How Terrorist Groups Glorify Violence on Social Media: Inside the Global Propaganda Ecosystem
Inside the Global Propaganda Ecosystem: How terrorist groups glorify violence across social media, the pipeline structure, platform gaps, and what a fair standard requires.
Twenty years ago, a terrorist group that wanted to reach the world needed a sympathetic television channel or a courier with a bag of DVDs. Tehreek-e-Taliban Pakistan’s media wing, Umar Media began exactly that way, distributing its videos on CDs, DVDs and pamphlets until 2010. Today the same outlet produces AI-generated news bulletins and voice-overs and spokespeople for the Afghan Taliban carry paid verification ticks on X.
Credit: Evolution, Expansion and Diversification: Tehreek-e-Taliban Pakistan’s Umar Media – GNET
Terrorist groups no longer need the legacy media. On social media, they have become it. This assessment maps how that happened: who produces the content that glorifies terrorist violence, why they produce it, how it spreads across platforms and borders and why so much of it survives despite two decades of counterterrorism effort online.
The State of Terrorist Propaganda Online
Overall, terrorist content remains widely available on the internet and its centre of gravity is shifting. Tech Against Terrorism’s Terrorist Content Analytics Platform has now identified more than 10,000 URLs hosting verified terrorist content, a milestone the UN’s Counter-Terrorism Committee Executive Directorate cites as evidence of the gap between the scale of the problem and platforms’ capacity to detect and remove it. The UN’s September 2026 trends report goes further describing terrorist propaganda as more than messaging: an operational instrument for recruitment, intimidation and the projection of power.
The geography of that propaganda has changed. As counterterrorism pressure has mounted in the Middle East, the Islamic State has shifted its focus largely toward Africa, according to the Center for Strategic and International Studies (CSIS). In 2025, its weekly al-Naba newsletter placed enormous emphasis on sub-Saharan Africa. South Asia has also become more crowded, with the Islamic State Khorasan Province, the Pakistani Taliban and Baloch separatist groups all investing in professional media operations.
The response meanwhile is thinning. CSIS reports that terrorism is declining as a US national security priority and that counterterrorism resources are decreasing accordingly with personnel cuts at the State Department’s counterterrorism office, the CIA and the FBI. Fewer resources mean less capacity to monitor and disrupt terrorist activity online, at the moment terrorist groups are expanding it.
The Producers: Who Makes Terrorist Content
Most major terrorist movements now run dedicated media wings that operate less like propaganda sidelines and more like small newsrooms. The table below summarises the principal producers by region.
| Region | Group | Media wing | What it glorifies |
|---|---|---|---|
| East Africa | al-Shabaab | Al-Kataib and supporter outlets | Attacks and “frontline” operations |
| West Africa and Sahel | ISWAP, Boko Haram, JNIM | IS central outlets; group channels | Attacks, fighters, governance claims |
| Global | Islamic State (central) | al-Naba, Amaq | Provincial attacks and “victories” |
| Global | al-Qaeda | As-Sahab and supporter networks | Leaders, affiliates, the legacy of 9/11 |
| South and Central Asia | ISKP | Al-Azaim | Attacks; attacks on the Taliban and TTP |
| South Asia | TTP | Umar Media | Attacks on Pakistani forces; its dead |
| South Asia | BLA | Hakkal | Suicide attackers, leaders, campaigns |
Africa is now the leading producer. Tech Against Terrorism describes al-Shabaab as essentially the largest single producer of terrorist material on the internet, responsible for around 20 to 25 percent of the terrorist content the organisation finds. In West Africa and the Sahel, the African Union’s Counter-Terrorism Centre warned in October 2026 that ISWAP, Boko Haram and JNIM are recruiting on social media and moving funds through mobile money, gift cards and cryptocurrency.
