Abstract: As an older generation of Islamic State ideologues, fighters, and propagandists dies out or is arrested, and the center of gravity for the Islamic State as a group shifts to Central Asia and Africa, a younger cadre of supporters is taking up the mantle of support for the group. They are forming the backbone of an unofficial ecosystem of Islamic State support spread across platforms, while evading takedowns and producing unsanctioned content in the name of the group. This article provides an overview of 93 unofficial Islamic State groups and outlets operating across social media platforms and messaging applications, a year after more than 25 minors connected online were in the final stages of preparing simultaneous attacks in several European cities.
For six months, between December 2023 and June 2024, a 12-year-old boy from Besancon, France, downloaded more than 1,700 jihadi videos on his computer and phone.1 He created jihadi characters wielding weapons such as knives, machine guns, and the flag of the Islamic State in online video games.2 He managed six accounts on just as many platforms, posting Islamic State execution videos.3 He engaged in conversations with supporters of the Islamic State on Telegram and Discord, where he also shared videos from his electronic stash of jihadi content.4 Then, on June 2, 2024, the Besancon Organized and Specialized Crime Division launched an investigation into the boy that would result in an August conviction under the “terrorism apology” laws in France.5 a
The news of the 12-year-old Islamic State supporter captured headlines across Europe and globally.6 It also quickly became just another story of a string of 2024 arrests of minors globally under the age of 18 engaged in disseminating content online linked to the Islamic State or plotting attacks across Europe. In 2024, 42 minors in Europe under the age of 18 were arrested for being involved in Islamic State attacks, attack planning or caught in the throes of propaganda operations, according to the Washington Institute for Near East Policy’s Islamic State Select Worldwide Activity Map.7
Playing a central part in of all these arrests was the role of the internet, and specifically the Islamic State’s reach across the open web and the vital role its communities of support online play in radicalization and attack planning and preparation. By the author’s far from complete count, the Islamic State’s cadre of unofficial support groups8 b operating online consists of 93 outlets, some of which are partially defunct and some of which are fully operational at the time of publication.9 c Understanding this ecosystem at this present day and time requires analysis of the breadth and scope of the Islamic State’s digital ‘caliphate’ across social media platforms and the open web.10
Terrorism scholars, academics, and non-governmental organizations have previously conducted Islamic State account censuses of X [formerly Twitter],11 focused on the online recruitment practices of the Islamic State,12 analyzed hundreds of channels on Telegram,13 tracked the Islamic State exploitation of youth-focused platforms such as TikTok and Discord,14 as well as analyzed the Islamic State’s website presence across the open web.15 This article, however, examines unofficial outlets of the Islamic State in the wake of the group’s territorial demise in Iraq and Syria in 2019, the rise of the Islamic State’s affiliates in Afghanistan and Africa, and the availability of unofficial Islamic State content across the social media platforms and encrypted messaging applications. The author seeks to highlight just how central this unofficial Islamic State ecosystem is to audiences inspired by the group and how the interplay between this ecosystem and youth requires reframing the challenge rather than doubling down on the same playbooks.
This article will first present the connection between these young peoples’ use of social media and their attacks. The author will then seek to create the tie-in between the real-world threats posed by these youth-led plots and the unofficial digital ecosystem of the Islamic State, going beyond and expanding the author’s previous work into the ecosystem.16 This tie-in will be followed by an analysis of the unofficial Islamic State ecosystem, expanding on what the author has already published about it, and will do so by diving into the outlets and tactics central to the ecosystem, and will conclude with recommendations for digital counterterrorism practitioners and researchers. The article will build on a broader report by the author on the Islamic State’s online activities that was published by the Institute for Strategic Dialogue (ISD) on February 12, 2025.17
A Week in March: Young People and the Islamic State Ecosystem
During a seven-day period in March 2024, 11 teenagers were arrested across France, Belgium, and Switzerland for being a part of a micro-network that both spread Islamic State propaganda online and appeared to be plotting an attack on an iconic music venue in Brussels.18 d The 10 minors and an 18-year-old, charged as an adult, were connected through a “closed chat group” online, and were allegedly sharing Islamic State content across social media platforms.19 e The incident highlighted a highly networked group of minors across borders sharing jihadi content online, inhabiting the same spaces online, with some elements of the same network plotting attacks. Reports from Switzerland, Belgium, and France of this teenage network indicated that the youths plotting the attacks in Belgium engaged with each other online, but also actively took part in producing their own content in support of the Islamic State.20 f The extent to which they were all involved with the planning of the concert hall attack, however, remains unclear.
