Abstract: The Vienna Taylor Swift concert plot highlights an alarming trend of Islamic State-inspired teenage jihadis targeting events to inflict maximum casualties and attract widespread media attention. The plot also underlined that Islamic State Khorasan (ISK), which appears to have inspired the lead plotter, remains an enduring threat, evolving its tactics and strategy while focusing on radicalizing followers and supporters through relentless online propaganda. The suspects in the Vienna plot epitomized the interplay of online and offline radicalization, with extremist content on social media platforms like TikTok playing a pivotal role. Influential salafi preachers use pop culture references as an on-ramp for more radical content, specifically targeting youth. Austrian authorities, supported by international intelligence agencies, disrupted the plot, which aimed to use vehicle ramming, knives, and explosives. The arrests underscore the importance of transnational intelligence cooperation and advanced surveillance techniques in counterterrorism efforts. The global terrorist threat landscape indicates that increasingly shifting resources away from counterterrorism to strategic competition will come at a cost.
Concerts and large public gatherings have, over the course of the past decade, become increasingly vulnerable targets for terrorist attacks and mass shootings. On November 13, 2015, Islamic State terrorists attacked multiple locations across Paris, including the Bataclan Theater, resulting in approximately 130 fatalities.1 Similarly, in May 2017, an Islamic State-inspired suicide bombing at an Ariana Grande concert in Manchester2 claimed the lives of 22 people. Just four months later, a lone gunman killed 60 attendees when he opened fire at a Las Vegas music festival, and although the Islamic State made a rare false claim of responsibility, no links were ever established, and the incident was not deemed an act of terrorism.3
On March 27, 2024, Islamic State Khorasan (ISK) carried out a terrorist attack on a sold-out concert at Crocus City Hall on the outskirts of Moscow, the deadliest incident in Russia in nearly two decades, with at least 143 casualties.4 Throughout the spring and summer of 2024, ISK encouraged its followers in online posts to target large gatherings at stadiums in London, Madrid, and Paris, including events such as the 2024 Paris Olympic Games,5 high-profile soccer matches during the UEFA European Championship in Germany,6 UEFA Champions League games,7 and other gatherings including crowded concerts.
This article begins by examining the particular dynamics of the plot in Vienna targeting the Taylor Swift concert. The alleged perpetrators were seeking to conduct a mass casualty attack at the concert venue, eerily reminiscent of the Islamic State-inspired Manchester Arena attack. After laying out the specific details of the plot, the article focuses on the importance of information sharing and intelligence cooperation between allies, which was essential to preventing the attack. It then analyzes the attack tactics of the plot, looking at some tactical similarities with previous European plots and attacks. Next, the article provides an overview of how the Islamic State is successfully engaging with youth on platforms such as TikTok, where its propagandists use pop culture references as an onramp for more radical content. In the section that follows, the article identifies other issue areas relevant to the plot, such as the pairing of online and offline radicalization, especially in the Balkan jihadi nexus, and the role of mental health. It concludes by placing the Taylor Swift plot in context alongside other ISK-driven European plots as well as the broader transatlantic threat posed by the group. The article draws upon a range of sources, including secondary source reporting, open-source intelligence, and sources from the Austrian government, since legal proceedings are still underway at the time of publication of this article.
The Plot Against the Taylor Swift Concert
Ternitz is a small town of approximately 15,000 inhabitants located about 60 kilometers south of the Austrian capital, Vienna. In the early morning hours of August 7, 2024, the Austrian law enforcement special forces unit COBRA conducted a raid on an unassuming residence after electricians had cut the power supply. The primary target of this operation was a 19-year-old man with Macedonian (ethnic Albanian) roots, Beran A., who was arrested on suspicion of planning a terrorist attack at a mass event. During the course of the house search, the police found € 21,000 in counterfeit currency, which was possibly intended for escape purposes. As well as an extensive trove of Islamic State propaganda material, an array of other items was seized: electronic ignition devices, a 12-channel transmitter, a detonator, a 60-centimeter-long metal pipe, a 30-centimeter-long combat knife, a 46-centimeter-long machete, a butterfly knife, and blank ammunition in addition to chemicals available at any hardware store. Moreover, the police operation yielded components for manufacturing the highly explosive triacetone triperoxide (TATP) and sulfuric acid, which he allegedly stored in the refrigerator.8
Franz Ruf, director general for public security at the Austrian Ministry of the Interior, stated that the investigations pointed to “concrete preparatory actions.”9 Until shortly before his arrest, Beran A. was employed at a local steelworks factory nearby, where he had allegedly stolen some of the substances found in his possession. The young man was completing a retail sales apprenticeship there, which granted him access to the plant’s laboratory and various chemicals. He allegedly managed to produce TATP from “everyday” substances—sulfuric acid, an acetone-based nail polish remover, and hydrogen peroxide, similar to the concoction used in an al-Qa`ida plot to bomb the New York City subway by Najibullah Zazi in 2009.10 Some of the bomb-making materials discovered are believed to have been acquired via the Darknet.11 Reportedly, Beran A. tried to order a hand grenade, a Zastava M70 assault rifle, a Kalashnikov AK-47 “clone” (the same type Kujtim Fejzulai, the perpetrator of the Vienna November 2, 2020, attack used), and a handgun from the United States via the messaging service Telegram but he completely failed in his endeavor to obtain weapons from his “list.”12 The suspect had already submitted his resignation to the factory on July 18, 2024, mentioning to his work colleagues at the factory that “big plans” were underway.13
Prior to the police raid, Austrian authorities had kept Beran A. under close surveillance for several days (since August 2, 2024). During this time, according to prosecutors, he was observed handling what appeared to be the highly volatile TATP while wearing protective gear, including gloves and a face mask. “The amounts (of TATP) were small, but appear sufficient to produce a detonator,” the official report of the Austrian Federal Office of Criminal Investigation (Bundeskriminalamt) stated.14
A few days before the planned attack, Beran A. allegedly asked a friend where he could acquire a fuse. When asked why he needed it, Beran A. allegedly responded: “You’ll hear about it!”15 In a Telegram Chat, the 19-year-old allegedly posted: “Fight for Allah. Go out and terrorize the kuffar (unbelievers). If you don’t have weapons, go out with knives. If you don’t even have knives, run them over. And if you can’t even run them over, then spit in their faces.” A fellow Islamist from Germany allegedly encouraged the young man in his intentions there. “Do you want to do a simultaneous attack? You at your place, me here,” Beran A. allegedly replied.16 There were numerous ideas exchanged in the chats: Beran A. was advised to acquire drones to drop bombs from the sky or to obtain sarin gas and release it at the concert venue.17 These exchanges with likeminded extremists on the platform Telegram suggest Beran A.’s advanced interest in plotting. To prepare himself, he watched videos of the Charlie Hebdo attack, went to the fitness center, and practiced shooting in a field at night.18
The suspected plot was a large-scale terrorist attack targeting a mass event in Vienna, specifically the second of three upcoming Taylor Swift concerts due to be held in early August 2024. Swift is currently considered the world’s most successful pop star with a global fanbase. Approximately 200,000 tickets were sold for the three concerts, originally scheduled for August 8, 9, and 10, 2024. According to findings by the Austrian Directorate for State Security and Intelligence (DSN), Beran A. pledged allegiance to the Islamic State’s leader on July 7 and uploaded his loyalty oath via Telegram.19 Although Beran A. had reportedly sympathized with al-Qa`ida, he seemed particularly fascinated and captivated by ISK.20
Beran A. can be categorized as an Islamic State-inspired lone perpetrator drawing on a supportive micro network. Albeit there is currently no conclusive evidence indicating direct contact with Islamic State operatives, his intense networking activities on messenger chats suggest contact with Islamic State affiliates. Moreover, at an earlier stage of plotting, he reportedly was in contact with a person believed to be a member of the Islamic State: “I will try to get a gun and bombs. If that doesn’t work, I will use big knives. Or I will kill a police officer and take his rifle.”21 There is no evidence that has publicly come to light that Beran A. sought or obtained “permission” from the Islamic State for the potential attack.22
Beran A. had planned to drive as close as possible to the Ernst-Happel Stadium, likely on August 9, in his parents’ VW Beetle equipped with emergency lights to deceive the security personnel.23 According to the case filed against him, to gain unfettered access to the stadium grounds, he was perhaps planning to disguise himself as a police officer, which would also make his possible escape more seamless after the attack to continue his deadly rampage.24
Beran A. purportedly planned a vehicle ramming attack aimed at causing maximum fatalities by targeting up to 30,000 Taylor Swift fans gathered outside the stadium. He allegedly was planning to use machetes and knives for further assault following the car attack and then to blow himself and others up using a homemade improvised explosive device (IED).25 According to official sources, he had downloaded operating instructions on the handling of the IED from an Islamic State propaganda website and had “considered both options,” a vehicle ramming followed by stabbing or using an IED concerning the modus operandi.26
In addition to the main suspect, Austrian police also arrested a 17-year-old Austrian with Turkish-Croatian roots, Luca K. The teenager had just been employed by a facility management company that was providing services of an unspecified nature at the venue of the Taylor Swift concerts, meaning that he likely had unrestricted access to critical areas.27 Luca K. was detected in front of the stadium and allegedly had “extensive IS materials with him.” Stickers glorifying jihadism were found in his wallet, displaying an Islamic State flag and al-Qa`ida lettering imitating an Adidas logo.28 Moreover, investigations have reportedly revealed that Luca K., who had just broken up with his girlfriend, had intensive contact with Beran A. before the attack.29 Telecommunications data shows that Luca K. had intensive contact with Beran A., for example, shortly after Beran A. swore allegiance to the Islamic State and also during the weekend prior to the Taylor Swift concerts.30
Perhaps unsurprisingly, Luca K. was already known to state police in the context of a previous criminal case, a gang war in Vienna.31 In March 2024, Luca K. stood trial in Vienna for physically assaulting a young Muslim in the Upper-Austrian town of Pasching in an attempt to convert him to the “right” Islam. “If your mother and sister were not present, we would kill you,” one of his accomplices allegedly threatened the victim.32 The 17-year-old received a four-month suspended prison sentence.
