Abstract: This article maps the proliferation of the online True Crime Community (TCC), a layered online ecosystem organized around the consumption, discussion, celebration, and—at its most extreme—emulation of violent perpetrators. Drawing on documented cases of violent attacks from 2024–2025, the authors outline how the TCC functions as a layered fandom culture in which mass-casualty perpetrators are researched, aestheticized, imitated, and ultimately incorporated into a shared mythos. They situate the TCC within the broader landscape of nihilistic violence and participatory memetic extremist networks, sustained by symbolism, references, and aesthetic call-backs that form a performative language understood by community insiders. By mapping the TCC’s tiered structure and the porous boundaries between mainstream true-crime consumption, fandom spaces, violent sub-clusters, and offline attacks, the authors demonstrate why the TCC represents a self-sustaining threat vector. The article concludes with future considerations for researchers, platforms, and security practitioners confronting this threat.
On the morning of December 16, 2024, 15-year-old Natalie Lynn Rupnow arrived at Abundant Life Christian School in Madison, Wisconsin, in an Uber her father had ordered. Armed with a Glock 19, a Sig Sauer P322, loaded magazines, and ammunition concealed in her backpack, Rupnow photographed the tiled floor of a school bathroom, her combat boots, and her hand forming the “OK” symbol, posting the image to the social media platform X. Minutes later, she shared a link on the same account to what appeared to be a manifesto. Carrying one of the handguns into classroom C218, a mixed-grade study hall, Rupnow fatally shot fellow student Rubi Patricia Vergara, 14, and teacher Erin Michelle West, 42, while injuring six others. The shooting ended when the perpetrator took her own life.1
When Rupnow’s alleged online boyfriend later shared a copy of her manifesto with a journalist,a it revealed Rupnow’s intense self-loathing and deep resentment of people in her life and humanity more generally. The document is a screed of racism, anger, insecurity, and fixation on violence. Yet, what stands out most is Rupnow’s longstanding fascination with mass killers, reflected vividly across the pages. Her manifesto includes images and brief profiles of perpetrators she appeared to idolize: Pekka Eric Auvinen, who killed eight at Jokela High School in Finland in November 2007 before turning his gun on himself;2 Vladislav Roslyakov who killed 20 and injured dozens more in October 2018 in Kerch, Crimea;3 and 18-year-old Arda Küçükyetim, who stabbed five people in a tea garden near a mosque in Turkey in August 2024.4 Statements throughout the document point to years of research and preparation by Rupnow, with references suggesting that her interest in mass violence dated back as far as 2020, four years before the shooting.
In the immediate aftermath of the attack, Rupnow’s online history, pictures, and social media accounts were swiftly documented, and dedicated archival websites were launched to preserve every detail of her digital footprint. For many of these amateur investigators, interest in Rupnow after her death was an attempt to better understand an act of wanton violence, but for a few, it was an act of admiration for someone continuing a lineage of infamous but exalted murderers.
This is not a unique phenomenon. Rupnow and her admirers exist as part of a larger fandom centered on perpetrators of mass shootings and similar acts of violence. Just as Rupnow was inspired by the shooters who came before her, her final act added to the same pantheon of death and has already been taken up by a community that uses her memory to motivate others to do the same.
A month after her attack, Solomon Henderson, a 17-year-old student at Antioch High School in Nashville, Tennessee, murdered one student and left another wounded. Henderson repeatedly idolized Rupnow in his journals and delighted in the fact that one of her X accounts had followed him. When Rupnow had posted her last photo from the school bathroom, an account connected to Solomon responded: “Livestream it.”5
Rupnow’s influence cascaded further. In September 2025, Desmond Holly injured two students at Evergreen High School in Colorado before taking his own life. While Holly did not leave a manifesto or note, his social media account on TikTok was known for espousing antisemitic conspiracy theories and is littered with symbols associated with far-right extremist movements. On the same account, he attempted to recreate an image that Rupnow had posted before her death6 and donned a shirt reading “wrath,” a nod to the outfit worn by Columbine shooter Dylan Klebold.7
Rupnow, Henderson, and Holly were all part of the same informal online ecosystem, which self-identifies as the True Crime Community (TCC). While predominantly researched in the U.S. context, TCC-linked violence has metastasized globally, with documented cases across Europe, Asia, and Latin America. In November 2025, a bombing attack against a public high school in Indonesia injured 97 students as they gathered for afternoon prayers. The alleged perpetrator, a 17-year-old student at the school, detonated seven IEDs. Images from the attack show that he carried several replica rifles with him that day8 that referenced previous attacks in Columbine, Christchurch, Quebec City, Macerata, and other locations. On TikTok, the perpetrator posted a video appearing to imitate Rupnow. In the video, filmed in a school bathroom, he makes the “OK” hand gesture and captioned it, “here it comes.” Notably, the post included hashtags commonly used by the TCC to share content.
The true nature of these cases, often seemingly disparate in geography, target selection, and surface ideology, becomes fully intelligible only when analyzed through the lens of the TCC. What initially appears as random violence or isolated personal grievance reveals itself as participatory engagement in a transnational subculture where attacks function as symbolic contributions to a collective narrative.
This article proceeds in four parts. The first section defines the online community that is inspiring young attackers to commit acts of violence, situating this phenomenon within emerging research on nihilistic violence (NV) and participatory memetic violent extremism. The second section maps the layered structure of the TCC. As the TCC consists of a broad category of people, the different layers of engagement have been divided into tiers that range from mainstream true-crime content consumption to violent sub-clusters, and outlines how individuals can move through these tiers. The third section of the article explores recurring themes in the profiles of TCC-linked perpetrators. The final section considers what the structure, origin, and modus operandi of the TCC means for researchers, platforms, and security officials.
