MS Risk Blog

Syrian, Egyptian Electronic Armies take Aim at ISIS

The Syrian Electronic Army has returned, and a copycat army of hackers has sprung up in Egypt.

The Syrian Electronic Army (SEA) is a group of hacktivists that support the Syrian government and its president, Bashar al Assad. On 27 November, the group targeted Gigya, a company which manages online comment platforms and Identity and Access Management for nearly 700 clients. The SEA breached Gigya’s account and redirected visitors to an SEA website.

The hack impacted 21 major websites including media outlets Aljazeera, the Chicago Tribune, CNBC, CNN Money, the Evening Standard, the Los Angeles Times, Microsoft, National Geographic, NBC, the New York Daily News, the Guardian, and the Independent. The breach also impacted tech companies including Dell, DirecTV, Logitech, Microsoft, and Verizon Wireless. For three and a half hours, visitors to the hacked sites received a message stating, “You’ve been hacked by the Syrian Electronic Army (SEA),” and were then redirected to an image of the SEA’s logo and a Syrian flag.

In response to the attack, Gigya CEO Patrick Salyer said, “To be absolutely clear: neither Gigya’s platform itself, nor any user, administrator nor operational data has been compromised and was never at risk of being compromised.”

On the SEA’s website, the pro-Assad hacktivists said the attack was launched in response to reports that Syrian airstrikes in Raqqa hit civilians, “while the truth the strikes hit the ISIS terrorists.” Raqqa, a city in northern Syria, is the headquarters for terrorist group Islamic State in Iraq and the Sham. On Twitter, the group messaged, “Happy thanks giving, hope you didn’t miss us. The press: Please don’t pretend #ISIS are civilians.”

In a second Tweet, the SEA provided users with information on how to prevent hacking:  “We’re the good guys so this was harmless but just in case the bad guys copy us, use NoScript with Firefox: noscript.net.”

Since their emergence on the hactivist scene in 2011, the SEA has caused disruption to numerous websites, but they are best known for hacking Twitter account of the Associated Press’ in April 2013. The group posted a tweet claiming that Barack Obama had been injured, causing Dow Jones Industrial Average to immediately plunge 143 points in response.

Meanwhile in Egypt, a copycat group has risen and is targeting ISIS and its online propaganda. In late November, less than 24 hours after ISIS social media accounts posted a threatening message from the group’s leader, Abu Bakr al Baghdadi, the Egyptian Electronic Army (EEA) replaced the audio recording with a song, and replaced the ISIS transcript with a logo resembling that of the Egyptian military, accompanied by a writing in Arabic that read “Egyptian Cyber Army.”

The modus-operandi was nearly identical to the methods used by the Syrian Electronic Army, which has inspired the group. However the hacktivists do not have any connection to one another.  According to a spokesman for the group, a man claiming to be a 37-year-old former Cairo police officer who goes by the name “Khaled Abubakr”, the EEA group’s members are all Egyptian. Many come from a military or police background, and all support the Egyptian government led by President Abdel Fattah el-Sisi. It is unclear whether the group is state sanctioned.

The EEA seeks to defend al-Sisi’s governments against opponent such as the Muslim Brotherhood or ISIS. The broad anti-ISIS perspective in the nation has brought a mass of hacktivists to the group who want to counter the terrorist group’s influence on the Internet. The spokesman said that Baghdadi “was delivering a message to all extremists all over the Middle East and my country that you have to use your weapons in the faces of the government and our people, so we took it down and replaced it with a very popular song. All the people instead of hearing this pig heard our song and laughed.”

The group has also claimed to have infiltrated top ISIS web forums, and American pro-democracy websites including the Open Society Foundation and the U.S.-Middle East Partnership Initiative, however there is no solid evidence of these activities. A security researcher says that some of the EAA’s supporters appear to have highly capable technical background.

The EAA has refused to disclose how the attack was conducted. A spokesman for the Internet Archive said that no outside account “made any modifications” to the files other than the original uploader. But that doesn’t rule out the possibility that the account was taken over by the hackers. The group claims they will continue to conduct hacktivist activities. The EAA spokesman said, “We have our people spying on al-Furqan, [the media arm of ISIS] which is the media of the terrorists and this will not be the last thing we are going to do. They must expect us any time.”

