Terrorists and extremists are creating growing numbers of safe havens on the “dark net” to plot future attacks, raise funds and recruit new followers, new research reveals.

Terrorist organisations and individuals are evading security services and intelligence agencies by “hiding in the shadows” of the darknet, using encrypted messaging services, to communicate and anonymous cryptocurrencies such as bitcoin to generate funds.

Researchers for the Henry Jackson Society, a foreign policy thinktank, say that groups have also been able to create a reservoir of extremist propaganda, saving it from deletion by the security services or tech companies.

Following the five terror attacks on British soil in 2017, the UK government has dedicated more time and funds to tackling online extremism, yet the report argues that more attention should be paid to the dark net because extremists are still able to operate unchallenged on the anarchic platform.

Researchers said that the current encrypted communication app of choice is Telegram, which Islamic State has encouraged members to use, with messages including explanations on how to access new dark net sites linked to the group. In November 2017, an al-Qaida-linked organisation called al-Sadaqah used a public channel on Telegram to campaign for bitcoin funding.

The report’s author, Nikita Malik, director of the centre for the response to radicalisation and terrorism at the Henry Jackson Society, said: “We have denied Islamic State territory in the real world, but it has a whole new safe haven in cyberspace which we need first to understand and then to close down.

“The authorities must move urgently to increase their knowledge of terrorists’ activities in cyberspace and their use of technologies such as bitcoin. Regulation in this area has to move carefully if we are to balance liberties with guarding against threats to our security – but the time has come to deny extremists the space they need online to plan fresh atrocities.”

Malik identified numerous sites on the dark net that explain how to make TATP – triacetone triperoxide – which can be made from household chemicals and was used in the jihadist attacks in Paris in November 2015, Brussels in March 2016, Manchester in May 2017 and Parsons Green, London, in September 2017.

One study last year found that of 811 arms-related listings on 24 darknet cryptomarkets, 208 were ebooks with instructions for the manufacture of explosives or firearms at home.

A preliminary search on the dark net on 18 January by Malik found 1,101 results for instructional material related to “security”, including guides on drugs, fraud, hacking, and firearms. The Anarchist Cookbook, which contains bomb-making instructions, was available for sale for 0.0003 bitcoin – around £1.45.

Other focal points for discussion on darknet forums included “how to make bombs, plan lone-actor terrorist attacks … how to use vehicles as weapons, where to stab people for maximum effect, and how to create a fake suicide vest or mask their activity, with the aim of convincing potential recruits to undertake their own attacks.”

Lord Trimble, a current member of Parliament’s joint committee on the national security strategy and former first minister of Northern Ireland, said: “While the first decade of the century was defined by the battle against jihadist ‘safe havens’ – physically located in Afghanistan, north-west Pakistan, Yemen and so on – this report draws attention to the possible rise of ‘virtual safe havens’: encrypted communication channels, hidden portions of the internet, cryptocurrency accounts that are not registered with any banks and more.”

Labour’s shadow spokesperson for digital, culture, media and sport, Lord Griffiths of Burry Port, said: “This is a deeply disturbing report, illustrating how extremist content and instructional terrorist material, as well as funding campaigns to raise money for terrorist groups, can be found on the internet – with varying degrees of accessibility.”

The report’s recommendations include a new internet regulatory body with the role of scrutinising tech companies’ efforts to remove extremist content, along with extra resources for the Joint Terrorism Analysis Centre to accrue darknet intelligence.

It also advocates that social media firms should ensure extremist material is not lost when it is deleted, but is archived to help develop a better understanding of extremists’ online behaviour.