The latest United Nations monitoring report noted that European authorities dismantled four terrorist cells consisting of 25 minors “connected online in the same virtual groups, who were in the final stages of preparing to execute simultaneous attacks in several European cities.”21 Attack plots in Switzerland,22 Belgium,23 France,24 Germany,25 and Austria26 appear to have been all hatched by minors working in concert with one another online, and had significant tie-ins to the unofficial Islamic State ecosystem of support on the open web. More recently, on February 10, 2025, a 14-year-old in Austria plotted an attack on the Westbahnhof Station in Vienna.27 Investigators found two knives, handwritten instructions for producing explosives to be used as a detonator for a bomb, as well as material including aluminum pipes that were intended to be used for bomb-making, and that the boy had numerous profiles on TikTok.28
In 2021, this author found that minors were quickly forming the backbone of a new online subculture in support of Islamic State and other jihadi groups.29 g The author called this online subculture movement the “Alt-Jihad,” which appropriated the aesthetics from extreme-right groups online and merged them with support for the Islamic State and al-Qa`ida while frequently using TikTok and Instagram and other social media platforms to spread and share that content.30 Young people that were a part of this subculture at the time were spread across Europe, North America, and the Middle East and North Africa. At the time, the author warned “using law enforcement to curb these communities” would “prove unwieldy, as such a multipronged and multi-platformed challenge would simply exhaust resources.”31 In fact, one of the first successful teen-led attacks last year, on March 3, 2024, involving a 14-year-old in Zurich, who stabbed an Orthodox Jewish man, was directly tied to this community of “Alt-Jihad.”32 The author, alongside journalists from Swiss media outlet Tamedia who reviewed and attempted to verify the boy’s social media accounts following the attack, found that he was heavily immersed in these communities and producing his own content.33 The author traced the content and the language used in boy’s online posts directly to specific “Alt-Jihad” communities in support of the Islamic State. Much of the content was remixed unofficial Islamic State content.
Producing unofficial content such as the video found by investigators in Belgium in support of the Islamic State has become part and parcel of the unofficial ecosystem of support groups and outlets operating across the open web. In Austria, for example, 20 days after the Vienna Taylor Swift concert plot34—similarly hatched by minors—was thwarted in August 2024, authorities arrested three teens, aged 16, 17, and 19, who were producing and disseminating unofficial Islamic State content on TikTok and Instagram.35 In Spain, authorities arrested an 18-year-old on March 16, 2024, in Barcelona, who had created his own Islamic State-branded channel online, while providing instructional material to four others in Sweden on how to carry out an attack. The 18-year-old was also connected to a teen in Canada, who was later arrested for attempting to facilitate an attack on a pro-Israel rally.36
Much like these small networks of teen propagandists and plotters, many of the 93 unofficial groups and outlets identified by the author and operating across Facebook, Instagram, TikTok, Telegram, Element, and RocketChat appear to be produced by small networks of Islamic State supporters dispersed across different locations.37 h They produce content that is not only unsanctioned by the central Islamic State media apparatus,38 but create their own branding, while operating in more than 20 different languages. They are well-versed in the language of the Islamic State and its history, while also steeped in internet cultures, referring to those who engage in similar support of the Islamic State on TikTok as “LARPers.”i While much of the animus displayed by these groups within the unofficial ecosystem is toward the Islamic State’s enemies, such as Christians, Shi`a, the global coalition, and Western states, it similarly turns onto itself, attacking each other in the process. Much of this is done in a language that young people understand and not in the official cadence of the group. This is where the danger lies. Using platforms familiar to young people is only a singular, and smaller, part of this issue; creating the content they seek to consume is the larger, more insidious problem.
This dynamic has raised alarms from the United Nations Analytical Support and Sanctions Monitoring Team concerning the Islamic State in Iraq and the Levant (Da’esh), Al-Qaida, the Taliban, and associated individuals, groups, undertakings, and entities. The team’s last two reports noted rising concern from member states, particularly in Europe, around “radicalized individuals” who “were often younger, some being minors, with direct or indirect connections with ISIL (Da’esh) through online encrypted messaging platforms,”39 as well as the “expansion” of “ISIL’s use of digital platforms.”40
‘Remaining and Expanding’: The Islamic State’s Unofficial Outlet and Group Ecosystem
Contrary to claims of the Islamic State’s defeat, the enduring prevalence of the movement online indicates that the fight against the group, its worldwide affiliates, and its global base of supporters is far from over.41 In reality, the Islamic State’s ability to “remain and expand” while continuing to adapt to new pressures, indicates resilience to the tactics and strategies designed to restrict its return.42
The Islamic State’s online presence is buttressed by low-budget innovative tactics and measures and by meticulous archiving happening in a decentralized fashion across an increasingly decentralized internet. Consequently, this article focuses on the unofficial Islamic State groups and outlets that make up the ecosystem of support spread across social media platforms and messaging applications. Online, the Islamic State continues to expand the boundaries of its valuable internet ecosystem, connected through social media platforms such as Facebook, Instagram, TikTok, and X as well as messaging applications such as Telegram, WhatsApp, RocketChat, and Element.
Ingrained in this ecosystem are more than 93 active or partially defunct unofficial media outlets supporting the Islamic State across platforms, with some a part of alliances as large as 20 groups, and some being launched at the time of this article.j Many of these groups are redundant43 k and could be considered third-rate propaganda purveyors, producing recycled content with rather poor graphic design or language, while others command audiences of more than 20,000 on channels solely dedicated to their content.44 l
Thus, the Islamic State’s virtual presence is highly decentralized—especially in an expansive and fluid operational theater such as the internet—are generally modest and short-lived.45 Part of this challenge has been the overarching focus on ‘official’ outlets and their channels, which have been one of the primary concerns of governments for at least the past decade. Meanwhile, unofficial channels and groups have festered, much to the chagrin of social media companies, and governments. This unofficial ecosystem of support for the Islamic State, therefore, has existed in tandem with the recent rise in Islamic State-inspired youth attacks and plots across Europe.
