Category Archives: Terrorism

Analysing the Online Thughur of the Salafi-Jihadi Digital Ecosystem: Facebook, Instagram, and TikTok – by A. Bolpagni, E. Ristuccia, and G. L. Giardini

09/12/2025IS propaganda, Islamic State, propaganda, TerrorismMarco Lombardi

ITSTIME speeches at the VOX-Pol online seminar “Under the Radar: Understanding the Salafi-Jihadi terrorist online information ecosystem” (Part 2)

On December 3, our analysts Alessandro Bolpagni, Eleonora Ristuccia, and Grazia Ludovica Giardini took part in the online seminar organised by VOX-Pol. This online seminar examined the structure and evolution of the contemporary Salafi-jihadi terrorist information ecosystem. It will focus on how violent extremist organisations, such as the Islamic State and al-Qaeda, exploit mainstream social media platforms, including Facebook, Instagram, TikTok, and Telegram. The seminar will explore the scale of activity carried out by “media mujahideen” within these environments and analyse the strategies they use to enhance the resonance of their messaging among target audiences. In addition, speakers addressed the role of Ansar media and unaffiliated supporters in conducting media jihad on behalf of these groups. Special attention will be given to explaining the continued presence of Salafi-jihadi actors on mainstream platforms, including the evasive tactics they commonly employ, believing it helps them to bypass content moderation.

In this presentation, they delved into the most important social networks of the Salafi-Jihadi online ecosystem, namely Facebook, Instagram, and TikTok. When it comes to addressing Salafi-Jihadi propaganda presence on those platforms, we are used to hearing that the Islamic State and al-Qaeda have been driven off these social networks. However, the reality tells another story. Facebook, Instagram, and TikTok present a heavy presence of Salafi-Jihadi material. Moreover, the most concerning thing is that this content is present in its most recognisable forms. Moreover, by recalling Abu Saad al-Amili’s words, although these social networks have been considered online spaces where Salafi-Jihadi groups are mere guests, nowadays the situation seems to change. In fact, the authors observed how users are gradually settling on the digital frontier of the Salafi-Jihadi online ecosystem, sharing more complex and articulated material, going beyond most known propaganda material. For this reason, they have noticed the emergence of a horizontal propaganda stream between Facebook, Instagram, and TikTok. Specifically, each of these platforms has its own content, based on how it works. The authors focused on what a user can do by simply swiping according to the platform’s functioning. On Facebook, a highly textual platform, users are “forced” to go into the posts’ texts and comments. On Instagram, instead, users tend to swipe from right to left, to go through images and videos carousel and, above all, through their followings’ stories. Finally, TikTok, which pushes its users to scroll almost only down through its For You page’s videos (Figure 1).

Based on this concept, we are dealing with different platforms, usual content, but in multiple forms. The authors observed the presence of different types of materials on these platforms (Figure 2). Except for the ‘Gaming-Jihad propaganda’, all these typologies can be present on Facebook, Instagram, and TikTok.

The social networks on the digital frontier share a number of techniques exploited by the Salafi-Jihadi movement to disseminate propaganda material. These include the use of the comments section, Direct Messages (DMs), stories, re-posts, broadcast channels, group chats, live propaganda discussions, ‘Account Hijacking’, hashtags, ‘Photo Mode’, editing and filters, and ‘favourites’ section. Nonetheless, they are used in different ways depending on the social network.

Firstly, Facebook is a highly ‘textual’ social network (Figure 3). This can be inferred from the fact that the character limit for post captions is 63,206. Hence, users are able to share large portions of text within the comments section and interact in a more extensive way. The comments section is used both to share propaganda content and spread links or outlinks to other platforms. Then, hashtags are employed as a functional tool for categorising Salafi-Jihadi content. Finally, Facebook is used by Salafi-Jihadi groups as a content aggregator, collecting several links and outlinks and directing users to pages operating on other platforms.

Secondly, Instagram is a sort of ‘in-between’ social network between Facebook and TikTok, being focused on both textual and visual content. Salafi-Jihadi groups are exploiting Instagram by means of broadcast channels and group chats (Figure 4), where they share institutional, Ansar Production, non-institutional, and non-branded propaganda content. Salafi-jihadi groups also use Instagram stories not only to share propaganda content, but also to disseminate outlinks which lead users to more encrypted platforms (e.g., Telegram and Element). Highlights are also exploited to categorise propaganda material. Moreover, carousel posts are employed to store propaganda in a single post. This is the case, for instance, with entire issues of An-Naba or a series of bulletins by Amaq News Agency.

