ISIS
ISIS, also referred to in the content as the Islamic State and the Islamic State of Iraq and Syria, is a jihadist terrorist organization that emerged from Abu Musab al-Zarqawi’s network, evolving from Jamaat al-Tawhid wa-l-Jihad to al-Qaeda in Iraq, Majlis Shura al-Mujahedin, the Islamic State of Iraq, and finally ISIS. The content describes ISIS as having been active in Iraq and Syria since at least 2014, later expanding through external provinces including Wilayat Qawqaz in Russia’s North Caucasus and ISIS-Mozambique. It is described as a rival of al-Qaeda and, by mid-2014, in open competition and warfare with al-Qaeda and Jabhat al-Nusra for leadership of the global jihadist movement. The group was led by Abu Bakr al-Baghdadi, with senior figures including Abd al-Rahman Mustafa al-Shakhilar al-Qaduli (also known as Haji Imam, Abu Ali al-Anbari, Abu Alaa al-Afri, Hajji Iman, the Hajji, and al-Dar Islami), described in the content as ISIS’s second-most powerful leader and overseer of its intelligence apparatus (amniyat). The content states that ISIS pursued territorial control, governance, propaganda, recruitment, intelligence operations, and foreign operations. It used social media and online platforms for propaganda, radicalization, recruitment, fundraising, and supporter mobilization; multiple references note ISIS recruitment networks online, ISIS media presence, and allegations in litigation that platforms such as YouTube, Twitter, Google, and Facebook amplified ISIS content. The group’s propaganda incorporated apocalyptic and end-times themes that analysts said helped recruit foreign fighters to Iraq and Syria. ISIS and its supporters also used anti-Semitic and anti-Israel messaging, including a propaganda video depicting the murder of Mohamed Musallam, threats against Jews and Israel, promises to conquer Jerusalem, and doxxing of alleged Israeli spies. The content also notes that ISIS supporters formed a cyber-alliance with anti-Israel hackers to increase cyber-attacks on behalf of ISIS. Operationally, the content describes ISIS as using extreme violence, harsh sharia enforcement, and proto-state governance. It captured and controlled infrastructure and territory in Iraq and Syria, and specifically used water resources and infrastructure as instruments of coercion and warfare. Examples directly mentioned include control of the Fallujah Dam, use of dam gates to flood surrounding regions and displace about 12,000 families, capture of Mosul and temporary cutoff of water to the city, cutoff of water to Qaraqosh, capture of the Samarra Barrage, and brief capture of the Mosul Dam. The content also states ISIS captured the Tabqa Dam and Tishrin Dam in Syria. Beyond infrastructure coercion, the content describes ISIS’s campaign against the Yazidis in Iraq as involving separation and execution of men, enslavement and rape of women, and abduction and indoctrination of children. A German court case cited in the content linked an ISIS-associated act against a Yazidi mother and child to ISIS’s broader goal of destroying Yazidi identity. The group is also described as having attracted large numbers of foreign fighters and maintaining transnational facilitation networks rooted in earlier conflicts. The content notes that approximately 2,000 foreign fighters from more than fifty countries were held by the Syrian Democratic Forces in northeast Syria and represented a substantial portion of the remnants of ISIS captured during the final phase of the territorial defeat of the ISIS caliphate. ISIS also maintained a large base of Chechen fighters in Iraq and Syria and released Russian-language propaganda encouraging allegiance, including in support of the establishment of Wilayat Qawqaz. Known aliases and related names directly mentioned in the content include ISIS, Islamic State, Islamic State of Iraq and Syria, Islamic State of Iraq and al-Sham, Islamic State of Iraq, and predecessor organizations Jamaat al-Tawhid wa-l-Jihad, al-Qaeda in Iraq, and Majlis Shura al-Mujahedin. Sub-groups or provinces directly mentioned include Wilayat Qawqaz and ISIS-Mozambique.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- SO
- MZ
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The content describes ISIS as having shifted its center of gravity to Africa, with affiliates competing for territory, resources, and people. It is portrayed as an international movement that could attract foreign fighters if an African capital falls and as a major transnational terrorist threat.
Operating recruitment networks as part of influence and propaganda activity.
Referenced as a target of US cyber operations; specifically, its online/media presence was disrupted in the NSA operation 'Glowing Symphony'.
Systematic violence against families, including the campaign against the Yazidis in Iraq involving separation and execution of men, enslavement and rape of women, and abduction, indoctrination, and reassignment of identities for children.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.