How ISIS uses the internet: malware, phishing, DDoS attacks, and communicating over Telegram
Sheera Frenkel / BuzzFeed :
Context & Ripple Effects
This piece sits mid-arc in the coverage of ISIS's online operations. Months earlier, NBC News reported the group ran a 24-hour help desk so members could recruit jihadists and use encryption to evade law enforcement; here, BuzzFeed's Sheera Frenkel adds the offensive layer — malware targeting computer systems, phishing campaigns against users, and DDoS attacks against online services — running alongside the Telegram channels operatives already coordinate on.
What came after shows why the mapping mattered: operatives went on to direct attacks in other countries anonymously over Twitter, Telegram and ChatSecure ([[a:916355]]), then dispersed to free public chat apps like RocketChat, Viber and Discord ([[a:937498]]) as scrutiny mounted, and by 2021 were slipping fundraising past social media moderators disguised as humanitarian appeals ([[a:963617]]).
First-order effects
- Telegram is carrying ISIS communication and coordination, putting the app's operators in the position of hosting traffic their own architecture makes hard to police, while law enforcement confronts malware, phishing and DDoS activity layered on top of recruitment.
- Online services hit by DDoS attacks and users targeted by phishing face direct operational disruption now, not hypothetical risk.
Second-order effects
- As attention fixes on Telegram, the group's documented pattern of hopping services forces each next host — RocketChat, Yahoo Together, Viber, Discord — into the same moderation-and-detection role Telegram occupies.
- Platforms also inherit adjacent abuse beyond messaging: the later fundraising campaigns show the same evasion playbook extending into payments and humanitarian-themed content.
Third-order effects
- If the pattern holds, counter-extremism enforcement becomes a standing cost of operating any mainstream consumer platform — a cat-and-mouse in which each takedown pushes the network to the next free service rather than eliminating it.
- Infiltration pressure compounds this: even fake versions of ISIS Android apps circulated among supporters, showing how porous these closed networks are to outside interference in both directions.
The trend: ISIS's online operations keep migrating across consumer platforms, turning each new host — from Telegram to RocketChat to fundraising feeds — into the next front line of counter-extremism enforcement.