Following the interrogation of a teenager (15) with Turkish roots as a witness, Austrian authorities investigating the Taylor Swift plot also arrested an 18-year-old Iraqi citizen as a third suspect on August 8, 2024.33 The Vienna Public Prosecutor’s Office is investigating Beran A. and Luca K. on charges of terrorist association, criminal organization, and violations of the Weapons Act. At the time of publication, both suspects remain in pre-trial detention, which was extended in November 2024. As a result of the arrests of the two suspects (Beran A. and Luca K.) accused in the terrorist plot, all three Taylor Swift concerts in Vienna were canceled on August 7, 2024. The fact that at least one of the plotters had infiltrated the workforce for the concerts was a critical factor in this decision. Event organizer Barracuda Music, in consultation with law enforcement officials and Swift’s management, chose to cancel the music events due to the confirmed terrorist threat.34 The cancellation upset many fans who had traveled from various countries and invested heavily in travel and accommodations to attend the event in Vienna. In response to the threat, and before the concerts were canceled, Austrian authorities had initially heightened security protocols for the concerts.35 Reinforced (“robust”) measures included increased security checks at the venue entrances and the deployment of special forces.36 Given Swift’s immense global popularity, the foiled plot served as fodder for ISK propaganda and brought an immense amount of attention to the group, which had already grown in notoriety as a result of the Moscow attack just several months earlier.
Virtual Planning Hub or Micro Network?
According to the most recent investigative findings, Beran A. had also planned an attack in front of a mosque in Dubai in the United Arab Emirates on March 11, 2024.37 This is what restored chats on his mobile phone, uncovered through forensic data analysis, now reveal. Beran A. flew to Dubai in March 2024 and purportedly had the firm intention of stabbing a soldier in front of a mosque and then “shooting at people in the vicinity” with the guard’s revolver at the beginning of Ramadan. But he decided against an attack “at the last moment” because he feared “dying in a hail of police bullets and having to suffer from it.”38 Following extensive communication on encrypted messenger applications (alternatively on Telegram, Signal, and Snapchat) with Beran A., two suspected accomplices of his from Lower Austria had planned to simultaneously execute attacks on sacred sites in Mecca and Istanbul, believing that they are visited by “infidels.”39 One of them, 20-year-old Hasan E., stabbed a security officer in front of the Great Mosque in Mecca on that very day (March 11), injuring four more persons severely. He is currently imprisoned in Saudi Arabia.40 Whether the other suspected accomplice, who is still unknown, succeeded with his plot in Istanbul is yet unknown and subject to investigation.41 Given this relevant context, it appears plausible that Beran A. may have functioned as either a member of a jihadi micro-network or as the organizer of a virtual plotting hub, facilitating the coordination of attacks on behalf of or in collaboration with the group. Referring to his various chats within different chat groups, his role might not be confined to this limited framework, as there is considerable potential for his activities to extend beyond the immediate network.
Transatlantic Intelligence Cooperation
Austrian intelligence services were able to thwart the plot with assistance provided by the CIA and other U.S. intelligence services.42 Considering the thwarted ISK Pride Parade plot of June 2023 and the foiled 2023 New Year’s Eve European cathedrals attack plan (both analyzed below), this was not the first instance of the United States aiding the Austrians with critical intelligence to prevent an attack. The CIA’s deputy director, David Cohen, said that the plot was “quite advanced” and was intended to kill “tens of thousands of people,” including “many Americans.”43 If successful, the attack would have been reminiscent of the Islamic State-inspired attack in Manchester, England, in 2017 at an Ariana Grande concert, which killed nearly two dozen concertgoers.44
The head of Austria’s domestic intelligence service, Omar Haijawi-Pirchner, confirmed that the intelligence tip had emanated from abroad without directly identifying the United States.45 Such warnings are common practice for the U.S. intelligence community, which also shared warnings about other imminent plots with Iran and Russia earlier in 2024.46 In those cases, even with Tehran and Moscow avowed U.S. adversaries, the intelligence community reached out under its “duty to warn” policy, put in place back in 2015 to establish “a consistent, coordinated approach for how the Intelligence Community (IC) will provide warning regarding threats to specific individuals or groups of intentional killing, serious bodily injury, and kidnapping.”47 The Americans reportedly first provided Austrian military intelligence authority “Heeres-Nachrichtenamt” (HNaA) with Beran A.’s telephone number, his Telegram profile (“Abu Dujana”), and the name of the suspect in a relevant channel, along with forwarded photographs.48 Under Austrian law, the security services and law enforcement authorities are prevented from legally monitoring the text messages of its citizens.49 Although sources and methods were never revealed, it is likely that signals intelligence, or SIGINT, enabled U.S. intelligence agencies to glean the information necessary to prevent the attack. Then Austrian Chancellor Karl Nehammer, speaking after the plot was disrupted, said, “It’s vital that messenger services like WhatsApp, Signal, Telegram can be decrypted for security authorities, under judicial oversight, while upholding the rule of law.”50
Attack Tactics
The Taylor Swift plot adhered closely to the tactics, techniques, and procedures (TTPs) seen in other jihadi attacks in the West, and in Europe in particular, over the past decade. To begin with, TATP, also known as “the mother of Satan,” has become the go-to choice for jihadi terrorists planning attacks in Europe. TATP was used or discovered in the Bataclan attack (November 2015); Brussels Airport attack (March 2016); Manchester Arena attack (May 2017); Brussels Central Station attack (June 2017); Barcelona car-ramming attack and Cambrils stabbing (August 2017); and the Parsons Green, London Underground attempted bombing (September 2017).51 There was also a vehicle ramming component to the plot, and vehicle ramming attacks became somewhat of a hallmark for the Islamic State during its apex, with deadly attacks at a Bastille Day parade in Nice, France (July 2016, 86 killed); a Berlin Christmas market (December 2016, 12 killed); a busy shopping area in central Stockholm, Sweden (April 2017, four killed); Las Ramblas in Barcelona, Spain (August 2017, 14 killed) and bicycle path in New York City (October 2017, 8 killed), to name just a few.52
Another horrific Islamic State-inspired terrorist attack occurred on New Year’s Day in New Orleans, Louisiana, when a 42-year-old former U.S. Army soldier named Shamsud-din Jabbar rammed a truck into a crowd of revelers on Bourbon Street, killing 14 and injuring many more.53 The attacker pledged his loyalty to the Islamic State in one of several videos posted online, referencing “a war between the believers and disbelievers.”54 He also hung an Islamic State flag from the vehicle used in the attack. Similar to the Taylor Swift plot, there were multiple attack tactics built into the New Orleans attack, which in addition to the vehicle ramming aspect, included a rifle and improvised explosive devices (though these failed to detonate).