The purpose of this article is not to prove whether or not these cases and would-be supporters were influenced by the unofficial and official presence of the Islamic State on the internet, which seems readily apparent, but rather to tell the story of the Islamic State’s unofficial ecosystem across platforms and the danger it poses to wider society.
The Unofficial Islamic State Support Ecosystem Online: Surviving, Sidestepping, and Spreading Content
While, at the macro level, unofficial Islamic State groups are using a range of propaganda and evasion tactics, the individual accounts behind these outlets and groups at the micro level are seemingly expanding their propaganda presence across platforms. For this article, the author tracked, analyzed, and dissected the behaviors of large and small networks of unofficial Islamic State groups and outlets consisting of:
300 accounts and 15 Facebook pages linked to support outlets and groups, some with audiences as large as 22,000. Individual accounts supportive of Islamic State were using ‘professional mode,’ giving them access to features to monetize their content.
50 accounts on Instagram, connected to a wider network on Facebook.
50 accounts on TikTok, sharing remixed official content of Islamic State, as well as unofficial group and outlet propaganda.
15 channels on WhatsApp being used to share Islamic State content and new channels that link to the wider ecosystem of support.
15 channels on Telegram being used to share Islamic State content and new channels that link to the wider ecosystem of support.
15 channels on Element being used to share Islamic State content and new channels that link to the wider ecosystem of support.
10 accounts on X, which had the fastest takedown rates of Islamic State content. The accounts typically did not last 72 hours. However, concerningly, two of the accounts seemed to have premium service subscriptions, indicating that X had accepted payments from accounts sharing terrorist content.
The online ecosystem of unofficial Islamic State support is a multidimensional network of writers, editors, and ‘artists,’ that exist in/on multiple countries and platforms, all using similar tactics and content, in self-organized clusters. Self-organized clusters46 are networks built around influencers (specifically individual accounts) that are similarly linked to a range of unofficial groups, each with their own bases of support. These distinct clusters are, in and of themselves, networks within networks, built to share new content and then simultaneously spread it out to users.
Using open-source intelligence gathering techniques, the author parsed through the ecosystem of unofficial Islamic State support groups and outlets on Facebook, Instagram, TikTok, and X, as well as the messaging applications WhatsApp, Telegram, and Element. Through this, unofficial Islamic State groups and outlets were engaged in, inter alia, the following broadly categorized propaganda activities:
Ideological support for the Islamic State and its ideologues
Islamic State news dissemination, under new brands not targeted by governments or technology companies, and mimicking independent news operations online
Translation services and multilingual content creation
Operational security, evasion tactics, and online tool dissemination
Undermining and attacking the narratives of global, regional, and country-specific anti-Islamic State efforts
Part and parcel of this unofficial Islamic State digital ecosystem are evasion tactics that are, in essence, a central toolbox of survival for these groups and outlets. The evasion tactics used by these groups have become ingrained into the ecosystem, and are routinely shared by individual groups, outlets, and influencers in the ecosystem in order to teach supporters operating across social media platforms. These tactics can be best described as the following:47
Account Hijacking: Unofficial Islamic State outlets and groups are hijacking accounts on social media platforms, stealing the accounts from already established users and then repurposing them for use by groups and outlets linked to support for the Islamic State. This tactic is coordinated through groups and outlets that continually return after bans and takedowns, illustrating how recidivism online innovates new tactics.
Content Masking: Unofficial Islamic State groups and outlets are altering the existing branding on content, blurring original logos, and in some cases using the branding of existing well-known global news outlets (e.g., Netflix, Amazon Video, France 24, Russia Today, CNN, and BBC).
Link Sharing: Links to existing official and unofficial content are shared frequently in the comments and threads linked to unofficial Islamic State outlets and groups across social media platforms. By focusing on seeding this content in comment spaces, the outlets and groups are using the comments as the primary space for sharing new and old content linked to the group.
Coordinated Raids: Unofficial Islamic State raid groups on Facebook have organized “raids” on their enemies’ social media assets, including those linked to U.S. news outlets and Syrian news outlets. Groups have similarly “comment-bombed” the official Facebook pages of the U.S. Department of Defense, the U.S. Air Force Academy, the U.S. Army, and even President Donald Trump during his first administration.48 The author witnessed these “raids” in real time, as followers posted instructions including the “target,” the “objective,” and the content needed to flood comment sections with terrorist material.
Gaming Text Analysis: Unofficial support groups and outlets are evading text-based analysis moderation by using ‘broken text’ posting formats that appear to be confusing automated systems identifying terrorist content. Unofficial outlets routinely use ‘broken text’ posting as a means to link to official and unofficial terrorist content. ‘Broken text’ posting has included identifying key words such as ‘jihad’ or ‘kill’ and adding punctuation such as periods, spaces, special characters, or commas between letters in the word. In some cases, ‘broken text’ posting have included the beginning of the word and then an emoji to describe the word used.
The Groups and Outlets of the Islamic State’s Unofficial Ecosystem Online: Between Disinformation, Recruitment, and Attacks
For this article, the author parsed through 93 unofficial Islamic State support outlets and groups operating across platforms.49 In order to provide a snapshot of their activities without overwhelming the reader, the author will provide three case studies of the largest outlets.
