The Al-Maarek Media Foundation and al-Qaeda’s ‘Cyber Jihad’

October 27, 2015

The Al-Maarek Media Foundation is a pro-Al-Qaeda entity with professed links to Afghanistan.[1] As in the case of many jihadi groups, it uses both Facebook and Twitter.[2] This report is an overview and assessment of their social media activity.

Video Production

Al-Maarek is responsible for producing and posting pro-Al-Qaeda videos on social media. The group announces them on Facebook and Twitter and posts the videos themselves on the Internet Archive (archive.org) and YouTube.

In videos like “Fight in the Path of God”, the group clearly espouses a radical, jihadi ideology. This video, released on February 8, 2015, contains voiceover criticizing the “war against the Islamic ummah” at the hands of the “American crusaders.” It also features footage of bombing attacks against U.S. vehicles in Iraq, and video of Osama bin Laden.

cjlab1027A screenshot from the Al-Maarek video “Fight in The Path of God” featuring Osama bin Laden. 

Hacking And Cyber-Jihad On Al-Maarek’s Twitter Account

Al-Maarek is active on Twitter; their account first tweeted on March 30, 2015 and currently has 245 followers and 19 tweets. Al-Maarek’s members use the site to support Al-Qaeda’s “cyber jihad.” Using Twitter and justpaste.it, they have announced multiple cyber-attacks launched on different websites. These “cyber jihadis” have targeted Chinese websites, the website for the Vietnamese Bar Association, commercial websites in India, and multiple Israeli websites. Al-Maarek’s tweets contain links to justpaste.it pages providing statements about those attacks.

On June 19, Al-Maarek tweeted a “statement of penetration a [sic] Russian tourist company by #AlQaeda_Electronic.” The text contained in the justpaste.it link explains that the reason for AQ’s actions were Russia’s counterterrorism policies towards Muslims in the Caucasus. They dedicated this “blessed” hacking operation to “Muslims generally and Muslims and mujahideen of the Caucasus especially” and threatened more cyber-attacks if Russia did not “stop the war against the Muslims in the Islamic Caucasus.”[3]

The justpaste.it pages tweeted by Al-Maarek often contain links to Zone-h.org. This website is an archive of defaced and hacked webpages and another way the organization can provide specific information about Al-Qaeda’s hacking activities. The pages contain details on the hack’s timing, the operating system used by the hackers, and the IP address of the target, as well as cached versions of the defaced sites.

cjlab10271Zone-H page providing details of an Al-Qaeda hack

cjlab10272Al-Maarek’s Twitter page, in which they identify themselves as a “media affiliate of Al-Qaeda Electronic” (“Al-Qaeda Electronic Jihad Base” in Arabic)

cjlab10273 Al-Maarek announcing the attack on a Russian website

Hacking and Cyber Jihad on Al Maarek’s Facebook Page

Al Maarek’s Facebook page shows a detailed record of the Electronic Jihad Base’s activities. The page was created on April, 2015, and has 89 likes as of June 30. Content posted on the page appears almost identical to that posted on their Twitter page, and is usually posted simultaneously to both sites. This appears to be part of a self-preservation strategy, since both Facebook and Twitter delete extremist accounts on a regular basis. Therefore, if one of Al-Maarek’s accounts is removed, they already have a backup in place on another site.

cjlab10274The same content posted on Al-Maarek’s Twitter and Facebook pages

Al Maarek’s Facebook posts also contain detailed accounts of hacking operations. They will often provide links to sites confirming the penetration of the target’s servers.

cjlab10275Facebook post providing a detailed confirmation of a hacking operation

In addition to hacking businesses and civil society organizations, the cyber jihadis also target rival Islamists. Attacks have been launched against Islamist forums deemed by AQ to be “Kharijites” and “infidels,” examples of this include alfetn.com and shabakataljahad.com.[4]

cjlab10276Al-Maarek announcing their attack on the Shabakat Al-Jahad (“Jihad Network”) forum

Endnotes:

[1] Tweets and Facebook posts from the group refer to Taliban leader Mullah Muhammad Omar as “Amir Al Mu’mineen” (leader of the believers), and their Twitter page identifies them as being from Kandahar.

[2] twitter.com/almaarek_media

[3] Justpaste.it/qe_b5

[4] Facebook.com/almaarek, April 14, 2015.