The Taylor Swift concert plot was intended to cause maximum casualties. Given the very high public profile of Taylor Swift, had the attack been successful, it likely would have resulted in weeks of global media coverage and a major boost to Islamic State propaganda, aiding the group in the recruitment of new supporters and followers. Other aspects of the plot—the use of knives, the interplay, as detailed below, of online/offline radicalization, and the use of fake police uniforms—were far from unique but still noteworthy, especially as terrorists often seek to emulate prior attacks and to learn from each other.55
TikTok Radicalization
Beran A. radicalized after regularly consuming video material of German salafi influencer preachers such as Abul Baraa and Marcel Krass.56 During initial interrogations, the teenager admitted that his radicalization was heavily influenced by consuming TikTok videos, particularly those created by Baraa.57 The salafi “hipster”-preacher’s relatable style on his TikTok channel has attracted 82,000 followers, with tens of thousands more across other social media platforms where he has shared more than 2,000 videos.58
Moreover, Beran A. stated that he had spent the past few weeks playing first-person shooter games on his PlayStation, going to the gym, and reading the Qur’an. According to his avowal, he felt rejected by friends and acquaintances because of their “sins,” dedicated his life to Allah, and was a strong advocate of sharia law.59
Analysts emphasize TikTok’s growing role as a key recruitment platform60 for young lone attackers and virtual terror cells, leveraging its vast reach and algorithmic influence.61 Meanwhile, Telegram is frequently utilized to plan and coordinate attacks. Encrypted platforms such as Telegram allow for secure group communications, enabling extremists to coordinate within cells or networks without fear of their conversations being monitored.62 According to recent research by Reuben Dass, “in at least 44 percent of the 57 virtually directed Islamic State plots between 2014 and 2020, Telegram was used as a method of communication.”63 This evolution in perpetrator’s communicative preferences presents significant challenges for law enforcement.
The recently appointed EU Counter-Terrorism Coordinator (EU-CTC), Bartjan Wegter, has identified a more diffuse jihadi threat, emanating from myriad directions and spreading online—something akin to “mutant jihadism.”64 Salafi jihadis, both organizations as well as micro-structures, are seeking to capitalize upon this dynamic. What might appear as harmless Islamist online content is ubiquitous on different platforms, including TikTok, YouTube, 4Chan, Reddit, Instagram, and others,65 while there is also extremely violent jihadi propaganda material shared on Telegram channels.66 The initial access point to salafi propaganda is online “borderline content”67 (low-threshold formats) that might be inciting hatred and fueling individuals’ radicalization.68 The phenomenon of “influencer preachers,” who are becoming popular and gaining larger and more diverse followings, should be considered as a driving force of “TikTok-radicalization.”69 One particularly concerning example of “borderline content” is the new generation of “hipster Salafists,”70 preachers who present themselves as pop culture influencers, using slang, memes, and various facets of online culture to present themselves on the internet in ways that resonate with younger generations. In some ways, their growing resonance with younger generations of Muslims is reminiscent of Anwar al-Awlaki, the al-Qa`ida in the Arabian Peninsula (AQAP) propagandist who had considerable influence radicalizing a generation of religious extremists.
Everyday problems are framed and interpreted or infused with Islamist ideas. The preacher’s casual and relatable appearance providing Q&A-style content in the language of the followers is a savvy tactic of subtle Islamist propaganda. Their goal is to create a gateway to more radical jihadi ideas.71 Extremists are succeeding in delivering partially radical messages to their target audience or in trivializing, distorting, or deliberately falsifying messages.72 TikTok regularly removes videos and accounts containing Islamist and Islamic State-related content, but propagandists appear to operate following a ‘flood the zone’ principle. Countless profiles openly glorify former Islamic State leaders, often accompanied by captions such as “Look how the kafir dies and burns.”73
The Balkan Jihadi Nexus: A Motor for Offline Radicalization
Both alleged plotters had links to the Balkans, with Beran A. having Macedonian (ethnic Albanian) roots and his alleged accomplice having Turkish-Croatian roots. An unmistakable characteristic of the Austrian jihadi scene is its distinctive transnational (Southeast European) network, particularly in, toward, and from the Balkans—especially in Bosnia, the Sandžak area,74 Kosovo, Albania, and North Macedonia.75 Strong ties also exist to neighboring Germany and Switzerland, and Turkey. The Balkan region is often described as a “Salafist bridgehead.”76 Even though Islam in the Balkans has historically been characterized by a tolerant form of Sunnism, the area has had significant issues with radical Islamism.77 The Balkan wars of the 1990s introduced numerous radicalized fighters from regions such as Saudi Arabia, Afghanistan, and North Africa, particularly to Bosnia and Herzegovina (BIH). According to some estimates, there are still approximately 65 salafi communities in BIH and there were three rural enclaves that were considered sources or refuges for supporters for the Islamic State during the heights of its ‘caliphate.’78 The radical ideology in these areas was further entrenched by conflicts such as the unfolding Syrian war. In towns like Gornja Maoca, Osve, and Dubica, the Islamic State flag was prominently displayed, and sharia law was enforced until the mid-2010s.79 These locations became recruitment hubs, with youth repeatedly drawn from there to fight as militants.80 Islamism remains a persistent challenge in North Macedonia. Increasingly, the concern is over online radicalization. This digital presence transcends borders, targeting young, radicalized members of the diaspora in Central and Western Europe.81
Notorious salafi hate preachers in Austria with a Balkan background, such as Mirsad O. (alias “Ebu Tejma”), Nedzad B. (alias “Ebu Muhammed”), and Hamza Hodja, as well as other charismatic figures in the scene with roots in the former Yugoslavia, have made a significant contribution to the development of overarching salafi structures and cooperation beyond Austria’s borders toward the Balkans. As a Central European hub, especially to the Balkan region, the Danube metropolis of Vienna, in particular, has in the past decade had a pronounced jihadi scene with “great ideological appeal” and far-reaching international connections for several years.82 Consequently, the jihadi scene in Austria is estimated to consist of between 120 and 150 particularly dangerous individuals. The director of the DSN recently spoke of a “very low three-digit number” of “endangerers.”83 Among them are second or third-generation Austrian citizens, returned foreign terrorist fighters, and immigrants/asylum seekers. As part of an increasingly concerning trend, some of the domestic potential attackers belong to the emerging category of “teenage terrorists”84—rapidly radicalized adolescents from Gen Z or even Gen Alpha.85 One analysis of recent jihadi propaganda suggests that some recruiters explicitly target youngsters from Balkan diaspora.86 Beran A. reportedly was a regular attendee at the local Albanian mosque, visiting every Friday.87 However, there is no indication that radical Salafi preachers were active there.