Defining the True Crime Community
The fluid, decentralized structure of the TCC complicates efforts to quantify it. Estimates of TCC-linked violent plots vary considerably, while available data remains fragmented across national and international jurisdictions, limiting comprehensive assessment. The Institute for Strategic Dialogue (ISD) has counted at least 15 different attacks and plots between January 2024 and September 2025.9 The authors’ own dataset similarly identifies 21 TCC-linked attacks and plots across 2024-2025.b Of all violent attacks and plots ISD studied in 2024 within the United States, about two-thirds of victims (deaths and injuries) were inflicted by TCC-linked perpetrators.10 Indications of the network’s growth and influence beyond Western contexts has also emerged: The Head of the Indonesian National Police’s Criminal Investigation Unit, Commissioner General Syahardiantono, highlighted that in 2025 the national police’s anti-terror squad had dealt with 68 children exposed to violent extremist ideology through the TCC “with an action plan targeting the school environment and their colleagues.”11
While these figures provide a partial indication of scale, a clearer picture emerges when examining how these plots are enacted. Violent acts linked to the TCC often refer and call back—explicitly or implicitly—to other violent acts that are TCC-linked or claimed as part of TCC lore, such as the Columbine High School shooting. Connections to the TCC are often signaled through manifestos that reference well-known perpetrators, online communications in TCC spaces prior to an attack, and the deliberate imitation of mannerisms, symbols, clothing choices, and inscriptions on weapons. These cues are rarely incidental; perpetrators make their affiliation with the TCC, or with a specific subcommunity within it, legible through a shared symbolic language.
Crucially, these signals are not primarily directed at external audiences; they are aimed inward, toward the TCC itself. Manifestos, symbols, and references such as gun inscriptions or clothing choices mimicking other perpetrators are only fully intelligible to those deeply embedded in these online communities. The meaning of the perpetrator’s outfit choice, mannerisms, and symbols is often layered and requires onlookers to be ‘in the know’ about prior attacks and the collective mythos of the TCC. TCC-linked violent plots are thus deeply performative acts of violence, where recognition by fellow participants is fundamental to the execution of the act.
The participatory nature of TCC-linked attacks is not unique to this online subculture. Far-right extremist attackers have similarly explicitly positioned their violence within a chain reaction and as part of a larger narrative of a transnational far-right movement. One in-depth study of the Buffalo, New York, terrorist attack finds: “There is a kind of ‘wiki effect’ to these attacks, with each individual attacker contributing to the larger product of the far-right extremist movement.”12 Specifically, the Buffalo shooter copied large portions of the Christchurch manifesto and stated Brenton Tarrant “started everything you see here.”13
The TCC can be situated within an emerging classification of violence often described as nihilistic violence (NV) or nihilistic violent extremism (NVE). This category encompasses individuals who encourage, glorify, investigate, disseminate, and ultimately commit acts of violence in the absence of a clear or distinct ideological motivation. Although such violence may appear senseless, it reflects the dynamics of a social ecosystem composed largely of young, disaffected individuals who elevate suicidal ideation with a final act of retributive memorialization. While the TCC draws on older gore and true crime fandoms that long predate online platforms,c its contemporary, networked form has become a significant vector for radicalization and violence.14
The referential component of violent acts linked to the TCC, and NVE milieus more broadly, has led some scholars to coin the concept of participatory memetic violent extremism, “a form of violence that is a symbolic statement of affiliation with or participation in groups that valorize violent or transgressive action, either as an end in itself or for its perceived social and cultural significance, in lieu of any clear strategic, political, or ideological goal.”15 TCC-linked acts can be understood as participatory, aiming to further expand the TCC patchwork of narratives and legends through the performance of violence. In this case, radicalization to offline violence signifies a shift from consuming and producing content to actively seeking to further the TCC.
Drawing on the authors’ own dataset and previous analysis by ISD16 of TCC-linked plots and attacks, a pattern of temporal clustering becomes evident. School shootings linked back to the TCC appear to inspire others to commit similar attacks, giving credence to the argument that participatory motivations are driving TCC-linked attacks. This recreative effort is not unique to the TCC; similar processes have been identified in other violent actors across a range of ideological contexts. Research employing “self-exciting” models to assess the occurrence of certain types of terrorist violence has noted that one attack increases the likelihood of another.17 While this occurrence is not universal across all attack types and tactics, it speaks to a similar pattern of behavior observed within TCC and broader NVE communities.18 TCC is thus dangerously self-sustaining; each TCC-linked violent attack prompts a new wave of fandom content and engagement, which in turn further fuels the legend of TCC, spurring on people seeking to participate, mimic, and expand it.
a 15-year-old shooter killed two individuals and injured six others there. (Scott Olson/Getty Images)
Scoping Out the Digital Phenomenon
Many of the behaviors observed in the TCC are not novel. Obsessive fandoms that venerate perpetrators and minimize their guilt predate the internet. Online, some of the most active and enduring fandoms of this kind developed around the Columbine perpetrators in the late 1990s and early 2000s.
Indeed, the “Columbiner” fandom can be thought of as a precursor to the TCC. “Columbiners” emerged on early message boards in the months after the April 1999 attack and expanded with the growth of social media, effectively establishing a template for other shooter fandoms. It was later, with the growth of social media engagement among young people in the late 2010s, that the TCC emerged. While there is no date that signifies its creation, the TCC is part of what has been dubbed the online “edge sphere” that began to take shape between 2018 and 2020 and has become a multitude of misanthropic online communities that engage in the deliberate erosion of social norms and glorification of violence.19
TCC is a layered online fandom. As membership or affiliation is organized around shared fascination with crime and perpetrators rather than adherence to a single doctrine, the boundaries between benign interest, glorifying fandom, and violent advocacy are porous. This weak layering creates comparatively low friction pathways from casual engagement to ideological learning, emulation of TCC cultural practices, and, for a small subset of individuals, radicalization to violence. The following discussion outlines the visible, mainstream layer of the TCC, then traces the progression toward more insular and violent subcommunities.
Tier 1: Mainstream True Crime Consumption
At its most visible layer, the TCC is a popular media genre centered on interest in and investigation of real crime cases. Online content spans blogs, podcasts, videos, opinion pages, and documentaries that regularly reach mass audiences. Participants consume and produce deep‑dive case analyses, timelines, “fact files,” and reconstructions of how offenses were planned and carried out. Some spaces collate and repost primary materials such as court documents, crime‑scene photographs, and, occasionally, perpetrators’ manifestos. Their motivations are varied: curiosity, entertainment, an interest in forensic methods, or a desire to ‘solve’ unsolved cases. While these practices raise important ethical questions about victim privacy and the commodification of suffering, in the vast majority of cases, it does not serve as a gateway to extremist activity or radicalization.
