ISIS-linked group promoting ‘lone jihadi’ tutorials on the dark web

A pro-Islamic State hacking group operating on the dark web has called on Muslims in the U.S. and Europe to launch attacks in their own countries. The ‘cyber Kahilafah’ group issued a message addressing so-called ‘lone wolves’ operating in “Europe, America and Gulf States involved in the coalition fighting the Islamic State.” “We invite you to train for combat and learn how to build and detonate improvised explosives” a chilling message on the front page of a new Zeronet portal observed by The Foreign Desk said. “If you cannot migrate from the land of the infidels to the Caliphate, then carrying out jihad in your own country will also be a victory for the Islamic State and all Muslims,” the message read. The website appeared on the ZeroNet network, a serverless peer-to-peer group of websites that rely on bitcoin cryptography and the BitTorrent network. These websites, though encrypted, making simple detection challenging for authorities, are accessible via a regular web browser. According to analysts there is presently no way to take down a ZeroNet webpage that still has seeders. Links on the ZeroNet page refer the user to an archive of PDF and video tutorials on bomb making, hacking tools and jihad guides hosted on the anonymous TOR network and a separate ZeroNet page provides a secure email address for further contact. The message for attacks in the West echoes the sentiments of a speech given by Islamic State leader Muhammad Al Adnani in May in which he declared that “if the tyrants have shut the doors of hijra [immigration to ISIS territories] in your face, then open the gate of jihad in their faces and make them regret their action. The smallest bit of work that you can carry out in their countries is far better and beloved to us than any major work [i.e. operations] here.” Adnani, a chief propagandist for the Islamic State, died in a coalition airstrike last month, but his message has become a cornerstone for jihadis to channel their militancy towards targets back home in the West. A reference to Adnani’s speech was found in a notebook carried by Ahmad Khan Rahami, the suspect behind last weekend’s terror spree in the NY/NJ area. One of Rahami’s entries reads, “I looked for guidance and . . Guidance came Sheikh Anwar Said it clearly attack the Kuffar [non-believers] in their backyard.” Rahami planted explosives in Seaside Park NJ, ahead of a Marine Corps charity run, before planting explosives in a dumpster on 23rd St. New York, Saturday night. Twenty-nine people were injured in that blast. A pressure cooker that failed to detonate was also found by police on West 27th Street, and authorities also discovered explosives at an Elizabeth, NJ train station in the early hours of Monday before a shootout with police ended with the arrest of Rahami, in Linden, NJ. To date, no group has claimed responsibility for the attacks carried out by Rahami. Analysis The Telegram Messenger app has become the platform and tool of choice for jihadis across the globe who use the app to communicate securely, exchanging commands and messages and spreading Islamic State propaganda across continents. Whereas Twitter and Facebook accounts are removed within hours, Telegram channels, which are secretive by nature and are often by invitation only, allow jihadis to grow online communities sometimes for up to a month and more. However, despite Telegram’s stated cloak of privacy and its purported obscurity to the intelligence community (Telegram has offered a $300,000 reward to hackers who can crack the company’s encryption,) French authorities have arrested more than a dozen jihadis over the past month, including a number of teenage girls, who have been communicating with a notorious jihadist using the encrypted app, after they gained entry to one of his secret channels. Kassim, 29, a sketchy French jihadist who fled to Syria via Egypt, has emerged in recent weeks as a key recruiter of the Islamic State, ‘remote controlling’ attacks in France in what French prosecutors have labeled terrorisme de proximite" (local terrorism). Authorities believe Kassim played a key role in the death of a French police couple in June as well as the slaying of an 86-year-old priest at his Church in July, attacks later claimed by the Islamic State. Breaches such as this may be leading jihadis to look further at even greater methods of stealth and anonymity online, such as ZeroNet and TOR-based websites.