Contrastingly, Luca K. is said to have attended the radical Islamist Tawhid-Mosque in Vienna-Meidling, which is known for being popular among young Islamic State sympathizers.88 The notorious mosque had been repeatedly linked to Salafi preachers such as former Imam Muhammed P. (who is alleged to have connections with radical Islamists in Bosnia and a Bosnian mujahideen training camp).89 It is also known as the preferred mosque for individuals with Balkan roots, later involved in (attempted or suspected) terrorist plots—most prominently the perpetrator of the Vienna attack of November 2, 2020, Kujtim Fejzulai,90 further underscoring its relevance for radicalizing adolescents in the local context.91 Consequently, the mosque was temporarily closed after the November 2 attack because Fejzulai is said to have become radicalized there.92
Luca K.’s radicalization, similar to that of Beran A., appears to have involved both online elements and offline components, such as networks and meeting points (including radical mosques). Furthermore, Luca K.’s radicalization involved interactions with a criminal youth gang with Islamist activities, a profile often seen recently among younger Islamist extremists.93
A combination of societal influence and exposure to extremist content online creates a potent breeding ground for radicalization.94 Social media algorithms, designed to engage users, amplify extremist narratives, with adolescents especially vulnerable.95 The intersection of mental health vulnerabilities and exposure to extremist ideologies further complicates efforts to intervene effectively.
Mental Health Issues
The third generation of jihadis often manifest as loose micro-networks with a low-profile connection, sometimes a non-affiliation with a core organization such as the Islamic State. Moreover, a hybrid on- and offline radicalization, a growing exploitation of virtual technology, and a tactical low-level attack approach define this current generation of jihadi perpetrators.96 Both suspected Taylor Swift concert plotters fit this third-generation profile in terms of age, ethnic background, and dual radicalization. They are teenagers with roots from the Balkans and radicalized online with a reinforcing real-life component.
A significant number of third-generation jihadi suspects have exhibited mental health conditions.97 Recent studies by widely acknowledged researchers like Paul Gill, John Horgan, and others have revealed a notable shift in our understanding of lone-actor terrorism, particularly in relation to jihadi and right-wing extremist violence.98 In 2016, Jeanine De Roy van Zuijdewijn and Edwin Bakker found that around 35 percent of European lone-actor terrorists exhibited signs of mental disorders, compared to 27 percent in the general population.99 According to research published in 2014 by Emily Corner and Paul Gill, lone-actor terrorists were 13 times more likely to have a mental disorder than those involved in group-based terrorism.100 These findings indicate that many jihadi lone attackers suffer from some variant of psychopathological illness, often even diagnosed and under surveillance.
The main suspect in the Taylor Swift concert plot, Beran A., is reportedly mentally unstable.101 Since the beginning of the year, he had been abusing the drug “Lyrica”—an anti-epileptic medication also used to treat neuropathic pain and anxiety disorders—along with cannabis.102 According to his juvenile court report partially cited by Austrian media, this substance abuse led the 19-year-old to experience delusions of persecution and, at times, auditory hallucinations.103 Seeking relief from his drug use and mental distress, he turned to an “Islamic cure” and sought a ruqyah (a form of exorcism) performed by an imam.104 Psychopathologies frequently diagnosed among lone actors—such as personality disorders, schizophrenia, delusional disorder, and autism spectrum disorders—often involve “deluded, rigid or fixated” thinking, which can be easily influenced by ideological beliefs.105
Prelude: Recent Foiled Islamic State and ISK Plots in Austria
Since mid-2023, there have been three significant foiled plots in Austria that could be regarded as indicators of the gathering threat demonstrated by the thwarted Taylor Swift plot. Similarities concern overall plotting, perpetrator typology, pathways of radicalization, modi operandi, networks, communication, tactics, and the strong allegiance of the plotters toward the Islamic State and specifically ISK.
The Early 2023 Vienna Pride Parade Plot
In early 2023, three Austrian teenage Islamists—comprising a 14-year-old of Chechen descent and two brothers, aged 17 and 20, of Bosnian descent—planned to use an assault rifle and a machete to attack the Vienna Pride Parade, a popular LGBTQ festival that takes place every June.106 They were arrested on June 17, shortly before the event.107 The three suspects were subsequently released a few days after their arrest and consequently not charged. There are indications that the suspected plotters were also planning a vehicle ramming attack.108 At least two of the plotters, much like the Taylor Swift case suspect Beran A., had been radicalized by Islamist influencer preachers on TikTok, regularly sharing ISK propaganda online.109 Moreover, the then 14-year-old teenage plotter with Chechen roots asked an unknown user on the messaging service Threema what components he needed to build an explosive.110 The accused then 14-year-old received a link with detailed instructions from this virtual comrade. On his cell phone, investigators discovered bomb-making instructions, a manual for operating an AK-47 assault rifle, a comprehensive guide on traveling to “Islamic State territory,” and a document outlining ways to support jihad.111 Police raids conducted before the parade uncovered additional evidence, including a significant cache of blade weapons, a trove of extremist materials, and a written pledge of allegiance to Abu Hussein al-Husseini al-Qurashi, the then-leader of the Islamic State. Among the seized items were an 18-page manual detailing tactics for urban combat and a homophobic pamphlet denouncing the LGBTQ community. The manual appeared to provide strategic instructions for carrying out attacks in densely populated areas, indicating a significant level of preparation and intent.112
The youngest among the group seemed to play a crucial role within the triad. He allegedly initiated a Telegram channel for fellow European-based jihadis and allegedly created and edited propaganda material promoting terrorism. According to investigations, he used a chat group to fundraise for weapons purchases for ISK and stated that he wanted to join the group in Afghanistan as soon as he reached adulthood. The Telegram group served as a hub for active communication with fellow jihadis across Europe, including individuals from Germany, Belgium, and the Balkans, potentially operating as a micro-network for virtual terror planning.113 Allegedly, the then 17-year-old plotter chatted with at least two suspected Islamic State supporters outside Austria, presumably discussing plans to attack the Vienna Pride Parade and holding out the prospect of acquiring an AK-47 and a large knife in the Czech Republic for a terrorist attack. His then 20-year-old brother is reported to have at least supported him psychologically.114 They are originally from St. Pölten, the state capital of Lower Austria, and the town where Kujtim Fejzulai, the 2020 Vienna attacker, had close ties to the Islamist scene.115 A foreign partner intelligence service is said to have provided the decisive tip-off about the suspects and their plot.116
The September 2023 Central Train Station Plot
On the 22nd anniversary of 9/11, September 11, 2023, 16-year-old Ali K., a teenager of Turkish descent, arrived at Vienna Central Station armed with a 17-centimeter blade combat knife and dressed in camouflage attire, probably to underscore his admiration for military combat. He lingered at the station for about 45 minutes, a location bustling with travelers and commuters, which would have maximized the impact of a knife attack.117 Ali K. planned to ignite a firecracker as a diversion before attacking startled passersby with a knife.118 This deceptive tactic has become characteristic of some recent plots by ISK supporters. For instance, the ISK Moscow Crocus City Hall perpetrators used firecrackers as a decoy, sending panicked visitors to the exits, where the gunmen shot them.119 As already noted, the individual behind the Taylor Swift concert plot intended to use emergency lights to heighten the impact. Apparently, Ali K. lost his nerve and ultimately decided not to follow through with his plans. Like Beran A., he idolized Kujtim Fejzulai, the perpetrator of the November 2, 2020, Vienna attack.120 The timing of the planned attack—on the anniversary of 9/11—suggested a deliberate attempt to draw symbolic significance to his actions, aligning himself with a broader narrative of jihadi ideology.
During his planning for the attack, Ali K., allegedly a fanatic supporter of the Islamic State, had announced his planned assault in a bumpy German-English mixture on a relevant Telegram channel: “I make inshallah attacke (sic!) in Vienna.”121 When asked when he would “do it,” he later replied: “Im make today,” using the platform to declare his intentions and possibly seek validation or encouragement from like-minded individuals. He posted a photo of himself in camouflage clothing and with a combat knife.122 His actions are again indicative of the growing trend of publicizing and glorifying terrorism on social media.