The outlets in the case studies are focused on the following activities:
disinformation operations and covert seeding of propaganda;
building the digital infrastructure to support their continued presence on popular social media platforms, despite moderation; and
attacking the online presence of governments, politicians, religious authorities, civil society, and media.50
‘Global Events:’m Daesh Disinformation
The supporter-led news outlet ‘Global Events’ is just one of many unofficial Islamic State media outlets operating across Facebook and other platforms, evading moderation specifically tasked with rooting out support for terrorist groups. The author identified six profiles linked to the ‘Global Events’ outlet, including one that had 9,700 followers and had classified itself as a “news personality.”51
On Facebook, ‘Global Events’ had more than 22,000 followers, and the outlet had a corresponding TikTok, Instagram, and Threads account, as well as a Telegram channel, which boasted more than 30,000 subscribers at the time of publication of this article. ‘Global Events’ is a central locus point for news for supporters and a prime example of how groups and outlets in the unofficial ecosystem have innovated in the wake of takedowns to ensure their survival.
The outlet has shared 80 video reels since its creation in October 2023 on Facebook, which generated more than 1.6 million views. The most watched video, a pair of men driving a car listening to a nasheed used by the Islamic State, generated 236,000 views. The second most watched video was stripped from an official Islamic State video created during Ramadan and features children learning religious principles from an Islamic State ideologue, which generated 116,000 views.
‘Global Events’ was one of the first unofficial Islamic State outlets to not only mainstream calls for hijrah, or migration, to sub-Saharan Africa, but also use a 43-emoji code system to describe types of attacks, official and unofficial messaging, and enemies of the group. These codes were also used to evade moderation, and function as signals to other Islamic State supporters on platforms. The outlet also developed built-in contingency plans in the event of account takedowns, namely creating back-up accounts, cross-linking, and signposting to their multi-platform presence.
‘The Incursions Brigade’: The Unofficial Facilitator
‘The Incursions Brigade’ is a group dedicated to providing accounts and other social media assets to Islamic State supporters online and attacking the group’s enemies on popular social media platforms. At one point during observation, the group had seven different Facebook pages, with a collective following of 10,857 users. The group claims to be an officially designated Islamic State facilitator for support content from other support groups such as Fursan al-Tarjama (the Knights of Translation), which is tied to 10 other unofficial propaganda outlets. The 10 propaganda outlets linked to Fursan al-Tarjama include: Sarh al-Khalifa, al-Battar, Horizon Electronic Foundation (Afaq), Fursan Upload, Hadm al-Aswar, at-Taqwa, al-Adiya, al-Liwa al-Ikhtamahat, al-Dira’, Tala’ al-Ansar, and al-Mourfa.n During the observation period, ‘The Intrusions Brigade’ has been actively recruiting across platforms. Through its Telegram recruitment channel, ‘The Intrusions Brigade’ provides a detailed breakdown of how to join five “battalions” online, which include:
The News Battalion, for sharing the Islamic State weekly Al Naba newsletter;
The Raid Battalion, for sharing official productions of the 10 propaganda Islamic State support outlets referenced in its Facebook posts;
The Creator Battalion, for sharing official Islamic State content;
The Intrusion Battalion, for Facebook raids/invasions;
The Sharp Battalion, for YouTube raids/invasions.
To join the ‘Incursions Brigade,’ a recruit must first pledge allegiance to the current ‘caliph’ of the Islamic State, Abu Hafs al-Hashimi al-Qurayashi, or renew a pledge to the ‘caliph.’ Once the pledge is accepted, a recruit must:
Be present for a designated posting time. If a user anticipates an absence, the user must inform the ‘supervisors.’
Share only pre-designed and prepared publications. A user is then obligated to forward the links to all the posts of the content to record attendance and document their work for the group.
Receive a social media account for the work necessary as part of ‘The Incursions Brigade.’ Recruits are prohibited from using personal accounts. Similarly, a user is barred from commenting in public on issues not assigned by the group.
‘The Incursions Brigade’ seems as if it is a rebooted and rebranded Bank al Ansar,52 o based on analysis of the connections between Telegram channels, Facebook pages, and personal accounts affiliated with both groups. However, this could be a case of a support group using an existing brand to build out its own separate brand for recognition within the digital Islamic State ecosystem. Nonetheless, it is clear the group is once again fully operational and building out Islamic State support networks to spread and share propaganda across social media platforms.
The ‘Scorched Earth Foundation’: The Attack Outlet
The ‘Scorched Earth Foundation’ is an Islamic State support group using Facebook and attempting to get a foothold on X to conduct ‘raids’53 p of enemy pages and accounts by posting Islamic State support outlet material from a range of groups. The group appears to have been founded in January 2025 and has been organizing raids through central accounts on Facebook and X. As tracked by this author, in January 2025, the ‘Scorched Earth Foundation’ organized raids of Facebook pages linked to the newly installed government of Syria and the U.S.-based news outlet Newsmax and created English translations of official Islamic State content in support of the January 1, 2025, New Orleans attacker.
The group also used a 2019 Islamic State al-Hayat Media Foundation video in a move to incite supporters to start fires in the wake of the massive fires engulfing the city of Los Angeles. The video is titled “Incite the Believers.” During that time period, the group released an Al Naba-style infographic detailing its ‘raids’ through the month of January 2025, which included 93 targets, of which the top three were Syrian (50), American (8), and Egyptian (7). The raid group claimed to have launched 15 ‘campaigns’ in this period, using 24 different pieces of content, and included Al Naba newsletter, archive, and supporter-led outlet material.