Within TikTok, users are allowed to create their own content by means of exploiting the editing features directly provided by the platform itself. Therefore, TikTok combines the edit-custom experience with the sharing one, allowing the proliferation of a highly creative type of content. In this respect, it was possible to detect a particular type of pro-Salafi-Jihadi propaganda, namely non-branded propaganda (Figure 5). The latter refers to a typology of pro-IS propaganda material which is not directly related to the institutional, non-institutional, and Ansar Production media outlets. Differently, this type of content is characterised by the use of audiovisual elements directly attributable to the Salafi-Jihadi imagery appeal to the audience. Notwithstanding the fact that the non-branded propaganda can be easily found on the other mentioned social network platforms, the latter assumes a particular connotation within TikTok, due to the platform’s high-level editing features. Consequently, it is possible to identify a whole section of highly edited non-branded propaganda, using elements and/or filters not related to IS. Differently, it was noticed that the employment of several elements, which are particularly appreciated by the younger audience. Other non-branded propaganda has been produced and shared by means of TikTok itself. In this case, it is possible to notice the combination of high levels of editing with the adaptation of pro-IS images to the most popular mainstream trends on TikTok. This leads to the creation and further dissemination of a controversial type of content, often crossing the so-called ‘hala-haram line’.

By means of monitoring how pro-Salafi-Jihadi propaganda is shared within the TikTok environment, it can be said that jihadi supporters take advantage of all the features provided by the platforms in order to accomplish their communicative purpose in terms of propaganda stream. Particularly, some TikTok users were seen to exploit the TikTok live streams in order to share Salafi-Jihadi propaganda and discuss it, creating a sort of safe interactional space within the platform. Furthermore, content is shared in two different indirect ways. On one hand, some users have been using the ‘Repost’ section in order to indirectly share Salafi-Jihadi propaganda, which was previously disseminated by other users on the platforms. On the other hand, the so-called ‘favourite’ section began to be used by TikTok pro-Salafi-Jihadi users. By means of using this particular TikTok feature, Salafi-Jihadi supporters are able to create and organise efficient folders of propaganda content, making it easier for new potential sympathisers and supporters to reach the content thanks to this ‘silent repost’.

To conclude, we stress the concept that each platform, which has its own audience, shows specific content shared by Salafi-Jihadi groups’ supporters through the exploitation of the platform’s features (Figure 6). According to that, we must highlight that Salafi-Jihadi groups’ supporters behave as normal human beings, who use these social networks according to their functioning. In other words, propaganda material on Facebook is highly textual because Facebook focuses on connecting people through people. Propaganda on Instagram is centred around visual and textual content because Instagram connects people and content. Finally, TikTok, where propaganda content is completely articulated on audiovisual content, because TikTok connects users only through content.

Rocket.Chat: The Digital Safe Haven of the Salafi-Jihadi Groups – by A. Bolpagni and E. Ristuccia

04/12/2025propaganda, Salafi-Jihadi groups, TerrorismMarco Lombardi

ITSTIME speeches at the VOX-Pol online seminar “Under the Radar: Understanding the Salafi-Jihadi terrorist online information ecosystem” (Part 1).

They analysed the presence of Salafi-Jihadi groups, specifically the Islamic State and al-Qaeda, on Rocket.Chat. In particular, they delved into their Rocket.Chat servers, respectively, TechHaven and GNEWS. Rocket.Chat is a messaging platform that embodies the Web 3.0 spirit and approaches. Unlike the Web 2.0-based social media, it is a decentralised platform wherein users can take control of their own server without fear that someone can interfere or intervene by removing the content and/or banning users. Rocket.Chat allows users to create a server that is divided into rooms, which can be converted into channels or chats.

