My analysis will not provide breakthrough informations, instead, it will gather together quite a lot of the informations available everywhere in the corners of the Internet, and help understand more accurately the background of these attackers. I will also derive some security related conclusions

As these events occured in France, many available resources are in French. So, there is going to be quite a lot of French in this article, especially in the videos. Nevertheless, the whole article should be understandable

OSINT – Open Source Intelligence

Let’s start by a short introduction about OSINT, and the basic techniques I’m using for this article

Open source intelligence is derived from data and information that is available to the general public

It is not limited to what you can find using the major search engines, as a huge proportion of the internet cannot be found with them. This so-called “deep web” is a mass of websites, databases, files, and more that cannot be indexed by Google, Bing, Yahoo,..

Despite this, much of the content of the deep web can be considered open source because it’s readily available to the public

In addition, there’s plenty of freely accessible information online that can be found using online tools, other than traditional search engines (such as geography data, internet archives, social media aggregators,…)

During the data collection, a risk of information overload is a real concern. Therefore a good balance between tools and areas of interest should be used, and a clear strategy shall be followed

Here below some of the basic techniques used for this article :

• Google dorks : it’s a search query that we give to Google to look for more granular information, and retrieve relevant informations quickly (https://bit.ly/3l2eFM4)
• YouTube : there are many videos about the attackers, and many informations can be found from there on. For instance, we can find visual clues about the attackers neighborhood, and then narrow down their home location on Google maps
• TOR : this is the gateway to the deepweb, where we can find tons of articles related to our topic, that would be hard to find on the usual Google search engine (https://bit.ly/3D3VnvU)
• Google Maps : very usefull to identify locations found in the videos (https://bit.ly/39Zchz3)
• Wayback machine : it archives web pages, even those that are no longer online (https://bit.ly/3uufDDP)
• Buzzglobe : this is a good social network aggregator (https://buzzglobe.com/)

Of course, there are much more OSINT techniques available, but the above are adequate for my article

You can check this GitHub for further informations and tools : https://bit.ly/2WARsqO

I also would like to put this slide, as I find it usefull in the context of this article. It’s a comparison between OSINT for Infosec and OSINT for Law Enforcement, my article being closer to the second one

Paris attacks on the 13th November 2015

As a reminder of the events, you can check this video : https://bit.ly/3A4aiEv

Here is a graphical summary of the events during that night. I’m not going to detail this further as this is not the purpose of my article. You can check the link below the map, where you will find much further informations how the events unfold

It is important to remind that in year 2015, the Islamic State organization was very active and controlling territories between Syria and Irak. The European allies, the USA, Russia, Syria, were all fighting a war against IS

The IS was preparing attacks in Western Europe from here. Terrorists joined the IS from France, Belgium and other countries, then went back to their countries of origin to stike. Also, the European secret services were active to deter these attacks

Now, I’m starting the OSINT analysis of each attacker

OSINT applied to the attackers

We are going to research informations about the following individuals :

• Bilal Hadfi (French)
• Ahmad al-Mohammad (Iraqi)
• Mohammad al-Mahmod (Iraqi)
• Samy Amimour (French)
• Abdelhamid Abaaoud (Belgian)
• Chakib Akrouh (Belgian)
• Ismael Omar Mostefai (French)
• Foued Mohamed-Aggad (French)
• Salah Abdeslam-Faklan (French)
• Brahim Abdeslam-Faklan (French)

Bilal Hadfi | French | Status : exploded near the Stade de France

Bilal Hadfi was a 20-year-old French citizen who had been living in Belgium, in Neder Over Heembeek. His parents had imigrated from Morocco

Bilal Hadfi was attending the Annessens-Funck school a year before the Paris attacks took place. At school, he was known to cause problems (had stollen cars, threatened people,…)

One of his teachers had called a Belgian radio station, to say she had raised the alarm after the teenager praised the Islamic State tactic of beheading their captives

His principal had sent an email to education officials in Belgium to alert them to the radicalized and dangerous behavior of Hadfi : https://bit.ly/3FbbsBA

Belgian police knew he had become indoctrinated, espousing support for Islamic State and Boko Haram. He left his family to Syria in February 2015

Hadfi returned to Europe by an unknown route and evaded police even though the Belgian Justice Ministry said microphones had been placed at the house where he was thought to be staying, but he failed to show up, so could not be traced

Hadfi was connected with an Islamic State cell based in the Molenbeek district of Brussels, where the Paris attacks were conceived

