Cyber Incident Victim: Anonymous
Date:
Feb 2015
Location:
France
Summary
The hacktivist collective Anonymous launched a cyber campaign dubbed #OpISIS targeting the extremist group's online presence, taking down hundreds of social media accounts used for recruitment and disseminating propaganda, including execution videos. The operation involved identifying and suspending ISIS-linked Twitter and Facebook profiles, releasing lists of suspected accounts on platforms like Pastebin, and publicly declaring intent to persistently disrupt the organization's digital operations by removing websites, emails, and other online assets. Anonymous framed the campaign as a unified effort against terrorism, vowing to expose and eliminate ISIS's digital infrastructure continuously.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In February 2015, the hacktivist collective Anonymous initiated a cyber campaign designated #OpISIS against the Islamic State (ISIS) terrorist organization, focusing on disrupting its social media recruitment and propaganda operations. The operation followed ISIS's alleged involvement in the Charlie Hebdo attack in Paris, though responsibility was later claimed by al-Qaeda in the Arabian Peninsula (AQAP). Anonymous, collaborating with a group called RedCult, publicly announced the campaign through a YouTube video disseminated widely on Twitter, declaring intent to dismantle ISIS's online infrastructure. The groups claimed to have already taken down hundreds of Twitter and Facebook accounts linked to ISIS, which the extremist organization used for recruitment, dissemination of extremist content, and sharing execution videos. A Pastebin link accompanying the video listed specific suspended or active Twitter accounts targeted in the operation, while a separate list identified Facebook accounts suspected of facilitating contact between ISIS operatives in Syria and Iraq. Among these was an account allegedly operated by a female ISIS recruiter accused of radicalizing youth to fight in Syria. Anonymous framed the campaign as a coalition of diverse individuals united against ISIS, emphasizing their intent to expose and eliminate the group’s digital presence systematically.
The campaign disrupted ISIS's ability to maintain stable communication channels, forcing the group to adapt by circulating a social media guide instructing members to hijack legacy accounts to evade takedowns. Anonymous characterized ISIS as a "virus" and pledged to continue hunting its online assets, including websites and email accounts, stating there would be "no safe place" for the group online. While thousands of ISIS-affiliated accounts remained active, the operation demonstrated a sustained effort to counter the group’s propaganda machinery through account suspensions and public exposure of suspected operatives. The hacktivists’ prior actions against French extremist websites following the Charlie Hebdo attack provided a precedent for this type of decentralized cyber response. No technical specifics regarding attack vectors or collateral impacts on platforms were disclosed, but the campaign highlighted the role of non-state actors in targeting terrorist networks’ digital infrastructure during active military conflicts against ISIS in the Middle East.