Loading threat actor…
Islamic State of Iraq and Syria (ISIS), also known as the Islamic State, ISIL, Daesh, and formerly al-Qaeda in Iraq (AQI) and the Islamic State of Iraq (ISI), is a Sunni extremist terrorist organization that emerged from Abu Musab al-Zarqawi’s Iraqi jihadist network. It formally split from al-Qaeda in 2014 after disputes over leadership, territorial expansion into Syria, violence, and governance. ISIS established a self-declared caliphate in Iraq and Syria in 2014, but sustained military and counterterrorism pressure dismantled its territorial control. The organization remains active through decentralized cells, external networks, and regional affiliates. ISIS and its affiliates have conducted mass-casualty attacks, insurgency, targeted killings, hostage-taking, propaganda, foreign-fighter recruitment, and attacks against civilian and critical infrastructure. Its operations have included weaponizing water infrastructure in Iraq and Syria by cutting supplies and manipulating dams to cause flooding and displacement. ISIS pioneered the use of commercially available armed drones during the Mosul campaign and affiliates have sought cryptocurrency funding for weapons and drone procurement. ISIS maintains a transnational financing model combining cash, hawala, money-service businesses, charitable fronts, and cryptocurrency. Affiliates and support networks have used cryptocurrency fundraising, laundering, and off-ramping to support fighters, detainees, families, weapons procurement, and operational activity. Stablecoins and encrypted communications have featured in decentralized donation campaigns, while regional exchanges and informal value-transfer networks facilitate conversion into cash. Major ISIS branches and affiliates include Islamic State Khorasan Province (ISKP), Islamic State West Africa Province (ISWAP), ISIS-Somalia, ISIS-Mozambique, and Wilayat Qawqaz in Russia’s North Caucasus. ISKP has conducted transnational attacks, including the 2024 Crocus City Hall attack in Russia. ISIS has also maintained foreign-operations and facilitation networks involving supporters and recruits from Europe and elsewhere. Its ideology incorporates sectarian violence, antisemitism, anti-democratic doctrine, and apocalyptic propaganda used to recruit and mobilize supporters.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses cryptocurrency across its dispersed affiliate network for fundraising and transfers, including support for detained members and families in Syria. African affiliates solicited crypto to acquire weapons and drones.
Mentioned only in passing as a residual threat in Syria.
Pioneered the use of cheap armed drones in combat, specifically inexpensive weaponized drones during the Mosul fighting.
Runs cryptocurrency fundraising campaigns and relies on Syria-based exchangers, hawala operators, and Nigeria-based money service businesses to convert crypto donations into operational cash and move funds across decentralized affiliate networks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.