Nonetheless, this hobbyist, mainstream TCC serves as the broad catchment area from which more concerning forms of engagement can emerge. Platform recommendation systems and user search behaviors can draw individuals toward more graphic and transgressive material.20 What begins as an interest in historic cases or high-profile incidents can, for a minority of users, evolve into sustained engagement with perpetrator-centered narratives and highly visual depictions of violence. This phenomenon has previously been described as a “dark fandom” by the Information Network Focus on Religious Movements (INFORM), defined as “a group of people united by their fascination with individuals who carried out, and/or events that culminated in, an act of violence or atrocity.”21 While many fandoms, including dark ones, remain benign at an individual level, they are inherently participatory. Consumers of this material frequently become producers, contributing to a social environment that can, at best, offer a sympathetic and sanitized portrayal of perpetrators and, at worst, actively encourage others to emulate their actions.
Tier 2: Fandom and Parasocial Identification
The second, more concerning tier is characterized by a shift from analytical interest in crimes to fascination with, and sometimes admiration for, the perpetrators themselves. Participants form parasocial relationships with offenders, reframing them as misunderstood anti-heroes, tragic figures, or objects of romantic interest. The focus moves to understanding the logic of an offense and empathizing with the offender. Practices in this tier include the production and circulation of fan art, fan fiction, and aesthetic edits centered on perpetrators; the emulation of their clothing or personal style; attempts to contact them in prison; and the dissemination of their manifestos, diaries, or personal writings. By creating a fanbase around perpetrators, elevating them to celebrity status, the process of glorifying their actions is set in motion.
Online users in this tier often constitute the most visible and prolific posters in TCC spaces, generating the bulk of content associated with known TCC hashtags on platforms including TikTok and Tumblr. While the material is transgressive and celebrates individuals who caused mass harm, it rarely meets the threshold for imminent concern, as it typically lacks explicit intent or demonstrated capability, and is likely not to be acted upon by moderation or trust and safety teams.
As in many online subcultures, video games that include creative and world-building elements are used to construct digital spaces where members can interact and expand on their common interests. For the TCC, games popular with young audiences, such as Minecraft and Roblox, are used to recreate significant locations or events related to mass acts of violence. Gameplay of these recreations are frequently recorded and reshared on other social media platforms, complicating moderation efforts.22 This tier does not explicitly engage in the promotion and encouragement of future shooters, but remains in close proximity to those who do, often circulating material created by those in more radical tiers.
Graphic footage is more prevalent in this tier, including livestreams of attacks, bystander footage, and photographs of victims or deceased perpetrators. There is significant overlap in the TCC with dedicated gore communities, and gore content is frequently shared among its members. At this tier, this material is often edited with filters and music, transforming documentation of atrocities into entertainment and tribute material. The accessibility of AI-enabled editing tools has amplified this production. These tools have enabled the rapid generation of multiple variants that evade hash-based content moderation systems, substantially expanding the circulation of graphic footage across platforms.23
While content may at first glance appear distasteful but harmless, this tier warrants substantially greater scrutiny from trust and safety teams and violence prevention practitioners for several interconnected reasons. Firstly, the celebration and idealization of perpetrators fundamentally desensitizes users to the gravity of the acts undertaken. Content that would initially provoke shock or moral repulsion becomes normalized in the TCC ecosystem through repeated exposure, with some research suggesting that this could lead to reduced emotional reactivity and empathic responses.24 Users apply invented attributes for perpetrators, fabricate relationships between them, create alternative narratives of their motivations, and humanize them through fictionalized portrayals, which helps to sanitize or minimize the horrors they inflicted. Furthermore, the average age of active participants is concerningly young, with evidence indicating considerable adolescent and even pre-adolescent engagement. Prior to content moderation interventions, the TCC tag on Tumblr featured numerous “introduction posts” where users presented themselves to the community. Monitoring conducted by the authors in November and December 2025 on Tumblr indicated that the majority of these users self-identified as under 18, with many explicitly reporting ages between 13 and 16. Matthew Kriner, the managing director of the Accelerationism Research Consortium, has reported similar numbers, stating that most individuals fall in the range of 13 to 18.25 While this does not suggest the entire TCC comprises minors, it underscores that key online spaces hosting this content feature a high prevalence of young users who are then interacting with and forming identities around disturbing material in these instances.
An additional, often-overlooked feature of the TCC is that, in certain online spaces, it functions as an interactive and participatory community rather than a loose collection of individuals consuming the same media. Participants develop ongoing relationships, recognize familiar usernames, and attribute status to particular contributors. Based on the authors’ observations, there are informal hierarchies and roles: Some users are known for producing the most detailed case analyses; others for creating the most visually striking edits, the most graphic content, or the most provocative commentary. For certain participants in the TCC, initial curiosity about crime or a single case may have drawn them into the TCC, but it is this sense of belonging, of having online friends or being recognized and validated, that keeps them there.26 In environments where attraction to perpetrators or fascination with extreme violence would be stigmatized offline, the TCC offers a rare space where such interests can be discussed openly and even celebrated.
While Tier 2 participation does not inevitably lead to violence, it constitutes a critical intermediate stage in documented radicalization pathways.27 Multiple TCC-linked school shooters progressed through fandom engagement before operational planning. Natalie Rupnow, for example, was known to members of the community and active in TCC fora,28 and Damian Haglund kept a blog idolizing the Columbine perpetrators.29 The volume and visibility of Tier 2 activity make it both the most observable manifestation of TCC culture and a critical intervention point.