The Islamic State and al-Qaeda remain the global brands. IS central publishes the weekly al-Naba and the Amaq news agency which carry its provinces’ claims. Al-Qaeda’s ecosystem has proved durable: 25 years after 9/11, the Institute for Strategic Dialogue (ISD) found roughly 200 pro-al-Qaeda accounts and pages on Facebook, 100 on TikTok, 55 on X and 50 on Instagram.
A TikTok account that only shares articles from al-Qaeda in the Arabian Peninsula’s (AQAP) now defunct English-language magazine Inspire. Credit: 25 years after 9/11, al-Qaeda remains perennially online: The group’s digital ecosystem in 2026 – Institute for Strategic Dialogue
South Asia has the most crowded field. ISKP’s Al-Azaim has expanded into Uzbek and Tajik editions. The TTP’s Umar Media named after the Afghan Taliban’s founder Mullah Omar was transformed in 2023 when a former propagandist for al-Qaeda’s As-Sahab joined as its media adviser. The BLA’s Hakkal, studied by West Point’s Combating Terrorism Center, publishes battle footage, tributes to suicide attackers and full annual reviews in three languages.
Why Terrorist Groups Glorify Violence
Glorification is not a by-product of terrorist violence. It is a strategy and across regions and ideologies it serves five consistent purposes.
Recruitment. Turning dead fighters into heroes makes joining look honourable and meaningful. Standardised tributes to fallen fighters and especially to suicide attackers are among the most common products of groups from al-Shabaab to the BLA.
Legitimacy. Annual reports, casualty tables, “courts” and the vocabulary of international law present a group as an army or a state rather than an armed band. The BLA’s 2025 annual review described the group as “an organized military force” acting in compliance with the Geneva Conventions.
Intimidation. Attack footage and casualty claims are aimed at the state, its soldiers and foreign investors, signalling that the group can strike anywhere.
Morale and survival. After defeats, propaganda reassures supporters that the movement endures. Organisations under military pressure tend to shift toward narratives of a long war that victory will eventually reward.
Rivalry. Groups compete for followers as well as territory. ISKP’s Al-Azaim has attacked the TTP and the Afghan Taliban in its propaganda and ISD found al-Qaeda supporters sharing templates to mass-report Islamic State channels and get them banned from Telegram.
How Terrorist Glorification Works on Social Media
The techniques differ by group but a common toolkit has emerged.
Martyrdom culture. Eulogies, final video testaments of suicide attackers and annual commemorations turn individual deaths into collective stories of sacrifice.
Leader cults. Groups build recognisable faces. The BLA’s media wing filmed its then-chief in open desert during its January 2026 campaign according to Jamestown Foundation analysis to dismiss rumours of his death.
Battle footage and infographics. Helmet-camera clips, drone video and tallies of “operations” present violence as proof of strength. ISKP infographics appear in the Islamic State’s al-Naba.
Platform gaming. ISD found al-Qaeda supporters using TikTok’s “promotional content” tags to boost terrorist videos and al-Shabaab supporters sharing the group’s radio programming each morning as their “news”. Taliban officials and pro-Taliban outlets acquired verification on X which lends them credibility and reach.
Generative AI. In Nigeria, Boko Haram and ISWAP have used AI to edit videos, produce fake news broadcasts, impersonate government officials and evade content moderators. The TTP’s Umar Media has adopted AI-generated news bulletins and voice-overs. Tech Against Terrorism’s assessment is that terrorists are using AI to accelerate existing activity rather than to transform their capabilities but the acceleration alone lowers the cost of producing content at scale.
Why Deletion Fails: The Supporter Pipeline
The single most important feature of the ecosystem is its structure. Terrorist groups rarely publish first on the platforms where most people see their content. They release it on channels they control usually Telegram, WhatsApp, their own websites and file-sharing services such as the Internet Archive and then rely on others to carry it further.
