In this article, I’m going to perform some OSINT data collection on the attackers of the 13th November 2015 in Paris
My analysis will not provide breakthrough informations, instead, it will gather together quite a lot of the informations available everywhere in the corners of the Internet, and help understand more accurately the background of these attackers. I will also derive some security related conclusions
As these events occured in France, many available resources are in French. So, there is going to be quite a lot of French in this article, especially in the videos. Nevertheless, the whole article should be understandable
OSINT – Open Source Intelligence
Let’s start by a short introduction about OSINT, and the basic techniques I’m using for this article
Open source intelligence is derived from data and information that is available to the general public
It is not limited to what you can find using the major search engines, as a huge proportion of the internet cannot be found with them. This so-called “deep web” is a mass of websites, databases, files, and more that cannot be indexed by Google, Bing, Yahoo,..
Despite this, much of the content of the deep web can be considered open source because it’s readily available to the public
In addition, there’s plenty of freely accessible information online that can be found using online tools, other than traditional search engines (such as geography data, internet archives, social media aggregators,…)
During the data collection, a risk of information overload is a real concern. Therefore a good balance between tools and areas of interest should be used, and a clear strategy shall be followed
Here below some of the basic techniques used for this article :
- Google dorks : it’s a search query that we give to Google to look for more granular information, and retrieve relevant informations quickly (https://bit.ly/3l2eFM4)
- YouTube : there are many videos about the attackers, and many informations can be found from there on. For instance, we can find visual clues about the attackers neighborhood, and then narrow down their home location on Google maps
- TOR : this is the gateway to the deepweb, where we can find tons of articles related to our topic, that would be hard to find on the usual Google search engine (https://bit.ly/3D3VnvU)
- Google Maps : very usefull to identify locations found in the videos (https://bit.ly/39Zchz3)
- Wayback machine : it archives web pages, even those that are no longer online (https://bit.ly/3uufDDP)
- Buzzglobe : this is a good social network aggregator (https://buzzglobe.com/)
Of course, there are much more OSINT techniques available, but the above are adequate for my article
You can check this GitHub for further informations and tools : https://bit.ly/2WARsqO
I also would like to put this slide, as I find it usefull in the context of this article. It’s a comparison between OSINT for Infosec and OSINT for Law Enforcement, my article being closer to the second one
Paris attacks on the 13th November 2015
As a reminder of the events, you can check this video : https://bit.ly/3A4aiEv
Here is a graphical summary of the events during that night. I’m not going to detail this further as this is not the purpose of my article. You can check the link below the map, where you will find much further informations how the events unfold
It is important to remind that in year 2015, the Islamic State organization was very active and controlling territories between Syria and Irak. The European allies, the USA, Russia, Syria, were all fighting a war against IS
The IS was preparing attacks in Western Europe from here. Terrorists joined the IS from France, Belgium and other countries, then went back to their countries of origin to stike. Also, the European secret services were active to deter these attacks
Now, I’m starting the OSINT analysis of each attacker
OSINT applied to the attackers
We are going to research informations about the following individuals :
- Bilal Hadfi (French)
- Ahmad al-Mohammad (Iraqi)
- Mohammad al-Mahmod (Iraqi)
- Samy Amimour (French)
- Abdelhamid Abaaoud (Belgian)
- Chakib Akrouh (Belgian)
- Ismael Omar Mostefai (French)
- Foued Mohamed-Aggad (French)
- Salah Abdeslam-Faklan (French)
- Brahim Abdeslam-Faklan (French)
Bilal Hadfi | French | Status : exploded near the Stade de France
Bilal Hadfi was a 20-year-old French citizen who had been living in Belgium, in Neder Over Heembeek. His parents had imigrated from Morocco
Bilal Hadfi was attending the Annessens-Funck school a year before the Paris attacks took place. At school, he was known to cause problems (had stollen cars, threatened people,…)
One of his teachers had called a Belgian radio station, to say she had raised the alarm after the teenager praised the Islamic State tactic of beheading their captives
His principal had sent an email to education officials in Belgium to alert them to the radicalized and dangerous behavior of Hadfi : https://bit.ly/3FbbsBA