Tier 3: Violent Sub-Clusters
The third tier consists of tighter-knit, more violent sub-clusters that overlap significantly with extremist spaces. Individuals in this tier continue to exchange violent material, often repackaged and redistributed from video‑streaming platforms that apply minimal or no moderation and are widely known for hosting gore content. These sites themselves have evolved into fringe social networks, providing follower systems, chat functions, and recommendation loops.30 Users often seek out these spaces after determining that ‘mainstream’ TCC content is no longer violent enough.
This tier is also where private chats form on semi-closed platforms including Telegram and Discord, often splitting into invite‑only or access‑controlled channels where users feel a greater sense of anonymity and impunity. For instance, Dylan Butler, the 17-year-old suspect in the Perry High School shooting in Iowa, was part of a chatroom dedicated to discussing school shootings on Discord, which was flagged to law enforcement before the attack.31 These spaces are much harder for researchers to observe, being small, tight-knit, and often closed communities. Within these spaces ambivalence about violence frequently emerges: Some members mock prospective attackers as “LARPers” (role‑players) who will never act, while others explicitly encourage escalation and frame carrying out an attack as the only way to achieve status and authenticity. High‑casualty attacks are held up as the ultimate legacy, and users pressure one another to prove commitment by moving from online performance into real‑world action. Here, participation involves not only consuming and producing content but also actively negotiating thresholds between fantasy, threat, and intent.
These dynamics also create competitive pressures. In communities accustomed to graphic and shocking material, producing content that stands out often requires being more explicit, extreme, or transgressive than others. This leads to a social contest that encourages participants to push boundaries, leading to an escalation in the gore, cruelty, or intensity of posts. The result is a feedback loop in which the most extreme contributions are rewarded with attention and status, further pulling the normative center toward the margins. This same behavior has been observed in other extremist networks and is often a key feature of NV communities. Groups associated with NV child extortion networks, like the 764 Network or the Sextortion Com network, will goad one another into coercing victims into increasingly harmful and damaging practices of self-harm, zoosadism, creating child sexual abuse material (CSAM), and even suicide.32 The more graphic the material, the more it raises the perpetrator’s standing among their peers. Another example can be found within certain branches of the left-hand path occult belief system referred to as the Order of Nine Angles (ONA). An American offshoot of the ONA, Tempel ov Blood, produced its own books and magazines through its publisher Martinet Press. Many of these texts contain graphic scenes that depict child sexual abuse, violence, and sexual assault. These texts were meant to desensitize readers against extreme violence.33
Of particular concern is that the authors have observed that some TCC-linked attacks no longer gain notoriety in these spaces, often when the perpetrator is deemed to be too performative, the attack is insufficiently lethal, or the perpetrator’s profile does not fit the idolized norm. This narrow definition of what constitutes an act of violence worthy of being absorbed in the TCC mythos pressures perpetrators to design attacks that are at once more spectacular, lethal, and symbolically resonant.
While this third tier represents a small fraction of the total TCC, it is significant from a security perspective because it reflects intentional orientation toward action, not merely rhetoric. Although not all online expressions of intent culminate in actual attacks, the presence of such intent, combined with social reinforcement within tightly networked communities, may increase the likelihood of progression from thought to action. Effective mitigation therefore requires not only the identification of explicit threats but also a nuanced understanding of how community dynamics and the normalization of violence shapes the perceptions, motivations, and risk trajectories of susceptible users over time.
Tier 4: Escalation to Offline Violence
Tier 4 comprises an extremely small subset of individuals who progress from online participation, ideation, planning, and community encouragement into actual commission of violence. Ideology may feature into the escalation to offline violence but is not what binds TCC-linked perpetrators.
The TCC is an ideologically heterogeneous online community, bound more by fandom than by a common belief system. As such, it does not lend itself to a traditional lens of ideological radicalization to understand the pathways to offline violence. This does not mean that TCC-linked violence is entirely non-ideological; online extremist ideas circulate widely, and the influence of violent ideologically motivated networks on the TCC cannot be discarded from the assessment of the radicalization path of an individual perpetrator.
TCC-linked violent acts have been carried out by both ideologically driven individuals, such as neo-Nazis or white supremacists, and by perpetrators whose manifestos reflect extreme, wide-ranging hatred without a coherent, singular ideology.d An illustrative example is Solomon Henderson, whose writings reveal influences from multiple online subcultures and far-right figures, while expressing deep-seated animosity toward Black people, Jewish people, trans individuals, and Muslims. He credited certain far-right political pundits and conspiracy theorists as having shaped and “radicalized” him, though the sincerity of these claims should be viewed skeptically. However, it does demonstrate clearly how TCC-linked actors may draw on a patchwork of extremist ideas rather than a single ideological framework.
Within the fandom culture of TCC, the ideology of a specific venerated perpetrator is usually tangential to the fascination with the attack and perpetrator itself, including the theatrics of violence, the perpetrator’s personal life and operational planning process, as well as specific mannerisms. Frequently, a shooter’s ideology (coherent or not) is not the primary focus of fandom discussions and content disseminated after a new TCC-linked attack.34 Instead, TCC participants start to identify and archive the perpetrator’s digital footprint; reshare any diaries, manifestos, or footage; and generate content for the community’s consumption. Mass shootings of all ideological stripes are incorporated into the TCC ‘pantheon,’ with attention often correlated more strongly with the scale of the attack than with its ideological content. Figures such as Anders Behring Breivik and Brenton Tarrant are idolized for the lethality of their attacks, but the ‘success’ of the action is not always measured in body count. Individuals like Rupnow and Henderson, by comparison to other perpetrators, failed to achieve their goals of killing large numbers of people. This does not diminish the tragedy of the attacks, and what has granted them significant status within the TCC is the media attention and messages they left behind.
Henderson’s esoteric, meme-laden manifesto and his recreations of self-portrait pictures taken by other perpetrators have sustained his memory within the community and media. Similarly, a selfie taken in a mirror unrelated to her attack and the picture taken by Rupnow in the bathroom stall before her assault have been replicated repeatedly by other attackers.