Three pipelines do that work. Supporter networks, volunteers who are not fighters, repost official material across open platforms such as X, Facebook, TikTok and YouTube. GNET’s analysis of the TTP shows the pattern clearly: official channels disseminate tightly controlled propaganda, while supporter channels recirculate it across platforms. Translation networks carry content into new languages: ISD found an account distributing al-Shabaab and al-Qaeda-linked material in Persian taking East African content to an entirely new audience. And news republication brings militant claims into the mainstream when outlets relay a group’s casualty figures as news. Indian wire services, for example, routinely relay the BLA’s weekly attack claims, which are then syndicated internationally.
This structure explains why removal so often fails. Deleting an official channel doesn’t delete the copies already reposted by supporters, and it doesn’t stop the next release reaching the same network through a new account. Detection, by contrast, is no longer the main obstacle. ISD’s analysts noted that X’s own AI assistant, Grok, correctly identified live al-Qaeda content as terrorist material. The content was found. It simply wasn’t removed.
The Uneven Ban: Gaps in Platform Enforcement
Enforcement against terrorist content is real but it is uneven across groups, regions and platforms.
Where law enforcement concentrates, it can succeed. Europol’s 2026 EU Terrorism Situation and Trend report records that Al-Azaim, the most prominent pro-Islamic State outlet and one linked to ISKP’s threats against Europe, suffered a serious blow. Groups whose primary targets lie outside the West have often faced less pressure. GNET’s monitoring found that the TTP’s Umar Media and its supporter networks had faced fewer digital crackdowns on Telegram than the Islamic State or al-Qaeda with some TTP channels operating without interruption for over a year.
Platform policy shapes the field as much as enforcement does. After paid verification was introduced on X, the open-source research group Afghan Witness documented a surge in verified Taliban accounts including spokespeople and officials, and noted that the Taliban prefer X to Meta’s platforms, citing Meta’s blocks on Taliban-affiliated accounts. Even governments hostile to a particular terrorist group can struggle to secure cooperation: in November 2026, a Taliban intelligence official said Telegram and TikTok were not cooperating against ISKP.
Where cooperation fails, some states have turned to blunt instruments. Somalia banned Telegram and TikTok in August 2023, citing al-Shabaab’s use of both platforms. Such bans raise serious concerns about freedom of expression and the censorship of legitimate speech and they rarely stop determined groups which move to smaller platforms and “beacon” websites as AQIM has done in North-West Africa.
The evidence establishes these gaps. It does not establish that they result from deliberate bias and they are better explained by where platforms, regulators and Western law enforcement have concentrated their resources. The result, however, is the same: the countries that suffer the heaviest terrorist violence often face the content that celebrates it with the least support.
Pakistan: A Crowded Information Battlefield
Overall, Pakistan faces one of the most crowded terrorist information environments in the world. At least four distinct producers target Pakistani audiences or the Pakistani state: the TTP’s Umar Media, ISKP’s Al-Azaim, the BLA’s Hakkal and the Taliban-affiliated Al-Mirsad, which the Pakistani think tank CSSPR describes as a coordinated information-warfare tool. Unlike much of the violence examined elsewhere in this assessment, the groups behind this content draw on organised media units, cross-border sanctuary and in the TTP’s case the production expertise of a former al-Qaeda propagandist.
The tempo is rising. The Pakistan Institute for Conflict and Security Studies found that the TTP substantially intensified its propaganda and recruitment between July and September 2026, appointing a new media chief and restructuring its website, video and social-media divisions. The BLA’s Hakkal meanwhile staged its largest media campaign to date around the group’s January 2026 offensive. Its claims reach international audiences in part through foreign wire services that republish them.
Pakistan’s capacity to respond has improved, though significant gaps remain. In a written response to parliament in October 2026, Interior Minister Mohsin Naqvi reported that platforms complied with only 23.7 percent of content-removal requests from the Pakistan Telecommunication Authority, with compliance as low as 7.4 percent for X and 1.9 percent for YouTube. The same response acknowledged a “data-to-intelligence gap” within Pakistani law enforcement and very low conviction rates in cybercrime cases. The government’s stated remedy is binding compliance arrangements with platforms through the new Social Media Protection and Regulatory Authority. Human Rights Watch has warned that the underlying 2025 cybercrime amendments contain vague provisions that could also be used against journalists and critics.