Belgian police knew he had become indoctrinated, espousing support for Islamic State and Boko Haram. He left his family to Syria in February 2015
Hadfi returned to Europe by an unknown route and evaded police even though the Belgian Justice Ministry said microphones had been placed at the house where he was thought to be staying, but he failed to show up, so could not be traced
Hadfi was connected with an Islamic State cell based in the Molenbeek district of Brussels, where the Paris attacks were conceived
He was active on social media, posting pro-jihadist messages and other violent messages, as early as 2013, when he was still at school. He was posting Facebook messages under the name Billy Du Hood
In a post from November 2013, he posted a photo in which a group of men were depicted destroying a police car, with a statement “fuck the police”
His profile picture was showcasing firearms, as early as December 2013, and another one was showing a Kalachnikov AK47 (version AKMS) : https://en.wikipedia.org/wiki/AKM
Writing on Facebook under the pseudonym Bilal Al Mouhajir, he put out a call to arms in a post in July 2015. The message refers to westerners as “those dogs who attack our civilians” in various Middle Eastern cities, and appeals to “brothers working in the land of nonbelievers” to “work within their community of pigs so they can’t feel safe again, even in their own dreams”
Shortly before the attacks in Paris, the Islamic State had released a disturbing propaganda video showing what appears to be a footage of the attackers from Paris. Bilal Hadfi is shown with a prisoner kneeling at his feet, whom Hadfi then beheads
During the attacks in Paris, Hadfi attempted to enter the Stade de France to cause a lot of damage, but he blew himself up nearby after being denied entry
After Hadfi was identified as one who detonated bombs outside the Stade de France, online acquaintances began posting tribute messages on his profile : “Brother, we’ll never forget that Allah opened for you the door of paradise, Insha’allah”
His mother Fatima Hadfi Kaddour, contacted MaghrebTV shortly after the attacks and reported live about the situation of her son : https://bit.ly/3zKq4Ej. She depicted him as a “nice person”, who had been “stollen” to her. In the video, she is also seen speaking about her son that left to Syria, a few months before the Paris attacks
She also wrote a book, claiming the love for her son, and how he “really” was before all this started
Fatima Hadfi has an Instagram account and she posts a photo of her son from time to time, stating “I miss you”. For example, this one dates back to March 2021
She his connected to one of her other son on Instagram, Belkacem Hadfi. In his Instagram account, it can be seen that he visits Morocco from time to time. He also has a Linkedin account. He has been truck driver for a company located in Brussels
Belkacem Hadfi had been jailed in 2014-2015 for drug traffic
The uncle of Bilal Hadfi, Mohamed Loudghiri, has been also jailed after he attempted to join Syria in 2015. He claimed that he was going there to find his son who had left to Syria. He was kept in jail for some time : https://bit.ly/3F9gYEV
Ahmad al-Mohammad | Iraqi | Status : exploded near the Stade de France
Another bomber carried a passport belonging to a 25-year-old Syrian named “Ahmad al-Mohammad”. A passport-holder claiming to be a Syrian refugee with that name was registered in Leros in Greece in October 2015 upon his arrival from Turkey
Leros is a well know spot for migrants entry into Europe. Usually, upon arrival, migrants are being searched, photographed, fingerprinted and interviewed
In summer 2015, up to a thousand migrants a day were landing at Leros, and there was a lack of personnel and infrastructure : https://bit.ly/3mnxFnB
The dead attacker’s fingerprints matched those taken at the registration on Leros. French officials concluded that “Ahmad al-Mohammad” is probably a dead Syrian soldier whose passport was stolen and faked after he was killed in Syria
Having a Syrian passport is interesting for attackers as following the civil war in Syria, the Syrian passport provides a right of asylum
Islamic State identified him as “Ukasah al-Iraqi”, indicating that he was from Iraq. Ukasah al-Iraqi was born in Iraq to a Sunni muslim family, and he joined the Islamic State during the Syrian civil war. He took part in fighting against the Syrian Arab army, and he was selected to take part in a special operation in 2015, that led to the Paris attacks
This was later confirmed in January 2017 when a declassified French intelligence file identified the bomber as Ammar Ramadan Mansour Mohamad al-Sabaawi, an Iraqi in his twenties from Mosul. Islamic State is said to have paid al-Sabaawi’s family $5,000 and flock of sheep after his death : https://politi.co/3ot8K4I
He has several brothers : one former Saddam Hussein military, one being taxi driver in Mosul, and two others who are said to be active djihadists
Mohammad al-Mahmod | Iraqi | Status : exploded near the Stade de France
