Islamic State Aims to Launch Cyberattacks on US

To date, ISIS’ cyber achievements agint America have been limited, although the US charged a Kosovo native in October with hacking into a US database and stealing personal information on more than 1,350 military and government personnel. Its hackers have tried to penetrate computers that regulate the nation’s electricity grid, US officials say.

The Islamic State is seeking the ability to launch cyberattacks against US government and civilian targets in a potentially dangerous expansion of the terror group’s Internet campaign.

Though crippling attacks for now remain beyond the reach of the Islamic State of Iraq and the Levant, also known as ISIL, its hackers have tried to penetrate computers that regulate the nation’s electricity grid, US officials say. On shadowy Internet forums, ISIL sympathizers post photos and videos of airplane cockpits and discuss wanting to crash passenger jets by hacking into on-board electronics. Fellow extremists debate triggering a lethal radiation release by sending rogue commands to nuclear power plants, according to the New York-based threat intelligence firm Flashpoint.

To date, a lack of world-class expertise has limited ISIL and its supporters to defacing websites, including that of an organization for US military spouses, and pranks such as commandeering the Twitter feed of the US military command directing operations in Iraq and Afghanistan. In September, James Clapper, the director of national intelligence, told Congress that the danger of a catastrophic attack from any cyber adversary was “remote.”

But Islamic State adherents have made no secret of their desire to acquire lethal capabilities, says Alex Kassirer, a Flashpoint terrorism analyst, who monitors conversations on extremist forums. “The capability’s not there and that’s why we’re seeing these low-level attacks of opportunity,” Kassirer said. “But that’s not to say it’s going to be that way going forward. They’re undoubtedly working on cultivating those skills.”

US vulnerability to cyberattacks is well known. Nearly 22 million individual records were stolen when hackers believed to be from China penetrated the government’s central personnel office computers.  The US government spends more than $5 billion annually on cyber defense, with responsibility divided among the departments of Defense and Homeland Security, the National Security Agency and the FBI. US companies, primarily responsible for their-own protection, spend a multiple of that figure.

While ISIL, under growing military pressure in its would-be Middle Eastern caliphate, has mainly put its efforts into inspiring scattered shootings and bombings rather than organizing mass casualty attacks, cyberspace could become a more active front in the war on terror.

The concern is not limited to the US government. Four days after ISIL terrorists killed 130 people in Paris, Britain’s top Treasury official warned that the terror group is dedicated to striking critical infrastructure, such as the financial system or power grid.


To date, ISIL’s cyber achievements have been limited, although the US charged a Kosovo native in October with hacking into a US database and stealing personal information on more than 1,350 military and government personnel. The suspect, Ardit Ferizi, later passed the data to Junaid Hussain, a member of the self-proclaimed Islamic State Hacking Division who was reportedly killed by an airstrike in Syria in August, authorities said. The information Ferizi pilfered included U.S. personnel’s email addresses, passwords, locations and phone numbers, according to the Justice Department.

Compared with earlier terrorist generations, ISIL has demonstrated an appeal to young, tech-savvy individuals far from the battlefields of Iraq and Syria, Kassirer said.

“Al Qaeda’s media apparatus was a van driving around Yemen passing out videos,” she said. “ISIS has really revolutionized how they use the tech sector, and their recruits tend to be younger individuals who grew up in the tech age.”

The group has also shown a sophisticated understanding of ways to shield its communications from eavesdropping intelligence agencies. Flashpoint earlier this month reported on a detailed manual released by an ISIL supporter urging members to use the popular encrypted chat system Signal. The manual even describes how to employ a fake phone number to set up a Signal account to avoid revealing personal information.

That’s a far cry from Al Qaeda, which communicated via couriers to escape surveillance, she said.

Experts have traditionally discounted the risk of cyberterrorism, saying terrorists prefer the greater chaos and bloodshed of physical attack. The technical skill required to execute a major cyberattack also was judged beyond any but a few nation-states.

Terrorists might pair a cyber-strike with a traditional attack to amp up the confusion or death toll, Bacon suggested. If terrorists overwhelmed the communication networks used by emergency responders, for example, that could magnify the damage of a physical attack. Attacking broadcast facilities might increase the public’s panic.

Still, ISIL for now is likely to stick to its traditional tools, guns and explosives, analysts said. “As far as getting attention, there’s still going to be, in the minds of most terrorist groups, an inherent advantage in things that make loud noises and flashes and kill a lot of people as opposed to digital systems going down,” said Paul Pillar, a Georgetown University terrorism expert and former CIA analyst. “The speculation about exotic terrorist techniques, especially in the cyber arena, has outrun what groups are actually doing.”

Politco: http://politi.co/1kpKYS8

« Apple Opens Fire In Encryption Battle
BBC Websites Offline After Massive DDOS Attack »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Alan Turing Institute

Alan Turing Institute

Alan Turing Institute is the UK national institute for data science. A major focus is Big Data analysis with applications including cyber security.

Thermo Systems

Thermo Systems

Thermo Systems is a design-build control systems engineering and construction firm. Capabilties include industrial control system cybersecurity.

ENEA Qosmos Division

ENEA Qosmos Division

Qosmos, a division of Enea, leads the market for IP traffic classification and network intelligence technology used in physical, SDN and NFV architectures.

Institute for Cybersecurity & Privacy (ICSP) -  University of Georgia

Institute for Cybersecurity & Privacy (ICSP) - University of Georgia

The goal of ICSP is to become a state hub for cybersecurity research and education, including multidisciplinary programs and research opportunities, outreach activities, and industry partnership.

National Digital Exploitation Centre (NDEC) - United Kingdom

National Digital Exploitation Centre (NDEC) - United Kingdom

NDEC is a project to create a centre of cyber and digital development and education for the UK. It will offer training in digital practices, cyber security and research.

Epati Information Technologies

Epati Information Technologies

ePati Information Technologies is a specialist in information technology and cyber security.

FinCom.co

FinCom.co

FinCom.Co is the world’s first automatic AML/ KYC screening system, for comprehensive compliance.

Lewis Brisbois

Lewis Brisbois

Lewis Brisbois offers legal practice in more than 40 specialties, and a multitude of sub-specialties including Data Privacy & Cybersecurity.

Wiser Market

Wiser Market

Wiser Market is a leading company in global online brand protection services, intellectual property protection, anti-Counterfeit & trademark infringements.

Rede Nacional CSIRT

Rede Nacional CSIRT

Rede Nacional CSIRT is a national network of CSIRTs in Portugal aimed at cooperation and mutual assistance in the handling of incidents and in the sharing of good security practices.

Appurity

Appurity

Appurity specialises in mobile and application security, delivering comprehensive solutions across all verticals.

Prancer

Prancer

Prancer is the industry's first cloud-native, self-service SAAS platform for automated security validation and penetration testing in the cloud.

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions is an Enterprise Cyber Security Platforms company offering Cyber Security & Technical Education and Compliance & Penetration Testing Services.

Applied Insight

Applied Insight

Applied Insight work closely with government agencies and industry to overcome technical and cultural hurdles to innovation, empowering them with the latest cloud, data and cyber capabilities.

Scality

Scality

Scality storage unifies data management from edge to core to cloud. Our market-leading file and object storage software protects data on-premises and in hybrid and multi-cloud environments.

National Cybersecurity Competence Center (NC3) - Luxembourg

National Cybersecurity Competence Center (NC3) - Luxembourg

The purpose of the is to strengthen the Country's ecosystem facing cyber Luxembourg National Cybersecurity Competence Centerthreats and risks.