(New York, N.Y.) — The Counter Extremism Project (CEP) reports on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. Last week, a member of a pro-ISIS chat on the RocketChat program released a 41-page manual offering advice on how to anonymously purchase and send cryptocurrency, using multiple online wallets and different cryptocurrencies to obscure the trail. CEP researchers also found 10 pro-ISIS accounts in a TikTok search, including one that received over 100,000 views on a pro-ISIS video and two that either posted explosive information or advertised they could provide bomb-making guides. On November 10, an online pro-ISIS group that translates the terrorist organization’s official propaganda into Hausa requested cryptocurrency donations.

ISIS, via their weekly al-Naba newsletter released on November 13, condemned Syrian President Ahmed al-Sharaa’s recent meeting with President Trump in Washington, D.C. Between November 9 and 15, ISIS claimed credit for 31 attacks, including two in Syria, with the other 29 attacks taking place in the Democratic Republic of the Congo, Nigeria, Mozambique, Niger, and Burkina Faso.

Also, last week, CEP researchers located a channel offering what it described as paramilitary training material, available for a fee, and spread via Telegram. The channel administrator claimed that Rinaldo Nazzaro, the leader of the neo-Nazi accelerationist group The Base, helped create the coursework, and asked that individuals get involved and send video clips to be used as propaganda.

At least seven Active Club chapters from Europe and the United States claimed to have attended the November 11 Independence March in Warsaw, Poland. Two breakaway chapters of the white supremacist Active Club movement, one in Illinois and the other in the Pacific Northwest, announced that they were creating an alliance, which also included two small regional groups. Finally, a Pennsylvania Active Club and an under-18 Youth Club announced that they held a joint boxing and hiking event in New Jersey.

Pro-ISIS RocketChat User Releases Anonymous Cryptocurrency Guide

On November 11, a user of a pro-ISIS RocketChat channel released a 41-page guide for anonymously obtaining and sending cryptocurrency. The guide advised using a dedicated Android mobile device, preferably a Google Pixel phone, obtained with cash, and using the open-source Graphene Operating System paired with a VPN, preferably Mullvad. The manual recommended having a friend or family member obtain the cryptocurrencies Bitcoin or Ethereum, and then transfer that to a multicurrency wallet, and then swapping the original cryptocurrency for the privacy coin Monero, before transferring it to another wallet platform, before transferring the funds to a third wallet platform, where the Monero would be switched into another currency for sending to the final recipient. The guide provided additional advice, such as waiting between steps, and noted that switching cryptocurrencies could help obscure the funds’ path. 

The guide was released shortly after two men were convicted in October in New York for conspiring and attempting to provide material support to ISIS, specifically, by using cryptocurrency and online fundraising platforms.

Pro-ISIS Content, Including Explosives Guide, Located on TikTok

In a sample of content on TikTok on November 13, CEP researchers found ten pro-ISIS accounts that posted propaganda, calls to commit acts of violence, instructions for making explosives and bomb components, and AI-generated content. Notable content included an AI-generated video of ISIS terrorist Abdelhamid Abaaoud celebrating the November 13, 2015, Paris attacks, which was posted on TikTok on November 10 and had over 800 views three days later. Another account, which primarily posted ISIS nasheeds, garnered over 112,000 views on one pro-ISIS propaganda video five days after it was posted.

Two accounts posted explosives-related content. An account with 180 followers advertised a library of content related to explosives, encouraging users to contact them on several platforms, including Threema and Element. The account was connected to an explosives-related channel on a pro-ISIS RocketChat channel. CEP researchers previously reported an account on TikTok in August that was tied to the same RocketChat channel and had also posted a directory of requestable guides and contact information. Another TikTok account, with over 2,400 followers, posted a call to violence on November 12. The same account previously posted two pro-ISIS guides made by the al-Saqri Foundation, one related to poisons and another for making homemade explosives, directly on TikTok, where the videos had over 1,800 views and 900 views, respectively, approximately a month after being posted.

CEP researchers reported the ten accounts to TikTok on November 13. As of November 17, eight reported accounts were still on the platform. TikTok removed one of the accounts that advertised explosives guides.

A pro-ISIS al-Saqri Foundation explosives guide on TikTok. Screenshot taken on November 13. This account and post were still on the platform on November 17.

Pro-ISIS Propaganda Group Requests Cryptocurrency Donations

In a RocketChat post on November 10, the pro-ISIS online propaganda group al-Buhaira Media requested cryptocurrency donations in Bitcoin. The accompanying message requested support in “fighting against our enemies.” On the online communications platform, al-Buhaira Media posts official ISIS claims of responsibility, Amaq videos, and additional propaganda translated into Hausa. The group is part of the pro-ISIS translation network Fursan al-Tarjuma. As of November 17, the Bitcoin wallet showed that no transactions had taken place.

Pro-ISIS al-Buhaira media request for Bitcoin, posted on RocketChat. Screenshot taken on November 14.

