Intsights

Summary

A hacktivist group affiliated with Anonymous, Ghost Sec, compromised an Islamic State propaganda website on the dark web, replacing its content with an advertisement for an online pharmacy selling Prozac and a satirical message discouraging support for the extremist group. The takedown occurred shortly after the site's creation and marked the first known instance of Anonymous targeting a Tor-based platform. Security analysts noted the site's operators made operational security errors that facilitated the attack. Concurrently, Anonymous' broader #OpParis campaign faced criticism for indiscriminately removing terrorist-affiliated online content, potentially disrupting intelligence-gathering efforts by law enforcement and counter-terrorism agencies.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In November 2015, Ghost Sec—a faction of the hacktivist collective Anonymous—compromised and defaced an Islamic State (ISIS) propaganda website named Isdarat operating on the Tor dark web network. The site had appeared on the Tor anonymity network the prior week, prompting Ghost Sec to replace its content with an advertisement for a bitcoin-based online pharmacy selling medications like Prozac and Viagra. The defacement included a message mocking ISIS supporters: "Too Much ISIS. Enhance your calm. Too many people are into this ISIS-stuff. Please gaze upon this lovely ad so we can upgrade our infrastructure to give you ISIS content you all so desperately crave." The takedown occurred less than a week after Isdarat’s creation, marking the first known instance of Anonymous-affiliated groups targeting a dark web site. Security analyst Scot Terban noted the site’s operators made "rookie stupid" configuration errors, leaving it vulnerable to attacks and potentially exposing their identities to authorities without requiring direct compromise of the Tor-hidden service. Counter-terrorism analysts observed ISIS’s shift to dark web platforms to evade hacktivist disruptions of its propaganda.

The incident drew criticism from national security experts regarding Anonymous’s broader #OpParis campaign tactics. Michael Smith, a U.S. Congress adviser and Kronos Advisory co-founder, stated Anonymous’s indiscriminate takedowns of jihadist websites and social media accounts—conducted without government coordination—destroyed valuable intelligence and inadvertently aided terrorist groups by hindering surveillance efforts. Ghost Sec’s specific defacement of Isdarat did not involve the counter-terrorism-focused Ghost Security Group, despite initial reporting errors conflating the two entities. The operation exemplified ongoing tensions between hacktivist interventions and law enforcement intelligence-gathering priorities following the November 2015 Paris attacks. ISIS’s technical vulnerabilities, combined with Anonymous’s disruptive but uncoordinated actions, highlighted challenges in countering terrorist propaganda while preserving investigative opportunities.

Sources

Sources available to members: 1 source.