During that time, the ‘Scorched Earth Foundation’ translated Al Naba newsletter articles into English, redesigning content in a blog-like fashion. The article it chose to translate was titled “With A Punishment by Him, or by Our Hands,” which presented the Los Angeles fires as retribution for the death and destruction in Gaza, and which called for arson attacks. The article noted “this chaotic and uncontrolled scene presents an inspiring operational opportunity to launch or prepare attacks. It attempted to spark ideas for lone mujahideen about how to cause a similar blaze. The method is simple: take a ‘camping trip’ to a forest near residential neighborhoods, ignite a fire, and quietly withdraw.” The post featuring the English translated version of the Los Angeles fires was shared 779 times, according to Facebook metrics.
Conclusion
The unofficial Islamic State outlet and group ecosystem continues to thrive on the internet, innovating new methods and tactics to ‘return and expand.’54 q Platforms and governments have adapted, building the tools and teams to combat this threat, but their inability to keep pace with the digital landscape, amidst myriad of other threats appears to be allowing many of these newer, more resilient groups to thrive.
The development of specialized trust and safety teams,55 automated tools to locate terrorist material, in tandem with coalitions of companies, governments and law enforcement agencies united in staving off the threat from Islamic State accounts and content online have been instrumental in countering the appeal and spread of these accounts. As experts and industry insiders have previously noted “expect obsolesce,” as threat actors such as the Islamic State are able to quickly, and at low cost, innovate. Similarly, building “cross-functional organizations “without bureaucracy creates the ability to rapidly assess and adjust to new threats as they appear on platforms and beyond.56 Being nimble and collaborative without the red tape are key lessons for counterterrorism organizations and platforms.
As this article highlights, the ecosystem of unofficial Islamic State groups and their supporters are continuing to flaunt their ability to use social media platforms for recruitment and propaganda, and to exact revenge on their enemies online.57 The article similarly shows that youngsters are interacting with and producing Islamic State content in new shapes and forms. This digitally astute generation of jihadi fan boys and ‘edgelords’ are forming collectives and infusing new aesthetics and language into unofficial Islamic State propaganda.58 By building all-encompassing communities online, spread across platforms, and fluent in numerous language and the content preferences of young people, these outlets are, and should be, considered as much the frontline as the fight in Africa, South Asia, and elsewhere.
The unofficial Islamic State propagandists are similarly finding innovative, low budget hacks to the hurdles placed in their way by social media companies and messaging applications. The Islamic State’s digital ecosystem is thriving, and the outlets within it are not just flaunting an ability to game platforms, but are similarly expanding their presence onto new emerging applications, allowing them to fight off coordinated efforts and automated approaches intended to stop their spread. As researchers noted in 2016,r the Islamic State ecosystem online is in fact a “network-of-networks” that can be broken apart into sub-communities, making it easier for them to withstand larger shocks to the overall ecosystem, such as targeted takedowns.59
This ecosystem of unofficial support is a long-standing global phenomenon that is operating with a hive mind across social media platforms. What is clear to the author is that there is a series of evergreen recommendations that need to be made in addressing this issue:
Expert moderation is only one part of the challenge, so creating ‘fly team’s type of structures for digital counterterrorism is needed. These ‘fly teams’ of digital counterterrorism would specifically work in markets where there has been less investment in moderation, such as Africa and South Asia. A primary goal of these ‘fly teams’ would be combating account recidivism and understanding the connections between unofficial and official outlets. By continuously strangling the ability of these outlets to survive through both in-depth investigation and reconnaissance coupled with contextual and linguistical knowledge of how these groups operate and signal to one another, smaller networks at the core of this digital ecosystem would be stymied.
Digital counterterrorism professionals need to think beyond cross-platform takedowns and actually red team the responses to these takedowns by the unofficial Islamic State ecosystem. By taking down networks across platforms in one fell swoop, governments and law enforcement have created an environment on some platforms that are hostile to the unofficial Islamic State presence, however this has also bred new tactics and resilience to these countermeasures. Europol in 201960 and again in 202461 targeted Islamic State channels in a wide ranging, multi-platform takedown effort, which should be repeated on a continual basis. However, the ecosystem, and the sum of its parts, has figured out platforms such as RocketChat, Element, and SimpleXt are places in which they can regroup and recalculate before retaking lost territory.
The toolbox of tactics deployed by the unofficial Islamic State outlets has changed, but the responses to them have not. Tactics like “broken text posting,”62 u a format used by a majority unofficial Islamic State outlets as a means to get controversial words past moderation mechanisms, has been used as means by which they have survived, but so has hiding content in cartoons and other innocuous formats, such as using still images of televisions that actually have embedded video within them.
There is an additional challenge of unofficial Islamic State support outlets and groups exploiting platform loopholes to verify media sources that needs to be addressed. The ability of the unofficial ecosystem of the Islamic State to stave off takedowns by mimicking the practices of legitimate journalism should be a worry for platforms, governments and law enforcement. By operating media outlets that outwardly operate as legitimate sources, these groups are adapting to an environment where there is no longer a stigma attached to disinformation. Understanding this context, and creating mechanisms to track the news ‘brands’ of the unofficial ecosystem, will undoubtedly improve the ability of teams tasked with taking down unofficial Islamic State groups operating as outlets online.
