ISIS is attracting a loose cadre of cyber warriors

Law enforcement and national security officials cringe at the threats posed by those who act alone in the name of others without any real affiliation, otherwise commonly referred to as lone wolves. “It’s something that frankly keeps me up at night,” former Attorney General Eric Holder said earlier this year regarding the unknown threat posed by lone actors who could potentially strike at any moment.

The terrorist group ISIS is attracting some of the lone cyber wolves, and the pose a different kind of threat than seen from nation-states. “Unlike the suspected state sponsored groups operating from China and Russia, ISIS-sympathizing hackers are a different type of cyber actor,” security company FireEye said a recent blog post.

FireEye said that, similar to the cyber operations of oppressive states such as Russia and China, sympathizers of the terrorist group have begun to target both large and small media outlets to inflate its presence beyond geographic borders, disrupt reporting and reveal information about soldiers supposedly participating in the global coalition against ISIS. The “Cyber Caliphate,” a loose organization of hackers purportedly acting on behalf of ISIS, in April successfully hacked into an influential French news outlet—TV5Monde—causing the network to go off the air. In another instance, a group called the Moroccan Revolution Team hacked into a chain of New York healthcare websites displaying a message that read “I love you ISIS.” 

ISIS has a high profile on the Internet and has proved itself adept in the cyber domain—so much so that the group was explicitly singled out in the Pentagon’s updated cyber strategy released in April. The recent attacks also demonstrate the threat of loose networks or individuals seeking to do damage on behalf of the group, as well as that the cyber domain is increasingly becoming an operational domain in the military sense.

“During the past year, ISIS-sympathizing hackers have gone from hijacking the social media account of a local television station in Maryland to conducting a more disruptive incident last month at the global television network, TV5Monde,” FireEye said. “This scattershot targeting probably reflects their lack of a leader and disorganization. ISIS-sympathizing hackers likely are dispersed around the globe and meet easily online to plot their next cyber operation. ISIS leaders in Iraq and Syria probably do not issue orders that dictate the sympathizers’ cyber targets in the way that we believe more centralized, resourced threat groups operate.” 

Despite the fact that FireEye noted ISIS was even caught off guard by the TV5Monde hack, signaling the lack of operational insight or support, these groups could pose a danger to unprotected networks, including those in government. While ISIS may not pose a direct military threat to the homeland, cyber attacks know no geographic bounds.

“[W]hose responsibility is it to protect the country? The Defense Department… it doesn’t say ‘except these kind of attacks’ because if somebody attacks in cyber, the distance between cyber and physical attacks can be very short,” former director of the National Security Agency Keith Alexander said in a recent address. In that regard, DOD has taken significant steps toward cyber defense, such as the creation of U.S. Cyber Command, which defends military networks, while the U.S. government as a whole has created a series of protocols and measures—such as greater interagency information sharing and greater information sharing with the private sector on cyber malice—to defend against cyber threats.     

There is not necessarily a need to sound the alarm bells just yet, however. “If you are talking about defacing a website probably one person could do that,” David Emm, principal security researcher at the Kaspersky Lab, told the Guardian. “If you want to get more serious and talk about infiltrating an organization you probably need some more people to do the research—who works there, what are their email addresses, what are their interests. It’s typically going to mean exploiting a human weakness, framing an email to them that is going to make them click [on something containing malware], so there is more legwork, if only because of the intelligence.”