Alongside other important features, since 2018 and 2019, Rocket.Chat has become the digital safe haven both for IS and AQ. But how do we get there? Usually, we refer to the period following Europol’s 16th Referral Action Day, carried out between November 21st and 22nd, 2019. After those days, we witnessed a transition of Salafi-Jihadi users on Rocket.Chat, which established the pro-IS server TechHaven and the AQ server GNEWS. Yet, it is paramount to stress that it was not a complete migration, but a diversification of the social media employed at that time. This can also be observed through the fact that early rooms on TechHaven were created back in late 2018, one year before the 16^th Referral Action Day. Nowadays, Rocket.Chat can be considered the digital safe haven par excellence of the Salafi-Jihadi groups. Based on the creation date of the first rooms, TechHaven was established around December 2018 (Figure 1). Today, it is composed of 530 rooms and 11,650 users. There are no institutional media houses active on the platforms, but a heavy presence of Ansar Production media houses. In particular, Ansar Production media houses’ presence is articulated through the activity of translation media houses. Alongside them, other important media houses active on Rocket.Chat are those dedicated to Operational Security (OPSEC) and technical support, followed by several non-institutional media houses. Moreover, besides rooms related to pro-IS media houses, two rooms work as “general discussion rooms”. These rooms are techhaven_عـام and Dar-AlArqam.

techhaven_عـام and Dar al-Arqam thus serve as online public spaces for all TechHaven’s server users. While the Arabic word in the name of the first room means “refuge” or “protection”, or “seeking refuge or protection”, the name Dar al-Arqam means “the house of al-Arqam”. It refers to the house of Arqam bin Abil al-Arqam, a companion of the Prophet, whose house was used as a secret and safe place for meetings and conducting da‘wa. Both these names clearly show the intention of bestowing a “safe dimension” to these rooms. Specifically, they are spaces of interaction for users and a space where all users and media houses’ content is gathered. Moreover, we can observe the presence of a room that serves as a nashir channel sharing institutional propaganda material, such as AMAQ News Agency war bulletins, images, and videos, An-Naba newsletters and editorials, and IS institutional videos. Alongside this room, there is also a room dedicated to the material produced by the Ansar Production media houses, such as Al-Battar, Sarh al-Khilafa, Talaea al-Ansar and so on. Other central rooms in the TechHaven server are those related to the Fursan al-Tarjuma umbrella translation organisation. The most important and most active are those of Fursan al-Tarjuma itself, serving as a hub for all translation media houses operating under it, Halummu room for English-translated material, At-Tamkin and al-Bashair media houses for content translated for Indonesian and Indian-translated material, and al-Azaim media and all related media houses. Finally, there are rooms dedicated to users’ operational security and technical support. For instance, the room of Ansar Electronic Security, a forum-style chatroom, focused on OPSEC and technology, and the room of Qimam Electronic Foundation, which shares security tips, manuals for using technological tools and social media. It also has an Arabic, Pashto, and Bengali version.

The first rooms on AQ’s Rocket.Chat server GNEWS were created in 2019. Today, GNEWS comprises of 211 rooms and is accessed by 4,529 users. Interactions between AQ supporters take place in general discussion rooms, which are both in Arabic and English. Institutional propaganda is mainly shared on rooms related to specific institutional media houses, such as Al-Malahem Media and As-Sahab Media. However, this type of content is also published on rooms which are not directly related to institutional media outlets. Subsequently, a few rooms are devoted to the dissemination of translated propaganda material. This is the case of rooms related to the Global Islamic Media Front (GIMF), which functions as a ‘hub’ for several AQ-affiliated groups’ media houses. The main GIMF room shares content in Arabic, while GIMF Français and GIMF \ Al-Shabaab disseminate content in French and Somali, respectively. Finally, some rooms are aimed at offering OSPEC and technical support to AQ supporters. The most active room is TECH SUPPORT – الدعم الفني, whereas tech_cyber_news has not published content since February 2024.

To conclude, we would like to focus your attention on the fact that Rocket.Chat is the “safest space” among the “safe spaces” that, according to al-Zawahiri, the Salafi-Jihadi groups have to create to allow the Mujahid vanguard to operate in the propagational field. Moreover, Rocket.Chat provides Salafi-Jihadi users with their own space, like the old forums. By recalling al-Amili’s words, Rocket.Chat can be considered a safe and fortified space where Salafi-Jihadi users can spread the truth and practice their duties without restrictions, conditions, or fear of tyrants.