The third bomber has been matched with a photo on arrival papers at Leros belonging to a man travelling together with Ahmad al-Mohammad under the name of M. al-Mahmod
Like al-Sabaawi, the Islamic State identified him as an Iraqi and called him “Ali al-Iraqi“, but his true identity has never been determined
Together with Ahmad Al-Mohammad, he bought a ticket for a ship to the port city of Piraeus, from where he continued his journey through Europe until France
Proofs that he travelled from the Western coast of Turkey, through Kalymnos in Greece, to the port of Piraeus near Athens, can be seen in the reservation below
The ferry tickets used by the two Iraqi have been uncovered
The route to France taken by the two Iraqi has been quite common for 2015, following the Syrian refugee crisis : https://bit.ly/3mh3CxP
They have followed the flow of migrants and hidden among the other refugees. Here is the typical route
Here further informations about this route : https://bit.ly/3iovChF. It was certainly quite an ordeal for the attackers, but they managed to get through it
There has been many discussions about how easy it is to fake a Syrian passport. A Dutch journalist used some of the ways to get a fake passport, just to show that it’s possible without too much difficulties
There are Facebook groups that provide answers to refugees needs. Smugglers use these groups, having obtained genuine blank passports stolen from government buildings in Syria amid the chaos of its internal conflict, as well as the machines for processing them
All that is needed is a photograph to make them indistinguishable from the passports of real Syrians. Driving licences and identity cards are also on offer
For example, this refugees Facebook group, which is in Arabic, creates opportunities, both for migrants seeking help and smugglers looking for business
There have been also strong warnings from the US about the Islamic State capabilities to issue fake Syrian passports. You can see in this well documented video (jump to 30′)
Samy Amimour | French | Status : eliminated in the Bataclan
Samy Amimour was a 28 year old French from Drancy (near Paris). He was living in this building block near the Drancy city council
Drancy https://reut.rs/3Fg1kYw
His family were migrants from Algeria. His father, Azdyne Amimour, has been seen several times in the media, including some interviews together with the father of a Bataclan victim. He also wrote a book with him (https://bit.ly/3uA19SK)
He currently lives in Liège (Belgium), is separated from his wife and daugthers, who are still located in Drancy. He runs a restaurant
His mother Mouna Amimour was active in the local associations. His sisters are Maya and Amel Amimour
Azdyne Amimour
Liègehttps://bit.ly/3pzdc1R
Samy Amimour was frequenting the Tawhid mosque (https://bit.ly/3mlkdjZ), located in Le Blanc-Mesnil
He was not very successfull at school and failed two different trainings (law, supply chain). He then started a job at the RATP (public transport in Paris area). In this photo below, he is seen following his initial training at the RATP
In the meantime, he started to radicalize and followed the principles of the Salafism. He planned some potential trips to Yemen and Afghanistan, and from then on, was arrested and put in custody by the police, and went through some interrogations. He was released and placed under legal supervision with mandatory weekly checks at the Drancy police. His ID and passport were removed
He had learned the basics of firearms at ANTP – Association Nationale de Tir de la Police (this association is not in direct connection with the French Police, it is an independant association)
Then, in September 2013, Samy Amimour left France to Syria, to join the Islamic State
His family kept in touch with him via Skype. They also helped his wife Kahina el-Hadra to join him into Syria : https://bit.ly/2ZJPFkg, although he was under legal supervision. His sister Maya was placed in custody for this
During the contacts they had all together, his lethal intentions were becoming more clear
As the situation was deteriorating, his father decided to organize a trip to the Syrian border in the city of Minbej, to convince his son to come back to France : https://bit.ly/2ZURTxq
The trip there was quite an ordeal to organize, as shown on the map
But he could not get his son to agree to come back. In the coming months, Amimour was “trained” by the Islamic State, to kill, slaughter and bomb
This video is a very good summary about Amimour
Three days after the massacre, his wife Kahina el-Hadra, e-mailed a former professor in France saying: “Did the attacks shock you? LOL” before boasting that her husband had been one of the assailants
“I encouraged my husband to leave in order to terrorize the people of France who have so much blood on their hands […] I’m so proud of my husband and to boast about his virtue, ah la la, I am so happy” the emails uncovered by investigators said
In a further email, she tried to justify the action of the terrorists (in a very poorly written language)
She is said to be still living in Raqqa, Syria