He was active on social media, posting pro-jihadist messages and other violent messages, as early as 2013, when he was still at school. He was posting Facebook messages under the name Billy Du Hood

In a post from November 2013, he posted a photo in which a group of men were depicted destroying a police car, with a statement “fuck the police”

His profile picture was showcasing firearms, as early as December 2013, and another one was showing a Kalachnikov AK47 (version AKMS) : https://en.wikipedia.org/wiki/AKM

Writing on Facebook under the pseudonym Bilal Al Mouhajir, he put out a call to arms in a post in July 2015. The message refers to westerners as “those dogs who attack our civilians” in various Middle Eastern cities, and appeals to “brothers working in the land of nonbelievers” to “work within their community of pigs so they can’t feel safe again, even in their own dreams”

Shortly before the attacks in Paris, the Islamic State had released a disturbing propaganda video showing what appears to be a footage of the attackers from Paris. Bilal Hadfi is shown with a prisoner kneeling at his feet, whom Hadfi then beheads

During the attacks in Paris, Hadfi attempted to enter the Stade de France to cause a lot of damage, but he blew himself up nearby after being denied entry

After Hadfi was identified as one who detonated bombs outside the Stade de France, online acquaintances began posting tribute messages on his profile : “Brother, we’ll never forget that Allah opened for you the door of paradise, Insha’allah”

His mother Fatima Hadfi Kaddour, contacted MaghrebTV shortly after the attacks and reported live about the situation of her son : https://bit.ly/3zKq4Ej. She depicted him as a “nice person”, who had been “stollen” to her. In the video, she is also seen speaking about her son that left to Syria, a few months before the Paris attacks

She also wrote a book, claiming the love for her son, and how he “really” was before all this started

Fatima Hadfi has an Instagram account and she posts a photo of her son from time to time, stating “I miss you”. For example, this one dates back to March 2021

She his connected to one of her other son on Instagram, Belkacem Hadfi. In his Instagram account, it can be seen that he visits Morocco from time to time. He also has a Linkedin account. He has been truck driver for a company located in Brussels

Belkacem Hadfi had been jailed in 2014-2015 for drug traffic

The uncle of Bilal Hadfi, Mohamed Loudghiri, has been also jailed after he attempted to join Syria in 2015. He claimed that he was going there to find his son who had left to Syria. He was kept in jail for some time : https://bit.ly/3F9gYEV

Ahmad al-Mohammad | Iraqi | Status : exploded near the Stade de France

Another bomber carried a passport belonging to a 25-year-old Syrian named “Ahmad al-Mohammad”. A passport-holder claiming to be a Syrian refugee with that name was registered in Leros in Greece in October 2015 upon his arrival from Turkey

Leros is a well know spot for migrants entry into Europe. Usually, upon arrival, migrants are being searched, photographed, fingerprinted and interviewed

In summer 2015, up to a thousand migrants a day were landing at Leros, and there was a lack of personnel and infrastructure : https://bit.ly/3mnxFnB

The dead attacker’s fingerprints matched those taken at the registration on Leros. French officials concluded that “Ahmad al-Mohammad” is probably a dead Syrian soldier whose passport was stolen and faked after he was killed in Syria

Having a Syrian passport is interesting for attackers as following the civil war in Syria, the Syrian passport provides a right of asylum

Islamic State identified him as “Ukasah al-Iraqi”, indicating that he was from Iraq. Ukasah al-Iraqi was born in Iraq to a Sunni muslim family, and he joined the Islamic State during the Syrian civil war. He took part in fighting against the Syrian Arab army, and he was selected to take part in a special operation in 2015, that led to the Paris attacks

This was later confirmed in January 2017 when a declassified French intelligence file identified the bomber as Ammar Ramadan Mansour Mohamad al-Sabaawi, an Iraqi in his twenties from Mosul. Islamic State is said to have paid al-Sabaawi’s family $5,000 and flock of sheep after his death : https://politi.co/3ot8K4I

He has several brothers : one former Saddam Hussein military, one being taxi driver in Mosul, and two others who are said to be active djihadists

Mohammad al-Mahmod | Iraqi | Status : exploded near the Stade de France

The third bomber has been matched with a photo on arrival papers at Leros belonging to a man travelling together with Ahmad al-Mohammad under the name of M. al-Mahmod

Like al-Sabaawi, the Islamic State identified him as an Iraqi and called him “Ali al-Iraqi“, but his true identity has never been determined

