On 3 October 2023, a fourteen-year-old teenager walked into the Siam Paragon shopping mall in the busy Pathum Wan commercial district of Bangkok wearing a black shirt, khaki cargo trousers, and a cap bearing an American flag. Metal detectors had been installed at the mall entrance, but security checks were inconsistently enforced, and he sauntered in unimpeded. He made his way to a men’s room on the ground floor before emerging almost 30 minutes later armed with a blank-firing pistol he had modified to fire live rounds. For the next hour, he fired at visitors across multiple floors, working his way from the ground floor to the third level. During the attack, he stopped to ‘like’ breaking news coverage of his own attack on X in near real-time (Figure 1). He also called the emergency number 191 himself, informed the operator he was the shooter, and asked whether he would go to jail. During the standoff that followed, he told officers he was prepared either to continue shooting or to turn the gun on himself. Officers spoke with him for approximately 20 minutes before he finally surrendered. Forensic officers later recovered more than 40 spent casings. Seven people were struck by bullets, three of whom died from their wounds. Thai authorities classified the attack as a mental health incident.
This Insight examines the Siam Paragon attack, tracing the conditions that produced the tragedy and situating it within the Participatory Memetic Violence (PMV) and Misanthropic and Nihilistic Violent Extremism (MNVE) frameworks. It investigates conceptions that have since matured alongside a wave of emerging regional incidents involving underage perpetrators, which makes re-examination both timely and necessary. The analysis interrogates the specific role of digital platforms, including gaming communities, in the manifestation of this violence, and draws out lessons for more appropriate responses and countermeasures.
Figure 1: Screenshot of the mall shooter’s X account showing him liking breaking news coverage of his own attack in near real-time.
Links with True Crime Community (TCC)
Many observers treated the 2025 SMAN72 attack in North Jakarta as being the first of its kind in Southeast Asia, but this Insight argues the Siam Paragon mall attack two years earlier was the regional progenitor of the phenomenon. While the two perpetrators were likely unknown to each other, what connects them, however, is not coordination but convergence. The Siam Paragon mall attacker (PT) attended a private school not far from the mall, where he was reportedly struggling academically, experienced sustained bullying and had a history of psychiatric treatment, which he abruptly discontinued prior to the attack. His family environment was characterised by limited parental presence and supervision, but he was pressured to perform well in school. According to his online peers, he spent considerable time on Roblox as a form of escapism. When hassled about his grades, he would go to the shooting range with friends and send his mother videos of himself target shooting.
Incidents like the SMAN72 school attack were discovered to be linked to the online subculture fixated on the 1999 Columbine school attack and other mass casualty perpetrators and serial killers, broadly referred to as the True Crime Community (TCC). As TCC terminology has crept into the region’s security parlance, however, TCC alone is insufficient as an analytical framework, as it only explains the “fandom”, but does not fully capture the misanthropic dimension, predatory behaviour, or the participatory performance logic.
Figure 2: While TCC serves as a broader ambient ecosystem that encompasses elements of both PMV(E) and M/NVE, each framework retains its own distinct characteristics and should not be treated as interchangeable.
While nihilistic violent extremism (NVE) has now become the prevalent analytical term, this Insight draws on Bjørn Ihler’s argument at Revontulet for the utility of misanthropic and nihilistic violent extremism (M/NVE), a formulation designed to capture the misanthropic dimension that NVE alone does not adequately address. Building on frameworks established by Dr Marc-André Argentino, Ihler argues that misanthropy must be acknowledged as a distinct driver, separate from nihilism, as the Bangkok case demonstrates. This Insight also draws on the participatory memetic violence (PMV) framework developed by Joe Ondrak and Laura Vitelli. Among youth perpetrators in particular, the behaviour is often better understood as emulation and performance for peer audiences.
This Insight’s investigation into the digital evidence discovered that PT was consuming TCC content and demonstrated the imitation behaviour characteristic of TCC subcultures. More significantly, he was himself engaging in predatory behaviour within an online gaming community that included minors. This matters because the constant refrain of the minor perpetrator as victim, while not without basis, can eclipse the ways in which young people also become agents of harm within the same ecosystems.