When you see that the Amimour family helped Kahina el-Hadra to travel to Syria, one can have doubts about the whole family. Did they really try to prevent this tragedy ? The tweet below provides some controversy about this : https://bit.ly/3mlKMFN
Shortly after his death, Amimour has been buried in the graveyard of La Courneuve, where there is a muslim square : https://bit.ly/3l3kVDa
Abdelhamid Abaaoud | Belgian | Status : eliminated in Saint-Denis
Abdelhamid Abaaoud (8 April 1987 – 18 November 2015), also known by his two “nom de guerre” Abu Omar Soussi and Abu Umar al-Baljiki, was a Belgian-Moroccan Islamic terrorist, who had spent time in Syria. He was one organizator of the Paris attacks
As a child, he was admitted to an exclusive Catholic school, Collège Saint-Pierre d’Uccle, in an upscale residential district of Brussels
But he was thrown out of that school, either for poor grades or bad behavior
He was travelling to his grand parents location in Morocco on a regular basis. Here is a video of his neighbours in Ouled Tayma
Omar Abaaoud, his father, owned a clothing store off the market square in Molenbeek, a borough of Brussels, and the family lived nearby in a house on Rue de l’Avenir near the local police station
Omar Abaaoud is now said to be living in Morocco with his family
As a young man, Abaaoud had carried out a number of armed robberies, for which in went to jail in 2010. He radicalized in prison
This is were he had met Salah Abdeslam
Although he had not shown any religious zeal, Abaaoud moved to Syria in the beginning of 2014, and joined the Islamic State. He was also a very active recruiter of potential terrorists
Abaaoud persuaded his younger brother Younes Abaaoud, then 13, to join him in the territory under control of Islamic State
During the campaign of Aleppo, Abaaoud was filmed at the wheel of a pickup truck dragging a load of mutilated corpses following a mass execution committed by the Islamic State of Iraq and Syria, at a place called Hraytan
There was an international arrest warrant issued for his activities in recruiting individuals to Islamic terrorism in Syria. In the meantime, Abaaoud was preparing terrorists attacks in Belgium
At some point, Abaaoud and his network tried to fake his death. For this purpose, in the summer of 2014, a Twitter account under the name “the lover of martyrs”, published a list of killed fighters
Among the purportedly deceased Belgian fighters was Abu Umar al-Belgiki, that is Abdelhamid Abaaoud
By faking his own death Abaaoud was able to go off the grid for several months, giving himself the opportunity to prepare for the terror plots in Belgium and France
Security services had been alerted to Abaaoud’s return to Europe by a telephone call he made from Greece to his brother, Yassine Abaaoud, in a Belgian prison (he was serving a sentence because of robbery : https://bit.ly/3amWcU5)
This led to a major operation to intercept him. The French DGSE tried to catch him in Athens, unfortunately without success
A house for islamic militants, he had helped set up in eastern Belgium, was raided. There, two of his associates, were killed in Verviers
But it missed its principal target, Abaaoud, who then somehow made his way back to Syria
Abaaoud was an asset for Islamic State leaders eager to take their battle to Europe, as he had a pool of friends and contacts back home willing to carry out attacks. For his activities, he was interviewed by the Islamic State propaganda, Dabiq
There had been some preventive air strikes in Syria by the French army, trying to block some Islamic State training camps in Deir ez-Zor, where Abaaoud had been reported by Intelligence sources
Abaaoud was also wanted in Belgium, where he was sentenced in absentia to 20 years imprisonment for serving as an Islamic State recruiter and “kidnapping” his younger brother Younes
Abaaoud’s father, Omar Abaaoud, joined this state prosecutor’s case against his son, for having recruited Younes
Despite all this, Abaaoud could not be refrained from attacking in Paris. Here is a summary of all his whereabouts in the years before the attacks
This video provides an excellent summary of the important efforts spent to track down Abaaoud
The Paris attacks provide all the patterns of a complex plot involving a high level of planning and preparation
This was proven after the attacks in Brussels from 2016. A terrorist named Najim Laachraoui, had a laptop found in a trash can, full of important informations
Although much of the hard drive had been wiped clean, digital forensic analysis by the Regional Brussels Computer Crime Unit yielded a trove of new information :
- Laachraoui consulted with an IS bombmaker, to improve on the explosive recipe he had used to build the suicide vests worn by the Paris attackers
- A number of audio recordings were recovered, in which Laachraoui briefed a senior IS operative on every aspect of their attack-planning
- The terrorist cell communicated with IS in Syria via encryption apps, providing a link between the terrorist organization and the Paris and Brussels attack teams