Mapping the pro-Islamic State (IS) ecosystem on TikTok: a brief overview – by G. L. Giardini and A. Bolpagni

19/11/2025IS propaganda, Islamic State, propaganda, Salafi-Jihadi groups, Terrorism, TikTokMarco Lombardi

From January 2025 to October 2025, G. L. Giardini and A. Bolpagni have been monitoring and analysing the presence of the pro-Islamic State (IS) ecosystem on TikTok, especially focusing on the dissemination of IS propaganda within the social network platform. Through day-by-day monitoring using Digital Human Intelligence (Digital HUMINT) techniques, more than 270 seed accounts have been identified. The latter, which are pro-IS accounts actively sharing propaganda material, have been functional to the reconstruction of a network characterised by more than 100,000 users.

Focusing on the type of propagandistic content shared and the way in which the material is disseminated by the targeted TikTok accounts, it was possible to outline a categorisation of the users part of the pro-IS ecosystem on the platform itself. Specifically, the content analysis led to the identification of 15 pro-IS user categories, of which 7 ‘pure’ and 8 considered to be ‘mixed’ categories. The ‘pure’ categories are characterised by pro-IS accounts dedicated – mostly or totally – to the dissemination of one type of pro-IS propaganda, namely Institutional, Ansar Production, non-Institutional, non-branded, theological, or ‘Gaming-jihad’ content. The last ‘pure’ category – Re-poster accounts – has been identified by means of considering those users who did not share pro-IS content directly on their personal accounts, but rather reposted propaganda material from other existing pro-IS TikTok accounts. Differently, the ‘mixed’ categories are composed of users dedicated to the dissemination of at least two types of propaganda content in ‘equal measure’.

Furthermore, it can be said that TikTok occupies a significant role in what Ali Fisher theorised as the digital frontier. The latter section of the pro-IS online ecosystem constitutes the most superficial layer of it, where content is ‘openly’ and ‘directly’ accessible thanks to social network platforms such as Facebook, Instagram, Discord, and TikTok. Specifically, TikTok became one of the platforms of choice within the Digital frontier, due to its peculiar features and ‘addictive’ nature, especially towards younger individuals.

Therefore, TikTok reconfirms itself as both an efficient and functional exit point of the IS propaganda and entry point for the pro-IS online ecosystem. On one hand, TikTok represent an effective exit point for the dissemination of pro-IS propaganda material coming from the most encrypted social media platforms operating in the core of the pro-IS online ecosystem. On the other hand, TikTok can also be considered a functional entry point for new potential pro-IS supporters and sympathisers. By means of disseminating the content directly on the mentioned platform, new sympathisers have the chance to get familiar with the pro-IS propaganda content, facilitating the radicalisation processes and the progressive shift to platforms operating in the core of the pro-IS ecosystem. Finally, it is also necessary to underline that TikTok does not only encompass the role of a ‘digital recruitment platform’ but rather a functional space where digital da‘wa – proselytism – can be conducted.

In conclusion, given the significant degree of young individuals operating on TikTok and the functional features of the latter in terms of creation, editing, and dissemination of audiovisual content, it is crucial to pay attention to the potential role of TikTok in recruitment and consequent radicalisation processes of young individuals. Its popularity among young individuals has thus made TikTok a ‘platform of choice’ for IS.

“Make it Count”: The Terrorgram Timeline – by S. Lucini, A. Pugnana

14/11/2025propaganda, Terrorgram, TerrorismMarco Lombardi

Terrorgram collective is a loosely connected network that operates on Telegram through a net of different chats and channels that share extremist ideas. The main purpose was to promote accelerationism, neo-fascist and neo-nazi subcultures, the glorification of violence, and acts of terror by sharing propaganda with the aim to radicalise users into committing attacks. Terrorgram developed on Telegram starting in 2019, becoming the Terrorgram collective in 2021.