ISIS Newsletter Condemns Washington D.C. Visit of Syrian President Ahmed al-Sharaa

The editorial in ISIS’s al-Naba weekly newsletter, issue 521, released on November 13, condemned Syrian President Ahmed al-Sharaa’s recent trip to meet with President Trump in Washington, D.C., stating that the former made many “sacrifices to the international system” to achieve this visit. The article noted that al-Sharaa’s publicized friendly basketball match against U.S. military officials signified “scoring more goals in his political career.” The editorial noted that Syria’s joining the coalition against ISIS was part of a long journey by al-Sharaa to ally with the West following his turning away from and conflict with Abu Bakr al-Baghdadi early in the Syrian Civil War. The message concluded by calling for supporters of al-Sharaa and the Syrian transitional government to join ISIS.

In late October, a pro-ISIS propaganda channel on Telegram noted the clash between Syrian transitional government soldiers and the French foreign fighter group Firqatul Ghuraba in Idlib.

Roundup of Claimed ISIS Attacks

Between November 9 and 15, ISIS claimed credit for 31 attacks. Ten attacks were claimed in the Democratic Republic of the Congo, nine in Nigeria, eight in Mozambique, two in Syria, one in Niger, and one in Burkina Faso.

White Supremacist Group Offers Online Paramilitary Training Via Telegram

CEP researchers identified a series of Telegram channels linked to an entity offering paramilitary training for a fee. The channel posts in Russian and English and claims that Rinaldo Nazzaro, the founder and leader of The Base, who is allegedly still living in St. Petersburg, Russia, assisted in creating the course material. Access to a closed Telegram chat costs $5 per month and is payable in USDT cryptocurrency. An additional course is available for a one-time fee of $15. In mid-October, the channel admin posted that he originally wanted to hold an in-person training in Czechia, but that it would be moved online due to a lack of funds.

The channel claims to be linked to an unnamed group in the U.S. and, in addition, offered help in connecting individuals with extreme-right groups, hoping to achieve “maximum organization.” Allied groups are required to send video footage for use in propaganda edits. 

Messages on the Telegram channel promote training, accelerationism, racism, and antisemitism. Remixed propaganda videos on the channel and an affiliated TikTok account include members of various neo-Nazi groups and an unconnected American white supremacist influencer. The channel admin advertised the group in several white supremacist Telegram chats.

In November 2020, Nazzaro launched the now-defunct “Project Omega,” a “matchmaker” effort to connect white supremacists and promote skill sharing in specific geographic areas.

Neo-Nazi accelerationist image on Telegram channel offering military style training. Screenshot taken on November 14.

American and European Active Clubs Confirm Presence at Polish Independence March in Warsaw

Members of at least seven Active Club chapters from Europe and the United States confirmed their presence at the November 11 Independence March in Warsaw, commemorating 107 years of Polish independence. The annual march is one of the largest nationalist demonstrations in Europe and has a history of attracting right-wing extremist groups. Active Clubs from the Netherlands, France, Sweden, Estonia, and Scotland advertised their attendance, as did at least one member from Active Clubs in Illinois and Pennsylvania. Other groups in attendance included Obóz Narodowo-Radykalny and Slavic Blood from Poland, Legio Hungaria from Hungary, and the Italian neo-fascist organization CasaPound.

Breakaway Active Clubs Announce Alliance

Two breakaway chapters of the white supremacist Active Club movement, along with two other groups, announced the formation of an alliance on Telegram on October 30. The four groups are two Active Club chapters in Illinois and the Pacific Northwest; a small white supremacist group that claims members in the Midwest and mid-Atlantic U.S., as well as Ontario and Manitoba in Canada; and an upstate New York Odinist religious group.

Telegram posts from the alliance included messages in support of white supremacy, anti-LGBTQ+ sentiment, and support for splitting the U.S. and Canada into five different zones: New England, Quebec, the U.S. South, Vinland (parts of the U.S. mid-Atlantic, Midwest, and the Canadian provinces of Ontario, Manitoba, and Nunavut), with the final zone, Cascadia, consisting of the U.S. southwest, west, and western Canada. The channel also shared a message from the breakaway Pacific Northwest Active Club stating that they were different than other clubs in the movement and existed outside of their leadership and guidelines. The two Active Clubs in the alliance are united in their opposition to Patriot Front, the neo-fascist group connected to several Active Club chapters.

In September, the breakaway Illinois Active Club posted emails allegedly sent to them by leaders of the Arizona and Texas chapters of the movement, calling them a “rogue” chapter and accusing them of associating with accelerationists. The emails called the Illinois chapter illegitimate and challenged them to a bare-knuckle fight.

Active Club and Youth Club Chapters Announce Joint Training

In a Telegram post on November 9, members of a white supremacist under-18 Youth Club chapter announced that they held a joint training with the Pennsylvania Active Club, consisting of “self-defense classes,” physical training, and an 8.5-mile ruck held in the New Jersey Pine Barrens. The Youth Club chapter claims to have members in New York, New Jersey, and Pennsylvania. Photos and a video showed seven members of both clubs participating in boxing drills and hiking.