When Belgian computer technicians examined the laptop, they faced several obstacles. The first was that much of the contents of the hard drive had been permanently deleted by the terrorists. The second was that the cell had at times made use of a widely commercially available full disk encryption software program – TrueCrypt – while working on the computer. The third was that the terrorists had used software to make themselves anonymous and to wipe away Internet traffic
The computer technicians analysis revealed the computer was first used by the terrorist cell on October 9th 2015, more than a month before the Paris attacks, with the last entry the day before the Brussels attacks. Examining WiFi connections, investigators also ascertained the laptop had been used at several of the safe houses used by the cell in Belgium, including a different apartment used to make bombs for the Paris attacks
The files metadata retrieved from files whose contents had been permanently deleted from the computer, revelead some of the targets followed by the terrorist cell :
- One of the files was titled “13Novembre” while another was titled “Targets” and a third was titled with the Arabic word for explosives and appears to have contained information on TATP, the homemade explosive triacetone triperoxide, which has been used in terrorist attacks
- The file titled “13Novembre” was accessed between November 7 and November 11, 2013, revealing the attack date had by then been selected and divisions of labor clinically allocated
Najim Laachraoui has been found to be the builder of the bomb belts used by the attackers
Now let’s review what happened after the Paris attacks
Striking details on Abaaoud’s whereabouts during the attacks in central Paris have been provided. He was caught on videos on the Paris Metro heading to the areas of the shootings where he spent two hours, including near the Bataclan concert hall, according to data collected from his mobile phone location
The presence of Abaaoud in the immediate vicinity of the attacks provides an indication of his degree of implication in the supervision and control of the plot and suggests he was giving direct orders and instructions to his team inside the Bataclan during the shootout
A discarded cellphone found near the Bataclan concert hall, helped find him, as he was preparing further attacks in Paris La Défense
The phone had contact information for Abaaoud’s 26-year-old cousin, Hasna Ait Boulahcen
In fact, Abaaoud had established contact with her and they were hiding in a flat in Saint-Denis
Boulahcen was closely monitored by the Police. One of her relative, a so called Sonia, called the French DGSI to tell them she knew about the location of Abaaoud and Boulahcen
As a result, the Police raided the flat. Both she and Abaaoud were killed as heavily armed SWAT teams raided the apartment in Saint-Denis
When it comes to Younes Abaaoud, his current situation is unclear. According to some sources, he may have died in Syria : https://bit.ly/2YIeuge
But after the Paris attacks, some people posted on Facebook that he would be trying to come back and revenge his brother
And when it comes to Yassine Abaaoud, he had tried to go to Syria, but was arrested in Turkey and sent to Morocco. A Moroccan court sentenced him to two years in jail on terrorism-linked charges : https://bit.ly/3p0PVWX
Chakib Akrouh | Belgian | Status : exploded in Saint-Denis
Chakib Akrouh, a 25-year-old Belgian citizen of Moroccan descent, was a resident of Molenbeek. His father Farid El Khattabi still lives in Molenbeek
Journalists from RTL Info and France 3 had been molested outside of his flat, during an investigation, by the brother of Akrouh and one room mate
Akrouh started to radicalize when he was frequenting the mosque Loqman, a small underground mosque where he started his acquaintance with a recruitment network, the Zarkani network : https://bit.ly/3CRx97I
This mosque was closed after a strong suspicion of radicalism
Akrouh had left Belgium to Syria in January 2013, through Turkey, using a fake identity
There, he joined the Islamic State and got trained, but also killed opponents and hostages
He was using the nom de guerre Abu Mujahid al-Baljiki
Because of all this, he was well known by the Police. In 2014, an international search warrant was issued against him. A court in Belgium had sentenced Akrouh to five years in jail in absentia in July 2015, in the case linked to the jihadist recruitment network sending fighters to Syria
He was one of the Kalashnikov gunmen who sprayed restaurants and cafe terraces with bullets, killing dozens of people. Together with Abdelhamid Abaaoud, he had left the location of the attacks, using the Paris Metro. The CCTV surveillance led to his identification by the Belgian authorities
He blew himself up during the Saint-Denis police raid that occurred five days after the Paris attacks. Akrouh was not identified until the 15th January 2016
