Isis cyber army grows in strength as caliphate hacking groups merge on Telegram

Three groups of pro-Islamic State (Isis) hackers have merged together in order to improve their capabilities, which have previously included hacking web hosts to deface internet sites and spreading religious extremist propaganda on social media.

Caliphate Cyber Army (CCA) is a pro-Isis hacking collective that has been known to target other hacktivists like Anonymous, which have been fighting against them and trying to embarrass the extremists online since the January 2015 Charlie Hebdo attacks in Paris. Junaid Hussain, who was killed by a US drone attack in August 2015, was the leader of this group, but he was the only actual on-the-ground Isis member – the rest were all supporters living in other parts of the world.

Recently, CCA published a "kill list" of 36 police officers in Minnesota, as well as trying to hack Google but mistakenly targeting an Indian business website called Add Google Online that offers search engine optimisation (SEO) services to small and medium businesses. According to an announcement posted on the encrypted messaging app Telegram at 8.44pm GMT on 4 April, CCA announced that it was merging with the Sons Caliphate Army (SCA) and Kalacnikov.TN (KTN) to form a new hacking group.

"After relying on Almighty Allah and by his grace, incorporation between Islamic State Hackers Teams to expand in our operations, to hit'em deeper. We announce our new team United Cyber Caliphate," the post read in both English and Arabic.

Caliphate Cyber Army is a "childish immature group of script kiddies"

Raijin, the technical lead of the Ghost Security Group (GSG), a non-profit organisation of people who analyse information relating to Isis on social media platforms to track potential terrorist activities, says that neither the CCA not SCA are actually that good at hacking, and that this might be the reason why the groups have chosen to collaborate with KTN – a Tunisia-based hacking group that mostly focuses on pro-Palestinian, anti-Israel website defacement campaigns.

"CCA was a childish immature group of script kiddies who had only one way of breaching a site. They didn't have a huge following and their claims were absurd if you knew what they were actually doing. But the media kept picking up their posts and all of sudden they'd go from a reach of about 200 pairs of eyes to tens of thousands or hundreds of thousands. My fear was always that the media alone would be the catalyst for CCA to attract other like-minded crews with much better skills," Raijin told IBTimes UK.

"Even Isis made fun of them because their claims were so outlandish. If this united team can make enough noise, maybe they'll attract someone who actually is capable of selecting any target at will and breaching it.

"I've identified several of them and they look like normal kids having fun, living in normal neighbourhoods, not war zones."

Islamic State is teaching supporters how to hack

According to Raijin, SCA is a little-known group that is not very active and only seems to hijack Facebook accounts in order to change the user's profile picture and profile banner to pro-Isis imagery in order to spread propaganda amongst their friends network. KTN, on the other hand, has much better hacking skills and has been known to steal credit card information by hijacking web hosts and gaining access to all the databases of multiple websites stored on web servers, as well as phishing for PayPal login details.

As for Isis itself, the terrorist group continues to launch multiple new channels on Telegram promoting its ideologies, and Ghost Security Group saw over 700 new channels pop up on the app in March alone. You can't search for content on Telegram, and the only way to find content is to locate links on the web from people in the know and then click on the URLs on a mobile device, or to be linked through an Isis bot that aggregates lists of channels for would-be Isis supporters.

On one channel seen by IBTimes UK, Isis recommends that Isis supporters check out the tech site The Hacker News for "tips and ideas", and the channel owner has also uploaded an eBook version of author David Melnichuk's The Hacker's Underground Handbook for supporters to download for free, to teach them how to hack from a beginner level.

"Learn what it takes to crack even the most secure systems! This guide is a little outdated but the basic concepts are good for foundation! Best defence is offensive," the channel owners state.