Hackers Leak Identity Of ISIS Cyber Army Top Brass

Written by Aveek Sen; Originally appeared at securityaffairs

The author is an electronics engineer and journalist from India who covers cyber security, Afghanistan and parts of the Middle East. He tweets at @aveeksen

Since  7th July,  Ghost Squad Hackers (GSH), a hacktivist (hacker activist) group started making the identities of hackers affiliated to ISIS cyber army called United Cyber Caliphate, including leader Mauritania Attacker, public. They also DoSed and took down 3 ISIS propaganda websites.

https://t.co/p4MK0sS2t2 #OpReverseCaliphate Isis propaganda website #Offline pic.twitter.com/sdtjfzwb7u

— s1ege (@s1ege_) July 9, 2016

https://t.co/hoxDxI0GeN #Offline server #Crashed Cloudfare cannot protect you Isis! #OpReverseCaliphate pic.twitter.com/VCDwKR76Il — s1ege (@s1ege_) July 9, 2016

https://t.co/GsFZ3SyJkk #Offline #OpReverseCaliphate every Isis propaganda/supporting site will be offline #GSH pic.twitter.com/EYx2oKffWv

— s1ege (@s1ege_) July 9, 2016

Prior to this, GSH had also gone against a Jordan based bank in May 2016 as it laundered money for ISIS (Part of Operation Icarus against global banking system; GSH are anarchists ideologically).

They were also part of Op ISIS against ISIS sympathisers on Twitter and Facebook. In collaboration with other hackers group like Anonymous, they took down the Twitter and Facebook accounts of ISIS sympathisers as part of Op ISIS.

The method used to expose the ISIS hackers is called doxing. Doxing means finding out the true identity of someone online. That can be via various techniques like finding links between anything revealed by their anonymous identity that could lead to their true identity being found; hacking into their devices or accounts, etc.

Mauritania Attacker has been revealed to be Moulaye Ahmed Ould Ahmed Semane of Nouakchot, the capital city of Mauritania and his Telegram phone number also disclosed. It might cut ISIS from all sources of propaganda as international press carries reports based on information from ISIS online channels.

Three other hackers have also been exposed. One of them is  named Harith Al-muhajir, the second calls himself Ansari Levantine or Romato and as per his Facebook account is from the Philippines. The third is Ouali Bouziad (who hauils from USA and currently lives in Sweden as per his Facebook bio) who had previously claimed that he will attack Malaysian servers for jailing IS terrorists.

The leaked pics of Romato include  one where he’s with his infant daughter, who’s not in a hijab. The other one shows his daughter wearing a hijab with a scarf with the Shahada written on it wrapped around her forehead. The Shahada, one of the Kalmas that are considered holy verses by Muslims, is used by ISIS in its flag.

This could suggest that there has been a recent radicalisation of Romato. It is interesting to note that ISIS has hardly any presence outside of Syria and Iraq. It is using its online propaganda to create fear. Just like the recent Bangladesh hostage crisis was by JMB and ISIS only took credit and did online propaganda, or Yemen or  Afghanistan, none of the networks outside of Iraq and Syria are of ISIS or IS. The media foolishly took ISIS online propaganda outlet Amaq’s claims on Dhaka attack at face value and created panic. ISIS had similarly released a hit list that also included names of 285 Indians, randomly picked up from social media!

As ISIS loses ground in Syria and Iraq, it will try to move from ISIS (Islamic State in Iraq and Syria) to IS (Islamic State). But since it doesn’t have any network outside of Iraq and Syria, it will do a quid pro quo deal with Jihadi terrorist groups online. Swear allegiance to IS and IS does free online propaganda. Hence, IS might expand into cyberspace to create fear disproportional to Hence, IS might expand into cyberspace to create fear disproportional to its on ground terror capabilities.

The online propaganda is picked up by gullible media and the objective of the terrorists, to create further terror among civilians is fulfilled. As such, it is important to monitor ISIS in the cyber world and responsible media should refrain from giving them free publicity.

S1ege said: “They are trying to create a quote on quote ‘Cyber Caliphate’ we intent to prevent that and stop them in their tracks thus we named the operation #OpReverseCaliphate.  Islam is not ISIS, ISIS is a gang attacking on Ramadan and they use drugs,  rape women and kill innocent children. Their victims are of all religions, infact most of their victims are Muslims in Syria & Iraq!”

GSH split from the AnonGhost hackers group when Mauritania Attacker and a few others supported ISIS. Thus two groups were formed: Ghost Caliphate that joined forces with ISIS, and Ghost Squad Hackers that opposed it.

GSH and prior to it, AnonGhost, were considered pro-Muslim hacking groups due to their support to Palestine. On being asked, S1ege replies: “Although we are Muslims Christians and Atheist we have no one religion and  we accept all. But (its true that) majority of us are Muslims and we believe in  true Islam not this fake ISIS shit.”

The war between good and evil seems to be culminating in the cyber world with indications of victory for the good ones. One hopes to see the war reach the same conclusion soon in Iraq and Syria as well.