In April 2024, Ali K. stood trial, but his aborted attack was not addressed in court due to his withdrawal from the plan. He was sentenced to two years in prison, with eight months to be served unconditionally, for membership in a terrorist organization and a criminal network. However, due to the time he had already spent in pre-trial detention, he was released shortly after on probation and enrolled in a deradicalization program.123 His probation proved unsuccessful, as he was reportedly spotted in Vienna wearing Taliban-style eyeliner. Moreover, from July 2024 onward, after Ali K. (now 18) had undergone a military medical examination but was deemed unfit for service, his radicalization intensified, and he reportedly began visiting known extremist mosques again, reading extremist literature, and reconnecting with the radical Islamist scene via Telegram.124
Ali K.’s aborted attack at the central station was reportedly preceded by a dispute with his father, which allegedly led to another falling out between them. Ali K. has been back again in pre-trial detention since November 6, 2024.125 The Vienna public prosecutor’s office has now appointed an expert to assess his sanity and dangerousness.126 This may suggest a mental health condition. The majority of suspects in recent Islamic State/ISK plots in Austria are male teenagers,127 and many reportedly exhibit increased psychological abnormalities and disorders. Their radicalization is influenced by their social and family environment as well as increasingly by social media, especially given the early access children have to platforms such as TikTok and YouTube.
The 2023 New Year’s Eve European Cathedrals Plot
A transnational, seven-member ISK cell, comprising six individuals of Tajik origin and one Turkish-rooted woman, orchestrated an elaborate plot targeting iconic churches in Europe, including St. Stephen’s Cathedral in Vienna and Cologne Cathedral.128 The group’s plans extended beyond symbolic destruction, aiming to inflict mass casualties. German authorities uncovered that the cell intended to carry out a vehicle attack against the dense crowds gathered outside Cologne Cathedral, a popular New Year’s Eve destination adjacent to the central train station.129 Both timing and target selection indicated a plan to maximize the number of potential victims and media impact.
The main suspect is also alleged to have taken photos and video recordings of the Viennese amusement park “Prater,” possibly another potential target of the ISK cell.130 However, his actions may not have been solely driven by terrorist intentions. It has now been confirmed that the man made at least five phone calls to a contact in October and November 2023, during which plans for a robbery, a kidnapping for ransom, and a contract killing were allegedly discussed.131 Further investigations revealed preliminary evidence pointing to additional plans by the same transnational cell active in Austria and Germany for an attack in Madrid, indicating the ISK cell’s broader European ambitions.132 Excavations in Lower Austria for a possible ISK weapons cache in a wooded area near Sieghartskirchen and in a ravine in Hinterbrühl were unsuccessful.133 Only pieces of sheet metal and wire were found, but no evidence to support the suspicions. Given that the crucial information needed to thwart the attack scenario and identify the suspects once again came from a friendly intelligence partner, the initial suspicion could not be corroborated with additional evidence (as intelligence data cannot be used in court). As a result, all criminal proceedings were dropped in October 2024.134
The Transnational ISK Threat
The ISK Taylor Swift plot came as little surprise to Western security services, which have been dealing with an uptick in ISK plotting.135 The group has deliberately made it a part of its strategy to focus on external operations and, accordingly, has dedicated more resources to launching attacks outside of Afghanistan. The shift in approach was the result of a decision taken by the group’s leader, Sanaullah Ghafari (also known as Shahab al-Muhajir), and began to take shape not long after the U.S. troop withdrawal from Afghanistan in August 2021.136 And though there is no evidence that the U.S. troop withdrawal precipitated Ghafari’s decision, the lack of a U.S. presence certainly enabled ISK to plot transnational attacks, taking advantage of an intelligence deficit that was the outcome of the troop withdrawal.
In 2022, ISK conducted cross-border rocket attacks against two of its neighbors, Uzbekistan and Tajikistan, launched assaults against the Russian and Pakistani embassies in Kabul, and attacked a hotel in Kabul frequented by Chinese businessmen.137 These targets were far from random and were indeed part of the group’s effort to globalize its agenda. ISK’s propaganda is key to understanding what it has called its internationalization strategy.138 To get a sense of the diversity of languages and the geographic scope and reach of ISK, one only needs to consider that its content is published in Arabic, Dari, English, Farsi, Hindi, Malay, Pashto, Russian, Tajik, Turkish, Urdu, Uzbek, and sometimes Uyghur. As part of the group’s production efforts, it releases online print magazines in Arabic, English, Pashto, Tajik, and Turkish, in addition to multilingual videos. The goal is to cast a wide net in an effort to radicalize a broad swath of supporters and followers. Toward this end, ISK has also diversified the tech platforms where it operates, communicating, spreading, and storing its propaganda through Archive.org, Element, Facebook, Hoop, Telegram, and TikTok while continuously looking for additional ways to spread its messaging.139
It is important to track and monitor ISK propaganda because the group is very serious about its plans and often follows through on the various threats it makes across languages and platforms. Over the summer of 2024, before the Taylor Swift plot was disrupted, it became clear that ISK was fixated on attacking Europe. Just as ISK telegraphed its intention to attack Russia through its propaganda,140 in the summer of 2024, ISK threatened the Euro 2024 games in Germany, the Cricket World Cup in the United States, and the Summer Olympics in Paris.141 Following ISK’s deadly attack in Russia in March, a website affiliated with the group published a graphic that read, “After Moscow … Who Is the Next?” and highlighted London, Madrid, Paris, and Rome as potential targets.142 These are hardly idle threats. In the lead-up to Euro 2024 in Germany, an Islamic State supporter had applied, unsuccessfully, for a job as part of the security staff employed to protect the games. The individual, of German-Moroccan-Polish nationality, was later arrested at the Cologne/Bonn airport in Germany and charged with violating the Foreign Trade and Payments Act for transferring approximately $1,700 USD in cryptocurrency to ISK.143
Conclusion
What does the Taylor Swift concert attack plot and the uptick in plotting by ISK tell us about the outlook for the current terror threat landscape and where things might be going over the course of 2025? To begin with, it seems logical to suggest a continued effort by jihadi groups, including affiliates of the Islamic State, to focus on radicalizing extremely young supporters and followers online. The demographics appear to have shifted, with children in their early teens now particularly susceptible to jihadi propaganda. Salafi ‘hipster preachers’ have repeatedly proven to be influential figures, effectively leveraging social media platforms like TikTok to spread their message.
The use of borderline content, wherein less threatening topics and internet meme culture are used as an on-ramp to more hardcore material, is likely to continue, if not increase altogether. ISK’s push to radicalize and recruit will be abetted by its aggressive propaganda campaign, which has expanded in both scale and scope, diversifying its geographic reach and publishing in more languages than ever before.
In line with the objective to radicalize and recruit new members and to push individuals toward plotting and acts of violence, groups such as the Islamic State and their affiliates will focus on dual radicalization—that is, attempting to radicalize potential supporters both online and in person, viewing this as the more effective route. Accordingly, the group will end up recruiting individuals, like some of those in the Austrian plots, who exhibit clear mental health issues.
Just as ISK will continue to combine the online/offline dual approach toward radicalization, in the future, the group will also likely continue to pursue a multi-pronged approach to plotting and attacking. While concert venues and other large gatherings will remain attractive, given the opportunity to maximize casualty counts, the ISK enabled or inspired individuals will also pursue low-level attacks with knives and other weapons in an effort to increase the operational tempo of their attacks and spread fear among civilian populations.
Each of these trends is converging around and is indeed impacted by a broader shift in the counterterrorism community, wherein resources have been diverted away from counterterrorism and toward great power competition. This includes not just funding and manpower/personnel but also a drawdown in Western military forces on the ground, which have been the tip of the spear in taking the offensive to terrorists, insurgents, and militias operating in areas where al-Qa`ida, the Islamic State, and their various franchise groups control territory and project influence.