Ismael Omar Mostefai | French | Status : eliminated in the Bataclan
Omar Ismail Mostefai was a 29-year-old Frenchman, of Algerian descent. He grew up in the Paris suburb of Courcouronnes, but was living in Chartres before living to Syria
His father is Mohammed Mostefai and his mother Lucia
In Courcouronnes, he was student at the Lycée Georges-Brassens. He was a difficult student
Initially, he was known by the Police for several petty crimes :
- drug traffic
- driving without a valid licence
- robbery
- acts of violence
He was put in custody several times but he was not jailed. His parents decided to move from Courcouronnes to Chartres, because of the difficult situations of Mostefai with some local gangs
He was a frequent visitor of the local mosques in Chartres (Lucé, and the great mosque of Chartres). He is said to have started his radicalization there
But, what triggered the attention of the Police was that Mostefai was seen several times with Abdelilah Ziyad, a Moroccan who was jailed 8 years in France, for his preparation of the terrorist attacks of the Asni hotel in Marrakech, in 1994 (https://bit.ly/3lsvUpS). After his release, he had turned into a radical preacher
The preacher was working during some time in the Troyes mosque, as can be seen in this video. He was dismissed as he was hiding under a false identity. Nobody seemed to know about his ambiguous past
As a consequence, in 2010, the French authorities had put Mostefai on a database as a suspected Islamic radical
He started to travel to Syria in 2013, through Turkey, and joined the Islamic State in Syria
It is said that the Turkish authorities warned the French Police twice about Mostefai whereabouts : https://bit.ly/3mGeDsD
Within the IS, Mostefai war name was Abu Rayyan al-Faransi
In the Islamic State propaganda, he is seen beheading a victim
Shortly after the attacks, his brother, located in Bondoufle, south of Paris, declared that he did not have contacts with him since 2 years, and qualified his acts as “horrible” and “unforgiving”. Mostefai father and brother were put in custody for a few days during the investigations
His brother was challenged by the Police and some journalists, as during the attacks, he was attending a show from the controversial Dieudonné (a former comic, who has been accused of anti-semitism, among other claims)
Mostefai is burried in the cemetery of Thiais, south of Paris : https://bit.ly/3BtWfJT
His parents are located in Romilly-sur-Seine, where they visit frequently the local mosque
They built a house where they live with the rest of the family. They are located only 40 kms from where Abdelilah Ziyad was preaching, in Troyes
Foued Mohamed-Aggad | French | Status : exploded in the Bataclan
Foued Mohamed-Aggad was a 23-year-old Frenchman, his father Said Mohamed-Aggad being from Algeria and his mother Fatima Hajji being from Morocco
The mother had raised two brothers – Foued and Karim -, and a sister Kenza, on her own. She had divorced from her husband about 10 years before the attacks in Paris
Aggad was living in Wissembourg near Strasbourg. His mother currently lives in this house located in the center
In 2013, he was seen on some Facebook videos, playing with his nephew around Strasbourg
He tried to join the French Army or Police, but he did not succeed. He followed a girlfriend in the city of Toulouse and found a job as a construction worker. He contributed to the construction of this building
In Wissembourg, he was frequenting the local mosque, nearby the Turkish cultural center
At that time, he did not show strong signs of radicalization
It is said that he started his radicalization through contacts made with Mourad Farès on Facebook
Mourad Fares had played a decisive role in recruiting young Frenchmen for Jihad in Syria unitl his arrest on August 16th 2014 in Turkey
He had been interviewed at length by the Vice online newspaper : https://bit.ly/3lNvw5n
He had used several names on Facebook : Abu al Hassan, Abu Rashid
He was issuing propaganda videos and went to Syria. He has been jailed for 20 years in France
With the influence of Farès, Aggad left to Syria in 2013 together with a group of ten other guys located in the Strasbourg area, including his brother Karim. Some died in Syria, but most of them returned to Strasbourg, except Aggad who did not return with them
A police raid occured in the Strasbourg suburb of “La Meinau“, to catch the men returned from Syria
In the meantime, Aggad was very active in Syria. His family helped him to survive by providing money (a few thousand dollars were sent from France). Hadjira, a young girl from Strasbourg, had joined him in Syria in March 2014, and married him there
She had given birth to a baby girl in August 2015
On Facebook, Aggad wrote on a number of successive accounts, under variants of the name Abou Foued Al-Muhajir (“the immigrant”). His account was popular and was followed by hundreds of other jihadi fighters or supporters
In another Facebook post, Aggad stated: “I am just a soldier among many that have joined the ranks and await martyrdom.”
