On Aug. 27, a shooter opened fire on the Annunciation Catholic Church in Minneapolis, which also serves as a school. Two children were killed and at least 17 other children and adults were injured. An initial NCITE review of materials purportedly produced by the attacker reveals common markers affiliated with online nihilistic violent subcultures.
In 2025, the FBI announced that they have over 250 open investigations across all fifty states into individuals affiliated with Nihilistic Violent Extremism (NVE). NCITE researchers examine NVE actors, tactics, and targets, making sense of this relatively novel form of extremism in light of this most recent tragedy.
THREAT ACTORS
|
TACTICS
|
TARGETS
|
| Examining cases of individuals charged with engaging in acts of Nihilistic Violent Extremism offers insight into the threat actors operating within this network. |
NVE threat actors use a range of novel and effective tactics to cause harm, amplified by their use of technology, social media, and online spaces to further their goals. |
Soft targets such as schools and churches are attractive targets for extremists because of their accessibility and security measures that are easier to circumvent compared with other targets. |
What is NVE?
The FBI describes NVEs as “individuals who engage in criminal conduct within the United States and abroad, in furtherance of political, social, or religious goals that derive primarily from a hatred of society at large and a desire to bring about its collapse by sowing indiscriminate chaos, destruction, and social instability.”
NVEs act as individuals or as part of a broader network that use social media to target vulnerable populations. Most NVEs operate largely online, using platforms like Discord and Telegram. In addition, they tend to be young, with the majority being under 25 and some under the age of 18. Some NVE networks (e.g., 764) target children and vulnerable individuals (e.g., those with mental health issues), increasing concern and attention from the public, media, and law enforcement. Nihilistic violence may vary in the strength and type of ideological motivation associated with it. Some of these common ideological motivations are shared at the network level, while others are specific to individual actors and the targets they select.
NCITE Insights — On NVE, Youth Recruitment and Mobilization
Listen to NCITE Research Associates Bettina Rottweiler, Ph.D., and Brenna Helm, ABD, discuss their burgeoning research on NVE and youth recruitment and mobilization to violent extremism. Read more about the research project.
Examining the Annunciation Attack
The shooter opened fire on churchgoers where students and parishioners were gathered for Mass during the first week of the fall school year. The 23-year-old attacker barricaded doors to the church before firing upon children in the pews.
The attacker uploaded videos containing journal entries, manifestos, and weapons customized by the attacker with an array of written messages. Messages were inscribed by the attacker across weapons, devices, and clothing referencing a range of violent extremists and associated movements, ncluding neo-Nazi and white supremacists movements, and violent online subcultures.
Ongoing research at NCITE examines the mobilization of young adults towards acts of nihilistic extremist violence. Through this research, NCITE has identified emerging parallels between the writings of the Minneapolis attacker and those present among nihilistic extremist communities. Numerous recent attacks, as well as foiled plots, have been connected to extremist subcultures of nihilistic violence online.
NCITE’s review of primary materials allegedly posted by the attacker revealed multiple notorious attackers referenced and written across the attacker’s firearms and gear. Examples of such references include, but were not limited to, perpetrators of the Sandy Hook Elementary School shooting, the Canadian École Polytechnique massacre, the Pittsburgh synagogue attack, and the Abundant Life Christian School shooting.
In the Minneapolis attack, the perpetrator's indicated a range of grievances and demonstrates risk factors seen in other violent extremists. Within this letter, the attacker states they had developed a “twisted mind” and wanted to carry out a final act against the world they had been ruminating on “for years”.
Threat Actors: Who Are NVEs?
In recent years, there have been a number of NVE terror attacks and arrests. A preliminary NCITE review of federal cases found more than two dozen arrests in the last few years that would squarely fall into the emerging analytic classification of Nihilistic Violent Extremism. There have been several dozen other cases NCITE researchers have identified overseas. The following cases illustrate the complexities with prosecuting young perpetrators, despite their violent activity.
Case 1 (2025)
A 17-year-old boy was arrested and charged by American authorities earlier this year after murdering his mother and stepfather. After searching his phone, authorities identified content related to The Order of Nine Angles (O9A), an occultic accelerationist group that is ideologically aligned with neo-Nazi extremism, as well as material related to satanic cults and admiration for Adolf Hitler. Additionally, the attacker produced a manifesto citing material sourced from the Terrorgram Collective, a federally designated transnational terrorist group.
Case 2 (2025)
A 19-year-old American man was arrested and charged for possession of child sexual abuse material (CSAM), having possessed over 8,000 images and videos of sexual abuse of young children and bestiality acts. This individual was an active member in 764, an online ecosystem of nihilistic violent extremist groups and channels whose members seek to cause chaos and destroy society through targeting and harming vulnerable populations. Most notably, members of the 764 network are known for targeting minors and engaging in strategic grooming practices to coerce young people into producing child sexual exploitative material, self-harm, and perpetuate violence towards others.
NCITE Director of Strategic Initiatives, Austin Doctor, Ph.D., contributed to an article on this NVE case in May published by ABC Action First News.
Case 3 (2020)
In 2020, an 18-year-old man was arrested in a city outside of London, England after sharing bombmaking manuals, producing child exploitation images, and disseminating terrorist materials to encourage acts of violence. Upon searching his laptop, authorities identified his ideology as a mix of neo-Nazism and violent Satanism. Investigators found photos and videos containing child exploitation, as well as over 4,000 files containing information and instructions for firearms and building bombs. Collectively, the located material reflected a fascination with the occult, Satanism, and neo-Nazism. In this case, the young man’s online activity showed interest in accelerationist terrorist groups, such as Sonnenkrieg Division and Atomwaffen Division, as well as a fascination with violence, such as school shootings and sexual violence towards women and children.