In November 2025, a 17-year-old student detonated improvised explosive devices (IEDs) at a North Jakarta high school, injuring 96 people. In social media posts, the perpetrator used TCC-linked hashtags on their TikTok content in videos depicting the school. In a TikTok post, shared the day before the attack, the perpetrator posted a picture showing a hand making the “OK” sign and their boots, a likely homage to Rupnow and other past killers who created similar pictures.35
Recurring Themes in Perpetrator Profiles
Across the TCC, the focus on notoriety, spectacle, and emulation shapes not only the fandom culture but also patterns among the perpetrators themselves. Despite variation in ideology, certain characteristics and motivations consistently appear among the individuals who commit TCC-linked attacks. These patterns are evident not only from public investigations into violent acts, but also through analysis of manifestos, social media activity, and other digital traces left by the perpetrators. The following section is based on a review of the manifestos of TCC-linked perpetrators and would-be attackers as well as their digital footprint and information released by investigators related to their cases.e
Misanthropy: In all manifestos and/or digital footprints reviewed by the authors, deep-seated misanthropy was present in the perpetrator and was positioned as the underlying motive and justification for committing violence. This hatred for humanity and society was sometimes tied to other ideological influences that seemed to have shaped the perpetrator, such as accelerationism or white supremacy, but was more often expressed as a self-contained belief, in which society and fellow human beings are portrayed as hostile and antagonistic to the perpetrator and therefore worthy of contempt and violence. While some perpetrators explicitly expressed this in their manifestos, others used dehumanizing language and displayed a general sense of hostile and sometimes self-imposed alienation from society.
Poor mental health and self-perception: In almost all cases, signs of poor mental health and self-perception were present. This aligns with psychology studies on the mental health of school shooters more broadly. According to one study, over 70% of school mass shooters had experienced some form of childhood trauma, which can include abuse, neglect, or household dysfunction.36 The pattern of poor self-esteem also squares with the young age of the perpetrators, typically teenagers, going through major identity and physical changes.f Suicidal ideation was present in multiple attackers, who also admitted to self-harm. In the case of Henderson, there were specific references to his appearance and ethnicity in his manifesto, which he said undermined his confidence. Much of the hatred and frustration expressed toward society in their misanthropic statements are simultaneously directed at themselves. In Henderson’s manifesto, he encouraged others not just to commit suicide but rather murder others first. This indicates the inwardly and outwardly destructive motives of TCC-linked acts.
Personal grievances and frustrations: Analysis of the manifestos, diaries, and digital footprints of perpetrators indicates that they experience deep personal frustration and see themselves as victims of unfair treatment. Multiple attackers bring up family issues, including accusations of neglect and abuse but also simple acknowledgments of an unstable home life. Grievances also emanated from experiences of isolation and social exclusion. In the case of the SMAN 72 school attacker in Indonesia, investigators indicate that bullying was likely a factor that drove the perpetrator to violence.37 Other would-be attackers and perpetrators, including Damian Haglund and Dylan Butler, for example, were allegedly bullied. Haglund left various notes to be discovered by law enforcement and his family after he left for his middle school in Wisconsin in May 2024 with an air rifle and was neutralized before injuring anyone, one of which clearly hinted at his isolation, stating: “I never thought I’d be leaving a suicide note. ‘Where was I on May 1st?’ There’s other kids out there like me too. Maybe, say hi to someone once in a while.”38
Engagement with gore: Many of TCC-linked perpetrators engaged with gore websites, with multiple perpetrators active on the same website. NVE scholar Marc-André Argentino has identified the link between the TCC and gore communities, coining it the Gore Crime Community, indicative of the porous borders between these communities. In his analysis of the Annunciation Church shooting (described later), he writes that “gore communities seed raw files, while true-crime fandoms act as discovery engines that route curious viewers outward to less regulated hosts.”39 The symbiotic relation between these two parts of the “edge-sphere” may further explain the self-sustaining nature of TCC. Two female high school students were arrested on February 12, 2026, after it was revealed the pair had been allegedly planning a shooting at a Shelbyville, Indiana, high school. Alexis Pickett’s mother reported her concerns to law enforcement after she began to suspect her daughter intended to harm herself or others. Pickett was an active participant in TCC social media. Her alleged accomplice, Melanie Little of Corinth, Mississippi, had received videos from Pickett showing the hallways of the school and they had begun to acquire firearms. Pickett was reported to be an active participant in the TCC on social media,40 and to have been in possession of a “shit ton of gore.”41
Linked to other harm and extremist groups: Perpetrators often have links to other online harm and extremist groups. Soyjack Violent Attacker Fandom (SAVF) is one such example: A cluster where predominantly young users share highly graphic memes, child sexual abuse material, and inside jokes that trivialize or celebrate extreme violence. SAVF is a community that emerged from an image board, similar in design to 4chan, and has participants on niche online spaces in most major social media platforms such as Bluesky, Discord, Instagram, Minecraft, Roblox, Stream, Telegram, Threads, TikTok, and X, according to some researchers.42 Solomon Henderson, Arda Küçükyetim, and Natalie Rupnow have all been identified as having connections to SAVF, with Henderson making direct references to the community in his journal and manifesto.43
In sum, TCC-linked perpetrators of violent acts experience deep misanthropy, which often collides with personal grievances and feelings of exclusion. While various ideologies seem to have impacted perpetrators—notably, white supremacy, accelerationism, and neo-Nazism—the overarching motivation appears to stem from adding to the collective TCC mythos and gaining recognition within the community. The pull of TCC and participating in the expansion of the mythos is clearly tied to these perpetrators’ deeply entrenched sense of exclusion and maltreatment, often coming from unstable households, struggles with mental health issues and experiences of social exclusion, leading toward a very individualistic, self-centered quest for notoriety rather than having an impact on any given ideological goal.
Future Considerations
The fluidity of the TCC makes it difficult to fit into traditional counterterrorism frameworks organized around discrete ideological categories. Individuals participate because they are fascinated by crime, violence, or particular perpetrators, not because they subscribe to a formal doctrine at the point of entry. Within the same online spaces, members may hold varying political views and fragments of multiple ideological traditions. Individuals also move in and out of TCC ecosystems, making the size and scope of the problem difficult to measure.