ISIS declares Sinai as the new destination for young fighters

3  December- The Islamic State of Iraq and Levant and the Sham(ISIS) are conducting a marketing strategy which recommends the Sinai as a destination for young militant recruits. The move comes after Sinai-based terrorist group Ansar Beit al Maqdis (Ansar Jerusalem), swore allegiance to ISIS and its leader, Abu Bakr al Baghdadi on 10 November. Soon thereafter, Ansar Beit al Maqdis began to refer to itself as “the Islamic State’s province in the Sinai”. ISIS has envisioned a caliphate stretching from Iraq to the Mediterranean. While ISIS does not have any actual control in the Sinai, the announcement is an attempt to marginalise other militants, perhaps to convince them to pledge allegiance to Baghdadi as well. ISIS supporters are calling on fighters globally to help Baghdadi’s organization build up its presence in the Sinai even further.

ISIS has made use of the Al Battar Media Establishment and the Media Front in Support of the Islamic State, two radicalised publishing establishments that deliver propaganda through social media. Each has posted a six-page article on Twitter written by a fighter known as “Abu Musab al Gharib”, who argues that the establishment of the Islamic State’s province in the Sinai will lead to greater unification of ISIS groups across the Middle East and North Africa. In November, ISIS gained total administrative control over Derna in the Eastern Province of Libya, and has set up training facilities in the mountainous regions in order to train North African fighters. By creating a unified front, Gharib ominously states, it will become easier for the jihadists to advance on Jerusalem and engage in the “liquidating” of the Jews in Egypt, Golan, Jordan, and Lebanon.

ISIS’s expansion has increased already existing tensions with other militant organisations. Al Qaeda has appeared to be at odds with the group and has competed for militants in “recruitment drives”, even opening a branch in Southeast Asia. Baghdadi and ISIS claim that their “caliphate” has usurped the authority of terrorist organisations in Egypt, Libya, Saudi Arabia, and Yemen. However the most organised and strong among these groups have not given over to Baghdadi. However despite the hindrance of competing terrorist organisations, reports indicate that ISIS’s campaign has been successful. Foreign fighters from the Levant, North Africa, Yemen, and elsewhere have travelled to the Sinai for training and other purposes.

Worryingly, the Sinai group appears to be increasingly active. Over the last weekend of November, Ansar Beit al Maqdis, under their new moniker, claimed to have killed an American oil worker. On Sunday, the group published an image on Twitter of a passport and two identification cards belonging to William Henderson, a 58-year-old employee of the Apache Corporation and Qarun Petroluem Co. Henderson was thought to have been killed in a carjacking incident in August.

It is uncertain whether Ansar Beit al Maqdis was actually responsible for the killing or just claiming it; the US State department is still investigating Henderson’s death and the US Embassy in Cairo has not disclosed any information. However the claim raises international concern that Sinai based radicals may begin to expand their targets beyond Egyptian military and security forces, or may even begin seeking Westerners for kidnap for ransom, or to send a visible political message.

Boko Haram Increases Tempo of Attacks in Wake of Ceasefire Claims

Boko Haram has been carrying out attacks with increased frequency and deadliness since the Nigerian military declared in October that the insurgents had agreed to a ceasefire. The recent wave of attacks across northern Nigeria have demonstrated the terrorist group’s continued abilities to strike at will in the region despite a state of emergency that was put in place to curb the group’s five year insurgency.

The most recent attacks attributed to Boko Haram occurred Monday in the northeastern state capitals of Damaturu and Maiduguri. At least five people were killed and 32 wounded when twin blasts targeted a crowded market in Maiduguri. The latest attack in the Borno state capital comes nearly a week after two female suicide bombers attacked the same market on 25 November, killing 78 people. Several witnesses reported Monday that two female bombers were responsible for the attacks. A separate attack in Damaturu, the capital of neighbouring Yobe state, began shortly after 05:00 local time (0400 GMT), with militants setting fire to a riot police base, and later attacking a primary school and the city’s university. On the ground sources reported that Boko Haram fighters, who have obtained most of their weapons by seizing them from the Nigerian army, appeared to be trying to gain access to military equipment stockpiled in the city.