The information sharing and intelligence cooperation that characterized the Taylor Swift plot surely relied, in great part, on the ubiquitous reach of signals intelligence. As evidenced by the strike that killed longtime al-Qa`ida leader Ayman al-Zawahiri in Kabul in late July 2022, the United States retains exquisite technological capabilities as part of its ‘over-the-horizon’ approach to counterterrorism. Still, as Israel learned painfully on October 7, 2023, an overreliance on technology can be deadly. The United States and its allies must not take their collective technological superiority for granted. Technology is critical to disrupting terrorist plots, but it is not a panacea. Only through a comprehensive approach to counterterrorism, including reliance on all forms of intelligence, from HUMINT to ELINT to COMINT, as well as sensitive site exploitation (SSE) and document exploitation (DOCEX), can the West remain at the forefront of protecting its citizens and institutions from the long arm of the Islamic State. CTC
Nicolas Stockhammer is the Director of the Research Cluster “Counter-Terrorism, CVE (Countering Violent Extremism) and Intelligence” at Danube-University Krems (Austria).X: @Nic_Stockhammer
Colin P. Clarke is the Director of Policy and Research at The Soufan Group and a Senior Research Fellow at The Soufan Center. X: @ColinPClarke
© 2025 Nicolas Stockhammer, Colin Clarke
Citations
[1] Jean-Charles Brisard, “The Paris attacks and the evolving Islamic State threat to France,” CTC Sentinel 8:11 (2015).
[2] Abraham Yosipof, Gordon Woo, and Nadejda Komendantova, “Persistence of risk awareness: Manchester arena bombing on 22 May 2017,” International Journal of Disaster Risk Reduction 94 (2023); Christopher Baker-Beall, Lee Miles, Nora Leach, and Emma Reed, “From Prevent to Protect and Prepare: The Manchester Arena Attack and Shifting Priorities in the United Kingdom’s Counter-Terrorism Strategy (CONTEST),” Studies in Conflict & Terrorism (2024): pp. 1-25.
[3] Sally Ho and Regina Garcia Cano, “‘I’m going to die’: fear grips Vegas strip; gunman kills 59,” Associated Press, October 3, 2017.
[4] Peter Smith, Lucas Webber, and Colin P. Clarke, “Islamic State Escalates Anti-Russian Militant Campaign,” Diplomat, April 2, 2024.
[5] Petter Nesser and Wassim Nasr, “The Threat Matrix Facing the Paris Olympics,” CTC Sentinel 1:6 (2024).
[6] Lucas Webber, “Islamic State Increasingly Targeted and Threatened Western Sporting Events in Advance of the Paris Olympics,” Terrorism Monitor 22:10 (2024).
[7] Tom O’Connor, “ISIS Is Once Again Planning to Attack the West. Are We Prepared?” Newsweek, June 3, 2024.
[8] “Details über Terrorverdächtigen: Sprengfallenbasteln in der Küche,” Die Presse, August 15, 2024.
[9] “Taylor Swift concerts in Vienna canceled due to suspicion of terrorism,” Der Standard, August 7, 2024.
[10] “Terrorpläne bei Swift-Konzert: Verdächtigem war Sprengstoff-Herstellung geglückt,” Kurier, October 29, 2024.
[11] Michaela Reibenwein, “Taylor-Swift-Attentat: ‘Salam alaikum, ich will Waffen kaufen,’” Kurier, September 6, 2024.
[12] “Terrorpläne bei Swift-Konzert: Verdächtigem war Sprengstoff-Herstellung geglückt.”
[13] Kate Conolly, “Third teenager arrested over foiled Taylor Swift concert attack in Vienna,” Guardian, August 9, 2024.
[14] “Swift-Terrorpläne: U-Haft verlängert,” ORF Wien, November 12, 2024.
[15] Natalia Anders, Gernot Bauer, and Daniela Breščaković, “Anschlag auf Taylor-Swift-Konzerte: Die Terroristen aus Ternitz,” Profil, August 16, 2024.
[16] “Swift-Terrorverdächtiger rief zu Kämpfen auf,” Kronen Zeitung, October 4, 2024. [Translation by the authors]
[17] “Anschlag auf Taylor-Swift-Konzert: ‘Sehe viele potenzielle Opfer,’” Kurier, October 20, 2024.
[18] Ibid.
[19] Deborah Cole, “Taylor Swift concert plot: Austrian police find bomb chemicals in suspect’s home,” Guardian, August 8, 2024.
[20] Aaron Katersky, Felix Franz, Will Gretsky, Emily Shapiro, Josh Margolin, and Luke Barr, “Taylor Swift shows in Vienna canceled after 2 arrested for planning ISIS-inspired terror plot,” ABC News, August 8, 2024.
[21] Souad Mekhennet and Joby Warrick, “Inspired by ISIS: From a Taylor Swift plot in Vienna to carnage in New Orleans,” Washington Post, January 3, 2025.
[22] Jan Michael Marchart, “Das düstere Geständnis des mutmaßlichen Anschlagsplaners Beran A.,” Der Standard, August 15, 2024; Sana Noor Haq, Nina Avramova, Matthies Otto, and Radina Gigova, “ISIS-inspired suspect planned suicide attack at Taylor Swift concert, Austrian authorities say,” CNN, August 8, 2024.
[23] “Details über Terrorverdächtigen.”
[24] Kelly-Ann Mills, “Taylor Swift terror suspect seen posing with knives and ISIS flag in first picture of teen,” Mirror, August 8, 2024. See also Leonhard Landes, “Arbeit im Stahlwerk, Bombenbau weit fortgeschritten – Neue Details zum Terrorverdächtigen,” Welt, August 11, 2024.
[25] Haq, Avramova, Otto, and Gigova.
[26] Jan Michael Marchart, David Krutzler, and Sandra Schieder, “Terror-Ermittlungen: Plan war, ‘Personen außerhalb des Stadions zu töten,’” Der Standard, August 8, 2024.
[27] Christopher F. Schuetze, “2 Youths Planned Attacks on Taylor Swift’s Vienna Concerts, Authorities Say,” New York Times, August 8, 2024.
[28] Marchart, Krutzler, and Schieder.
[29] Zahid Mahmood, Jessie Yeung, and Issac Yee, “Taylor Swift shows in Vienna canceled over alleged planned terrorist attack,” CNN August 8, 2024.
[30] Patrick Wammerl, “Der komplette Akt des Beran A.: Bomben, Exorzismus und Taylor Swift,” Kurier, August 22, 2024.
[31] Marchart.
[32] Jan Michael Marchart, Fabian Schmid, and Birgit Wittstock, “Auf den Spuren des Ternitzer Anschlagsplaners Beran A.” Der Standard, August 9, 2024.
[33] “Weitere Festnahme, U-Haft für 19-Jährigen,” ORF Wien, August 9, 2024.
[34] Alexandra Schwarz-Goerlich and Miranda Murray, “ISIS-inspired suspect in Taylor Swift show plot planned suicide attack,” Reuters, August 9, 2024.
[35] “Taylor Swift Vienna concerts canceled over terror threat,” Deutsche Welle, August 8, 2024.
[36] Stefan Putz, “Wegen Festnahme: Sicherheitsmaßnahmen für Taylor-Swift-Konzerte erhöht,” 5min.at, August 7, 2024.
[37] “Swift-Terrorverdächtiger plante offenbar auch Anschlag in Dubai,” Die Presse, January 19, 2025.
[38] “Terrorfreund von ‘Swift-Planer’: Anschlag in Mekka verübt,” Kronen Zeitung, January 19, 2025.
[39] Ibid.
[40] “Swift-Terrorverdächtiger plante Anschlag in Dubai,” ORF Wien, January 19, 2025.
[41] Ibid.