He was also in contact with his mother and mentioned his future martyrdom. In fact, Aggad had told his family months ago, that he was going to be a suicide bomber in Iraq and had no intention of returning to France
Aggad was flagged as a radical by the French police and he was also followed by Interpol
He started to gain importance in the Islamic State, with a prominent role
He was spotted by the US led coalition, and on the 8th September 2014, there had been a drone attack on him in Raqqa
It is important to remind that the drone strikes against IS where at a climax at this time, especially in Raqqa : https://bit.ly/3lM6tje
There is a very interesting British report, “the drone war“, about drone eliminations in the region. The British made several attacks “a strike at the heart” of Islamic State, and had expended big efforts to intercept and decipher any encrypted messages that might reveal the location of the djihadis : https://bit.ly/3EvK3ci
Before the Paris attacks, Aggad was communicating with some people in his French network, that “something big” would happen : https://bit.ly/3vjaY7U
In the aftermath of the Paris attacks, Hadjira informed Aggad mother about his death
“Your son died as a martyr on November 13th” said the text message received by Aggad’s mother on November 30th 2015. His widow, Hadjira, sent the text from Syria
“I want to know where he died,” Fatima replied. “With his brothers in Paris” Hadjira answered
Fatima Mohamed Aggad notified the French police. This led to the identification of Aggad and the police could conclude he was one of the Paris attackers
“What kind of human being could do what he did?” his father said. He is interviewed here in front of his house
Aggad brother, Karim, was sentenced to nine years in jail in 2017, for his participation to the Djihad in Syria : https://bit.ly/3BPKsFV
Hadjira, his wife, is supposed to have died in 2018 with her baby, during a bombardment
The rest of the family was put on custody several times in the last years, and again in 2021, the police raided the family house because of further evidences that they had financed a part of his living in Syria
The sister Kenza Mohamed Aggad is on Linkedin and in the past, she was service agent
Kenza Aggad is married with Mohamed Hattay, one of the ten guys who flew to Syria with Aggad in 2013 (full detailed article here : https://bit.ly/2Z4L3Fn). He is currently serving a nine years prison sentence
Salah Abdeslam-Faklan | French | Status : facing trial in Paris
Salah Abdeslam was born the 15th September 1989, and is a Belgian-born French national of Moroccan descent
He is accused of involvement in the Paris attacks, helping the attackers to move from Syria to Belgium, and then Paris, and actually participating to the attacks. As such, he is said to be the Logistician
He was supposed to explode himself near the Bataclan, but his explosive belt may have been faulty. After the attacks, he managed to travel back to Belgium, with the help of some accomplices
There is a full step by step story here (highly recommended) : https://bit.ly/3BQAK5Y, so I’m not going into all details
He was grown up in Molenbeek, a suburb of Bruxelles, known for its high Muslim population
His parents and some part of his family, leaved in this flat with financial incentives from Molenbeek, until 2016
His parents were running some shops. He started to work as a transport agent, but was fired because of his numerous absences
His sister Myriam Abdeslam-Faklan was working for the Molenbeek city council, as can be seen in the records of Molenbeek city : https://bit.ly/39HOOlK
Abdeslam started some robbery and petty crimes : https://bit.ly/3FWhExE
With his brother Brahim Abdeslam, he was running a bar where they were doing some drug traffic
One of his childhood friends was Abdelhamid Abaaoud
But unlike Abaaoud, Salah Abdeslam and his brother Brahim Abdeslam, did not have a long history of religious extremism. They did not follow the strict directives of radical Islam, and preferred to spend time smoking pot, playing video games and going to clubs
Unlike other attackers, Salah Abdeslam may have never visited Syria
But he started to have stronger ties with Abaaoud months before the Paris attacks. He started to prepare the attacks using Facebook : https://bit.ly/3kGE51B, and was instrumental in the organization of the attacks by planning most of the Logistics (car and hotel rental,…)
After the attacks, he flew to Bruxelles. He wrote several letters to his family, praying for his actions : https://bit.ly/3ATX3ak
Here is a good summary video together with the details of his arrest in Bruxelles, where Abdeslam was hiding
Abdeslam was hiding in a flat located ” 79 rue des Quatre Vents” in Molenbeek, that his aunt Djamila Mohamed, was renting from the Molenbeek City Council
Therefore the role of the whole Abdeslam family has been critized
The Molenbeek City Council decided to terminate the apartment lease that was granted to Djamila Mohamed. It is quite amazing to see that this flat is in the same building block as some Molenbeek City facilities, as can be seen on this picture
Tense scenes had broken out between locals and security forces in Molenbeek following the arrest of Salah Abdeslam, with some Muslim residents reportedly “praising” the evil Paris terrorist
Riot police were called in to disperse the crowds who gathered in the Brussels suburb after objects such as bottles, were thrown at the Belgian authorities
