Islamic State
The Islamic State (IS), also referred to in the content as ISIS, Isis, and Daesh, is a Salafi-jihadist terrorist organization that declared a self-proclaimed Caliphate on 29 June 2014. The group’s al-Hayat Media Centre launched Dabiq in July 2014 as an English-language propaganda outlet. The content describes IS as a persistent global violent extremist threat despite the territorial defeat of its proto-state in Syria and Iraq on 23 March 2019. The content states that IS supporters are assessed as among the most likely violent extremist actors to target 2026 FIFA World Cup-related soft targets in the United States, including fan zones, transportation infrastructure, hospitality venues, hotels, and watch parties, while stadiums are considered harder targets. It also notes that homegrown violent extremists radicalized online by Islamic State propaganda are viewed as a major threat in the United States. The group is described as maintaining extensive propaganda and online recruitment activity. The content notes that IS migrated to Telegram after pressure on Twitter and remains active there. In Bangladesh, the content states that the Islamic State network continues online recruitment and that Neo-JMB is an Islamic State-affiliated extremist group. It also references Islamic State’s Wilayat al Hind as the group’s India branch. The content attributes to IS an interest in cyber capabilities and the concept of a “cyber caliphate.” It states that IS openly promoted plans to build cyber capabilities, recruit technically skilled supporters online, and target U.S. government agencies, banks, energy companies, and transport systems. IS-linked cyber recruitment is described as having been spearheaded by Junaid Hussein, also known as Abu Hussain Al Britani, a British hacker from Birmingham and former leader of Team Poison who traveled to Syria to join the group. The content also states that IS developed or used encryption tools for militant communications and that Dabiq referenced an encryption program intended to help militants communicate without interception. The content describes multiple branches and networks outside Iraq and Syria. In Somalia, IS is described as having built an operational and financial hub in the north, and Daesh-Somalia is characterized as playing an outsized role in the global Islamic State network through financing, international recruitment, and plotting outside Africa. Treasury reporting cited in the content says Daesh-Somalia has been one of the group’s more successful branches in revenue generation and has facilitated funds to other African IS branches. The content also references Daesh-Sahel Province and notes that Sirte, Libya, was once IS’s most important stronghold outside Iraq and Syria. In Saudi Arabia, the content states that IS declared war on the kingdom in late 2014, announced provinces there including Najd Province, Hijaz Province, and Bahrain Province, and launched attacks targeting Shia civilians and Saudi security forces. The group is described as claiming to be the true representative of Wahhabism while differing from mainstream Wahhabism through its rejection of alliance with the Al Saud dynasty, pursuit of a caliphate, extraordinary violence, and apocalypticism. The content also links IS to attacks and attack claims in Israel. It states that the group claimed responsibility through Amaq for the Hadera shooting, which Israeli officials said was carried out by attackers affiliated with the Islamic State, and notes this was described by SITE as IS’s first official claim of an attack in Israel since 2017. Known aliases and related names directly mentioned in the content include ISIS, Isis, IS, and Daesh. Related branches or affiliates directly mentioned include Daesh-Somalia, Daesh-Sahel Province, Wilayat al Hind, Neo-JMB as an IS-affiliated group in Bangladesh, and the Saudi provinces Najd Province, Hijaz Province, and Bahrain Province.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Transportation
- Consumer Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- US
Tradecraft
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Supporters of Islamic State are assessed as the most likely violent extremist actors to plot attacks against 2026 FIFA World Cup-related targets in the US, especially audiences, fan zones, transportation infrastructure, and hospitality facilities rather than stadium venues directly.
Referenced as the most likely violent extremist actor whose supporters in the US could plot attacks related to World Cup audiences, fan zones, transportation infrastructure, and hospitality facilities.
Referenced as the broader jihadist organization whose African affiliates support global activity through financing, recruitment, safe havens, and external plotting.
Referenced as a jihadist organization inspiring homegrown violent extremists and lone actors, with recent attacks in the US linked to Isis inspiration or support.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.