NCITE Insights — On 764
Listen to Seamus Hughes, NCITE senior research faculty and policy associate, discuss 764, the neo-Nazi, satanic, largely NVE-inspired online community.
Tactics: How do NVEs Operate?
NVE tactics vary across groups and may range from school shootings, swatting, doxxing, and sextortion (particularly of minors).
In August of 2025, several universities were victims of swatting attacks during the first week of classes. In these attacks, callers falsely claimed that they had seen an active shooter on campus, activating campus security and law enforcement to secure the campus until the threat was determined to be fake. A member of the NVE group Purgatory (part of an NVE network known as “The Com”) claimed responsibility for the swatting attacks, including livestreaming additional swatting calls online using the platform, Discord.
Sextortion NVE groups target minors and other vulnerable individuals to coerce them into producing violent and/or sexual content. They then leverage threats to expose that content to coerce them to produce more content or engage in additional acts of violence themselves. In early 2025, two individuals who were leading a subgroup of 764 – an online sextortion group aAiliated with The Com – were arrested and charged for their role operating a global child exploitation enterprise. The 764 subgroup led by the two defendants used covert online spaces to share their victims’ content, as well as tactics and strategies to further escalate their exploitation of their victims.
NCITE research examines how online communities like The Com enable the spread of their violent beliefs. For instance, court records associated with convicted members of Purgatory and 764 outline how these spaces are used to recruit, radicalize, and communicate. These spaces allow them to share instructions and information on how to engage in violence, as well as to share evidence of their actions with others in the NVE communities. NVE emphasize sharing violence through images, artifacts (e.g., lorebooks), videos (e.g., livestreams), and other mechanisms to gain credibility within the group. NCITE researchers are examining how the use of technology to plan and execute attacks contributes to how some NVE—among other threat actors—identify innovative mechanisms and strategies to cause harm.
Targets: What do NVEs Target?
Soft targets such as schools and churches are common targets for threat actors as these places serve important community-oriented missions. In line with the services they offer, soft targets hold large concentrations of people at one time. This combination of symbolic value and public accessibility makes them particularly vulnerable to those seeking to cause harm or disruption.
The nature of these buildings and spaces also make physical security a challenge. Buildings may have multiple access points, be in central areas within a city, and are typically designed to be welcoming and accessible rather than fortified. The need to balance openness with ensuring the physical security of the soft target and the individuals occupying it is an ongoing challenge. As a result, these institutions face unique vulnerabilities – such as resource limitations, heightened visibility, and emerging threats – while continuing to uphold safety and advance their vital missions.
For NVE, these targets are attractive because security is relatively low, they are accessible, and attacks on them will garner public attention—part of the NVE mission to spread fear. In addition, these targets may also carry ideological importance to individual attackers. For instance, the Minnesota shooting was located at the parish where the attacker had previously attended school. Universities and K-12 institutions are attractive targets to NVEs given their familiarity with them, as demonstrated through recent swatting attacks linked to The Com.
NCITE researchers are currently working with law enforcement and national security partners to develop a school safety risk assessment engine that will help security at K-12 schools. The goal of this work will result in an AI-supported risk assessment system that school administrators and teachers can complete using a guided set of questions. The work is intended to help schools not only prepare for common threats they face, but also anticipate and prevent emerging threats such as those posed by newer NVE ecosystem.
Hear more from an event with Jennifer Hesterman on threats malevolent actors pose to supply chains and other soft targets as well as a podcast (below).
Jennifer Hesterman On Soft Target Protection
NVE Ecosystems: Challenges for Law Enforcement
The online and transnational nature of NVE can pose challenges for law enforcement intervening, deterring, and preventing nihilistic violence. While some NVE networks display indicators of organizational structure (e.g., formalization of membership), others are more loosely affiliated within the network. Actors such as the Minneapolis shooter may appear to be independent, but NCITE research indicates that these actors operate within the broader NVE ecosystem in formal and informal ways.
NCITE researchers are examining the changing nature of violent extremist organizations operating in the U.S. and what it means to be a member in today’s landscape. This research looks beyond traditional hierarchical groups to include looser, networked, and online-based forms of affiliation. By analyzing how organizations evolve, how individuals identify with them, and how “membership” itself is shifting, NCITE researchers partner with law enforcement to translate their finding to better understand the dynamics of extremist ecosystems and their implications for security and prevention.
Prevention: Safeguarding Against Attacks
NCITE has developed a corpus of research that speaks directly to preventing violent attacks from aggrieved individuals.
- Developing a Soft Target Risk Assessment Engine and Recovery Resources to protect K-12 schools and public spaces. Read the report and view the project page.
- Developing and deploying an artificially intelligent chatbot to improve suspicious activity reporting. View the project page.
- Supporting efficient and effective suspicious activity reporting across multiple state fusion centers. View the project page.
- Defining the need for best practices and standards for soft target protection tailored to unique soft target sectors (e.g., schools, houses of worship, museums, event venues). View the report here.
- Evaluating the effectiveness of the National Threat Evaluation and Reporting Office’s (NTER) Master Trainer Program to enhance outcomes. Read the report and view the project page.
- Examining challenges in event security planning for security coordinators attempting to balance security, business, and safety objectives. Read the report and view the project page.
- Partnering with families to aid in preventing violent extremism and reducing the risk of recidivism. Listen to the podcast below or view the project page.
Other Resources