While TCC and participatory memetic violent extremism writ large thus drastically differ from other forms of violent extremism, many primary, secondary, and tertiary interventions continue to be relevant. In the opinion of the authors, some of the main challenges to the study and prevention of TCC-linked violence include definitional fuzziness, inadequate content moderation and terms of services, and the under-exploitation of leakage (the tendency of prospective attackers to communicate their violent intentions prior to committing violence) as a key intervention opportunity.
Definitional Fuzziness
The definition of NVE used by U.S. law enforcement is, in the view of the authors, too broad to be useful in understanding and mitigating the harms posed by NVE communities. The FBI defines NVEs as “individuals who engage in criminal conduct in furtherance of political, social, or religious goals that derive from the hatred of society and a desire to bring about its collapse by encouraging social instability.”44 In the view of the authors, nihilistic violence should have a narrower and specific definition in order for it to be useful as a designation of a specific type of targeted violence—one that deprioritizes ideology as the primary motivator for targeted violence. As other researchers have indicated, this definition easily could encompass white supremacist movements, like far-right militant accelerationism, or jihadi terrorist groups.45 Both harbor an intense hatred for society and seek to enact a political or religious goal through violence. Unlike belief systems that seek to support or carry out violent action as part of a broader goal or political aim—for instance, militant accelerationism seeks to exacerbate existing tensions in society in order to bring about a collapse that will lead to the creation of a new society—NVE seeks violence for its own sake, aiming to cause harm, earn recognition from their social ecosystem, and gain infamy from the public. This definitional overreach has practical consequences. If NVE is not clearly differentiated from ideologically structured forms of extremism, it becomes difficult for practitioners to identify the specific risk factors, mobilization pathways, and intervention points associated with violence that is not primarily ideology-driven.
Inadequate Content Moderation and Terms of Services
The authors’ research finds that the volume and visibility of Tier 2 activity make it both the most observable manifestation of TCC culture and thus a critical intervention point. Currently, many TCC-affiliated accounts openly share violent material and have proven adept at adapting to moderation efforts. The authors have observed users employing a range of tactics to circumvent platform controls, including applying filters or blurring effects to disguise livestreams of attacks, using coded language and slang to evade keyword and search‑term blocks, and reproducing attack footage on gaming platforms.
This resilience to moderation is evident in the authors’ observations from January 2026, when TCC‑aligned accounts publicly expressed frustration that keywords and phrases associated with their network were being blocked in searches and related material was being removed on Tumblr.46 In response, community members quickly adopted alternative signifiers, including emojis, altered spellings, and coded lexicons, to continue connecting and producing content despite heightened moderation. Resilience to moderation efforts is not unique to the TCC, with many of the evasion techniques used by TCC participants to continue its presence on its preferred social media platforms are tried and tested methods by online Islamic State supporters.47
To navigate and manage this dynamic, the authors suggest that platforms couple keyword filtering and human review with sustained trust and safety teams capable of interpreting layered, context‑dependent messaging that is explicitly designed to evade automated detection. While banning tags and removing harmful fandom content are useful tools, moderation must be continuous and informed by a nuanced understanding of how tactics, language, and platform use evolve over time to remain effective.
In the view of the authors, platforms should also strengthen and consistently enforce terms of service that explicitly prohibit hosting, promoting, or monetizing gore content, including time-of-death imagery and material produced by perpetrators themselves. Clear prohibitions should extend to the re-uploading and remixing of such footage, closing the gap that currently allows users to circulate graphic material as aesthetic edits, memes, or tribute videos that evade moderation. Platforms should treat persistent dissemination of such material as a priority harm category rather than a peripheral policy issue. With reduced investment in trust and safety teams and technology, and slower detection systems, safeguards are currently behind the rapid spread of viral gore.48
In parallel, regulators and platforms should pay more attention to the ease with which young users can access dedicated gore websites, including through search engines and link-sharing in mainstream social media environments. Because TCC-linked radicalization pathways move users from relatively mainstream content to gore-heavy subcultures, platforms should treat patterns of outbound linking to known gore hosts as a warning signal, triggering human review, friction measures, and, where appropriate, referrals to specialist prevention services.
Under-exploitation of ‘Leakage’
A critical phenomenon observed across multiple Tier 4 perpetrators is what threat assessment professionals term ‘leakage’: the tendency of prospective attackers to communicate their violent intentions, either directly or through disguised references, prior to committing violence. In multiple instances, teachers, parents, and caregivers have noted that prior to attacks, perpetrators of mass casualty attacks expressed subtle and explicit indicators of their intent. Robin Westman, the perpetrator of the August 2025 attack against the Annunciation Church and school in Minneapolis, Minnesota, gave such an indication in their own coded diary that they revealed to the public via their YouTube channel: “I want someone to stop me, but they won’t. No one sees it.”49
This is particularly pronounced in the TCC due to the emphasis on community validation and being part of a TCC lineage of perpetrators who released manifestos and personal documents before their attacks. Leakage has already been responsible for mitigating planned attacks, allowing law enforcement to intervene before attacks can be carried out. On September 5, 2025, Ukrainian law enforcement, acting on intelligence provided by U.K. authorities, detained a 15-year-old student planning an attack at a secondary school in the Transcarpathia region (Zakarpattia Oblast). The perpetrator had posted detailed threat messages on social media platforms specifying his intentions to commit a knife attack and to livestream the assault.50
Conclusion
In conclusion, the TCC is a digital subculture that has grown out of a fusion of popular media and extremist communities. Proliferating online, individuals provide support in the finding, consumption, and potential radicalization through materials related to mass killers. The TCC illustrates a form of digitally mediated participation in which violence becomes a symbolic language rather than an ideological act. Its tiered structure shows how individuals may move from mainstream true-crime interest into more insular, transgressive subcultures that celebrate perpetrators and aestheticize harm. Although only a small fraction of participants progresses to violence, the participatory logic of the TCC, and specifically its emphasis on recognition and shared lineage, helps explain how certain individuals come to view violent acts as a form of self-expression within a broader narrative.
