Cyber Caliphate's Scorecard

Researchers say Islamic State's United Cyber Caliphate remains in its infancy when it comes to cyber-attack expertise.

Hackers operating within the Islamic State's United Cyber Caliphate may be well-versed and conversant in encrypted communications tools such as Telegram and WhatsApp, but they're still novices when it comes to their actual cyber-attack expertise.

While the online propaganda machines and presence of some of the world's most prominent terrorist groups appear technologically advanced and organised, their underlying cyber-attack tools and techniques are still rudimentary and limited, security researchers say. 

As such, they're not likely to disrupt a power plant with a cyber-attack any time soon like a nation-state could do, yet there is always a concern of their eventual partnering with more advanced and resourced attack groups to wreak physical or other damage via cyber-attacks.

Kyle Wilhoit, senior security researcher with DomainTools, has been studying the cyber capabilities of several terrorist groups. He found that the United Cyber Caliphate, the cyber arm of ISIS that has been in operation for nearly three years, employs techniques similar to those of a so-called script kiddie or fledgling hacker.
"Their relative overall technical expertise is low," he says.

The cyber terrorist group's denial-of-service attack MO is akin to a crowd-sourced attack not unlike Anonymous employed in its heyday, for instance. "Their denial-of-service attacks are being executed through Windows applications on multiple hosts, but not infected" bots or a botnet infrastructure, he says. In other words, they're mostly using their own, or supporters', machines to pummel websites with SYN or other flood attacks, for example

To cover its tracks, the terror group also employs domain-registration proxies for their online activity, he says, to help hide their real identities. 
"They are also leveraging what cybercriminals use," he says, test-driving malware development toolsets. "Just recently, with this research … I found them dabbling in the creation of malware."
Wilhoit spotted the Cyber Caliphate using the known underground crime toolkit Ancalog Exploit Builder to generate fake HTML pages to a command and control server. "That piece of malware looked like it was in the development phase. It wasn't weaponised," he says.
The terrorist group is most advanced when it comes to communicating among its members, he says. The members use the encrypted messaging platforms Telegram and WhatsApp to discuss and share information about hacking tools or targets they're going after, he says.
"Looking at their toolsets, I found that ultimately as it stands right now they don't have advanced enough technological capability to cause a major problem" or widespread damage, he says. "But that's not to say in the future" they couldn't become a bigger threat, he says.

Ken Wolf, senior analyst for cyber terror research at Flashpoint, concurs that the cyber terror groups are not skilled or sophisticated in their DoS attacks. His team also has spotted ISIS supporters in one top-tier ISIS forum employing a downloadable DoS tool they dubbed "Caliphate Cannon."
"It was written by a forum member" who appears to be an entry-level coder, he says. Members of the forum downloaded the tool and ran it from their machines in crowdsource-style, HTTP-flood DoS attacks against mainly Middle East government targets in January, for example.
"We've seen other cases where actors have been aggregating … open-source tools" for those attacks, he says. "But there's nothing that we've seen that's suggesting they are using those to inspire their own tool development," Wolf says.
"The greatest value that these actors provide is in their propaganda value," he says.

Ground Battle
It's unclear how the intensified ground battles in Raqqa, Syria and Mosul, Iraq, have affected the Islamic State's cyber powers. Wolf says his team of researchers hasn't seen any Telegram communications out of the United Cyber Caliphate (UCC) since late April, nor any real cyber activity. He says that could indicate manpower losses or other disruptions to their operations as a result of the ground battles.
"We've seen over the past year a few instances in which the United Cyber Caliphate or other groups aligned with it have announced members of their teams were killed in Syria. Most recently, in March, a UCC leader was killed in an airstrike in Syria," Wolf says. "But there's a lot of uncertainty who these actors are, or where they might be," whether on the ground fighting or elsewhere, he says.
Wilhoit says defending against cyber terror groups like the United Cyber Caliphate now doesn't require any different denial-of-service defenses than state-of-the-art firewalls and other best practices. "If you follow basic security precautions, most of these [attacks] can be blocked. They are not using infected botnets to perform denial-of-service attacks," and they are relatively small attacks, he says.
"I'm somewhat surprised that they are not further along than this," Wilhoit says of UCC's cyber-attack capabilities. 

Dark Reading:

You Might Also Read:

Islamic State On The Internet:

Islamic State's Social Media Strategy:

US And UK Agree To Take On Islamic State In Cyberspace:

« US Marines Embrace Cyber Warfare
Terrorist Activities On Social Media »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Charlton Networks

Charlton Networks

Charlton Networks provide a complete range of IT infrastructure, network and security solutions aimed at SME companies.

National Authority Against Electronic Attacks (NAAEA) - Greece

National Authority Against Electronic Attacks (NAAEA) - Greece

The National Authority Against Electronic Attacks (NAAEA) is the national computer emergency response team of Greece.

4iQ

4iQ

4iQ fuses surface, social, deep and dark web sources to research and assess risks to people, infrastructure, intellectual property and reputation.

OnSystem Logic

OnSystem Logic

OnSystem Logic has developed a unique, patent-pending solution to solve the problem of the exploitation of flaws in application software as a technique for cyber attacks.

Vintegris

Vintegris

Vintegris are a Certification Authority and manufacturer of innovative systems and applications for the full cycle of digital identity.

Repulsa

Repulsa

Repulsa provides state-of-the-art, patented, fast filtering with over 700 million malicious IP addresses and over 30 million categorized site listings updated daily.

NextVision

NextVision

NextVision is a Cybersecurity and Technology company offering a range of solutions and services for Security, Compliance and IT Infrastructure Management.

Chronicle

Chronicle

Chronicle products combine intelligence about global threats in the wild, threats inside your network, and unique signals about both.

HCL Technologies

HCL Technologies

HCL offer an integrated portfolio of products, solutions and services built around Digital, IoT, Cloud, Automation, Cybersecurity, Analytics, Infrastructure Management and Engineering Services.

Approach

Approach

Approach is a leading provider of cyber security consulting and secure application development services in Belgium.

Corsha

Corsha

Corsha is on a mission to simplify API security and allow enterprises to embrace modernization, complex deployments, and hybrid environments with confidence.

RevBits

RevBits

RevBits provides high-performance cybersecurity solutions including email security, endpoint security, deception technology and PAM solution to enterprise companies and public sector organizations.

Web3fied

Web3fied

Web3fied is a seed stage company building the future of decentralized digital identity and credentials management.

Fusion Cyber

Fusion Cyber

Fusion Cyber educates students in Zero Trust Risk Management, Defense, and Cyber Offense that lead to taking industry-accepted cybersecurity certifications.

Cycurion

Cycurion

Cycurion is a global leading provider of Network Communications and Information Technology Security Solutions.

Darwinium

Darwinium

Darwinium is a Cyberfraud Prevention Platform that provides scalable customer journey protection without complexity.