Pakistan’s record also shows what cooperation can achieve. In October 2026, the National Cyber Crime Investigation Agency arrested a suspect in Lahore indicted in the United States for a $126 million postal fraud scheme, acting on information shared by the FBI. The case is not terrorism-related, but it demonstrates the model Pakistan has argued for: evidence shared through formal channels, verified by a dedicated agency and acted on lawfully.
In general, the analysis suggests that Pakistan’s challenge is less a lack of will than a lack of reciprocal cooperation. Pakistan’s stated position is that platforms must comply with Pakistani law, and the evidence of uneven enforcement supports a broader case: that content glorifying attacks in Pakistan deserves the same scrutiny as content threatening Europe or North America. Its credibility in making that case will depend on narrowly targeting terrorist content rather than legitimate political speech.
Implications: What a Fair Standard Would Require
The evidence points to four priorities for governments, platforms and researchers.
First, target the pipeline, not only the source. Removing official channels has limited effect while supporter and translation networks remain intact. Enforcement that tracks how content moves, across platforms and languages, would close the gap that deletion leaves open.
Second, apply standards consistently across regions. Africa now produces the largest share of terrorist content, and South Asia hosts some of the most active media wings. Enforcement attention has not kept pace with that shift.
Third, replace blanket bans with binding cooperation. National bans on whole platforms penalise ordinary users and push militants to smaller sites. Formal agreements that set out how platforms respond to lawful, specific requests, and how governments narrowly define terrorist content, would serve security and free expression alike.
Fourth, invest in capacity where the violence is. As Western counterterrorism budgets shrink, the burden of monitoring is shifting to states with fewer resources. Shared databases, forensic capacity and trained analysts in Africa and South Asia would make cooperation workable in practice.
Conclusion
Terrorist groups have built their own broadcasting networks, and social media has given those networks a global reach that no television channel ever offered them. The content that glorifies their violence is produced by organised media wings, spread by volunteer supporters, carried into new languages by translators and sometimes amplified by news outlets and algorithms that never intended to help.
The technology to find this content already exists. What is missing is the consistency to remove it wherever it causes harm, not only where it threatens the countries with the most influence over the platforms. Until that changes, the countries that bury the victims of terrorist attacks will continue to face the content that celebrates those attacks largely on their own.
Frequently Asked Questions
How do terrorist groups use social media? Terrorist groups use social media to recruit, build legitimacy, intimidate opponents and maintain morale. Most publish first on channels they control, such as Telegram and WhatsApp, then rely on supporters to repost content on open platforms like X, Facebook, TikTok and YouTube.
Which terrorist group produces the most content online? According to Tech Against Terrorism, the Somali group al-Shabaab is the largest single producer of terrorist content online, accounting for around 20 to 25 percent of the material the organisation identifies.
What does glorification of terrorism mean? Glorification of terrorism refers to content that celebrates terrorist attacks, attackers or leaders, such as tributes to suicide bombers, attack footage presented as victories, or leaders presented as heroes.
Why is terrorist content so hard to remove? Removing an official channel rarely removes the copies that supporters have already reposted across other platforms and languages. Detection is improving, but enforcement remains uneven across groups, regions and platforms.
How are terrorists using artificial intelligence? Groups such as ISWAP, Boko Haram and the TTP have used AI to edit videos, generate fake news broadcasts and voice-overs, impersonate officials and evade content moderation.
What is Pakistan doing about online terrorist propaganda? Pakistan is establishing a Social Media Protection and Regulatory Authority and seeking binding compliance arrangements with platforms, after reporting low compliance with its takedown requests. Rights groups have urged that new powers be narrowly defined to protect legitimate expression.
