Islamic State-Linked Hacker and Abu Hussain Al Britani Associate Arrested for Leak of U.S. Military and Government Personnel Information

On October 15, federal prosecutors in the U.S. unsealed a criminal complaint charging Kosovo citizen Ardit Ferizi, aka “Th3Dir3ctorY,” with providing material support to The Islamic State and committing “computer hacking and identity theft violations in conjunction with the theft and release of personally identifiable information (PII) of U.S. service members and federal employees”.

Ferizi, who is believed to be the leader of hacking collective Kosova Hacker’s Security, hacked a target located in the U.S. and subsequently stole thousands of individuals’ personal information. He then allegedly provided the information on more than 1,000 U.S. government personnel to The Islamic State for release.

The complaint indicated that Ferizi provided the data to infamous Islamic State hacker Junaid Hussain, better known by his jihadi nom de guerre Abu Hussain Al Britani, who thereafter publicly released the dump under the name of the Islamic State Hacking Division (ISHD) on August 11.

A history of surveillance

As previously reported by Flashpoint, alongside the data dump, Hussain proclaimed, “O Crusaders, as you continue your aggression towards the Islamic State and your bombing campaign against the Muslims, know that we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands! ‘So wait; we too are waiting.” The message also specified the target as the “United Sates Government and Military – The Head of the Crusader Coalition.”

The August 11 dump included the names, departments/divisions, emails, passwords, locations, and phone numbers of nearly 1,500 military and government personnel, including individuals from the Air Force, various foreign embassies, the Marines, NASA, USAID, NY Port Authority, and more. The hack also included the credit card information of several U.S. State Department officials, as well as screenshots of private Facebook messages between U.S. servicemen.

Connected in crime

Ferizi, who was living in Malaysia at the time of his arrest, also provided information to Islamic State member Tariq Hamayun, aka Abu Muslim Al Britani, including the credit card information belonging to “27 Americans, 18 British and 22 French citizens, including: names, addresses, zip codes, birthdates…”

Hamayun, who had indicated on his personal Twitter account in November 2014 that he was born in Dudley, UK in 1976, noted that he was a full-time electrical engineer and explosives expert, as well as a part-time sniper. Hamayun also boasted about being a seasoned jihadi, previously operating in Khorasan [the AfPak region], specifically Waziristan.

On November 15, 2014, Hamayun announced that he “arrived from the Land of Khorasan (WAZIRISTAN) to the Land of Bilad Al Sham (SYRIA-IRAQ) after 4 months of travel by land.” Hamayun was well known within the jihadi community and to those monitoring him for making bold claims, including a November 23 allegation that The Islamic State had found radioactive material from Mosul University,” thereafter explaining how the group could use the material to best, “cause widespread panic, and [a] rush to evacuate the targeted city.”

Exemplifying the interconnectedness of these Islamic State foreign fighters and supporters, when speaking with Ferizi, Humayun said that Junaid Hussain, “is my friend he told me a lot about u.”

A legacy lives

Although Junaid Hussain was killed in an August 2015 drone strike in Syria, his wife, Sally Jones (aka Umm Hussain Britaniya), has attempted to carry on her late husband’s legacy, maintaining a prolific and violent social media presence, even, in her own words, releasing, “the address & details of US Military target no.2 also one of America’s most decorated soldiers,” Sgt. 1st Class Dillard Johnson on October 08. Making very clear why she released the information, Britaniya proclaimed, “Once again I leave these details online to cause havoc in his life & for my brothers and Al-Qaeda in the U.S to eventually hunt him down & kill him.”

Ever since Junaid Hussian fled to Syria from the UK in 2013, The Islamic State has been responsible for fueling the growing jihadi-hacker nexus, leading to the emergence of several groups that have launched attacks in The Islamic State’s name, including the referenced Islamic State Hacking Division, the Cyber Caliphate, the Islamic Cyber Army (ICA), and others. Despite dozens of claimed attacks and breaches, the August 11 dump provided by Ferizi has been among the most notorious of hacks associated with Islamic State supporters.

Furthermore, today’s revelations have proven that much of the pro-Islamic State hacking efforts would have been impossible without the apparent alliance between Hussain and Ferizi. Therefore, while Hussain’s death and Ferizi’s arrest represent major victories in the fight against The Islamic State, the group’s appeal among the young, tech-savvy demographic ensure that while authorities might have won this battle, the greater war against such efforts will continue.