreading messages. The campaign expanded Anonymous' prior actions against extremist-linked online infrastructure following earlier attacks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In February 2015, the hacktivist collective Anonymous initiated #OpISIS, a cyber campaign targeting the Islamic State's (ISIS) social media infrastructure and recruitment activities. The operation followed ISIS's suspected involvement in the Charlie Hebdo attack in Paris, though responsibility was later claimed by al-Qaeda in the Arabian Peninsula. Anonymous released a video on YouTube that rapidly circulated through Twitter, declaring intent to dismantle ISIS's online presence. The group, collaborating with RedCult, claimed to have already taken down hundreds of Twitter and Facebook accounts used by ISIS for propaganda dissemination, recruitment operations, and sharing execution videos. A linked Pastebin document provided evidence of suspended accounts and identified active accounts still promoting extremist content. Anonymous characterized its coalition as an international alliance spanning multiple religions, ethnicities, and technical backgrounds, explicitly stating their mission to expose and disrupt ISIS operations through digital means.
The campaign directly impacted ISIS's communication channels by removing key social media assets and publicly identifying suspected recruiters, including a woman accused of radicalizing youth for combat in Syria. Anonymous further released a list of Facebook accounts allegedly maintaining contact with ISIS operatives in Iraq and Syria, urging continued monitoring. ISIS responded by distributing a social media survival guide instructing followers to hijack inactive accounts to evade suspensions. Anonymous vowed to escalate operations, threatening to dismantle websites, email services, and additional accounts while framing their actions as an ongoing "cure" against the "virus" of ISIS. This initiative followed Anonymous's prior cyber actions against French extremist websites after the Charlie Hebdo attack, demonstrating a pattern of targeting groups associated with terrorism through coordinated account takedowns and information exposure campaigns.