[42] Holly Honderich, “CIA says Swift concert plotters planned to kill ‘a huge number,’” BBC, August 29, 2024; Nicolas Stockhammer and Colin P. Clarke, “Learning from Islamic State-Khorasan Province’s Recent Plots,” Lawfare, August 11, 2024.
[43] Katie Bo Lillis, “US intelligence helped stop terror plot targeting Taylor Swift concert, CIA deputy director confirms,” CNN, August 29, 2024.
[44] Julia Jacobs, “Taylor Swift’s Vienna Concerts Are Canceled After Terror Plot Arrests,” New York Times, August 7, 2024.
[45] Schuetze.
[46] Ellen Knickmeyer, “‘Duty to warn guided US advance warning of the Moscow attack. Adversaries don’t always listen,” Associated Press, March 26, 2024. See also Aamer Madhani, “US warned Iran that ISIS-K was preparing attack ahead of deadly Kerman blasts, a US official says,” Associated Press, January 25, 2024.
[47] Director of National Intelligence (DNI), “Duty to Warn,” ICD Nr. 191 (2015).
[48] “Staatsschutz offenbar erst kurz vor Swift-Konzerten über Anschlagspläne informiert,” Der Standard, August 10, 2024.
[49] Philipp-Moritz Jenne, Stefanie Dazio, and Kirsten Grieshaber, “Suspects in foiled attack on Taylor Swift shows were inspired by Islamic State group, officials say,” Associated Press, August 8, 2024.
[50] “Austria Chancellor Urges More Comms Monitoring After Taylor Swift Plot,” US News/Reuters, August 11, 2024.
[51] Peter Bergen and David Sterman, “Key Trends in Terrorism” in Jihadist Terrorism 17 Years After 9/11: A Threat Assessment (Washington: New America, 2018).
[52] “Terrorist Attacks by Vehicle Fast Facts,” CNN, August 23, 2024.
[53] Celina Tebor, “Scouting the City, Setting a Fire and Bringing in Supplies: Here’s How the NOLA Suspect Planned the Attack,” CNN, January 7, 2025.
[54] “Investigative Updates on the New Orleans Bourbon Street Attack,” FBI statement, January 2, 2025.
[55] See, for example, Daveed Gartenstein-Ross and Thomas Joscelyn, Enemies Near and Far, How Jihadist Groups Strategize, Plot, and Learn (New York: Columbia University Press, 2022).
[56] Salma Abdelaziz, Florence Davey-Attlee, and Nina Avramova, “The ‘rock star’ preacher influencing young people online,” CNN, August 15, 2024. See also Florian Hartleb and Nicolas Stockhammer, “‘Ich hätte den Sprengstoff in der Menschenmenge platziert’. Eine Analyse des vereitelten Terroranschlages auf die Massenveranstaltung ‘Taylor-Swift-Konzert’ im August 2024 in Wien,” EICTP Research Paper, September 2024, p. 13.
[57] “Nur ein Maus-Klick bis zur Bombe,” Focus Magazin 34 (2024).
[58] Abdelaziz, Davey-Attlee, and Avramova.
[59] “Details über Terrorverdächtigen.”
[60] Anna Wintersteller, “Die Tricks der Islamisten: So radikalisieren sie Junge im Netz,” Profil, June 22, 2023.
[61] Jakob Guhl and Milo Comerford, “Understanding the Salafi Online Ecosystem: A Digital Snapshot,” Institute for Strategic Dialogue, 2021.
[62] “Digital Counterterrorism: Fighting Jihadists Online,” Bipartisan Policy Center, March 2018, pp. 15-20.
[63] Reuben Dass, “Islamic State-Khorasan Province’s Virtual Planning,” Lawfare, May 19, 2024.
[64] Armen Georgian, “‘Mutant jihadism’ spreading across borders and online: EU’s anti-terrorism coordinator,” France 24, May 10, 2023.
[65] “Verfassungsschutz warnt vor ‘Tiktokisierung des Islamismus,’” Die Zeit, April 21, 2024.
[66] Rita Katz, Saints and Soldiers. Inside Internet-Age Terrorism, From Syria to the Capitol Siege (New York: Columbia University Press, 2022), pp. 157-168.
[67] Erin Saltman and Micalie Hunt, “Borderline Content: Understanding the Gray Zone,” Global Internet Forum to Counter Terrorism, GIFCT Insight, June 29, 2023.
[68] “TikTok Jihad: Terrorists Leverage Modern Tools to Recruit and Radicalize,” Soufan Center, Intel Brief, August 9, 2024.
[69] Peter R. Neumann, Die Rückkehr des Terrors. Wie uns der Dschihadismus herausfordert (Berlin: Rowohlt, 2024), pp. 81-97.
[70] “Dokumentationsstelle Politischer Islam warnt vor ‚Hipster-Salafisten,’” Die Presse, July 17, 2024.
[71] Matthew L. N. Wilkinson, The Genealogy of Terror. How to distinguish between Islam, Islamism and Islamist Extremism (London: Routledge, 2019).
[72] Donghee Shin and Kulsawasd Jitkajornwanich, “How Algorithms Promote Self-Radicalization: Audit of TikTok’s Algorithm Using a Reverse Engineering Method,” Social Science Computer Review 42:4 (2024): pp. 1,020-1,040.
[73] Jan Michael Marchart, “Wie die Radikalisierung zum Islamisten auf Tiktok funktioniert,” Der Standard, August 11, 2024.
[74] Claudia Mende, “Is Islamist radicalization returning to the Western Balkans?” Deutsche Welle, July 19, 2024.
[75] Franciska Rhomberg, “Terrorangst: Warum religiöser Extremismus auch in Österreich zum Problem wird,” news.at, October 27, 2023.
[76] Shams Ul-Haq, “IS instrumentalisiert jugendliche Migranten: Österreich findet Lösungen, Deutschland noch nicht,” FOCUS, August 25, 2024.
[77] Predrag Petrović, “Islamic radicalism in the Balkans,” EU Institute for Security Studies, Issue Alert 24 (2016).
[78] Ul-Haq.
[79] Dado Ruvic, “Islamic State flags appear, then disappear, in Bosnian village,” Reuters, February 5, 2015; Ul-Haq.
[80] Mende.
[81] Destan Jonuzi, “Islamist Extremists in North Macedonia Keep Up Online Propaganda,” Balkan Insight, December 28, 2022.
[82] Guido Steinberg, Islamistischer Terrorismus in Europa: Dschihadismus in Österreich (Berlin: Konrad-Adenauer-Stiftung, 2021).
[83] Daniel Bischof, “Staatsschutz-Chef Haijawi-Pirchner: ‚Den Teenagern geht es darum, Gewalt auszuüben,’” Die Presse, November 9, 2024.
[84] Cathrin Schaer, “The teenage terrorists of the ‘Islamic State,’” Deutsche Welle, September 11, 2024.
[85] Carolin Görzig, “Gen Z and Terrorism” in Nicolas Stockhammer ed. Routledge Handbook of Transnational Terrorism (Oxon, NY: Routledge, 2023), pp. 183-192.
[86] Adelheid Wölfl, “Jihadisten rekrutieren gezielt Kinder der Balkan-Diaspora,” Der Standard, August 12, 2024.
[87] Patrick Wammerl, “Bombenbau im Kinderzimmer: So tickt das Terrorhirn Beran A.,” Kurier, August 8, 2024.
[88] Marchart, Schmid, and Wittstock.
[89] Ednan Aslan, Evrim Erşan Akkılıç, and Maximilian Hämmerle, “Islamistische Radikalisierung”. Biografische Verläufe im Kontext der religiösen Sozialisation und des radikalen Milieus (London: Springer, 2017).
[90] Nicolas Stockhammer, Trügerische Ruhe. Der Anschlag von Wien und die terroristische Bedrohung in Europa (Vienna: Amalthea, 2023).
[91] Johannes Saal and Felix Lippe, “The Network of the November 2020 Vienna Attacker and the Jihadi Threat to Austria,” CTC Sentinel 14:2 (2021): p. 37.