Together with Ahmad Al-Mohammad, he bought a ticket for a ship to the port city of Piraeus, from where he continued his journey through Europe until France

Proofs that he travelled from the Western coast of Turkey, through Kalymnos in Greece, to the port of Piraeus near Athens, can be seen in the reservation below

The ferry tickets used by the two Iraqi have been uncovered

The route to France taken by the two Iraqi has been quite common for 2015, following the Syrian refugee crisis : https://bit.ly/3mh3CxP

They have followed the flow of migrants and hidden among the other refugees. Here is the typical route

Here further informations about this route : https://bit.ly/3iovChF. It was certainly quite an ordeal for the attackers, but they managed to get through it

There has been many discussions about how easy it is to fake a Syrian passport. A Dutch journalist used some of the ways to get a fake passport, just to show that it’s possible without too much difficulties

There are Facebook groups that provide answers to refugees needs. Smugglers use these groups, having obtained genuine blank passports stolen from government buildings in Syria amid the chaos of its internal conflict, as well as the machines for processing them

All that is needed is a photograph to make them indistinguishable from the passports of real Syrians. Driving licences and identity cards are also on offer

For example, this refugees Facebook group, which is in Arabic, creates opportunities, both for migrants seeking help and smugglers looking for business

There have been also strong warnings from the US about the Islamic State capabilities to issue fake Syrian passports. You can see in this well documented video (jump to 30′)

Samy Amimour | French | Status : eliminated in the Bataclan

Samy Amimour was a 28 year old French from Drancy (near Paris). He was living in this building block near the Drancy city council

His family were migrants from Algeria. His father, Azdyne Amimour, has been seen several times in the media, including some interviews together with the father of a Bataclan victim. He also wrote a book with him (https://bit.ly/3uA19SK)

He currently lives in Liège (Belgium), is separated from his wife and daugthers, who are still located in Drancy. He runs a restaurant

His mother Mouna Amimour was active in the local associations. His sisters are Maya and Amel Amimour

Samy Amimour was frequenting the Tawhid mosque (https://bit.ly/3mlkdjZ), located in Le Blanc-Mesnil

He was not very successfull at school and failed two different trainings (law, supply chain). He then started a job at the RATP (public transport in Paris area). In this photo below, he is seen following his initial training at the RATP

In the meantime, he started to radicalize and followed the principles of the Salafism. He planned some potential trips to Yemen and Afghanistan, and from then on, was arrested and put in custody by the police, and went through some interrogations. He was released and placed under legal supervision with mandatory weekly checks at the Drancy police. His ID and passport were removed

He had learned the basics of firearms at ANTP – Association Nationale de Tir de la Police (this association is not in direct connection with the French Police, it is an independant association)

Then, in September 2013, Samy Amimour left France to Syria, to join the Islamic State

His family kept in touch with him via Skype. They also helped his wife Kahina el-Hadra to join him into Syria : https://bit.ly/2ZJPFkg, although he was under legal supervision. His sister Maya was placed in custody for this

During the contacts they had all together, his lethal intentions were becoming more clear

As the situation was deteriorating, his father decided to organize a trip to the Syrian border in the city of Minbej, to convince his son to come back to France : https://bit.ly/2ZURTxq

The trip there was quite an ordeal to organize, as shown on the map

But he could not get his son to agree to come back. In the coming months, Amimour was “trained” by the Islamic State, to kill, slaughter and bomb

This video is a very good summary about Amimour

Three days after the massacre, his wife Kahina el-Hadra, e-mailed a former professor in France saying: “Did the attacks shock you? LOL” before boasting that her husband had been one of the assailants

“I encouraged my husband to leave in order to terrorize the people of France who have so much blood on their hands […] I’m so proud of my husband and to boast about his virtue, ah la la, I am so happy” the emails uncovered by investigators said

In a further email, she tried to justify the action of the terrorists (in a very poorly written language)

She is said to be still living in Raqqa, Syria

When you see that the Amimour family helped Kahina el-Hadra to travel to Syria, one can have doubts about the whole family. Did they really try to prevent this tragedy ? The tweet below provides some controversy about this : https://bit.ly/3mlKMFN

Shortly after his death, Amimour has been buried in the graveyard of La Courneuve, where there is a muslim square : https://bit.ly/3l3kVDa

Abdelhamid Abaaoud | Belgian | Status : eliminated in Saint-Denis

Abdelhamid Abaaoud (8 April 1987 – 18 November 2015), also known by his two “nom de guerre” Abu Omar Soussi and Abu Umar al-Baljiki, was a Belgian-Moroccan Islamic terrorist, who had spent time in Syria. He was one organizator of the Paris attacks

As a child, he was admitted to an exclusive Catholic school, Collège Saint-Pierre d’Uccle, in an upscale residential district of Brussels

But he was thrown out of that school, either for poor grades or bad behavior

He was travelling to his grand parents location in Morocco on a regular basis. Here is a video of his neighbours in Ouled Tayma

Omar Abaaoud, his father, owned a clothing store off the market square in Molenbeek, a borough of Brussels, and the family lived nearby in a house on Rue de l’Avenir near the local police station

Omar Abaaoud is now said to be living in Morocco with his family

As a young man, Abaaoud had carried out a number of armed robberies, for which in went to jail in 2010. He radicalized in prison

This is were he had met Salah Abdeslam

Although he had not shown any religious zeal, Abaaoud moved to Syria in the beginning of 2014, and joined the Islamic State. He was also a very active recruiter of potential terrorists

Abaaoud persuaded his younger brother Younes Abaaoud, then 13, to join him in the territory under control of Islamic State

During the campaign of Aleppo, Abaaoud was filmed at the wheel of a pickup truck dragging a load of mutilated corpses following a mass execution committed by the Islamic State of Iraq and Syria, at a place called Hraytan

There was an international arrest warrant issued for his activities in recruiting individuals to Islamic terrorism in Syria. In the meantime, Abaaoud was preparing terrorists attacks in Belgium

At some point, Abaaoud and his network tried to fake his death. For this purpose, in the summer of 2014, a Twitter account under the name “the lover of martyrs”, published a list of killed fighters

Among the purportedly deceased Belgian fighters was Abu Umar al-Belgiki, that is Abdelhamid Abaaoud

By faking his own death Abaaoud was able to go off the grid for several months, giving himself the opportunity to prepare for the terror plots in Belgium and France

Security services had been alerted to Abaaoud’s return to Europe by a telephone call he made from Greece to his brother, Yassine Abaaoud, in a Belgian prison (he was serving a sentence because of robbery : https://bit.ly/3amWcU5)

This led to a major operation to intercept him. The French DGSE tried to catch him in Athens, unfortunately without success

A house for islamic militants, he had helped set up in eastern Belgium, was raided. There, two of his associates, were killed in Verviers

But it missed its principal target, Abaaoud, who then somehow made his way back to Syria

Abaaoud was an asset for Islamic State leaders eager to take their battle to Europe, as he had a pool of friends and contacts back home willing to carry out attacks. For his activities, he was interviewed by the Islamic State propaganda, Dabiq

There had been some preventive air strikes in Syria by the French army, trying to block some Islamic State training camps in Deir ez-Zor, where Abaaoud had been reported by Intelligence sources

Abaaoud was also wanted in Belgium, where he was sentenced in absentia to 20 years imprisonment for serving as an Islamic State recruiter and “kidnapping” his younger brother Younes

Abaaoud’s father, Omar Abaaoud, joined this state prosecutor’s case against his son, for having recruited Younes

Despite all this, Abaaoud could not be refrained from attacking in Paris. Here is a summary of all his whereabouts in the years before the attacks

This video provides an excellent summary of the important efforts spent to track down Abaaoud

The Paris attacks provide all the patterns of a complex plot involving a high level of planning and preparation

This was proven after the attacks in Brussels from 2016. A terrorist named Najim Laachraoui, had a laptop found in a trash can, full of important informations

Although much of the hard drive had been wiped clean, digital forensic analysis by the Regional Brussels Computer Crime Unit yielded a trove of new information :

• Laachraoui consulted with an IS bombmaker, to improve on the explosive recipe he had used to build the suicide vests worn by the Paris attackers
• A number of audio recordings were recovered, in which Laachraoui briefed a senior IS operative on every aspect of their attack-planning
• The terrorist cell communicated with IS in Syria via encryption apps, providing a link between the terrorist organization and the Paris and Brussels attack teams

When Belgian computer technicians examined the laptop, they faced several obstacles. The first was that much of the contents of the hard drive had been permanently deleted by the terrorists. The second was that the cell had at times made use of a widely commercially available full disk encryption software program – TrueCrypt – while working on the computer. The third was that the terrorists had used software to make themselves anonymous and to wipe away Internet traffic

The computer technicians analysis revealed the computer was first used by the terrorist cell on October 9th 2015, more than a month before the Paris attacks, with the last entry the day before the Brussels attacks. Examining WiFi connections, investigators also ascertained the laptop had been used at several of the safe houses used by the cell in Belgium, including a different apartment used to make bombs for the Paris attacks

The files metadata retrieved from files whose contents had been permanently deleted from the computer, revelead some of the targets followed by the terrorist cell :

• One of the files was titled “13Novembre” while another was titled “Targets” and a third was titled with the Arabic word for explosives and appears to have contained information on TATP, the homemade explosive triacetone triperoxide, which has been used in terrorist attacks
• The file titled “13Novembre” was accessed between November 7 and November 11, 2013, revealing the attack date had by then been selected and divisions of labor clinically allocated

Najim Laachraoui has been found to be the builder of the bomb belts used by the attackers

Now let’s review what happened after the Paris attacks

Striking details on Abaaoud’s whereabouts during the attacks in central Paris have been provided. He was caught on videos on the Paris Metro heading to the areas of the shootings where he spent two hours, including near the Bataclan concert hall, according to data collected from his mobile phone location

The presence of Abaaoud in the immediate vicinity of the attacks provides an indication of his degree of implication in the supervision and control of the plot and suggests he was giving direct orders and instructions to his team inside the Bataclan during the shootout

A discarded cellphone found near the Bataclan concert hall, helped find him, as he was preparing further attacks in Paris La Défense

The phone had contact information for Abaaoud’s 26-year-old cousin, Hasna Ait Boulahcen

In fact, Abaaoud had established contact with her and they were hiding in a flat in Saint-Denis

Boulahcen was closely monitored by the Police. One of her relative, a so called Sonia, called the French DGSI to tell them she knew about the location of Abaaoud and Boulahcen

As a result, the Police raided the flat. Both she and Abaaoud were killed as heavily armed SWAT teams raided the apartment in Saint-Denis

When it comes to Younes Abaaoud, his current situation is unclear. According to some sources, he may have died in Syria : https://bit.ly/2YIeuge

But after the Paris attacks, some people posted on Facebook that he would be trying to come back and revenge his brother

And when it comes to Yassine Abaaoud, he had tried to go to Syria, but was arrested in Turkey and sent to Morocco. A Moroccan court sentenced him to two years in jail on terrorism-linked charges : https://bit.ly/3p0PVWX

Chakib Akrouh | Belgian | Status : exploded in Saint-Denis

Chakib Akrouh, a 25-year-old Belgian citizen of Moroccan descent, was a resident of Molenbeek. His father Farid El Khattabi still lives in Molenbeek

Journalists from RTL Info and France 3 had been molested outside of his flat, during an investigation, by the brother of Akrouh and one room mate

Akrouh started to radicalize when he was frequenting the mosque Loqman, a small underground mosque where he started his acquaintance with a recruitment network, the Zarkani network : https://bit.ly/3CRx97I

This mosque was closed after a strong suspicion of radicalism

Akrouh had left Belgium to Syria in January 2013, through Turkey, using a fake identity

There, he joined the Islamic State and got trained, but also killed opponents and hostages

He was using the nom de guerre Abu Mujahid al-Baljiki

Because of all this, he was well known by the Police. In 2014, an international search warrant was issued against him. A court in Belgium had sentenced Akrouh to five years in jail in absentia in July 2015, in the case linked to the jihadist recruitment network sending fighters to Syria

He was one of the Kalashnikov gunmen who sprayed restaurants and cafe terraces with bullets, killing dozens of people. Together with Abdelhamid Abaaoud, he had left the location of the attacks, using the Paris Metro. The CCTV surveillance led to his identification by the Belgian authorities

He blew himself up during the Saint-Denis police raid that occurred five days after the Paris attacks. Akrouh was not identified until the 15th January 2016

Ismael Omar Mostefai | French | Status : eliminated in the Bataclan

Omar Ismail Mostefai was a 29-year-old Frenchman, of Algerian descent. He grew up in the Paris suburb of Courcouronnes, but was living in Chartres before living to Syria

His father is Mohammed Mostefai and his mother Lucia

In Courcouronnes, he was student at the Lycée Georges-Brassens. He was a difficult student

Initially, he was known by the Police for several petty crimes :

• drug traffic
• driving without a valid licence
• robbery
• acts of violence

He was put in custody several times but he was not jailed. His parents decided to move from Courcouronnes to Chartres, because of the difficult situations of Mostefai with some local gangs

He was a frequent visitor of the local mosques in Chartres (Lucé, and the great mosque of Chartres). He is said to have started his radicalization there

But, what triggered the attention of the Police was that Mostefai was seen several times with Abdelilah Ziyad, a Moroccan who was jailed 8 years in France, for his preparation of the terrorist attacks of the Asni hotel in Marrakech, in 1994 (https://bit.ly/3lsvUpS). After his release, he had turned into a radical preacher

The preacher was working during some time in the Troyes mosque, as can be seen in this video. He was dismissed as he was hiding under a false identity. Nobody seemed to know about his ambiguous past

As a consequence, in 2010, the French authorities had put Mostefai on a database as a suspected Islamic radical

He started to travel to Syria in 2013, through Turkey, and joined the Islamic State in Syria

It is said that the Turkish authorities warned the French Police twice about Mostefai whereabouts : https://bit.ly/3mGeDsD

Within the IS, Mostefai war name was Abu Rayyan al-Faransi

In the Islamic State propaganda, he is seen beheading a victim

Shortly after the attacks, his brother, located in Bondoufle, south of Paris, declared that he did not have contacts with him since 2 years, and qualified his acts as “horrible” and “unforgiving”. Mostefai father and brother were put in custody for a few days during the investigations

His brother was challenged by the Police and some journalists, as during the attacks, he was attending a show from the controversial Dieudonné (a former comic, who has been accused of anti-semitism, among other claims)

Mostefai is burried in the cemetery of Thiais, south of Paris : https://bit.ly/3BtWfJT

His parents are located in Romilly-sur-Seine, where they visit frequently the local mosque

They built a house where they live with the rest of the family. They are located only 40 kms from where Abdelilah Ziyad was preaching, in Troyes

Foued Mohamed-Aggad | French | Status : exploded in the Bataclan

Foued Mohamed-Aggad was a 23-year-old Frenchman, his father Said Mohamed-Aggad being from Algeria and his mother Fatima Hajji being from Morocco

The mother had raised two brothers – Foued and Karim -, and a sister Kenza, on her own. She had divorced from her husband about 10 years before the attacks in Paris

Aggad was living in Wissembourg near Strasbourg. His mother currently lives in this house located in the center

In 2013, he was seen on some Facebook videos, playing with his nephew around Strasbourg

He tried to join the French Army or Police, but he did not succeed. He followed a girlfriend in the city of Toulouse and found a job as a construction worker. He contributed to the construction of this building

In Wissembourg, he was frequenting the local mosque, nearby the Turkish cultural center

At that time, he did not show strong signs of radicalization

It is said that he started his radicalization through contacts made with Mourad Farès on Facebook

Mourad Fares had played a decisive role in recruiting young Frenchmen for Jihad in Syria unitl his arrest on August 16th 2014 in Turkey

He had been interviewed at length by the Vice online newspaper : https://bit.ly/3lNvw5n

He had used several names on Facebook : Abu al Hassan, Abu Rashid

He was issuing propaganda videos and went to Syria. He has been jailed for 20 years in France

With the influence of Farès, Aggad left to Syria in 2013 together with a group of ten other guys located in the Strasbourg area, including his brother Karim. Some died in Syria, but most of them returned to Strasbourg, except Aggad who did not return with them

A police raid occured in the Strasbourg suburb of “La Meinau“, to catch the men returned from Syria

In the meantime, Aggad was very active in Syria. His family helped him to survive by providing money (a few thousand dollars were sent from France). Hadjira, a young girl from Strasbourg, had joined him in Syria in March 2014, and married him there

She had given birth to a baby girl in August 2015

On Facebook, Aggad wrote on a number of successive accounts, under variants of the name Abou Foued Al-Muhajir (“the immigrant”). His account was popular and was followed by hundreds of other jihadi fighters or supporters

In another Facebook post, Aggad stated: “I am just a soldier among many that have joined the ranks and await martyrdom.”

He was also in contact with his mother and mentioned his future martyrdom. In fact, Aggad had told his family months ago, that he was going to be a suicide bomber in Iraq and had no intention of returning to France

Aggad was flagged as a radical by the French police and he was also followed by Interpol

He started to gain importance in the Islamic State, with a prominent role

He was spotted by the US led coalition, and on the 8th September 2014, there had been a drone attack on him in Raqqa

It is important to remind that the drone strikes against IS where at a climax at this time, especially in Raqqa : https://bit.ly/3lM6tje

There is a very interesting British report, “the drone war“, about drone eliminations in the region. The British made several attacks “a strike at the heart” of Islamic State, and had expended big efforts to intercept and decipher any encrypted messages that might reveal the location of the djihadis : https://bit.ly/3EvK3ci

Before the Paris attacks, Aggad was communicating with some people in his French network, that “something big” would happen : https://bit.ly/3vjaY7U

In the aftermath of the Paris attacks, Hadjira informed Aggad mother about his death

“Your son died as a martyr on November 13th” said the text message received by Aggad’s mother on November 30th 2015. His widow, Hadjira, sent the text from Syria

“I want to know where he died,” Fatima replied. “With his brothers in Paris” Hadjira answered

Fatima Mohamed Aggad notified the French police. This led to the identification of Aggad and the police could conclude he was one of the Paris attackers

“What kind of human being could do what he did?” his father said. He is interviewed here in front of his house

Aggad brother, Karim, was sentenced to nine years in jail in 2017, for his participation to the Djihad in Syria : https://bit.ly/3BPKsFV

Hadjira, his wife, is supposed to have died in 2018 with her baby, during a bombardment

The rest of the family was put on custody several times in the last years, and again in 2021, the police raided the family house because of further evidences that they had financed a part of his living in Syria

The sister Kenza Mohamed Aggad is on Linkedin and in the past, she was service agent

Kenza Aggad is married with Mohamed Hattay, one of the ten guys who flew to Syria with Aggad in 2013 (full detailed article here : https://bit.ly/2Z4L3Fn). He is currently serving a nine years prison sentence

Salah Abdeslam-Faklan | French | Status : facing trial in Paris

Salah Abdeslam was born the 15th September 1989, and is a Belgian-born French national of Moroccan descent

He is accused of involvement in the Paris attacks, helping the attackers to move from Syria to Belgium, and then Paris, and actually participating to the attacks. As such, he is said to be the Logistician

He was supposed to explode himself near the Bataclan, but his explosive belt may have been faulty. After the attacks, he managed to travel back to Belgium, with the help of some accomplices

There is a full step by step story here (highly recommended) : https://bit.ly/3BQAK5Y, so I’m not going into all details

He was grown up in Molenbeek, a suburb of Bruxelles, known for its high Muslim population

His parents and some part of his family, leaved in this flat with financial incentives from Molenbeek, until 2016

His parents were running some shops. He started to work as a transport agent, but was fired because of his numerous absences

His sister Myriam Abdeslam-Faklan was working for the Molenbeek city council, as can be seen in the records of Molenbeek city : https://bit.ly/39HOOlK

Abdeslam started some robbery and petty crimes : https://bit.ly/3FWhExE

With his brother Brahim Abdeslam, he was running a bar where they were doing some drug traffic

One of his childhood friends was Abdelhamid Abaaoud

But unlike Abaaoud, Salah Abdeslam and his brother Brahim Abdeslam, did not have a long history of religious extremism. They did not follow the strict directives of radical Islam, and preferred to spend time smoking pot, playing video games and going to clubs

Unlike other attackers, Salah Abdeslam may have never visited Syria

But he started to have stronger ties with Abaaoud months before the Paris attacks. He started to prepare the attacks using Facebook : https://bit.ly/3kGE51B, and was instrumental in the organization of the attacks by planning most of the Logistics (car and hotel rental,…)

After the attacks, he flew to Bruxelles. He wrote several letters to his family, praying for his actions : https://bit.ly/3ATX3ak

Here is a good summary video together with the details of his arrest in Bruxelles, where Abdeslam was hiding

Abdeslam was hiding in a flat located ” 79 rue des Quatre Vents” in Molenbeek, that his aunt Djamila Mohamed, was renting from the Molenbeek City Council

Therefore the role of the whole Abdeslam family has been critized

The Molenbeek City Council decided to terminate the apartment lease that was granted to Djamila Mohamed. It is quite amazing to see that this flat is in the same building block as some Molenbeek City facilities, as can be seen on this picture

Tense scenes had broken out between locals and security forces in Molenbeek following the arrest of Salah Abdeslam, with some Muslim residents reportedly “praising” the evil Paris terrorist

Riot police were called in to disperse the crowds who gathered in the Brussels suburb after objects such as bottles, were thrown at the Belgian authorities

Abdeslam is currently facing his court trial, and in the meantime, he his retained in a very secure area of the Fleury Merogis prison in the south of Paris

His sister Myriam Abdeslam does not show any empathy for the victims, but says she still loves her brother in this interview : https://bit.ly/3AJJeez

She should join the trial in Paris starting the 13th January 2022, but so far refuses to go there for “safety reasons”

To be noted, Abdeslam received a letter from Dieudonné, who proposed to meet him to “understand” his actions : https://bit.ly/3j9a6ho

Brahim Abdeslam-Faklan | French | Status : exploded near boulevard Voltaire

Brahim Abdeslam was the brother of Salah Abdeslam

He hаd bееn a troublemaker whеn hе wаѕ young, attracting thе attention оf thе police аnd serving twо prison sentences fоr theft, оnе fоr thrее months аnd оnе оf ѕix months

Hе wаѕ a qualified Electrician

He got married in 2006 with his wife Naima Abdeslam, but the couple split in 2008 after two years of marriage and officially divorced in 2013

He was said to be lazy, spending his days smoking cannabis and drinking alcohol

He never went to a mosque

He opened the bar called Les Beguines (as seen above), but it was the location where he drugged himself and sold drug

Eventually the bar came to the attention of the police. The mayor of Molenbeek ordered the closure of the bar

Brahim Abdeslam, in close relationship with his brother Salah Abdeslam and Abdelhamid Abaaoud – who were managing a Djihadi recruitment network -, joined the Islamic State in Syria

He is seen in this IS propaganda video, threatening the former French President, François Hollande. The terrorists were determined to strike France

Like the other attackers, Abdeslam went back to France to execute the terrorist plot

He died in the bar Voltaire in Paris, after detonating his suicide bomb belt. In the below photo, he is seen actually detonating the explosive, a few fractions of a second before he dies

His funeral was in Molenbeek

At the cemetery, the police was here and took pictures of the family members

We see the cousin of Salah Abdeslam on the left – Abid Aberkane -, and Mohamed Abdeslam on the right – another brother of the family

In the meantime, Salah Abdeslam was hiding in the flat of Djamila Mohamed, the mother of Abid Aberkane. In the previous days of the funeral, Aberkane was instrumental to help hide Salah Abdeslam

The presence of Aberkane at the funeral and the monitoring of some phone calls he made to Salah Abdeslam in the previous days, led the police to the exact location of Salah Abdeslam

The phone of Brahim Abdeslam was recovered. The police analyzed the phone and found miscellaneous informations : https://bit.ly/39FEniG

A further analysis proved that he was in contact with Abdelhamid Abaaoud as early as 2014, talking about Djihad and assassinations : https://bit.ly/3lNo9eb

Mohamed Abdeslam-Faklan

Mohamed Abdeslam is the brother of Salah and Brahim Abdeslam. In the above picture, he is seen with Dieudonné, which we have already seen above in the dramatic story

When he was younger, he was arrested because of a sordid story. He was employed by an ambulance company but was robbing the dead people. He was sentenced to 2 years in prison (with probation) : https://bit.ly/3kEN1UY

Despite this situation, he was working for the Molenbeek City Council

After the Paris attacks, he was interviewed by the media. He was saying that no one in the family ever had any issue with the justice (absolutely not true)

He made further controversial declarations about his brother Salah Abdeslam, trying to minimize his terrorist acts, and because of this, he was fired from the Molenbeek City Council : https://bit.ly/3AILCCw

In 2018, he was jailed 30 months after stealing his former employer, using his knowledge of the offices, threat and violence : https://bit.ly/3AU5um0

Conclusion

By using some basic OSINT techniques, we have been able to build the profile of each attacker and some of their relatives. We have also noticed some of the following items :

• Jihadi networks are structured and large. Their active monitoring requires significant resources
• Jihadi networks have the support of their local community
• The networks are often built around families who are radicalized and the relations to their relatives are often ambiguous
• Jihadi networks are often linked to criminal organizations and drug traffic
• They are able to use many technics to stay invisible : false papers, encrypted communications, deletion of forensics traces, accomplices and logistics network, manipulation of informations,…
• Social networks (Facebook,…) are used as a propaganda vector and shall be monitored to detect threats upfront, together with classical methods of surveillance (phone conversations interception, electronic devices forensics…)
• The media may give voice to djihadi and their families, and relay biased messages unwillingly
• Jihadi take advantage of the migrants flow to infiltrate western countries
• The migrants flow shall be kept under control with proper identification technics (facial recognition,…) and a central database shall be maintained
• Intelligence services shall work in close cooperation with the countries of residence of the djihadi, for deterrence and coordinated actions of force if necessary
• The use of drones has to be considered in extreme cases for directed eliminations