Cyber Incident Victim: Intsights
Date:
Jun 2016
Location:
United States of America
Summary
An Anonymous-affiliated hacker compromised ISIS supporter accounts on Twitter, flooding them with adult content and deploying pornbots to disrupt recruitment and propaganda efforts. The attacker exploited platform vulnerabilities to hijack profiles, exposing personal data like IP addresses and phone numbers while sowing internal distrust regarding account legitimacy. This tactic aimed to degrade the group's social media presence and hinder their communication channels.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
The provided articles do not reference any incident involving the company 'Intsights.' The source material exclusively details an operation conducted by Anonymous-affiliated hackers against ISIS (Daesh) Twitter accounts in 2016. No connection to Intsights—a cybersecurity threat intelligence firm acquired by Rapid7 in 2021—is established in the evidence.
The documented operation, referred to as "Porn Daesh" by participants, involved hacker WauchulaGhost and associates hijacking ISIS-affiliated Twitter accounts used for recruitment and propaganda. Attackers exploited unspecified Twitter vulnerabilities to gain control, subsequently defacing profiles with adult-themed imagery and peaceful messages. The group also deployed automated "PornBots"—fake accounts following ISIS members to dilute their follower base with non-ideological content. WauchulaGhost claimed to have compromised hundreds of accounts, maintaining a public list of 161 hijacked profiles. Twitter suspended many targeted accounts for policy violations, though hackers continued acquiring replacements. Motivations included disrupting ISIS propaganda networks, exposing operator metadata (IPs, phone numbers), sowing distrust among militants, and enabling monitoring of private accounts. Critics raised concerns that these actions interfered with law enforcement surveillance, but hackers argued their methods accelerated identification of newly created ISIS accounts. The operation coincided with mid-2016 credential leaks (e.g., LinkedIn), though WauchulaGhost denied using breached passwords, emphasizing exploitation of platform vulnerabilities instead. Impact assessments noted ISIS's ideological aversion to pornography could amplify reputational damage from such defacements beyond technical disruption.