The Siam Paragon case also raises important questions about how grooming operates within this phenomenon. The Com and 764 network cases documented in the West have established a standard M/NVE grooming model premised on a hierarchical dynamic where an older or more experienced actor targets a younger or more vulnerable individual.
The Bangkok case challenges both models. PT was fourteen when he sent pornography to a younger member. That does not fit the commonly understood hierarchical adult-to-children dynamic, but a lateral one where the power asymmetry was rooted in community standing rather than age. What existing frameworks and responses have not adequately considered is that grooming in this context can likely be peer-to-peer, and that the same individual can simultaneously be a victim of grooming and a perpetrator of it. Beyond transmission, the grooming process itself plays a critical role in desensitisation by eroding boundaries and normalising harm in ways that lower the threshold for tolerating abuse.
Triggers and Stressors
Figure 3: Screenshots of PT’s final Discord messages posted in the hours before the attack. His profile had been removed (Source: Discord)
PT’s digital footprint places him primarily within ReySync, a gaming-adjacent Discord server that functioned as his main social attachment rather than a radicalisation environment. Approximately one month before the attack, he was banned from ReySync for sending pornography to a thirteen-year-old member. At the time of the ban, he made explicit threats to shoot up a school and his own best friend. The community documented and condemned both the grooming behaviour and the threats, but did not escalate either to the authorities. In the hours before the attack, he posted three final messages on the server: “The rot consumes,” “Today is the dooms day,” and a message declaring to members to “tell Rey that his community was responsible for everything” (Figure 3).
Signals and Indicators
Figure 4: Footage recovered from PT’s mobile phone by police shows him practising rapid magazine changes against a makeshift backdrop, wearing the same tactical fit he would wear on the day of the attack.
The videos he sent his mother in response to academic pressure were a visible signal of weapon fixation that adults around him observed but did not act on. He had been regularly attending a commercial shooting range with friends. He also procured his weapon through online channels, including one that he modified to fire live rounds. This level of preparation, taken alongside the ammunition stockpile and in-home target recovered by forensic officers, points clearly to premeditation rather than impulse. Days prior to the attack, a witness saw him firing over 100 rounds in a single session at the shooting range. Photos posted of himself dressed in a tactical fit that drew on American gun culture aesthetics are consistent with the peacocking phase documented across subsequent PMV cases in the region.
The explicit threats made at the time of his Discord ban represented a further intervention point that went unescalated. At some point around the attack, PT updated his Discord biography to express his scorn for humanity and claim responsibility for the Siam Paragon attack. Taken alongside his act of liking breaking news coverage of his own attack in real-time and his final message to the ReySync community, the picture that emerged is of a perpetrator oriented toward notoriety, for whom the attack was a premeditated performance rather than an act of impulse. Notably, the gap between his ban and the attack was approximately one month. The same interval appears in the SMKBU4 case in Malaysia, where disciplinary action preceded the knife attack by a similar period.
Figure 5: In previous analyses, this Insight’s author characterised the attacker’s motivation as nihilistic; following Ihler’s M/NVE framework, misanthropy is the more precise descriptor. (Source: Discord)
Key Takeaways
The ReySync community evidence contradicts the oft-repeated claim in some policy and civil society circles that gaming communities function as “self-radicalisation” pipelines. Rather than tolerating or normalising PT’s behaviour, the community’s response was immediate removal. Given that they identified as furries, a subculture that tends to experience social marginalisation in real life, this may partly explain their investment in maintaining safety within their online environment. This is perhaps why, when PT demonstrated predatory behaviour toward a younger member, he was immediately banned. When he made explicit threats, those threats were documented. His final messages blamed the community for his violent actions, a deflection of accountability that reflects the grievance displacement pattern seen across targeted violence cases, in which the abuser externalises responsibility onto those who enforced the boundary. Despite the membership largely being composed of adolescents, his peers demonstrated a level of agency that recognised his behaviour was harmful and acted accordingly. Parallels can be drawn with cases like Spawnism, where gaming community members tried to band together to protect their own against predatory actors in their midst.
