The Cyber-Caliphate hacks 54,000 Twitter accounts
The ISIS propaganda machine has a dual role, publicity and recruitment; its noise level had been curtailed with the killing of British hacker and ISIS member Junaid Hussain. He had played a key role in setting up and running an ISIS hacking group called the Cyber Caliphate, that claimed a number of spectacular hacks, particularly focusing on Twitter sites. This weekend the group sprang back to life with news that it had hacked over 50,000 Twitter accounts, primarily in Saudi Arabia, but also of key personnel within the FBI and the CIA. The extent of the group's abilities are not clear: having claimed responsibility for the TV5 Monde hack last June, it later transpired that this had been the work of the state-sponsored Russian APT28 group.

SAN FRANCISCO – Russian hackers posing as the ISIS "Cyber Caliphate" were likely behind the hack of France's TV5Monde television channel, according to cybersecurity experts who have examined the attack.

Hackers claiming affiliation with ISIS shut down transmissions on the TV5Monde network on April 8 and posted pro-ISIS propaganda on the station's Facebook and Twitter accounts during the attack.

But a Russian group known as AT28 may have used ISIS as a cover for hacking, the U.S.-based security firm FireEye told BuzzFeed News Tuesday, after observing similarities in the infrastructure used by the Russian group and the one involved in the TV5Monde attack.

"There are a number of data points here in common," said Jen Weedon, manager of threat intelligence at FireEye. "The 'Cyber Caliphate website,' where they posted the data on the TV5Monde hack, was hosted on an IP block which is the same IP block as other known APT28 infrastructure, and used the same server and registrar that APT28 used in the past."

Weedon and other cybersecurity experts have been following the APT28 group for some time. The group — also known as Pawn Storm, Tsar Team, Sednit, and Fancy Bear — has been hacking into computer networks for the past seven years using highly advanced and aggressive methods, according to an October 2014 report released by FireEye. The report argues that APT28 is sponsored by a government unit based in Moscow.

"Russia has a long history of using information operations to sow disinformation and discord, and to confuse the situation in a way that could benefit them," Weedon told BuzzFeed News. "In this case, it's possible that the ISIS cyber caliphate could be a distraction. This could be a touch run to see if they could pull off a coordinated attack on a media outlet that resulted in stopping broadcasts, and stopping news dissemination."

Weedon said that researchers at FireEye had eyes on APT28's infrastructure and had seen it target other journalists around the same time as the TV5Monde attack. France's L'Express newspaper published a story Tuesday citing judicial sources who said that investigators had turned their attention away from ISIS and toward a group of Russian hackers. The paper said it would reveal more details on the investigation Wednesday.

The April 8 attack on the TV5Monde managed to take down the internationally broadcast television network for a full 18 hours. French Prime Minister Manuel Valls called the attack an "unacceptable attack on freedom of information and of expression," while Yves Bigot, head of TV5Monde, described the attack as "unprecedented in the history of television."