Fifteen Extremist Groups Share a Common Media Playbook: Lessons for Counter-Messaging Strategies

The headline is that extremist groups ranging from Al-Shabaab to ISIS-K to Hezbollah are clearly learning from each other, leading to an informal universal playbook that is consistent across the groups.

This insight comes from an analysis of how 15 adversarial groups utilize media to communicate locally and internationally, conducted with the same mindset used in the private sector to study competitors and improve approach.

The implication for any counter-messaging team is practical. Watching one group’s innovation is watching all fifteen. The right question to ask inside your own operation is whether you are monitoring the first mover in the playbook — not just the group on your assigned target list.

Bob Pearson, Chairman of the Pearson Advisory Group and Member of the Information Professionals Association

The groups analyzed include ISIS, Al-Qaeda, Al-Shabaab, Boko Haram/ISWAP, Taliban, Hay’at Tahrir al-Sham, Hezbollah, Hamas, Tehrik-i-Taliban Pakistan, AQAP, ISIS-K, Jemaah Islamiyah, Abu Sayyaf Group, Jaish-e-Mohammed/Lashkar-e-Taiba, and Houthis.

Media Strategy

Telegram serves as the home base for distribution due to its broadcast channels with no subscriber limits, bots for automation, end-to-end encrypted direct messages, minimal content moderation, and ease of migration after bans via invite links. Narratives often originate in Telegram before being fed to other platforms.

Groups distribute content across an average of 3-7 platforms simultaneously, anticipating takedowns. To counter removals, they upload content to Archive.org as a holding tank, enabling re-uploads if content is taken down from social channels. A typical media mix may include Telegram, Facebook, TikTok, Element, and Archive.org.

A two-tier distribution system. All groups have two-tier distribution – their official channels for direct distribution and unofficial channels for supporters/surrogates (TikTok, Instagram, YouTube) to reshare and amplify content. The supporters help groups maintain a presence despite official account bans. Platform policies have difficulties proactively monitoring and patrolling the surrogate amplification layer.

The Cipher Brief, April 22, 2026

Enforcement leads to migration. Groups pre-position on alternative channels such as Rocket.Chat, Element, and Session to activate a pre-existing presence when needed. They also move to platforms beyond the reach of platform moderation, including satellite TV (used by Hezbollah and Houthis) and physical offline media (employed by groups like Jemaah Islamiyah and Boko Haram).

Narrative Style

Groups expertly establish false narrative frames, exploiting major geopolitical events by inserting their narrative within hours. Conducting this “narrative jacking” within 2-4 hours of an incident allows them to lead the first wave of interpretation before mainstream media establishes the dominant frame.

Video accelerates attack claims. Every group releases an official video within hours of any attack. Pre-produced, officially branded with logos, released to Telegram first. Sets the frame and it is often more emotional.

The Cipher Brief, April 22, 2026

They employ parallel audience messaging: the local message is delivered in the local language and often focuses on governance legitimacy or grievance, while the international message emphasizes solidarity, victimhood, and humanitarian framing. Dual-narrative analysis is more instructive than tracking either message alone.

Ability to reframe civilian imagery. The footage is often authentic. The deception is in the attribution, the framing, or the claimed scale.

The Cipher Brief, April 22, 2026

Grievance amplification is a gateway to radicalization. Media strategy often begins by amplifying legitimate grievance – real injustices, real conflicts, civilian suffering. Extreme content gets layered on top over time, and because the foundation is real, platform policies usually don’t flag it.

The Cipher Brief, April 22, 2026

Understanding how these groups learn from each other improves the ability to identify which media, technology, and AI trends are being utilized. What breaks new ground is quickly analyzed and implemented across the network.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief.