UN: Terrorist propaganda is now operational infrastructure
A new United Nations assessment shows how propaganda has moved beyond messaging to support recruitment, financing, governance and operational planning.
The United Nations Security Council Counter-Terrorism Committee Executive Directorate (CTED) has issued a warning about the changing function of terrorist propaganda. Its September 2026 Trends Report, Beyond messaging: terrorist propaganda as operational infrastructure, argues that propaganda is no longer simply communications content produced around terrorist activity. It is part of the infrastructure through which groups organise, finance and sustain operations.
Governments and technology companies have spent much of the past decade improving detection, removing accounts and disrupting distribution. Terrorist organisations have responded by spreading activity across social media, smaller platforms, encrypted services, gaming environments, file-sharing systems and websites under their own control. Removing a post or channel may interrupt distribution. It rarely dismantles the network that created it, the community that circulates it or the grievance that gives it force.
CTED examines how propaganda is created, how it is distributed and what makes it effective. Its central finding is that success depends less on production quality than on persistence, proximity and volume. Propaganda enters spaces in which people feel excluded or unheard, validates those perceptions and supplies an explanation that no credible alternative voice contests.
Artificial intelligence lowers the barrier
Artificial intelligence increases the speed, scale and precision of this activity. Generative tools can produce propaganda, translate it, tailor it to particular grievances and amplify it through automated accounts. They can also sustain personalised exchanges with vulnerable users. CTED raises the possibility that AI may become a radicalisation environment in its own right: a private interaction that reinforces beliefs while remaining largely invisible to conventional monitoring.
The report records experimentation across ideological lines. Da’esh supporters have used AI-generated video programming and translation. Accelerationist networks have used generative systems for memes, ideological interpretation and potentially operational information. AI does not create terrorist intent by itself. It reduces production costs, allows small networks to communicate as if they were larger organisations and compresses the time between an event, a narrative and a targeted response.
Propaganda is also converging with finance. ISIL-K has placed cryptocurrency addresses and QR codes inside its publications. Similar digital ecosystems turn ideological affiliation into donations, distribute payment instructions and establish the trust on which dispersed financing depends. This is an important analytical shift: a publication, video or channel may be simultaneously a recruiting asset, a fundraising mechanism and an operational node.
The audience and the environment are changing
Gaming platforms and services including Discord, Twitch and Steam combine community, live conversation, payments and semi-private spaces. Extremist actors can use modified games, visual language, competitive features and peer groups to make their material participatory. Moderation is uneven, particularly on smaller platforms and in less widely supported languages. In Africa, where CTED cites roughly 350 million gamers, rapid growth, mobile payments and limited investigative capacity present a substantial emerging exposure.
Children and young people are central targets. Recruiters meet them in familiar cultural spaces and move them gradually from open platforms into closed groups carrying more violent material. CTED also identifies youth-on-youth recruitment. Gender shapes the approach: boys may receive narratives built around status and hypermasculinity, while girls may be targeted through belonging, protection, identity and relationships.
The content itself is becoming less ideologically coherent. Gore communities, mass-shooter culture, violent misogyny, antisemitism, conspiracy theories, jihadist material and neo-Nazi accelerationism can coexist within the same online journey. For some younger participants, CTED finds that attraction to violence, spectacle and identity may precede a settled ideology. This challenges systems built to identify membership of a defined movement. The threat may instead emerge from a fluid collection of grievances, symbols and violent reference points.
Propaganda reveals how groups intend to operate
The regional analysis shows why “infrastructure” is justified. In the Sahel, JNIM documents state violence or absence, publicises its provision of food, courts and protection, and frames retaliation as defence of aggrieved communities. Al-Shabaab presents governance as evidence of state-like capacity. ISIL-K attacks the legitimacy of Taliban rule and tailors multilingual material to minority and diaspora audiences. TTP combines religious narratives with Pashtun identity and local grievance.
These are not campaigns added after operations. Communications, governance and violence form a cycle. Groups choose targets partly for media value, prepare material for rapid release and use propaganda priorities to signal where they want recruitment or expansion to move next. Rivalry can increase operational tempo and propaganda output as groups compete for authority.
The acceleration gap
CTED describes a widening “acceleration gap”. Terrorist actors can change tools, languages, platforms and narratives quickly; legislation, regulation and institutional coordination move slowly. National bans often displace activity without reducing it and may strengthen claims of state censorship. Automated moderation adds reach but remains weak on context, language and culture.
The answer is not unrestricted surveillance or indiscriminate removal. CTED stresses that counter-terrorism measures must remain lawful, necessary and proportionate. Broad restrictions can suppress journalism, civil society and legitimate dissent, deepen distrust and reproduce the grievances that terrorist organisations exploit.
The practical implication is that states, platforms and exposed organisations must analyse propaganda as a system rather than a stream of objectionable content. Communications intelligence must connect with financial intelligence, threat assessment, safeguarding and local knowledge. Signals should be assessed across platforms and languages, alongside changes in fundraising, governance claims, target selection and community grievance. The contest is no longer simply over messages. It is over the infrastructure that converts attention into trust, affiliation, money and action.