Cyber Caliphate Army

Also reported as Islamic State Hacking Division, CCA, United Cyber Caliphate, UUC, CyberCaliphate and 4 other names.

Reports: 22
Last reported: 6 April 2026
Known CVEs: 14

ID: cyber-caliphate-army
Sources: MISP ETDA Malpedia
Merge evidence: 7 alias matches

Reports per quarter

2015 Q2: 2 reports
2015 Q3: 5 reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: 1 report
2016 Q3: 1 report
2016 Q4: 3 reports
2017 Q1: 2 reports
2017 Q2: 1 report
2017 Q3: no reports
2017 Q4: 1 report
2018 Q1: no reports
2018 Q2: 2 reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: 1 report
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: 1 report
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 2 reports

Dated reports, 2015 Q2 to 2026 Q2.

CVEs named in reports

Show all 14 CVEs Show fewer

CVE-2016-725521
CVE-2016-7855 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Cyber Caliphate Army (CCA), United Cyber Caliphate (UCC)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cyber Caliphate Army (CCA), United Cyber Caliphate (UCC)
6 April 2026

ISIS-linked Cyber Group Releases ‘Kill List’ of 8,786 US Targets For Lone Wolf Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor ISIS-linked Cyber Group Releases ‘Kill List’ of 8,786 US Targets For Lone Wolf Attacks
12 July 2023

The GRU's Disruptive Playbook | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The GRU's Disruptive Playbook | Mandiant
25 October 2022

os-kmandia-033017.pdf

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor os-kmandia-033017.pdf
8 May 2018

Russian hackers posed as IS to threaten military wives

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian hackers posed as IS to threaten military wives
8 May 2018

Russian hackers posed as IS to threaten military wives

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian hackers posed as IS to threaten military wives
2 November 2017

russian-federation-country-profile.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor russian-federation-country-profile.pdf
27 April 2017

Two Years of Pawn Storm Examining an Increasingly Relevant Threat

file creation date fromORKL

Archived copy on ORKL Detailsfor Two Years of Pawn Storm Examining an Increasingly Relevant Threat
10 January 2017

APT28-Center-of-Storm-2017.pdf

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT28-Center-of-Storm-2017.pdf
10 January 2017

At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations

Show all 22 reports Show fewer

10 October 2016

How France's TV5 was almost destroyed by 'Russian hackers'

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How France's TV5 was almost destroyed by 'Russian hackers'
10 October 2016

How France's TV5 was almost destroyed by 'Russian hackers'

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How France's TV5 was almost destroyed by 'Russian hackers'
9 October 2016

SiteIntel- Cyber Caliphate Army

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SiteIntel- Cyber Caliphate Army
7 September 2016

Bartholomew-GuerreroSaade-VB2016.indd

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bartholomew-GuerreroSaade-VB2016.indd
4 May 2016

ib-entertainment.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor ib-entertainment.pdf
1 September 2015

Fancy Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fancy Bear
1 September 2015

Fancy Bear

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Fancy Bear
1 September 2015

Fancy Bear

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Fancy Bear
12 August 2015

Islamic State Hacking Division

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Islamic State Hacking Division
12 August 2015

Islamic State Hacking Division

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Islamic State Hacking Division
29 June 2015

FireEye Intelligence: Threat Landscape Overview

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor FireEye Intelligence: Threat Landscape Overview
5 May 2015

Targeted Attack on France's TV5Monde

date in the CCS '25 data Ahnlab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Targeted Attack on France's TV5Monde

Newest first. Details opens the report in Explore.