The authors’ dataset of TCC-linked plots and attacks examined throughout this article reveal patterns that diverge from conventional models of radicalization. Rather than adhering to an ideological doctrine, TCC-linked perpetrators often operate within a hybrid environment where misanthropy, personal grievance, identity struggles, and online subcultural norms intersect to create a sense of the normalization of violence. Perpetrators frequently draw on prior attacks for meaning, creating a recursive cycle in which violence produces material that is then absorbed back into the community. This self-referential, Ouroboros-like cycle has effectively created ‘chains’ of TCC-linked perpetrators, where one incident inspires many others. This highlights the importance of understanding TCC-linked harm as a networked phenomenon.
The fluid boundaries of the TCC complicate efforts to determine its scale or define its contours. Engagement is not static or exclusive: Participants move between platforms and blend practices from adjacent online subcultures. Taken together, TCC-linked violence points to the need for conceptual frameworks that can account for a form of violence driven not by coherent ideology, but by the desire to contribute to a shared mythos of the TCC. CTC
Peter Smith is a journalist and a researcher at Militant Wire. His work has appeared in CTC Sentinel, Lawfare, Nikki Asia, Militant Wire, and other publications specifically examining the propaganda, tactics, and violent action produced by militant groups and extremists.
Cat Cadenhead is a Threat Intelligence Analyst at Tech Against Terrorism, where she conducts OSINT monitoring and analysis to help disrupt terrorist use of the internet. Her work includes producing intelligence-led threat reporting and alerting tech platforms to the presence of terrorist content on their services.
Clara Broekaert is a research analyst at The Soufan Center where she focuses on terrorism, foreign interference, and technology.
© 2026 Peter Smith, Cat Cadenhead, Clara Broekaert
Substantive Notes
[a] In a December 2024 X thread, journalist Anna Slatz (@Slatzism) claimed to have obtained and verified the alleged manifesto of the Wisconsin school shooter through contact with an individual described as the shooter’s online boyfriend, who Rupnow is not believed to have ever met in person. Excerpts of the manifesto repeated in a criminal complaint against Jeffery Rupnow, Natalie Rupnow’s father, contain quotations that match the document. See Slatzism, “I have made contact with the alleged boyfriend of the Wisconsin shooter …,” X, December 16, 2024.
[b] The authors compiled a dataset documenting TCC-linked attacks and foiled plots observed since January 2024. As of January 1, 2026, the dataset contains 21 entries, nine of which were foiled plots, involving a total of 23 perpetrators or would-be perpetrators with a median age of 17. Across these incidents, the authors recorded 23 fatalities and 186 injuries. Geographically, 15 attacks or plots occurred in the United States, with additional cases in Malaysia (1), Indonesia (1), Russia (1), Austria (1), Ukraine (1), and Mexico (1). These figures should be understood as a minimum baseline rather than a comprehensive count. Two structural limitations contribute to the incompleteness of the dataset. First, media and law-enforcement reporting often does not employ the ‘true crime community’ (TCC) label even when cases exhibit characteristics consistent with TCC-linked radicalization, making systematic identification difficult. Second, many investigations remain partially or fully classified, limiting publicly available detail. For example, although the Indonesian police chief publicly stated that 68 minors were identified in 2024 for their involvement in TCC-linked violent plotting, the authors were unable to locate additional reporting or case-level information that would allow inclusion of these incidents in the dataset.
[c] The phenomenon of glorifying and romanticizing violent criminals, also known as “hybristophilia,” has a long pre-internet history, particularly around serial killers and other mass casualty killers. The serial killer Ted Bundy received numerous love letters from women and had ‘groupies’ attend his trials. Sue Klebold, the mother of one of the Columbine shooters, indicated she was “receiving love letters to Dylan from young girls in the mail” after the Columbine High School shooting.
[d] The manifesto of the Antioch High School shooter shows polylateral hate rather than a coherent ideology. See Marc-André Argentino, “Narrative Examination of the Antioch High School Shooter’s Manifesto and Diary,” From the Depths, January 23, 2025. However, the manifesto of the Moscow Oblast school attacker, who stabbed a 10-year-old Tajik student, clearly indicates a white supremacist worldview in which Christianity is under attack by Muslims, Jews, LGBTQ+ people, and leftists. See Nordirbek Soliev, “The Moscow Oblast School Stabbing: Understanding Hybrid Radicalisation and Transnational Online Subcultures,” Global Network on Extremism & Technology, January 19, 2026.
[e] The authors’ dataset (see footnote b) includes 21 documented plots and attacks involving individuals linked to the TCC. Of these 21 cases, six involved publicly available manifestos, diaries, or notes authored by the perpetrator or would-be perpetrator. The remaining profiles of perpetrators were assessed through their archived digital footprints and publicly available court filings or investigative documents.
[f] The median age of perpetrators and would-be attackers is 17 according to the dataset compiled by the authors.
Citations
[1] Sarah Lehr, “One year later, first responders, medical workers reflect on Abundant Life shooting,” Wisconsin Public Radio, December 16, 2025.
[2] Associated Press, “Police: Finland Teen Shooter Left Suicide Note,” NBC News, November 8, 2007.
[3] Richard Arnold, “The ‘Russian Columbine’ Shooting in Crimea Highlights Youth Radicalization, Proliferation of Firearms,” Jamestown Foundation, Eurasia Daily Monitor, October 22, 2018.
[4] “Turkish Attacker Steeped in Neo-Nazism and Online Gaming Culture,” Global Project Against Hate and Extremism, August 14, 2024.
[5] Phoebe Petrovic and Wisconsin Watch, “Madison and Nashville School Shooters Appear to Have Crossed Paths in Online Extremist Communities,” ProPublica, January 24, 2025.
[6] “Evergreen High School Shooter’s Online Activity Reveals Fascination with Mass Shootings, White Supremacy,” Anti-Defamation League Center on Extremism, September 12, 2025.
[7] “Colorado School Shooting Highlights Extremism’s Deep Roots in Digital Radicalization,” Global Project Against Hate and Extremism, September 25, 2025.
[8] Munira Mustaffa, “Cosplaying Columbine: How Memetic Violence Transformed Southeast Asia’s Extremist Threat,” Global Network on Extremism and Technology, December 22, 2025.
