The Counter Extremism Project (CEP) reports on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. In this week’s issue:
- ISIS Activity Roundup
- Online ISIS Supporters Celebrate Jordan Church Attack
- ISIS Al-Naba Editorials Promote Online Propaganda and Perseverance
- Pro-ISIS Propaganda Channel Requests Monero Donations
- Pro-ISIS Video Propagandist Releases AI-Generated Video Featuring ISIS Hostage John Cantlie
- Pro-ISIS Tech Group Releases Cybersecurity Guide Focusing on Online Anonymity
- Pro-AQAP Social Media Posts Glorify Attempted FlyDubai Co-Pilot Attacker
- Telegram Account Linked to Active Club Movement Leadership Encourages Attacks on UK Government Contractors Providing Housing and Transport for Migrants and Asylum Seekers
- Member of Texas Chapter of White Supremacist Active Club Announces Upcoming Bare-Knuckle Boxing Match in Mexico
- Extreme Right Propagandists Blame Immigrants for France Unrest
- Polish Active Club Launches Substack
ISIS Activity Roundup
Between October 11 and 17, ISIS claimed credit for 21 attacks. ISIS claimed responsibility for eight attacks in Nigeria, four in the Democratic Republic of the Congo, four in Pakistan, two in Niger, two in Mozambique, and one in Burkina Faso.
Between October 18 and 24, ISIS claimed responsibility for 15 attacks. The terrorist group claimed responsibility for seven attacks in Nigeria, three in Pakistan, two in Mozambique, and one each in the Democratic Republic of the Congo, Iraq, and Niger.
On October 12, ISIS released an Amaq statement claiming that on October 9, the group had repelled an attack from Jama'at Nusrat al-Islam wal Muslimeen (JNIM) in Oudalan Province, Burkina Faso, killing over 400 JNIM fighters, including commanders, in the initial battle and pursuit. The post claimed that ISIS destroyed over 300 motorcycles and captured over 100 motorcycles, as well as hundreds of small arms and light weapons. ISIS claimed in al-Naba issue 569 that the JNIM assault consisted of over 3,000 soldiers.
Online ISIS Supporters Celebrate Jordan Church Attack
ISIS online supporters celebrated the October 23 attack on a Greek Orthodox Church in Hamoud village, Karak governorate, Jordan, where gunmen attacked a funeral service, killing nine people and wounding 40. ISIS online supporters glorified the attack and posted news updates and publicly available videos. On October 24, a pro-ISIS channel on Telegram mocked the Jordanian government, noting that their previous counter-ISIS efforts had failed.
As of October 25, ISIS has not claimed responsibility for the attack. Despite pro-ISIS online posts praising the attack, pro-ISIS channels noted on October 24 that the terrorist group had not released a statement taking credit or officially confirming a link to the perpetrators.
On October 26, three suspects were arrested following a shootout with Jordanian authorities.
ISIS Al-Naba Editorials Promote Online Propaganda and Perseverance
In al-Naba issue 569, released on October 15, ISIS noted the importance of sharing the group’s propaganda and message online, stating that the armed aspect of the conflict was fueled by a “war of words”. The authors noted that it was essential to share content in the face of the “media war” against the group online, on television, radio, and in newspapers, and the removal of pro-ISIS online accounts. The editorial claimed that spreading ISIS media was a critical function.
Previous al-Naba editorials have similarly noted the importance of sharing ISIS content. In al-Naba issue 477, released on January 9, 2025, ISIS claimed that the group’s propaganda had helped inspire the New Orleans New Year’s Eve attacker who killed 14 people and injured 57 others in a vehicle and firearms attack.
A pro-ISIS propaganda poster located on SimpleX Chat on October 22, containing text from al-Naba editorial 569 promoting the sharing of ISIS online propaganda.
The editorial in al-Naba issue 570, released on October 22, promoted perseverance, patience, and faith, claiming that those who fight for ISIS are imbued with divine strength. The editorial claimed that disbelievers have always harbored hatred towards believers, and that the former will foment plots against the latter.
Pro-ISIS Propaganda Channel Requests Monero Donations
On October 20, a pro-ISIS propaganda channel on the RocketChat platform requested donations using the privacy cryptocurrency Monero. The channel posted a wallet address and QR code with the Monerujo Android crypto wallet logo. The channel posts exhortations to commit acts of terrorism in Bengali and English. Previous posts have called for violence against a wide variety of people, including those deemed apostates, those who have spoken out against ISIS, and Hindus.
Pro-ISIS Video Propagandist Releases AI-Generated Video Featuring ISIS Hostage John Cantlie
On October 18, a pro-ISIS propagandist released a short video totaling less than a minute and a half that contained AI-generated audio and video footage of John Cantlie, the British photojournalist captured by ISIS in Syria in November 2012.
The 2026 video features an AI-generated Cantlie stating that a three-minute recording of him allowed a voice recreation, and warning about the use of AI text-to-speech, deepfakes, and videos, noting that these could be used to deceive ISIS supporters. The video warned that news and videos should be double-checked to ensure truthfulness and concluded by stating that certain future pro-ISIS videos made by the same propagandist would feature the AI-generated Cantlie. Cantlie appeared in 14 ISIS propaganda videos from 2014 to late 2016. He is presumed to have been killed between 2017 and 2022.
Online ISIS supporters have mixed views regarding the use of AI. In 2024, ISIS supporters posted short propaganda videos featuring an AI-generated newscaster. A pro-ISIS tech group has previously recommended using the Proton Lumo AI. In contrast, other supporters of the terrorist group have warned that AI should never be used for potentially dangerous functions such as building explosive devices or components, or for depicting ISIS fighters.
