Full Report
Three domestic terrorism plots. Three ideologies. One weapon. Since late 2024, plots planning to attack a Pride parade, Nashville’s power grid, and the UFC Freedom 250 event at the White House have shared nothing except their weapon of choice. Domestic violent extremists across the ideological spectrum are adopting drones as a weapon for their plots,…
Analysis Summary
# Tool/Technique: Weaponized Unmanned Aircraft Systems (UAS)
## Overview
The use of commercial or hobbyist drones modified to carry and deploy Improvised Explosive Devices (IEDs). This technique involves utilizing the mobility and aerial perspective of drones to bypass traditional ground-based physical security measures to target critical infrastructure and public gatherings.
## Technical Details
- **Type**: Physical Attack Tool / Kinetic Delivery System
- **Platform**: Hardware (Commercial-off-the-shelf UAS, e.g., DJI, Skydio, or custom FPV drones)
- **Capabilities**: Aerial surveillance, remote payload release, precision kinetic targeting, and standoff delivery of explosives.
- **First Seen**: Emerging trend in domestic plots identified in late 2024; techniques imported from foreign conflict zones (Ukraine, Middle East).
## MITRE ATT&CK Mapping
*Note: As this is a physical/kinetic threat, mappings refer to the preparation and "left of bang" digital activities or the Physical Security equivalents.*
- **[TA0042 - Resource Development]**
- **[T1587 - Select/Acquire Infrastructure]**: Purchasing commercial drones and explosive components.
- **[TA0007 - Discovery]**
- **[T1595 - Active Scanning]**: Using drones for pre-operational surveillance of targets (e.g., Nashville power grid).
- **[TA0040 - Impact]**
- **[T1491 - Non-Executable Property Damage]**: (Physical world equivalent) Destruction of property and critical infrastructure.
## Functionality
### Core Capabilities
- **Aerial Payload Delivery**: Transporting explosive materials to specific GPS coordinates or visual markers.
- **Remote Detonation**: Initiating an explosive charge from a distance using the drone's control frequency or a separate trigger.
- **Surveillance**: Real-time video transmission to identify security gaps or high-density crowds.
### Advanced Features
- **Explosive Loading**: Integration of improvised "drop mechanisms" or "kamikaze" configurations where the drone itself acts as the delivery vehicle.
- **Bypassing Perimeter Security**: The ability to fly over fences, checkpoints, and traditional physical barriers.
## Indicators of Compromise
- **File Hashes**: N/A (Physical hardware focused).
- **File Names**: N/A.
- **Registry Keys**: N/A.
- **Network Indicators**:
- Unidentified 2.4 GHz or 5.8 GHz radio frequency signals in restricted airspaces.
- Uplinks/Downlinks to unauthorized ground control stations.
- Communication with known drone manufacturer update servers from suspicious locations.
- **Behavioral Indicators**:
- Repeated "probing" flights near critical infrastructure (e.g., electrical substations).
- Modifications to drone firmware to bypass "No-Fly Zone" (NFZ) restrictions.
## Associated Threat Actors
- **Domestic Violent Extremists (DVEs)**: Including White Supremacist groups (Tennessee plot).
- **Homegrown Violent Extremists (HVEs)**: Individuals inspired by foreign terrorist organizations like Islamic State (Arizona plot).
- **Unknown Ideological Actors**: Participants in the UFC Freedom 250 plot.
## Detection Methods
- **Radio Frequency (RF) Sensors**: Monitoring for the specific control and telemetry signals used by commercial drones.
- **Acoustic Sensors**: Identifying the unique sound signatures of multi-rotor propulsion systems.
- **Radar**: Utilizing specialized low-altitude radar to detect small-form-factor aircraft.
- **Visual/Thermal Analytics**: Using AI-enabled cameras to detect and track drones in protected airspace.
## Mitigation Strategies
- **Counter-UAS (C-UAS) Systems**: Deployment of signal jammers (electronic mitigation) or kinetic interception tools.
- **Physical Hardening**: Installing netting or overhead protection at critical substations and power grid nodes.
- **Geofencing**: Working with manufacturers to enforce software-based "No-Fly Zones" around sensitive government sites.
- **Regulatory Oversight**: Strengthening "Know Your Customer" (KYC) requirements for high-payload commercial drones and components.
## Related Tools/Techniques
- **FPV (First Person View) Loitering Munitions**: Highly maneuverable drones used for precision strikes.
- **IED (Improvised Explosive Device)**: The traditional payload adapted for aerial delivery.
- **Swarm Technology**: The coordination of multiple drones to overwhelm defenses (emerging threat).