Substantive Notes
[a] The boy was not sentenced to jail time, according to reports. Instead, he was placed under supervision and treated for what appeared to be a series of cognitive health issues. “12-year-old boy found guilty of advocating terrorism,” Monde, August 21, 2024.
[b] Unofficial Islamic State outlets are not linked to the central media apparatus but are still branded outlets supportive of the Islamic State, have a much larger footprint, and are more readily available on platforms and messaging applications than official outlets. Much of the material they rely on comes from official media content, but they have, and do, create original content that gets past moderation at what the author believes to be a higher rate than official outlets.
[c] The author cataloged 93 unofficial Islamic State groups across platforms between January and February 2025. The list is not complete, but appears to be the largest sample of unofficial Islamic State groups and outlets cataloged to date. The author estimates that number is likely in the hundreds. The author determined that 60 percent of the 93 outlets have produced new content in the past six months, making them active, while 40 percent have not produced new content in the past six months but are still available online, making them partially defunct.
[d] On March 14, investigators in Switzerland would announce three more teens under the age of 18 who were arrested in connection to the minors in Belgium and France. Carmen Schelkens, Guy Van Vlierden, and Faroek Özgünes, “16-year-old from Etterbeek, who may have been involved in a foiled attack on Botanique, arrested: ‘He posed with a Kalashnikov in the video,’” HLN, March 14, 2024.
[e] On March 3, 2024, four teenagers between the ages of 18 and 15 were arrested by counterterrorism police in Belgium for allegedly plotting an attack on Le Botanique, the famed botanical garden turned concert venue. Also on March 3, 2024, three teenagers in France, between the ages of 15 and 17, were arrested for suspected links to the Belgian plotters. Michael Torfs and Joris Truyts, “Suspect in terror case from Ninove is barely 15 years old and may have planned an attack with 3 others,” NRT News, March 3, 2024.
[f] According to a report by HLN, one of the teens arrested on March 14 connected to the suspects arrested in Belgium produced a video in support of the Islamic State while holding a weapon. Schelkens, Van Vlierden, and Özgünes.
[g] The author’s research noted “a generational shift, inspired by other internet subcultures using platforms like Discord, Reddit and 4Chan, has become one of the defining aspects of Gen-Z Salafi aesthetics online. These internet subcultures of 4Chan, Reddit and other alt-right forums are increasingly being appropriated by Gen-Z Salafi members of Islamogram, and the akh-right, as well as younger supporters of the Islamic State, al-Qaeda and Islamist movements such as the Taliban.” The Akh-right is an online sub-culture of young Islamists who are either aligned with conservative, far right, and extreme-right ideologies or ideologues.
[h] Based on a review of each of the groups’ channels and accounts, the author determined some of the larger groups have four to six administrators while some are operating more than one outlet with only one. Approximately 47 of the outlets reviewed had one administrator/content producer, while another 21 had two to three administrators/content producers, and 25 had four to five administrators/content producers.
[i] Merriam-Webster dictionary defines LARPer as “a person who participates in a live-action role-playing game,” or, in this case, is faking their persona online. “LARPer Definition & Meaning,” Merriam-Webster, accessed February 26, 2025.
[j] The author conducted a review of the branded media outlets on the Islamic State’s most prominent forum. Defunct outlets were those that had not produced content in a period longer than one year.
[k] The author observed outlets that existed for two months and then were relegated to the dustbins of history. One of those outlets was Baqia, a Telegram, Pinterest, and Facebook outlet using artificial intelligence to generate provocative images that used recreated notorious scenes from Islamic State videos in anime format. While the group seemed to have appeal among Islamic State circles, it could not withstand constant takedowns on Telegram and Facebook.
[l] The largest outlet observed for this article was ‘Global Events.’ ‘Global Events’ is an unofficial Islamic State alternative news outlet operating multi-platform, multi-lingual disinformation operations under the guise of ‘media’ and ‘media personalities,’ contributing to an already fractured and polarized online media landscape and spreading Islamic State news to new audiences. As explained further down, rather than identifying unofficial Islamic State outlets, the author assigned them names to avoid amplifying them.
[m] To avoid amplification, the author is not identifying the unofficial outlets by their actual names.
[n] These 10 groups have already been named in public reports and assessments, so their names have not been changed, just transliterated. See, for example, Lucas Webber and Daniele Garofalo, “Fursan al-Tarjama carries the torch of Islamic State’s media jihad,” Global Network on Extremism & Technology, June 5, 2023.
[o] Bank al Ansar is an Islamic State support group doling out social media accounts to Islamic State supporters. The group has claimed in the past to have “seized” up to 7,000 social media accounts and distributed them. The group’s activities and presence are central to the unofficial ecosystem and provides the infrastructure for Islamic State support groups and supporters to continue fanning out across social media platforms.
[p] The group has been unable to gain a presence on X for longer than 72 hours and has consistently been taken down from that specific platform. However, it has managed to keep its Facebook presence by setting up numerous accounts. The author believes the group is linked to ‘The Intrusions Brigade’ and may be operating in concert with that group.
[q] The refrain ‘return and expand,’ stripped from Islamic State content, has become the mantra of unofficial outlets and groups online.