An image from the video released on October 18. The footage of John Cantlie is from a video released in 2014. Screenshot taken on October 21.
Pro-ISIS Tech Group Releases Cybersecurity Guide Focusing on Online Anonymity
On October 22, CEP researchers located a cybersecurity manual released by the pro-ISIS Electronic Horizons Foundation (EHF). The 11-page pamphlet was split into 10 sections, all focused on increasing online anonymity. The segments included advice on using different devices and accounts; how to acquire phone numbers for social media and communications apps; using strong passwords and storing them properly; accessing internet networks not traceable to the user; disabling app permissions and preventing microphones and cameras on a mobile device from functioning; concealing a user’s location with the use of paid VPNs or the Tor network; paying for online services or transferring money using the Monero privacy cryptocurrency; only downloading apps and programs from trusted sources; scanning files for malware; and using privacy-focused browsers.
Based on the manual’s date, it was likely released in late September or early October. The pamphlet was located on RocketChat, SimpleX Chat, and pro-ISIS websites.
Electronic Horizons Foundation pamphlet located on October 22.
Pro-AQAP Social Media Posts Glorify Attempted FlyDubai Co-Pilot Attacker
On October 20, a pro-al-Qaeda in the Arabian Peninsula (AQAP) social media account shared messages praising FlyDubai flight FZ1073 co-pilotHammam al-Hammami. On a September 30 flight from Dubai, United Arab Emirates, to Tel Aviv, Israel, Al-Hammami reportedly attacked the pilot and sought to use the plane in a suicide terrorist attack. The social media posts claimed that the attempted attack was revenge for Israel’s killing of civilians in Gaza, and urged others to follow in al-Hammani’s footsteps.
The posts came after an October 11 statement from AQAP al-Malahem Media praising the attempted September 30 attack and declaring al-Hammami a hero to be emulated.
Al-Malahem Media message released on October 20 praising the FlyDubai attacker. The post used imagery depicting Ibrahim al-Qosi, a.k.a. Abu Khubaib al-Sudani. Screenshot taken on October 22.
Telegram Account Linked to Active Club Movement Leadership Encourages Vandalism and Intimidation Attacks on UK Government Contractors Providing Housing and Transport for Migrants and Asylum Seekers
On October 12, a Telegram account linked to the leadership of the Active Club movement posted a short essay noting recent attacks in England on alleged housing for migrants and asylum seekers and buses used to transport them. The post, which was attributed to a pseudonym used by a presumed leader in Active Club England, stated approvingly that anti-immigration activists were moving from “verbal protests to clandestine operations,” claiming that the attacks were targeting government contractors providing housing and transport, accusing them of facilitating an “illegal invasion.” The post encouraged property damage against companies providing services to migrants “until they have no choice but to pull out of their deal with the UK government.” The post did not claim credit for attacks.
An individual using the same name previously made posts on Substack supporting anti-immigrant violence and providing advice for maintaining anonymity during protests and civil unrest.
Broken windows on buses used to transport asylum seekers and migrants in Hampshire, England. The photo, from a post on X unaffiliated with the Telegram channel, appeared in an anti-immigrant Telegram post by a leader in the Active Club movement. Screenshot taken on October 22.
Member of Texas Chapter of White Supremacist Active Club Announces Upcoming Bare-Knuckle Boxing Match in Mexico
CEP researchers located a TikTok post from a prominent member of a Texas chapter of the white supremacist Active Club movement announcing his participation in an upcoming bare-knuckle boxing competition in Sonora, Mexico. The fight, featuring the Lone Star Active Club member Avery Ross Ruiz facing off against an English fighter, is scheduled to take place in Puerto Peñasco during the town’s annual motorcycle rally in mid-November.
Ruiz has appeared in Active Club propaganda, including an October 2025 video where he spoke of his path to the white power movement and promoted street activism, as well as a short video released on October 17, 2026, by the Active Club-affiliated streetwear brand Will2Rise advertising clothing, accessories, and a sticker with white supremacist symbols and the phrase “white youth in revolt.” In a February 2025 interview, Ruiz criticized societal condemnation of those who expressed hatred of people of color and Jews.
An advertisement stated that the Sonora, Mexico fight will be streamed live on the website Fight.Tv.
Extreme Right Propagandists Blame Immigrants for France Unrest
The week of October 18 to 24, dozens of extreme right propagandists on Telegram blamed non-white immigrants for unrest in France. Posts praised extreme right street gatherings in response to protests, rioting, and looting and blamed both the left and conservatives for permitting immigration, calling for a “racial solution.” A Swedish entity affiliated with that country’s Active Club movement noted that the current crisis was an opportunity, alluding to potential future recruitment efforts.
Polish Active Club Launches Substack
The main Polish Active Club launched a Substack in early October. In four English posts from October 4 to 20, the blog covered the Active Club movement in Poland, hatred of journalists, a definition of the “3.0” white supremacist counterculture, and an explainer on making graffiti stencils.
CEP researchers located a Substack affiliated with a Swiss Active Club chapter in September. Substack accounts for the main Active Club movement were removed from the platform in August, September, and October. Substack also likely removed an account connected to an Active Club chapter in North and South Dakota, Nebraska, Iowa, and Minnesota, in late August.
The landing page company Lnk.Bio removed an account for the Polish Active Club chapter on October 21 after CEP reported it.
A post on the Polish Active Club Substack page promoting the “3.0” white supremacist counterculture. Screenshot taken on October 22.