Here we propose a Terrorgram timeline to highlight the main phases of the Terrorgram collective from 2019 until 2025:

06/2018, the Telegram channel Hans’s Right Wing Terror Center paved the way for the creation of Terrorgram network;
15/03/2019, Brenton Tarrant commits a shooting at the Al Noor Mosque and Linwood Islamic Centre in Christchurch, New Zealand, while live stream his attack on Facebook. His deed was successful in extreme right online circles. The practice of “sanctification” of white supremacist and extreme right attackers begins. His assault became emulated by what was defined by Terrorgram as his “disciples” (John Earnest, Patrick Crusius, Philip Manshaus, Stephan Balliet, Nathaniel Veltman, Payton Gendron, Jordan Patten, Ryan Palmeter, Juraj Krajčík) and other copycats;
Between 2019 and 2020, two key figures emerged in the creation and dissemination of accelerationist propaganda: Miss Gorehound, which later became Ryder Returns, and BigTittyChica;
In 2021, the Terrorgram collective was created. In the same year, two Terrogram-branded publications were shared: Militant Accelerationism and Do It For The ‘Gram;
In June 2022, Pavol Beňadik, one among the first prominent members of Terrorgram, was arrested;
In July 2022, The Hard Reset, another official Terrorgram propaganda book was published;
October 2022 sees the release of the documentary White Terror;
In November 2022, there was the first Terrorgram attempt to migrate to TamTam;
In February 2023, there was the second attempt of migration. In this occasion from Telegram to Element. However, this migration attempt also proved to be inefficacious;
In December 2023, Matthew Althorpe was arrested. He has been a member of Atomwaffen Division, and he had contributed to the creation of Terrorgram manifestos and propaganda. He was also the administrator of a relevant channel to the collective;
09/09/2024, the two main producers of Terrorgram propaganda, Matthew Robert Allison and Dallas Erin Humber, were arrested and charged with a 15-count indictment. Many Terrorgram chats and channels were banned, and the collective began to fragment;
19/09/2024, the remaining users attempted to migrate to Simplex. The migration effort failed, and users returned to Telegram;
From the end of 2024 onwards, the Terrorgram collective fragmented even further, with more arrests taking place. Despite that, its propaganda and accelerationism influence succeeded in inspiring other attackers such as Samantha Rupnow, Solomon Henderson and Muhammad Nazriel Fadhel Hidayat.

Continue reading →

29Ago/25

Telegram, TikTok e Discord come strumenti di reclutamento e radicalizzazione dell’estrema destra in Italia – by A. Pugnana

29/08/2025arresti, Terrorgram, TerrorismMarco Lombardi

Da gennaio 2024 a luglio 2025, in Italia sono stati effettuati 21 arresti nei confronti di affiliati all’ecosistema di estrema destra nazionale e internazionale. Gli individui arrestati presentavano età differenti comprese tra i 18 e i 70 anni, con una prevalenza di arrestati over 31. I dati analizzati sono stati acquisiti attraverso un’analisi di dati open source resi consultabili dalle autorità. Per tale ragione, i dati considerati fanno riferimento a quegli arresti in cui le autorità hanno esplicitamente dichiarato i social media (piattaforme di messaggistica o social network) nei quali gli imputati operavano.

Dai dati raccolti è emerso che l’86% degli arrestati aveva presenza attiva online. In particolare, attraverso i social media, avvenivano attività di reclutamento, radicalizzazione e proselitismo. Le piattaforme maggiormente utilizzate per queste attività sono risultate essere Telegram, TikTok e Discord (Figura 1), spesso utilizzate in combinazione tra loro, soprattutto dai più giovani. Nello specifico le combinazioni più frequenti riguardano l’uso congiunto di Telegram e TikTok e Telegram e Discord.

Come emerge dal grafico rappresentato in Figura 1, e sulla base di quanto approfondito in open source, è possibile affermare che Telegram risulta essere la piattaforma social maggiormente utilizzata da parte di militanti di estrema destra, seguita da TikTok e Discord. I risultati ottenuti sono ascrivibili al fatto che gli utenti di estrema destra hanno sempre considerato la piattaforma Telegram sicura, utile ed efficace per condividere propaganda, reclutare membri e organizzarsi in cellule operative più ridotte. Solo più recentemente la propaganda e il reclutamento hanno iniziato a essere più presenti, in maniera sistematica, anche su altre piattaforme, come TikTok e Discord, soprattutto nella fascia di età 18-30 anni, avendo però sempre come obiettivo quello di indirizzare nuovi membri su Telegram, sfruttando gli altri social network come canali di ingresso (entry point) verso l’ecosistema di estrema destra online.

