Cyber Incident Victim: Intsights
Date:
Aug 2016
Location:
Israel
Summary
An Israeli cyber-intelligence firm infiltrated an ISIS-operated Dark Web forum hosted via Telegram, uncovering plans for imminent attacks targeting US military installations in Kuwait, Bahrain, and Saudi Arabia, along with Israeli military bases. The group selected these locations due to their use in coalition airstrikes against ISIS forces. The security company identified shared maps and operational details on the forum but did not disclose its intrusion methodology. This operation aligns with broader hacktivist and researcher efforts to disrupt ISIS communications, though mainstream attention to such actions remains limited. The incident highlights proactive cybersecurity measures to intercept terrorist plotting through monitoring extremist digital platforms.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early August 2016, Israeli cyber-intelligence firm Intsights disclosed it had infiltrated an ISIS-operated Dark Web forum hosted via Telegram, uncovering active plans for imminent terrorist attacks. The company, staffed by former Israel Defense Forces intelligence personnel, identified discussions detailing preparations for assaults on US military installations in Kuwait, Bahrain, and Saudi Arabia. Attackers specifically targeted these bases due to their role in supporting coalition airstrikes against ISIS positions in Syria and Iraq. A map geolocating US and Israeli military facilities worldwide circulated on the forum on August 1, 2016, indicating reconnaissance efforts preceding physical operations. Intsights linked the uncovered plot to ISIS's established attack patterns, referencing the July 26, 2016 Normandy church attack where assailants murdered an 85-year-old priest. The firm provided its findings to Israeli television network Channel 10, though no technical details regarding the Telegram breach methodology were disclosed.
This intrusion marked a continuation of hacktivist operations against ISIS digital platforms, with groups like Anonymous historically targeting extremist forums but receiving limited media coverage. Intsights' disclosure coincided with broader security community scrutiny of Telegram's vulnerabilities, evidenced by separate Black Hat conference revelations about Iranian state actors compromising 15 million Telegram accounts. The firm's actions exposed active threat coordination channels and specific targeting methodologies, though governmental or military responses to the intelligence remained unconfirmed in available reporting. The incident underscored persistent exploitation of encrypted platforms for terrorist logistics and the role of private intelligence firms in disrupting such activities through offensive cyber operations.