From this case, we can learn that the direction of content flow was reversed from what the pipeline model predicts. Pathologising gaming spaces risks misidentifying the source of the threat and undermining communities that are performing a genuinely protective function. The fact that ReySync did not escalate the grooming incident or the explicit pre-attack threats to appropriate authorities raises a separate and important question, whether the members underestimated his intent, whether the reporting mechanisms available to young people are simply too inaccessible, inconsistent, or unresponsive to be relied upon, whether they feared being belittled, or triggering disproportionate response, or having their own community penalised in the process. For many of these communities, particularly those with marginalised identities or precarious social standing, navigating that environment as safely as possible is already the primary concern.
PT also displayed several behaviours that prefigure those documented across subsequent regional cases. Archived posts confirm direct imitation of the Sandy Hook perpetrator, including a photograph that replicates his pose on a Dance Dance Revolution machine. PT’s attack sequence also mirrored the approach used by the perpetrator of the 2021 Oxford High School shooting, including entering a bathroom before the attack and calling emergency services during the attack. The surrender was likely not out of fear or concession, but deliberate behavioural scripting.
Absent the weapon inscriptions seen in later attacks, PT nonetheless exhibited peacocking, notoriety-seeking, a boastful superiority complex, explicit threatening behaviour, and indifference to his own survival during the standoff. The attack on a shopping mall should not be interpreted as an outlier from the school attacks that followed. In fact, it demonstrates the same underlying intent to target public spaces and maximise both casualties and visibility, with target selection reflecting a consistent logic across cases, specifically familiar environments rather than symbolic or ideologically significant ones.
Conclusion and Recommendations
Too often, the prescribed response to online-linked violence defaults to censorship, content removal and blocking. The Bangkok case is an important corrective because the teenagers within ReySync did exercise their own form of community discipline. The failure was not in their response to PT but in the absence of a clear pathway to escalate that response to adults or authorities who could have intervened before the attack. This underscores how necessary it is to equip young people with the means and the confidence to report concerning behaviour, including peacocking, weapon displays, and explicit threats, to a trusted channel.
The principle is not unlike “see something, say something” applied to the digital environments young people actually inhabit. Platforms like Discord do have reporting tools, but these mechanisms may remain underused because they are either unintuitive or inconsistently moderated, potentially leaving young users with little confidence that reporting will make a difference without exposing them to social retaliation within their own communities.
The Siam Paragon case illustrates why gaming and gaming-adjacent communities should not be treated as inherently suspect. The evidence here suggests they can function as resilience structures when their norms are respected and their members are supported. The more productive intervention is to build clearer reporting infrastructures within these platforms so that community-level responses, which young people are already making, can be connected to adult oversight and, where necessary, law enforcement. A critical obstacle, however, is that platform operators are not sufficiently incentivised to prioritise safety over engagement. Many hide behind US regulation Section 230 safe harbour protections, which shield them from liability for user-generated content, while their moderation reflects predominantly Western norms that leave significant gaps in non-Western contexts. The growing wave of product liability litigation against platforms, premised on the argument that algorithmically engineered harm constitutes a defective product rather than a free speech question, represents a meaningful shift in this landscape and one that policymakers in the region should watch closely.
Finally, the lateral grooming dynamic documented here points to a gap in existing safeguarding frameworks. Platforms need reporting mechanisms that can capture peer-to-peer coercion and boundary violations, not only adult-to-child predation, and those mechanisms need to be accessible and intelligible to young users themselves. As it stands, grooming is widely understood as a top-down mechanism, and this has implications for moderation frameworks. For this to be deployed effectively, policymakers and tech companies should consider expanding their understanding of, and possible profiles of, grooming actors and actions.
—
Munira Mustaffa is a security practitioner based in Kuala Lumpur, Malaysia. She is the founder and Executive Director of Chasseur Group, where she serves as principal consultant focusing on critical security challenges. Her specialisations include threat analysis and attack attribution. She is also a Senior Fellow at Verve Research.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.