Saw a lot of speculation about what ISIS does or does not do without actual links. Here are a few good ones I've seen in the past:

https://www.wired.com/2015/11/isis-opsec-encryption-manuals-...

This podcast was pretty good. ISIS were using a Turkish Dropbox like service to move files ... except the service was actually based in France, something a whois on the domain could have easily detected. Fighters have also geotagged tweets/instagram/Facebook posts, which led to a drone strike:

https://gimletmedia.com/episode/62-decoders/

So ... they're both more sophisticated than you think when it comes to opsec. And less sophisticated than you think when it comes to opsec.