you should think about ISIS (and Al-CIAda) as more of a franchise than a stable organization with clear organizational structure.
The term "false flag" originated in the 16th century as an expression meaning an intentional misrepresentation of someone's allegiance https://en.wikipedia.org/wiki/False_flag
Let us take a completely fictitious example. A private military company is paid to secure oil wells in Syria by some oil billionaire. It deploys in Turkey with patches of PMC and crosses the border into syria. And then changes patches to ISIS and secures an oil well and starts extracting oil and selling it to Israel through Τurkey. Of course, money from this operation is laundered through the Caribbean offshore accounts.
What is ISIS going to do ? Tell the world, this is not ISIS ? We did not sell them franchise rights ? They are not going to attack PMC because PMC has an air cover from drones that are flying from Persian Gulf states or israel. And to everybody, that oil well is under control of ISIS. After all, they do have patches of ISIS and flag. Then, they are obviously ISIS...
PMCs have sometimes side hustle. They are LARPing as ISIS or Al-CIAda. And are sometimes paid to play that part. Also, no responsibility under law for their actions.
Additionally, US special ops and UK SAS and SBU are using uniforms and flags of ISIS and Al-CIAda when they operate inside their territory. A false flag operation is an act committed with the intent of disguising the actual source of responsibility and pinning blame on another party.
It means that ISIS is more of a make believe organization than an actual organization. ISIS is a false flag operation of Israel and US/UK intelligence and is run by them.