Monday’s attacks on the two state capitals appear to be a continued acceleration of extremist violence in northeastern Nigeria, which in recent weeks has seen insurgents staging attacks on an almost daily basis. Over the past two weeks, attacks linked to Boko Haram have killed at least 220 people, with some experts indicating that the number is likely closer to 300. On Friday, at least 120 people were killed after three explosions occurred during prayer hours at one of the largest mosques in the city of Kano. Security officials believe that the Grand Mosque in Kano may have been targeted after one of Nigeria’s top Islamic leaders recently issued a call to arms to fight Boko Haram. On Thursday, at least forty people were killed after a bomb exploded at a bus station in Mubi, the second largest city in Adamawa state. While some of these attacks have yet to be claimed, Boko Haram is widely suspected to be responsible.

Boko Haram’s attacks and the recent seizure of several towns in northeastern Nigeria have killed thousands of civilians and forced many to flee, resulting in a massive displacement that is creating a humanitarian crisis in Africa’s most populous nation, and in neighbouring states. According to a report released by Human Rights Watch earlier this year, from January to June 2014, Boko Haram attacks killed at least 2,053 people. The recent escalation of attacks has also caused thousands to flee, with many seeking shelter elsewhere in Nigeria, or opting to cross the border in neighbouring Cameroon or Niger.

Earlier this month, the militant group seized a town in northeastern Nigeria’s Borno state, killing nearly fifty people and forcing at least 3,000 people to flee to Niger. According to the United Nations refugee agency, UNHCR, since May 2013, at least 100,000 people have fled to Niger. Last month, Boko Haram seized control of the town of Mubi, in Adamawa state. That attack forced at least 13,000 people to flee to Cameroon. Continued violent attacks will only worsen the already fragile humanitarian situation in both Nigeria and in neighbouring states.

Boko Haram’s expanding threat and recent cross-border raids in Cameroon have demonstrated the militant group’s desires to expand their operations. Fears that Boko Haram fighters may soon target neighbouring states have prompted officials in Niger and Cameroon to close schools and health centres located along the borders with northern Nigeria over fears of attacks carried out by the Islamist group. Many civilians living in towns close to the porous border have opted to leave, seeking safety elsewhere.

The Nigerian government’s state of emergency, which was imposed in May 2013, has done little to curb the violence. The recent denial of a third extension of the emergency rule demonstrated that Nigerian MP’s, like Nigerian civilians, are becoming increasingly frustrated with the situation. The Nigerian government’s security strategy now remains uncertain while the tempo of Boko Haram attacks is likely to increase over the month of December as the holiday season approaches.

The WHO Achieves December 1 Ebola Targets

On Monday, World Health Organization (WHO) officials indicated that they have met what they call interim targets that were put in place in October in a bid to end the upward trend in new Ebola cases. While progress has been made, with some countries seeing the spread of the disease either stabilize or decline, reports of new cases in Mali and high transmission levels in some parts of Sierra Leone have shown that more work is required in order to end the worst Ebola outbreak on record.

Two months ago, the WHO launched a plan to stop the Ebola outbreak in West Africa. It aimed to isolate 70 percent of the sick and safely bury 70 percent of the victims in the three hardest hit countries – Guinea, Liberia and Sierra Leone – by 1 December. According to the latest figures released by the UN health agency, both Liberia and Guinea have met the targets, with Sierra Leone likely to fully achieve its goal in the coming weeks.

New figures released Monday indicate that both Liberia and Guinea have met the 1 December target for isolating 70 percent of people infected with Ebola, and have safely buried 70 percent of those who died. Sierra Leone however has not fully met the target. At a news conference in Geneva, the WHO’s Dr Bruce Aylward disclosed that Sierra Leone’s western region probably met the targets and likely will improve to the 70 percent target nationwide “in the coming weeks.” Dr Aylward further disclosed that the WHO’s plan to stop the spread of the deadly Ebola virus had shown that it was possible to quickly reduce the “yawning gap” between disease levels and the capacity to respond.

