Despite the recent hit the Islamic State of Iraq and Syria (ISIS) suffered earlier this month with the death of its leader Aal-Qurashi, it continues to operate as usual both offline and online.

More than any other terrorist group, ISIS is known for adopting its media operations to the digital age. For this reason, we have decided to take a closer look at the group’s activities on the open, deep and dark web in this turbulent time for its members.

ISIS uses many online platforms which serve both its activists and supporters in Syria and Iraq, but also across the rest of the world.

We at webz.io crawl some of these platforms, which allow us our cyber team to keep track of ISIS’ activities as they shift between different platforms to avoid restrictions imposed by big social media platforms.

What open, deep and dark web platforms is ISIS using?

Telegram

The first on the list is Telegram as it’s one of the main platforms used by ISIS. The organization takes advantage of the platform’s high-level end-to-end encryption to protect the anonymity of its users, and avoid the authorities.

ISIS started using Telegram many years ago, peaking in 2015, as around that time it offered a more secure platform in comparison to other chatting platforms. Since then, Telegram has been taking action to remove extremist and violent content from its platform, including the removal of suspicious accounts and groups. However, it seems that the steps taken to eradicate the phenomenon have not been very successful. The ease of opening new groups while maintaining activity under the radar has allowed ISIS to operate dozens of active groups on Telegram.

Using our Cyber API, we regularly monitor some of these groups. According to our research, ISIS is primarily using Telegram to spread propaganda on different channels and groups and to facilitate communication between its activists by using the platform’s private chat rooms.

RocketChat

Similarly to Telegram, RocketChat is another example of the various chat-based services ISIS is using. This platform is particularly interesting given the scope of ISIS activities we can find over an extensive amount of time. ISIS is turning to RocketChat for two main reasons. The first is because it provides anonymity to users. The second is because unlike Telegram and other mainstream social media platforms, RocketChat is built in such a way that bars its own developers from monitoring or taking action against content stored on its servers. ISIS is using this chat for various purposes, including dissemination of important messages to its activists and supporters, the spread of ideological propaganda and religious messages, ongoing updates of terrorist activities carried out by the organization, and the recruitment of new supporters.

TOR network

Another platform ISIS is using, primarily for the dissemination of official announcements and religious content by the organization, is the TOR network. This platform hosts news-like websites operated by ISIS’s media arm. On these sites, we have found a lot of textual content, downloadable digital newspapers, audio files as well as videos. Showcasing their global reach, there is a large number of translated material in different languages on these sites.

Alternative social media platforms

For years social media networks have been ISIS’s favorite platform to reach a wider audience and spread fear with its propaganda. In its early days, the group used Facebook and Twitter, but very quickly, their content was removed and they were barred by these networks. As a result, the its activists, similarly to jihadist activists, turned to alternative social media platforms, because of their relatively fewer restriction on fringe content. Although most of these platforms were formed for far-right activists, ISIS also found them particularly attractive as it allowed its members and supporters to spread their messages among the wider public. Over the past year, we have been seeing some alternative social media platforms taking measures against certain types of content, such as Islamic terrorism. So far, these measures have not discouraged ISIS activists from using these fringe networks to promote their activities.

Paste Sites

Recently we’ve seen ISIS using a new platform – paste sites. These sites usually operate on the open web and allow users to share anonymous texts called “pastes” without having to open an account or create a user ID on the site. ISIS activists have started using these sites to distribute guides on how to maintain anonymity in the online space or how to protect themselves from surveillance by the authorities when using digital devices.

Over the years, ISIS, like other extremist groups, has a particularly creative and flexible capacity when it comes to maintaining its online presence. It keeps responding to the new challenges of operating on digital platforms and takes proactive steps to protect the anonymity of its members and supporters while providing them with unregulated spaces to communicate freely. In addition to its quick adoption of new, relevant platforms, ISIS is also regularly maintaining various platforms at the same time, which allows them the flexibility of switching to a new platform if one closes or bars them.

ISIS resilience and quick adoption of digital platforms is a challenge for intelligence bodies that look to trace and combat ISIS on the web. Keeping up with ISIS and other extremist organizations requires continuous monitoring of open, deep and dark web platforms. Webz.io’s Dark Web API helps organizations track the people behind terrorist organizations, produce actionable intelligence reports about the organization’s activities and plans, and identify new emerging narrative stemming from extremist dark web groups which can later spread to other areas of the web.