[r] “The researchers suggest that by concentrating just on these relatively few groups of serious followers—those that discuss operational details like routes for financing and avoiding drone strikes—cyber police and other anti-terrorist watchdogs could monitor their buildup and transitions and thwart the potential onset of a burst of violence.” Deserae del Campo and Maya Bell, “Analyzing how ISIS recruits through social media,” University of Miami, June 6, 2016. See also N.F. Johnson, R. Leahy, N.J. Restrepo, et al, “Hidden resilience and adaptive dynamics of the global online hate ecology,” Nature 573 (2019): pp. 261-265.
[s] The Federal Bureau of Investigation (FBI) manages ‘fly teams’ consisting of field agents and intelligence analysts who provide “intelligence gathering regarding terror cells and groups” and have a remit for both domestic and international environments. “FBI Counterterrorism Fly Team Training,” Federal Bureau of Investigation.
[t] SimpleX is a messaging platform that provides enhanced privacy and assigns no unique identifiers, such as user identification to its users. Moustafa Ayad and Steven Rai, “Neo-Nazi accelerationists seek new digital refuge amid looming Telegram crackdown,” Institute for Strategic Dialogue, October 4, 2024.
[u] ‘Broken text posting’ refers to a technique to game automated text analysis, which includes using punctuation in certain key words, or leaving spaces between letters, or specialized fonts that are unreadable by machines, to post, for example, about the Islamic State.
Citations
[1] Fatima-Zohra Fadaili, “12-Year-Old boy convicted of promoting terrorism in France,” Barlaman Today, August 22, 2024.
[2] Pierre Bienvault, “Video games, new recruiting ground for jihadists,” Criox, August 23, 2024.
[3] Geoffroy Antoine, “A 12-year-old minor who planned terrorist attacks ‘against French people’ arrested,” Journal du Dimanche, July 2, 2024.
[4] Fadaili.
[5] “12-year-old boy found guilty of advocating terrorism,” Monde, August 21, 2024.
[6] “The solitary drift of a 12-year-old boy, prosecuted for ‘apology of terrorism,’” Europe1, August 5, 2024. “France finds 12-year-old boy guilty of ‘advocating terrorism’ for content he shared online,” Universo, August 21, 2024.
[7] Aaron Zelin, “Introducing the Islamic State select worldwide activity map,” Washington Institute for Near East Policy, March 21, 2023.
[8] Moustafa Ayad, “A Decade after the ‘Caliphate’: The state of the Islamic State online,” Institute for Strategic Dialogue, February 12, 2025.
[9] Ayad, “A Decade after the ‘Caliphate.’”
[10] Ibid.
[11] J.M. Berger and Jonathon Morgan, “The ISIS Twitter census: Defining and describing the population of ISIS supporters on Twitter,” Brookings Institution, March 5, 2015.
[12] J.M. Berger, “Tailored Online Interventions: The Islamic State’s Recruitment Strategy,” CTC Sentinel 8:10 (2015).
[13] Bennett Clifford and Helen Powell, “Encrypted Extremism Inside the English-Speaking Islamic State Ecosystem on Telegram,” George Washington University Program on Extremism, June 2019.
[14] Moustafa Ayad, “CaliphateTok: TikTok continues to host Islamic State propaganda,” Institute for Strategic Dialogue, June 13, 2023; Moustafa Ayad, “The ‘original sounds’ of terrorist leaders: A TikTok feature enables terrorist content to flourish,” Institute for Strategic Dialogue, July 18, 2024.
[15] “The threat of terrorist and violent extremist operated websites,” Tech Against Terrorism, January 28, 2022.
[16] Ayad, “A Decade after the ‘Caliphate.’”
[17] Ibid.
[18] Marc Menichini, “Three minors suspected of having links to jihadist extremism arrested in French-speaking Switzerland,” Radio Télévision Suisse, March 16, 2024.
[19] Maïthé Chini, “Four arrested teenagers were planning terror attack on Brussels concert venue,” Brussels Times, March 4, 2024; Michael Torfs and Joris Truyts, “Suspect in terror case from Ninove is barely 15 years old and may have planned an attack with 3 others,” NRT News, March 3, 2024; Jules Torres, “JDD: Three minors linked to a jihadist movement planning an attack in Belgium arrested in France,” Journal du Dimanche, March 5, 2024; Carmen Schelkens, Guy Van Vlierden, and Faroek Özgünes, “16-year-old from Etterbeek, who may have been involved in a foiled attack on Botanique, arrested: ‘He posed with a Kalashnikov in the video,’” HLN, March 14, 2024.
[20] Schelkens, Van Vlierden, and Özgünes.
[21] “Thirty-fifth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2734 (2024) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations, Analytical Support and Sanctions Monitoring Team, February 6, 2025.
[22] “Three teens suspected of backing Islamic State arrested in Switzerland,” Swissinfo (SWI), April 13, 2025.
[23] Sejla Ahmatovic, “4 teens arrested for planning terrorist attack in Brussels,” Politico, March 4, 2025.
[24] “Teens charged in France for allegedly planning to attack Jewish targets,” France 24, June 22, 2024.
[25] “Germany arrests three teenagers on suspicion of attack plot,” Al-Jazeera, April 12, 2024.
[26] Nicolas Stockhammer and Colin Clarke, “The August 2024 Taylor Swift Vienna Concert Plot,” CTC Sentinel 18:1 (2025).
[27] “Austria arrests teen over foiled plot to attack Vienna station,” Reuters, February 19, 2025.