[92] “Umstrittene Tewhid-Moschee aufgelöst,“ ORF Wien, February 2, 2024.
[93] Shams Ul-Haq, “Wie soll Deutschland mit jungen Radikalen umgehen?” FOCUS, August 25, 2024.
[94] Joe Whittaker, “Rethinking Online Radicalization,” Perspectives on Terrorism 16:4 (2022): pp. 27-40.
[95] Philip Baugut and Katharina Neumann, “Online propaganda use during Islamist radicalization,” Information, Communication & Society 23:11 (2020): pp. 1,570-1,592.
[96] Farhad Khosrokhavar, “The New European Jihad,” Revue du MAUSS 49:1 (2017): pp. 31-47; Gilles Kepel, “The Limits of Third-Generation Jihad,” New York Times, February 16, 2015.
[97] Emily Corner and Paul Gill, “A false dichotomy? Lone actor terrorism and mental illness,” Law & Human Behavior 39:1 (2014): p. 23; John Horgan, Terrorist Minds. The Psychology of Violent Extremism from Al-Qaeda to the Far Right (New York: Columbia University Press, 2024). See also Emily Corner and Paul Gill, “Is There a Nexus Between Terrorist Involvement and Mental Health in the Age of the Islamic State?” CTC Sentinel 10:1 (2017).
[98] Bart Schuurman, Edwin Bakker, Paul Gill, and Noémie Bouhana, (2018): “Lone Actor Terrorist Attack Planning and Preparation: A Data-Driven Analysis,” Journal of Forensic Sciences 63 (2018): pp. 1,191-1,200.
[99] Janine De Roy van Zuijdewijn and Edwin Bakker, “Analysing personal characteristics of lone-actor terrorists: Research findings and recommendations,” Perspectives on Terrorism 10:2 (2016): p. 44.
[100] Corner and Gill.
[101] “Terrorpläne rund um Taylor-Swift-Konzerte: Hauptverdächtiger soll psychisch auffällig sein,” Der Standard, September 3, 2024.
[102] Ibid.
[103] “Swift-Attentäter bekam von Drogen und Tabletten Wahn-Ideen,” OE24, September 3, 2024. On the nexus of drug abuse, mental illness, personal relationships, and radicalization, see Lewis Harrington, Understanding Islamist Terrorism in Europe. Drugs, Jihad, and the Pursuit of Martyrdom (Oxon, NY: Routledge, 2022), pp. 44–77.
[104] “Terrorpläne rund um Taylor-Swift-Konzerte: Hauptverdächtiger soll psychisch auffällig sein.”
[105] Monica Lloyd and Annelies Pauwels, “Lone Actors as a Challenge for P/CVE,” Radicalisation Awareness Network, European Commission, 2021, p. 8.
[106] Antoinette Radford, “Vienna Pride parade attack foiled, Austrian police say,” BBC, June 18, 2023.
[107] “Anschlag auf Wiener Regenbogenparade durch Verfassungsschutz vereitelt,” Austrian Federal Ministry of the Interior, June 18, 2023.
[108] “Erster konkreter Hinweis auf geplanten Anschlag bei der Pride in Wien,” Die Presse, November 7, 2023.
[109] “Anschlag auf Wiener Regenbogenparade durch Verfassungsschutz vereitelt,” Bundesministerium Inneres, June 18, 2023.
[110] “Geplanter Pride-Anschlag: Chats verdeutlichen Interesse an Bombenbau,” OÖ Nachrichten, July 1, 2023.
[111] Natalia Anders, “DSN: ‘Latentes Gefahrenpotenzial’ bei Regenbogenparade,” Profil, June 7, 2024.
[112] Michaela Reibenwein, „Pride-Ermittlungen: ‘Unter den Brüdern gibt es viele Sprengstoff-Experten,’” Kurier, July 1, 2023.
[113] Anders.
[114] “Pride: Konkreter Hinweis auf Anschlagsplan,” ORF Wien, November 7, 2023.
[115] “Erster konkreter Hinweis auf geplanten Anschlag bei der Pride in Wien.”
[116] Ibid.
[117] Jan Michael Marchart, “Jihadist soll Anschlag in Wien in letzter Sekunde abgebrochen haben,” Der Standard, September 19, 2023.
[118] Irina Stöckl, “16-Jähriger war bereits mit Messer am Hauptbahnhof,” Kronen Zeitung, September 19, 2023.
[119] Paul Kirby, “Bullets and panic – the Moscow concert that became a massacre,” BBC, March 23, 2024.
[120] Jan Michael Marchart and Fabian Schmid, “Unbekannter Jihadist drängte 16-Jährigen zu Anschlag in Wien,” Der Standard, November 6, 2023.
[121] “Terror-Plan am Hauptbahnhof: Verurteilter Jugendlicher wieder in U-Haft,” Kurier, November 8, 2024.
[122] Ibid.
[123] Konstantin Auer, “Wiener Islamist erneut in Haft: Ermittler schon längst nervös,” PULS24, November 14, 2024.
[124] Jan Michael Marchart, “Wiener Jihadist kam nach Terrorrückzieher flott frei – nun ist er erneut in Haft,” Der Standard, November 8, 2024.
[125] Jan Michael Marchart, “Wie der verurteilte Wiener Anschlagsplaner Ali K. erneut zur Gefahr wurde,” Der Standard, November 14, 2024.
[126] Ibid.
[127] Based on own research of the authors, particularly drawing on Erik Hacker, Jihadi Attacks in Europe. Trends and Features 2014 – 2022 (Vienna: Scenor, 2023).
[128] “German police warn of possible attack at Cologne Cathedral,” Deutsche Welle, December 23, 2023.
[129] “Anschlagspläne auf Kölner Dom: Was wir wissen – und was nicht,” WDR, January 3, 2024.
[130] “14 Handys, Tausende Chats: Wiener Coup gegen Terror-Netzwerk ISKP,” PULS24, January 6, 2024.
[131] “Anschlagspläne auf Stephansdom: Verdächtige nicht mehr in U-Haft,” Die Presse, May 23, 2024.
[132] “German police warn of possible attack at Cologne Cathedral.”
[133] “Anschlagspläne auf Stephansdom: Verdächtige nicht mehr in U-Haft.”
[134] Michaela Reibenwein, “Terroranschlag auf Stephansdom geplant: Justiz stellte Ermittlungen ein,” Kurier, January 13, 2025.
[135] Nesser and Nasr.
[136] Amira Jadoon, Abdul Sayed, Lucas Webber, and Riccardo Valle, “From Tajikistan to Moscow and Iran: Mapping the Local and Transnational Threat of Islamic State Khorasan,” CTC Sentinel 17:5 (2024).
[137] “Terrorist Groups in Afghanistan,” In Focus, Congressional Research Service, April 2, 2024.
[138] Amira Jadoon and Nakissa Jahanbani, “Iran terror blast highlights success – and growing risk – of ISIS-K regional strategy,” Conversation, January 11, 2024.
[139] Colin P. Clarke, Lucas Webber, and Peter Smith, “ISKP’s Latest Campaign: Expanded Propaganda and External Operations,” GNET Research Insights, June 27, 2024.
[140] Lucas Webber, Ricardo Valle, and Colin P. Clarke, “The Islamic State Has a New Target: Russia,” Foreign Policy, May 9, 2023.
[141] Lucas Webber and Colin P. Clarke, “ISIS-K Goes Global. The World Is Not Ready to Confront a New International Terror Threat,” Foreign Affairs, August 1, 2024.
[142] Peter Smith, Levent Kemal, and Lucas Webber, “Islamic State Khorasan’s Westward Network Expansion Into Iran, Turkey, and Europe,” Diplomat, April 30, 2024.
[143] “Suspected IS supporter arrested at Cologne airport,” Deutsche Welle, June 9, 2024.
