A predawn attack on a French policeman’s home, the killing of a priest during Mass and a car bomb planted near Notre Dame Cathedral in recent months were plots that appeared isolated until investigators discovered a common thread.
Their authors had all allegedly been in contact with a man whom authorities identify as 29-year-old Rachid Kassim.
From somewhere in Islamic State-held territory in Iraq or Syria, authorities say, the French national had used the encrypted Telegram chat app and other social-media tools to contact people back home—mainly French teenagers who are believed to have little or no previous connection to the terror group or each other—and instruct them on how to mount attacks.
Investigators across Europe are alarmed by the rise of militants such as Mr. Kassim, who they suspect have developed a way to “remote control” attacks from far away. That is blurring the lines between assaults carried out by militants trained in Islamic State territory and those by so-called lone wolves who authorities assumed were acting without the direction or support of terror groups.
“What worries us is a new type of attacker who only appears to be acting alone,” said Hans-Georg Maassen, head of Germany’s domestic intelligence. “Such assailants are being steered virtually from abroad via instant messaging.”
The recent unfurling of terror plots allegedly directed by Mr. Kassim in France have sent investigators scrambling to trace the militant’s internet footprint, seizing the phones of attackers and poring over communications that were previously hidden by encryption.
Followers of Mr. Kassim’s private channel on Telegram received instructions in mid-August on how to buy cooking-gas canisters for a car bomb, according to a copy of the channel’s content provided to The Wall Street Journal by a person with access to it. The content was confirmed by French authorities.