In recent weeks there have been a number of successes in the fight against Ebola. Amongst these are the fact that Ebola cases in Liberia and Guinea are either stabilizing or are on the decline. The case in Sierra Leone however is quite different as the country’s capital city Freetown and the town of Port Loko are seeing a severe surge in cases. Additionally, a new outbreak in Mali has caused concern that the deadly disease will spread into other West African countries.

When the deadline was first announced in October, Dr. Aylward acknowledged that to reach the 1 December goal would be “really pushing the system hard.” Dr Aylward, who is directing the WHO’s Ebola response, further disclosed “if we don’t do it in 60 days and we take 90 days: No. 1, a lot more people will die that shouldn’t; and No. 2, we will need that much more capacity on the ground to be able to manage the caseload.”

The Ebola outbreak was first reported in Guinea in March of this year. It has since spiralled out of control and was declared a public health emergency in August.   Latest figures released by the WHO indicate that the Ebola virus has sickened more than 16,000 people, of whom 7,000 have died. Tony Banbury, the head of the UN Ebola response mission in West Africa has warned that there is still a “huge risk” that the deadly disease could spread to other parts of the world.

Many Killed In Bombings in Northeastern Nigeria

Reports emerged Friday that many people have been killed in three explosions that occurred during Friday prayers at one of the largest mosques in the Nigerian city of Kano. The attacks come a week after one of Nigeria’s top Islamic leaders issued a call to arms to fight Boko Haram.

According to on the ground sources, the Grand Mosque in Kano was targeted Friday by suspected Boko Haram militants. The blasts occurred as Friday prayers had got under way at about 2:00 PM (1300 GMT). According to one local, “two bombs exploded, one after the other, in the premises of the Grand Mosque seconds after the prayers had started,” adding “a third one went off in a nearby road close to the Qadiriyya Sufi order. The blasts were followed by gunshots by the police to scare off potential attacks.” Eyewitnesses have reported that at least fifty people were killed in the attack, however officials have not released any official figures. National police spokesman Emmanuel Ojukwu confirmed that an attack had occurred in Kano however he noted that he was waiting for a briefing from officers at the scene and declined to comment further.

While Boko Haram has in the past targeted the city, which is the largest in northern Nigeria, several times during its five-year insurgency, most of its attacks have occurred in the eastern areas of the city.

The Grand Mosque is attached to the palace of the Emir of Kano, Nigeria’s second most senior Muslim cleric. The Grand Mosque is also where the influential Muslim leader usually leads prayers. The Emir, Muhammed Sanusi II, is currently in Saudi Arabia. Sources have reported that he arrived in Saudi Arabia late on Thursday night from Paris. Some have indicated that Friday’s attack on the Grand Mosque may be the result of comments made by the Emir last week in which he stated that northerners should take up arms against Boko Haram. In what are rare public comments by a cleric pertaining to political and military affairs, the Emir also cast doubts on the ability of Nigeria’s army to protect civilians and to end the five-year insurgency.

Friday’s explosions come after civilian vigilantes in the northeastern city of Maiduguri revealed that they had foiled a bomb attack against a mosque just five days after two female suicide bombers killed over forty-five people in the city.   Civilian vigilantes have disclosed that they discovered a suspected remote-controlled device that was planted in the Gamboru Market area of the city. Sources have indicated that while the bomb was successfully diffused by the police bomb squad another bomb near the area exploded. There were no casualties and the area has since been cordoned off. Locals have reported that the bombs were likely planted ahead of Friday’s prayers, as there is a mosque located nearby. Many suspect Boko Haram militants to be behind this incident, which also come just days after several arrests were made. If Boko Haram confirms this incident, then it would demonstrate that it is evolving its tactics, as the use of concealed roadside bombs is not typically a method that the group has used. In the past, Boko Haram has used direct hit-and-run tactics, car bombs and suicide attacks to carry out its deadly campaign of creating an Islamic state in northeastern Nigeria.