Sulla base di quanto osservato dai materiali raccolti, si può affermare che, nonostante l’arresto di Pavel Durov (avvenuto in Francia ad agosto 2024) e la conseguente maggiore collaborazione di Telegram con le autorità, i militanti di estrema destra considerano ancora la piattaforma come la migliore alternativa per le proprie attività di radicalizzazione. Le potenzialità di altri social network, invece, vengono sfruttate per la diffusione della propaganda verso un pubblico più ampio con lo scopo di avvicinare nuove reclute a Telegram per una comunicazione più privata e organizzata, all’interno della quale la radicalizzazione continua e diventa più profonda.

18Ago/25

“Vincere i cuori e le menti”: la rete jihadista in Italia passa dai social agli arresti – by E. Ristuccia e G. Giardini

18/08/2025arresti, Security, TerrorismMarco Lombardi

Da gennaio 2024 a giugno 2025, in Italia sono stati effettuati 28 arresti per terrorismo islamico. Gli individui arrestati per tali reati sono di nazionalità, età e contesti socio-culturali differenti, con una prevalenza di soggetti rientranti nella fascia d’età dei Millenials e della Generazione Z, più generalmente intesa come fascia 19-30 anni. Tuttavia, denominatore comune di quasi la totalità degli arresti effettuati è il ruolo sempre più centrale dei social media nei processi di avvicinamento e successiva radicalizzazione.

Continue reading →

16Lug/25

“Path to Sainthood”: the role of influence played by the ‘Sanctification Propaganda Cycle’ within the Terrorgram collective – by S. Lucini e A. Pugnana

16/07/2025propaganda, Security, Terrorgram, TerrorismMarco Lombardi

The following article is an extract from the paper “Path to Sainthood”: the role of influence played by the ‘Sanctification Propaganda Cycle’ within the Terrorgram collective, Issue 4, Vol. 21, published by the ITSTIME international journal Sicurezza, Terrorismo, Società.

Continue reading →

15Lug/25

“Creating awareness within the masses”: mapping the pro-Islamic State (IS) ecosystem on Instagram – by A. Bolpagni, E. Ristuccia e G. Giardini

15/07/2025Instagram, IS propaganda, Salafi-jihadi movements, TerrorismMarco Lombardi

The following article is an extract from the paper “Creating awareness within the masses”: mapping the pro-Islamic State (IS) ecosystem on Instagram, Issue 2, Vol. 21, published by the ITSTIME international journal Sicurezza, Terrorismo, Società.

Continue reading →

29Giu/25

The danger of nationalist extremism in Europe: The “Defend Salonica” case in Greece – by Maria Alvanou

29/06/2025TerrorismDefend Salonica, Extreme right, Greece, SaloniccoMarco Lombardi

During May 2025, a police operation in Thessaloniki, the second-largest city in Greece, resulted in the arrest of members of the group “Nationalist Youth of Thessaloniki”, linked to various criminal offences, e.g. robberies, assaults and acts of viol e nce with a racist motive.

Continue reading →

12Giu/25

Epilogo dell’orchestra: la PMC Wagner si ritira dal Mali – by A. Bolpagni ed E. Ristuccia

12/06/2025Afrika Corps, PMC Wagner, Security, TerrorismMarco Lombardi

“Missione compiuta” o, meglio, “la PMC Wagner ha completato la sua missione in Mali”. Con queste parole, il 6 giugno, due tra i principali canali di propaganda dell’ecosistema Wagner su Telegram hanno annunciato (in contemporanea) con un video, seguito da un breve messaggio, la fine delle operazioni della PMC Wagner in Mali.

Continue reading →

25Mag/25

Le dinamiche del Terrorgram: propaganda, “santificazione” e violenza – by A. Pugnana e S. Lucini

25/05/2025TerrorismExtreme right, Propaganda, Santification, TerrorgramMarco Lombardi

Fin dalla sua nascita, il collettivo di estrema destra Terrorgram ha promosso l’accelerazionismo militante con l’obiettivo di portare al collasso la società moderna, considerata corrotta, per dar luogo a una rivoluzione suprematista bianca in cui il caos, la violenza e atti terroristici vengono utilizzati per consentire la creazione di un etno-stato bianco.

Continue reading →

Categoria: Terrorism