Transnational crime organizations and terrorist groups such as, ISIL use social media in a highly sophisticated and coordinated manner to disseminate their propaganda. Various social media platforms, such as Twitter, YouTube, Facebook, ask.fm, Tumblr, etc. are used by ISIL to recruit, radicalize, and raise funds. By doing so, they have more control on their messages and more assurance that their messages (text, photo, or video) reach many people instantly. Here, we study ISIL’s social media activity (propaganda messages, recruitment messages, etc.) and model their sociotechnical behavior as a manifestation of a deviant cyber flash mob (DCFM) behavior.We operationalize our conceptual model for analyzing DCFM, demonstrate the model’s applicability to real-world setting, evaluate the research using Twitter data, and in doing so, highlight the challenges, contributions, and broader implications of the work. The findings of the research reveal a strategic choice of platforms used by ISIL’s top disseminators for propaganda dissemination. Further, the network activity of ISIL’s top disseminators reflect a well-coordinated organization with designated roles for outreach and intra-organization communications.