Skip to main content
Mallory
🇺🇸 US

Islamic State

Also known asIslamic State

The Islamic State (IS), also referred to in the content as ISIS, Isis, and Daesh, is a Salafi-jihadist terrorist organization that declared a self-proclaimed Caliphate on 29 June 2014. The group’s al-Hayat Media Centre launched Dabiq in July 2014 as an English-language propaganda outlet. The content describes IS as a persistent global violent extremist threat despite the territorial defeat of its proto-state in Syria and Iraq on 23 March 2019. The content states that IS supporters are assessed as among the most likely violent extremist actors to target 2026 FIFA World Cup-related soft targets in the United States, including fan zones, transportation infrastructure, hospitality venues, hotels, and watch parties, while stadiums are considered harder targets. It also notes that homegrown violent extremists radicalized online by Islamic State propaganda are viewed as a major threat in the United States. The group is described as maintaining extensive propaganda and online recruitment activity. The content notes that IS migrated to Telegram after pressure on Twitter and remains active there. In Bangladesh, the content states that the Islamic State network continues online recruitment and that Neo-JMB is an Islamic State-affiliated extremist group. It also references Islamic State’s Wilayat al Hind as the group’s India branch. The content attributes to IS an interest in cyber capabilities and the concept of a “cyber caliphate.” It states that IS openly promoted plans to build cyber capabilities, recruit technically skilled supporters online, and target U.S. government agencies, banks, energy companies, and transport systems. IS-linked cyber recruitment is described as having been spearheaded by Junaid Hussein, also known as Abu Hussain Al Britani, a British hacker from Birmingham and former leader of Team Poison who traveled to Syria to join the group. The content also states that IS developed or used encryption tools for militant communications and that Dabiq referenced an encryption program intended to help militants communicate without interception. The content describes multiple branches and networks outside Iraq and Syria. In Somalia, IS is described as having built an operational and financial hub in the north, and Daesh-Somalia is characterized as playing an outsized role in the global Islamic State network through financing, international recruitment, and plotting outside Africa. Treasury reporting cited in the content says Daesh-Somalia has been one of the group’s more successful branches in revenue generation and has facilitated funds to other African IS branches. The content also references Daesh-Sahel Province and notes that Sirte, Libya, was once IS’s most important stronghold outside Iraq and Syria. In Saudi Arabia, the content states that IS declared war on the kingdom in late 2014, announced provinces there including Najd Province, Hijaz Province, and Bahrain Province, and launched attacks targeting Shia civilians and Saudi security forces. The group is described as claiming to be the true representative of Wahhabism while differing from mainstream Wahhabism through its rejection of alliance with the Al Saud dynasty, pursuit of a caliphate, extraordinary violence, and apocalypticism. The content also links IS to attacks and attack claims in Israel. It states that the group claimed responsibility through Amaq for the Hadera shooting, which Israeli officials said was carried out by attackers affiliated with the Islamic State, and notes this was described by SITE as IS’s first official claim of an attack in Israel since 2017. Known aliases and related names directly mentioned in the content include ISIS, Isis, IS, and Daesh. Related branches or affiliates directly mentioned include Daesh-Somalia, Daesh-Sahel Province, Wilayat al Hind, Neo-JMB as an IS-affiliated group in Bangladesh, and the Saudi provinces Najd Province, Hijaz Province, and Bahrain Province.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Consumer Services
  • Transportation

Where they target

Geographies tied to known operations.

  • 🇺🇸 United States

Where they're from

Attributed origin per open-source reporting.

  • US
MITRE ATT&CK

Tradecraft

7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

5 of 15 tactics7 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1589×4
Gather Victim Identity Information
TA0042
Resource Development
2 techniques
T1583
Acquire Infrastructure
T1585×2
Establish Accounts
T1585.001×4
Social Media Accounts
TA0001
Initial Access
1 technique
T1566
Phishing
TA0011
Command and Control
1 technique
T1573×2
Encrypted Channel
TA0040
Impact
1 technique
T1498
Network Denial of Service
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping7

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.