[28] Tamsin Paternoster, “Austrian authorities arrest teen for plotting Vienna railway station attack,” February 19, 2025.
[29] Moustafa Ayad, “Islamogram: Salafism and alt-right subcultures,” Institute for Strategic Dialogue, November 16, 2021.
[30] Moustafa Ayad, “’An Alt-Jihad’ is rising on social media,” Wired, December 8, 2021.
[31] Ibid.
[32] “Swiss teenager arrested on suspicion of stabbing an Orthodox Jewish man on a Zurich street,” Associated Press, March 3, 2024.
[33] Anielle Peterhans and David Sarasin, “How jihadists use mangas and memes to recruit teenagers,” Tamedia, March 25, 2024.
[34] Nicolas Stockhammer and Colin Clarke, “The August 2024 Taylor Swift Vienna Concert Plot,” CTC Sentinel 18:1 (2025).As the authors noted, the primary plotter in the Taylor Swift concert plot told investigators “his radicalization was heavily influenced by consuming TikTok videos.”
[35] “Austria opens terror probe against teens over sharing extremist content,” Local Austria, August 27, 2024.
[36] “Detenido un yihadista en Barcelona que instruyó a una célula que iba a atentar en Suecia,” Pais, March 26, 2024.
[37] Ayad, “A Decade after the ‘Caliphate.’”
[38] Charlie Winter, “Media Jihad: The Islamic State’s Doctrine for information Warfare,” International Centre for the Study of Radicalisation and Political Violence and the Institute for Strategic Dialogue (ISD), February 2017; Daniel Milton, Pulling Back the Curtain: An Inside Look at the Islamic State’s Media Organization (West Point: Combating Terrorism Center, 2018).
[39] “Thirty-fifth report of the Analytical Support and Sanctions Monitoring Team.”
[40] “Thirty-fourth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2664 (2022) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities, United Nations, Analytical Support and Sanctions Monitoring Team, July 22, 2024.
[41] James A. Piazza and Ahmet Guler, “The Online Caliphate: Internet Usage and ISIS Support in the Arab World,” Terrorism and Political Violence 33:6 (2021).
[42] Ali Fisher, “Swarmcast: How Jihadist Networks Maintain a Persistent Online Presence,” Perspectives on Terrorism 9:3 (2015).
[43] Ayad, “A Decade after the ‘Caliphate.’” Author’s research for this article, conducted January and February 2025.
[44] Moustafa Ayad, Nadeem Khan, and Aymenn al-Tamimi, “The Terror Times: The Depth and Breadth of the Islamic State Alternative News Outlet Ecosystem Online,” Institute for Strategic Dialogue, September 28, 2022.
[45] Moustafa Ayad, Amarnath Amarasingam, and Audrey Alexander, The Cloud Caliphate: Archiving the Islamic State in Real Time (West Point, NY: Combating Terrorism Center, 2021).
[46] Francis Heylighen, “Collective Intelligence and Its Implementation on the Web: Algorithms to Develop a Collective Mental Map,” Computational and Mathematical Organization Theory 5 (1999): pp. 253-280.
[47] Moustafa Ayad, “The propaganda pipeline: The ISIS Fuouaris Upload network on Facebook,” Institute for Strategic Dialogue, July 13, 2020.
[48] Michael Weiss and Moustafa Ayad, “ISIS is setting up fake social justice accounts on Facebook,” Daily Beast, July 22, 2020.
[49] Ayad, “A Decade after the ‘Caliphate.’”
[50] Moustafa Ayad, Nadeem Khan, and Aymenn al-Tamimi, “The Terror Times: The Depth and Breadth of the Islamic State Alternative News Outlet Ecosystem Online,” Institute for Strategic Dialogue, September 28, 2022.
[51] Ayad, “A Decade after the ‘Caliphate.’”
[52] “European Union Terrorism Situation and Trend Report 2018,” Europol, January 12, 2018; Melili Criezis, “Remaining and expanding or surviving and adapting? Extremist platform migration and adaptation strategies,” Global Network on Extremism & Technology (GNET), November 12, 2021.
[53] Ayad, “A Decade after the ‘Caliphate.’”
[54] Patrick B. Johnston, Mona Alami, Colin P. Clarke, and Howard J. Shatz, “Return and expand? The finances and prospects of the Islamic State after the Caliphate,” RAND, August 8, 2019.
[55] Brian Fishman, “Feature commentary: Organizing for innovation: Lessons from digital counterterrorism,” CTC Sentinel 17:10 (2024).
[56] Ibid.
[57] Moustafa Ayad, “The terrorist radio revival: How the Islamic State’s radio station survives on social media,” Institute for Strategic Dialogue, January 4, 2024.
[58] Moustafa Ayad, “Meming 9/11: A new generation of Salafi-jihadists terrorposting the September 11 attacks,” Institute for Strategic Dialogue, September 12, 2023.
[59] Moustafa Ayad, “The terrorist radio revival: How the Islamic State’s radio station survives on social media,” Institute for Strategic Dialogue, January 4, 2024.
[60] “Europol and Telegram take on terrorist propaganda online,” Europol, November 25, 2019.
[61] “Major takedown of critical online infrastructure to disrupt terrorist communications and propaganda,” Europol, June 14, 2024.
[62] Ayad, “The propaganda pipeline.”