US CentCom Twitter hack probably not Isis

The ‘CyberCaliphate’ claimed to be waging ‘CyberJihad’ — but was just as likely a teenager in their bedroom

A high-profile Twitter hack yesterday that was claimed by a group calling itself CyberCaliphate was probably not connected to Isis.

The group could be sympathisers with Isis, also known as the Islamic State, but could just have taken the name as a way of promoting themselves or antagonising those it has attacked. CyberCaliphate has also claimed cyberattacks on a Maryland news station and a New Mexico newspaper.

The group took over the Twitter and YouTube accounts of US Central Command yesterday, claiming to have leaked sensitive information before the two accounts were shut down.

A computer screenshot shows the U.S. Central Command Twitter feed after it was apparently hacked (Reuters)

The most telling evidence of the lack of Isis involvement is the name itself — the group doesn’t call itself Isis, but Islamic State. (The extra letters stand for “in Iraq and Syria”, and Islamic State is not limiting its ambitions to those countries.)

Lots of the messages also look childish and intentionally inflammatory. When the group changed CentCom’s Twitter image, for example, it read “i love you isis”. The picture was posted as the account’s banner image and profile picture.

The messages are in keeping with the very general messages that the group tends to post during its attacks, which look much more like the work of someone impersonating Isis from the west that anyone with real involvement. Last week’s hack of a Maryland TV station’s Twitter feed used the message: “INFIDELS, NEW YEAR WILL MAKE YOU SUFFER”.

After those attacks, the TV station WBOC said that the group had likely gained access by “using the login and password of members in the news department”. The CentCom attack was likely the same, with login details often easy to acquire if security is lax.

The claims to have hacked into Pentagon servers were likely to be false, too. The group had posted maps of North Korea’s nuclear plans and apparent responses to war in China before the Twitter account was suspended. But most if not all of the information posted on accounts seemed to be publically available.

CentCom did not apportion blame in a brief statement released yesterday, calling the attack “purely a case of cybervandalism”.

It said that its initial assessment was that “no classified information was posted and that none of the information posted came from CENTCOM's server or social media sites”.