Skip to main content
Mallory
🇸🇴 🇲🇿 SO

ISIS

Also known asISIS

ISIS, also referred to in the content as the Islamic State and the Islamic State of Iraq and Syria, is a jihadist terrorist organization that emerged from Abu Musab al-Zarqawi’s network, evolving from Jamaat al-Tawhid wa-l-Jihad to al-Qaeda in Iraq, Majlis Shura al-Mujahedin, the Islamic State of Iraq, and finally ISIS. The content describes ISIS as having been active in Iraq and Syria since at least 2014, later expanding through external provinces including Wilayat Qawqaz in Russia’s North Caucasus and ISIS-Mozambique. It is described as a rival of al-Qaeda and, by mid-2014, in open competition and warfare with al-Qaeda and Jabhat al-Nusra for leadership of the global jihadist movement. The group was led by Abu Bakr al-Baghdadi, with senior figures including Abd al-Rahman Mustafa al-Shakhilar al-Qaduli (also known as Haji Imam, Abu Ali al-Anbari, Abu Alaa al-Afri, Hajji Iman, the Hajji, and al-Dar Islami), described in the content as ISIS’s second-most powerful leader and overseer of its intelligence apparatus (amniyat). The content states that ISIS pursued territorial control, governance, propaganda, recruitment, intelligence operations, and foreign operations. It used social media and online platforms for propaganda, radicalization, recruitment, fundraising, and supporter mobilization; multiple references note ISIS recruitment networks online, ISIS media presence, and allegations in litigation that platforms such as YouTube, Twitter, Google, and Facebook amplified ISIS content. The group’s propaganda incorporated apocalyptic and end-times themes that analysts said helped recruit foreign fighters to Iraq and Syria. ISIS and its supporters also used anti-Semitic and anti-Israel messaging, including a propaganda video depicting the murder of Mohamed Musallam, threats against Jews and Israel, promises to conquer Jerusalem, and doxxing of alleged Israeli spies. The content also notes that ISIS supporters formed a cyber-alliance with anti-Israel hackers to increase cyber-attacks on behalf of ISIS. Operationally, the content describes ISIS as using extreme violence, harsh sharia enforcement, and proto-state governance. It captured and controlled infrastructure and territory in Iraq and Syria, and specifically used water resources and infrastructure as instruments of coercion and warfare. Examples directly mentioned include control of the Fallujah Dam, use of dam gates to flood surrounding regions and displace about 12,000 families, capture of Mosul and temporary cutoff of water to the city, cutoff of water to Qaraqosh, capture of the Samarra Barrage, and brief capture of the Mosul Dam. The content also states ISIS captured the Tabqa Dam and Tishrin Dam in Syria. Beyond infrastructure coercion, the content describes ISIS’s campaign against the Yazidis in Iraq as involving separation and execution of men, enslavement and rape of women, and abduction and indoctrination of children. A German court case cited in the content linked an ISIS-associated act against a Yazidi mother and child to ISIS’s broader goal of destroying Yazidi identity. The group is also described as having attracted large numbers of foreign fighters and maintaining transnational facilitation networks rooted in earlier conflicts. The content notes that approximately 2,000 foreign fighters from more than fifty countries were held by the Syrian Democratic Forces in northeast Syria and represented a substantial portion of the remnants of ISIS captured during the final phase of the territorial defeat of the ISIS caliphate. ISIS also maintained a large base of Chechen fighters in Iraq and Syria and released Russian-language propaganda encouraging allegiance, including in support of the establishment of Wilayat Qawqaz. Known aliases and related names directly mentioned in the content include ISIS, Islamic State, Islamic State of Iraq and Syria, Islamic State of Iraq and al-Sham, Islamic State of Iraq, and predecessor organizations Jamaat al-Tawhid wa-l-Jihad, al-Qaeda in Iraq, and Majlis Shura al-Mujahedin. Sub-groups or provinces directly mentioned include Wilayat Qawqaz and ISIS-Mozambique.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

  • SO
  • MZ
MITRE ATT&CK

Tradecraft

8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

3 of 15 tactics9 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
2 techniques
T1589×3
Gather Victim Identity Information
T1589.001
Credentials
T1593
Search Open Websites/Domains
T1593.001
Social Media
TA0042
Resource Development
1 technique
T1585
Establish Accounts
T1585.001×3
Social Media Accounts
TA0040
Impact
3 techniques
T1496
Resource Hijacking
T1499
Endpoint Denial of Service
T1531
Account Access Removal
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping8

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

ISIS | Mallory