(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. Last week, CEP researchers located messages in an online pro-ISIS community on the RocketChat program that offered advice and warnings following the alleged arrest of a propagandist affiliated with ISIS-K-linked Al-Azaim Media. On May 25, Al-Azaim Media released a video declaring war on Baloch separatist groups in Pakistan. Online ISIS supporters advised against using the SimpleX Chat app, stating that it could leak IP addresses.
On TikTok, CEP researchers located accounts that uploaded content glorifying the Christchurch attacker and antisemitic violence, propaganda made by the groups National Action and Patriot Front, and accounts affiliated with white supremacist Youth Clubs. A video featuring footage from the Christchurch attack received over 100,000 views on the platform after being online for 13 days. CEP researchers also located content on X that promoted white supremacist terrorism. Finally, a Telegram channel released two short videos featuring Robert Rundo, marking his first video appearance in Active Club propaganda since his sentencing in December 2024.
Pro-ISIS Online Community Issues Operations Security and Cybersecurity Advice After Alleged Arrest
Pro-ISIS members of a closed community on the RocketChat platform warned other users of operations security and cybersecurity risks after a prominent online propagandist was allegedly arrested in Pakistan. The individual, whom other users claimed was taken into custody by security services, is connected to a RocketChat account that is one of the administrators of a channel linked to ISIS-K Al-Azaim Media and is likely associated with a Telegram account using the same name.
The English-language Al-Azaim Media RocketChat channel has not posted since April 28, 2025. The last issue of the English-language ISIS-K linked web magazine, “Voice of Khorasan,” was released on March 27. The web magazine was previously released approximately once every month. Al-Azaim affiliated channels in several other languages, including Pashto, Russian, Tajik, Farsi, and Urdu, are still available on RocketChat.
Pro-ISIS RocketChat users noted several times between May 16 and 26 that the individual had been arrested, following a May 14 post where a user had inquired about his whereabouts after stating he had not posted in a month.
On May 23, a pro-ISIS user provided operational security advice for Android users, including using a dedicated device for illicit purposes, avoiding Google-based operating systems, scrubbing metadata from screenshots, and using a reliable VPN. The user claimed that the arrested individual might have made mistakes or been careless, which led to their arrest.
Several days later, on May 28, a pro-ISIS cybersecurity group noted that the individual had been arrested and accused Pakistani authorities of removing cryptocurrency from wallets the individual controlled. The pro-ISIS cyber group pointed out that this had occurred after his arrest, meaning that his phone was likely accessed. The group encouraged their followers to utilize advanced phone security settings, permanently delete incriminating files, and maintain separate sets of devices for illegal activities and legitimate ones. The group advised using the Tails operating system, which functions over the anonymous Tor browser and does not store data locally. The group also encouraged being wary of people in real life who might be conducting surveillance.
ISIS-K-Linked Al-Azaim Media Declares War on Baloch Separatists
On May 25, ISIS-K-linked Al-Azaim Media released an approximately 36-minute video stating that they would attack Baloch separatist groups in Pakistan. The video, which included previously released footage from official ISIS videos, blamed Baloch nationalists for killing ISIS-K members in Mastung district in March and stated that Baloch separatist groups and their supporters would be targeted. The video condemned these groups for fighting for ethnic and patriotic reasons rather than out of religious motives. CEP researchers located and reported the video on Dailymotion and Odysee on May 28 and 29, respectively. As of June 2, the video was still on Dailymotion but had been removed from Odysee.
On April 15, ISIS claimed two attacks in Balochistan: the killing of a Shiite man in Quetta and an attack on a bus carrying Pakistani police officers in Mastung, killing three and wounding 19. On May 11, Al-Azaim released a 218-page book in Pashto condemning nationalist groups, mainly directed at the Taliban.
ISIS-K linked Al-Azaim Video on Dailymotion. Screenshot taken on May 29.
Pro-ISIS Online Supporters Warn of Potential Security Risks For SimpleX Chat Platform
On May 28 and 29, pro-ISIS users on Element and RocketChat shared a message warning that the SimpleX Chat platform could potentially expose IP addresses. The posts noted that IP addresses used to access the app could be revealed, as well as connected IP addresses. The posts indicated that SimpleX was aware of the risk and had recommended users employ a VPN, but that the chat program cannot be operated over Tor. The same post pointed out that the company is headquartered in London and concluded that the app cannot be trusted. Online ISIS supporters have used SimpleX since at least January. Channels have shared propaganda videos and photos, Nashir and Amaq news updates, guides for making explosives and committing terrorist attacks, and links to content on other websites. SimpleX is an encrypted chat program that allows anonymous use and does not require a phone number to create an account, like Telegram.
On May 29, 12 pro-ISIS SimpleX channels had an average of 328 members, ranging between 53 and 821. The same user can join the same channel with multiple anonymous usernames, potentially inflating the number of members.
ISIS al-Naba newsletter shared on SimpleX Chat on May 22. Screenshot taken on May 29.
Christchurch Attack Footage with Over 100,000 Views, Various White Supremacist Content Located on TikTok
In a sample of content located on TikTok on May 29, CEP researchers located 14 accounts that posted content related to white supremacist or antisemitic violence or groups. An account posted a 56-second clip containing violent footage from the Christchurch attack video that had a modified color scheme and received over 131,000 views in the 13 days it was online. A video that glorified the Halle gunman who attempted to attack a German synagogue in October 2019 received almost 9,000 views after one week on TikTok. Other content included a notorious video made by the British neo-Nazi group National Action, a video glorifying the Christchurch attacker and urging “revenge,” an account that posted content promoting a Maniac Murder Cult affiliate, an account that called for violence against Jews, accounts that promoted Patriot Front, and six accounts affiliated with white supremacist Youth Clubs.
CEP reported the 14 accounts to TikTok or relevant national authorities on May 29. As of June 2, the ten accounts that CEP reported directly to TikTok, which had encouraged violence against Jews, posted Patriot Front or National Action propaganda, or were connected to Youth Clubs, were still available.
National Action video on TikTok. Screenshot taken on May 29.
Content Glorifying White Supremacist Terrorism Located on X
In a sample of content located on X on May 29, CEP researchers located five uploads that glorified white supremacist terrorism. Content included a violent two-minute and 20-second clip taken from the Christchurch attack video; a 35-second video that contained violent footage from the Christchurch attack; a video containing clips from Atomwaffen Division propaganda videos that also included clips from the Christchurch and Buffalo attacks; a video glorifying the June 17, 2015, Charleston church shooter; and a video advertising a neo-Nazi accelerationist group that featured violent footage from the Christchurch attack video. The five uploads had an average of 558 views, ranging between 65 and 2,171.
CEP reported the accounts to the relevant national authorities on May 29.
Robert Rundo Appears in Active Club Propaganda Videos For The First Time Since His Release
Two videos featuring Robert Rundo, the founder of the Active Club movement, were shared by a Telegram account affiliated with the decentralized white supremacist network on May 28 and 31. The two uploads are the first video footage of Rundo released by the movement since he was sentenced to two years of time served and two years of supervised release in December 2024. The first video shows Rundo training alone on a deserted street, with an overlay of the slogan “defeat never, victory forever,” often attributed to Robert Mathews, the founder of the white supremacist terrorist group The Order, before showing the URL for an Active Club-affiliated website. The second video shows Rundo training with an individual wearing an Active Club brand-affiliated shirt in front of a flag described in the post as “the banners of the club.” Under the terms of his release, Rundo is forbidden from associating with members of his previous group, the Rise Above Movement, and is subject to electronic monitoring. On May 1, Rundo published an article on an Active Club-affiliated Substack.