Abdeslam is currently facing his court trial, and in the meantime, he his retained in a very secure area of the Fleury Merogis prison in the south of Paris
His sister Myriam Abdeslam does not show any empathy for the victims, but says she still loves her brother in this interview : https://bit.ly/3AJJeez
She should join the trial in Paris starting the 13th January 2022, but so far refuses to go there for “safety reasons”
To be noted, Abdeslam received a letter from Dieudonné, who proposed to meet him to “understand” his actions : https://bit.ly/3j9a6ho
Brahim Abdeslam-Faklan | French | Status : exploded near boulevard Voltaire
Brahim Abdeslam was the brother of Salah Abdeslam
He hаd bееn a troublemaker whеn hе wаѕ young, attracting thе attention оf thе police аnd serving twо prison sentences fоr theft, оnе fоr thrее months аnd оnе оf ѕix months
Hе wаѕ a qualified Electrician
He got married in 2006 with his wife Naima Abdeslam, but the couple split in 2008 after two years of marriage and officially divorced in 2013
He was said to be lazy, spending his days smoking cannabis and drinking alcohol
He never went to a mosque
He opened the bar called Les Beguines (as seen above), but it was the location where he drugged himself and sold drug
Eventually the bar came to the attention of the police. The mayor of Molenbeek ordered the closure of the bar
Brahim Abdeslam, in close relationship with his brother Salah Abdeslam and Abdelhamid Abaaoud – who were managing a Djihadi recruitment network -, joined the Islamic State in Syria
He is seen in this IS propaganda video, threatening the former French President, François Hollande. The terrorists were determined to strike France
Like the other attackers, Abdeslam went back to France to execute the terrorist plot
He died in the bar Voltaire in Paris, after detonating his suicide bomb belt. In the below photo, he is seen actually detonating the explosive, a few fractions of a second before he dies
His funeral was in Molenbeek
At the cemetery, the police was here and took pictures of the family members
We see the cousin of Salah Abdeslam on the left – Abid Aberkane -, and Mohamed Abdeslam on the right – another brother of the family
In the meantime, Salah Abdeslam was hiding in the flat of Djamila Mohamed, the mother of Abid Aberkane. In the previous days of the funeral, Aberkane was instrumental to help hide Salah Abdeslam
The presence of Aberkane at the funeral and the monitoring of some phone calls he made to Salah Abdeslam in the previous days, led the police to the exact location of Salah Abdeslam
The phone of Brahim Abdeslam was recovered. The police analyzed the phone and found miscellaneous informations : https://bit.ly/39FEniG
A further analysis proved that he was in contact with Abdelhamid Abaaoud as early as 2014, talking about Djihad and assassinations : https://bit.ly/3lNo9eb
Mohamed Abdeslam-Faklan
Mohamed Abdeslam is the brother of Salah and Brahim Abdeslam. In the above picture, he is seen with Dieudonné, which we have already seen above in the dramatic story
When he was younger, he was arrested because of a sordid story. He was employed by an ambulance company but was robbing the dead people. He was sentenced to 2 years in prison (with probation) : https://bit.ly/3kEN1UY
Despite this situation, he was working for the Molenbeek City Council
After the Paris attacks, he was interviewed by the media. He was saying that no one in the family ever had any issue with the justice (absolutely not true)
He made further controversial declarations about his brother Salah Abdeslam, trying to minimize his terrorist acts, and because of this, he was fired from the Molenbeek City Council : https://bit.ly/3AILCCw
In 2018, he was jailed 30 months after stealing his former employer, using his knowledge of the offices, threat and violence : https://bit.ly/3AU5um0
Conclusion
By using some basic OSINT techniques, we have been able to build the profile of each attacker and some of their relatives. We have also noticed some of the following items :
- Jihadi networks are structured and large. Their active monitoring requires significant resources
- Jihadi networks have the support of their local community
- The networks are often built around families who are radicalized and the relations to their relatives are often ambiguous
- Jihadi networks are often linked to criminal organizations and drug traffic
- They are able to use many technics to stay invisible : false papers, encrypted communications, deletion of forensics traces, accomplices and logistics network, manipulation of informations,…
- Social networks (Facebook,…) are used as a propaganda vector and shall be monitored to detect threats upfront, together with classical methods of surveillance (phone conversations interception, electronic devices forensics…)
- The media may give voice to djihadi and their families, and relay biased messages unwillingly
- Jihadi take advantage of the migrants flow to infiltrate western countries
- The migrants flow shall be kept under control with proper identification technics (facial recognition,…) and a central database shall be maintained
- Intelligence services shall work in close cooperation with the countries of residence of the djihadi, for deterrence and coordinated actions of force if necessary
- The use of drones has to be considered in extreme cases for directed eliminations