In October 2024, a detailed analysis of media practices among 15 extremist and militant groups revealed a consistent pattern of cross-group learning in how they use digital platforms to shape narratives and evade content moderation. The study, which examined groups including Al-Shabaab, ISIS-K, Hezbollah, Hamas, the Taliban, Hay’at Tahrir al-Sham, Boko Haram/ISWAP, Al-Qaeda, AQAP, Tehrik-i-Taliban Pakistan, Jemaah Islamiyah, Abu Sayyaf Group, Jaish-e-Mohammed/Lashkar-e-Taiba, and the Houthis, found that these organizations operate with a shared informational playbook despite ideological and geographic differences. Central to their strategy is the use of Telegram as a primary hub for content distribution. The platform’s features—unlimited subscriber broadcast channels, automated bots, end-to-end encryption, minimal content moderation, and ease of migration via invite links after bans—make it ideal for rapid dissemination. Content often originates on Telegram before being pushed to other platforms. Anticipating takedowns, groups routinely duplicate uploads across 3 to 7 platforms simultaneously, including Facebook, TikTok, Element, and Archive.org. The latter serves as a repository; when content is removed from mainstream social media, it can be re-uploaded from Archive.org, preserving continuity. To further withstand platform enforcement, groups employ a two-tier distribution model. Official channels handle direct messaging, whereas unofficial networks of supporters and surrogates reshare content on platforms like TikTok, Instagram, and YouTube. This layer amplifies reach while obscuring the origin, exploiting the difficulty platforms face in monitoring decentralized, peer-driven sharing. When pressure mounts, groups activate pre-positioned presences on alternative platforms such as Rocket.Chat, Session, or Element, or shift to less regulated environments like satellite television—used by Hezbollah and the Houthis—or physical media distribution, as seen with Jemaah Islamiyah and Boko Haram in offline contexts. In narrative execution, these groups demonstrate a synchronized approach to breaking events. Within two to four hours of an incident—such as an attack or geopolitical development—they release professionally produced videos, complete with logos and branding, first on Telegram. This “narrative jacking” allows them to frame the event before mainstream media establishes dominance, often using emotionally charged visuals to accelerate message acceptance. The footage is frequently authentic, but deception lies in attribution, framing, or exaggerated scale claims. Audiences are addressed through dual messaging: locally, in vernacular languages, emphasizing governance, legitimacy, or grievance; internationally, focusing on solidarity, victimhood, and humanitarian appeals. This parallel communication strategy enables them to resonate with distinct constituencies without contradiction. Crucially, their media campaigns often begin by amplifying verifiable grievances—real injustices, civilian suffering, or legitimate conflicts—before layering in extremist content. Because the foundation is fact-based, automated moderation systems frequently fail to flag the escalating material, allowing radicalization to proceed under the radar. The analysis concludes that innovation in media tactics among these groups is not isolated but rapidly diffused. When one group develops an effective technique—whether a new encryption tool, a viral video format, or a platform-hopping protocol—others observe, adapt, and deploy it within weeks. This creates an iterative, competitive dynamic akin to private-sector innovation cycles, where success is quickly copied and refined. For counter-messaging efforts, this means monitoring any single group’s advancement offers insight into the likely tactics of all others. The implication is clear: tracking the leading edge of innovation—rather than focusing solely on prescribed targets—is essential for anticipating the next move in the information domain.
How Terrorist Groups Share a Universal Media Playbook: Lessons from ISIS, Hezbollah, Al-Shabaab and 12 Others