[9] “Memetic Violence: How the True Crime Community Generates Its Own Killers,” Institute for Strategic Dialogue, October 2, 2025.
[10] “Online radicalization and the nexus to violence in the US: 2024 year in review,” Institute for Strategic Dialogue, July 18, 2025.
[11] “Densus 88 Tangani 68 Anak Terpapar Ideologi Neo-Nazi di 2025, Sasarannya Sekolah,” kumparanNEWS, December 30, 2025.
[12] Amarnath Amarasingam, Marc-André Argentino, and Graham Macklin, “The Buffalo Attack: The Cumulative Momentum of Far-Right Terror,” CTC Sentinel 15:7 (2022).
[13] Ibid.
[14] Ali Fisher and Arthur Bradley, Gore and Violent Extremism: An Explorative Analysis of the Use of Gore Websites for Hosting and Sharing Extremist and Terrorist Content (Dublin: VOX-Pol Network of Excellence, 2025); Marc-André Argentino, “True Crime Community – Fascination and Contagion & the Annunciation Church Shooting,” From The Depths, September 2, 2025.
[15] Joe Ondrak and Laura Vitelli, “Participatory Memetic Violence: Legend, Ostension, and Ideologically Diffuse Violence,” Global Network on Extremism and Technology, December 18, 2025.
[16] “Memetic Violence: How the True Crime Community Generates Its Own Killers,” Institute for Strategic Dialogue, October 2, 2025.
[17] Don Rassler, Nicholas Clark, and Sean Morrow, “Danger Zone: Terrorism Risk – Theory, Practice, and Evolution,” CTC Sentinel 18:11 (2025).
[18] Ibid.
[19] Marc-André Argentino, “Beyond the Headlines: Arrest Data and Drivers of Nihilistic Violent Extremism in the Com Network,” From The Depths, September 18, 2025.
[20] Joe Whittaker, Seán Looney, Alastair Reed, and Fabio Votta, “Recommender systems and the amplification of extremist content,” Internet Policy Review 10:2 (2021).
[21] “Cultic Fandoms: Columbine and Ted Kaczynski,” Inform (Information Network Focus on Religious Movements), Global Network on Extremism & Technology (GNET), August 9, 2023.
[22] Moustafa Ayad and Isabelle Frances-Wright, “Minors Exposed to Mass Shooter Glorification across Mainstream Social Media Platforms,” Institute for Strategic Dialogue, January 24, 2024.
[23] “Early terrorist experimentation with generative artificial intelligence services,” Tech Against Terrorism, November 2023.
[24] Sylvie Mrug, Anjana Madan, Edwin W. Cook 3rd, and Rex A. Wright, “Emotional and physiological desensitization to real-life and movie violence,” Journal of Youth and Adolescence 44:5 (2015): pp. 1,092-1,108.
[25] Odette Yousef, “Experts warn that recent school shootings show growth in new radicalization pattern,” NPR, March 8, 2025.
[26] Naomi Barnes, “Killer Fandoms Crime-Tripping & Identity in the True Crime Killer Fandoms Crime-Tripping & Identity in the True Crime Community,” Utah State University, May 2015.
[27] “From Gore to Hate: How ‘WatchPeopleDie’ Serves as a Gateway to Extremism,” Anti-Defamation League, August 21, 2025.
[28] “How the True Crime Community generates its own killers,” Institute for Strategic Dialogue, October 2, 2025.
[29] Associated Press, “Prosecutors won’t charge officers who killed armed student outside Wisconsin school,” WSAW, August 12, 2024.
[30] “Gore online: How violent content is reaching children and what you can do,” eSafety Commissioner, Australian Government, July 10, 2025.
[31] Ben Goggin, “Iowa school shooter appeared to be active on Discord and discussed ‘gearing up’ in moments before attack,” NBC News, January 7, 2024.
[32] Mike Levine, “’10 minutes of murder’: Why one family is speaking out about the online extremist network 764,” ABC News, November 18, 2025.
[33] “Dangerous Organizations and Bad Actors: Order of Nine Angles,” CTAC, September 29, 2023.
[34] Authors’ review of TCC content on multiple platforms including TikTok, BlueSky, and Tumblr between 2022 and January 2026.
[35] “Alleged Jakarta Bomber Leaves Behind Digital Trail Worshiping Past Racist Attackers,” Global Project Against Hate and Extremism, November 12, 2025.
[36] “Key Findings – Comprehensive Mass Shooter Data,” The Violence Project, Hamline University.
[37] Mustaffa.
[38] “Wisconsin Division of Criminal Investigation Initiating Case Report 24-2990,” May 1, 2025.
[39] Argentino, “True Crime Community.”
[40] “Shelby County teen arrested, charged as adult for alleged May school shooting plot,” WRTV, January 7, 2026.
[41] Jade Jackson, “Court docs: 17-year-old planned Shelby County school shooting on Discord,” Indianapolis Star, January 7, 2026.
[42] Jean Slater and Ry Terran, “Examining the Soyjak Attacker Video Fandom (Part I),” From the Depths, January 24, 2025.
[43] Authors reviewed Solomon Henderson’s 288-page diary and 51-page manifesto.
[44] “Farmington Hills Nihilistic Violent Extremist Charged with Producing Child Pornography,” U.S. Attorney’s Office, Eastern District of Michigan, U.S. Department of Justice, September 11, 2025.
[45] Steven Rai and Cody Zoschak, “Setting the Record Straight on Nihilistic Violence,” Just Security, July 1, 2025.
[46] Authors’ research on Tumblr and other platforms used by TCC participants.
[47] Moustaffa Ayad, “Exploit and Evade to Remain and Expand: The Cross-Platform Evasion Toolbox of Islamic State Supporters,” Global Network on Extremism & Technology, December 13, 2023.
[48] “Gore online: How violent content is reaching children and what you can do.”
[49] Argentino, “True Crime Community.”
[50] “UK internet user helps stop teenager launching deadly attack on Ukrainian school,” SkyNews, September 9, 2025.
