On June 22, 2026, two students aged 14 and 15, identified by their aliases “Nash” and “Rod”, opened fire at San Jose National High School in Tacloban City, Philippines, killing three students and injuring 20. Early accounts emphasised alleged bullying, access to two handguns and the 14-year-old’s history of playing GoreBox prior to the attack. Further analysis of the perpetrators’ clothing, their social media posts of themselves posing with firearms, as well as other digital traces, suggests that the perpetrators were involved with online cultures that aestheticise mass shooters.
The Philippine authorities have since discussed the shooting under the label of nihilistic violent extremism (NVE), which, if accepted as such, would make it the country’s first completed attack to carry that label. Investigators subsequently began examining whether the perpetrators had been influenced by 764, a transnational online network that encourages the use of coercive control to target vulnerable minors and where members gain status through escalating requests for violent content.
This Insight examines the attack’s preparation and online afterlife, showing how local grievances and peer reinforcement became incorporated into a transnational – and increasingly Southeast Asian – repertoire of performative violence. NVE does not necessarily denote a coherent ideology and is instead a contested umbrella term for online milieus shaped by misanthropy, notoriety-seeking and violence-fixation, rather than a coherent ideology or organisation. While the Tacloban shooting shows credible influence from mass-shooter and True Crime Community (TCC) subcultures, formal involvement from NVE groups such as 764 remains unverified.
Interpreting the Attack
Both suspects initially described being bullied, possibly since Grade 7 (12 to 13 years old). However, investigators said they had planned the attack since late April, indicating that bullying may have supplied a grievance but cannot fully explain the premeditated, largely indiscriminate school shooting.
The two were described as close friends. Planning and acting together allowed the perpetrators to validate each other’s grievances, normalise the proposed violence, and make an otherwise aspirational fantasy appear achievable. Pre-attack Facebook Messenger exchanges between the two suspects, confirmed by the authorities, show them discussing the likely consequences of the attack, including the belief that they’d be charged differently since they were minors (Fig 1.)
Figure 1. Alleged pre-attack Facebook Messenger exchange between Nash and Rod on the legal consequences of the shooting.
The attack was characterised by emulation of past mass attackers; Nash changed into a KMFDM shirt – a possible reference to the Columbine shooting also seen in the 2024 Abundant Life Christian School shooting. One of the perpetrators also posted videos on social media of themselves with firearms, which authorities implied were “imitating” past mass shooter incidents. The claim that the same perpetrator played GoreBox also fits within the subcultural influence of sandbox games and radicalisation commonly associated with past NVE-related mass attacks. Collectively, these not only suggest influence by the NVE subculture and past mass attackers, but also an effort to make the attack recognisable within an established mass-shooter repertoire.
The Contested 764 Connection
The strongest official claim that connects the Tacloban shooting to the 764 networks came from Cybercrime Investigation and Coordinating Center (CICC) Undersecretary Renato Paraiso, who stated that recovered chat logs showed both perpetrators were active participants in the network and had been groomed by it. Since these chats have not been publicly released, the claim cannot yet be independently assessed. It also contrasts with the more cautious language used during the Senate hearing.
At the July Senate hearing, Senator Risa Hontiveros presented an account using the pseudonym “Sedykh Ryazanov” that had interacted with profiles linked to Nash. After the attack, the account left a comment claiming to have produced an edited video featuring Nash and told him to delete his Discord, Reddit and Telegram accounts. Hontiveros described the user as a suspected adult groomer but stressed that the lead still required National Bureau of Investigation validation. The post shows an online milieu around Nash, but its timing cannot establish pre-attack contact, grooming or direction.
Wider contextual evidence speaks to the presence of these networks in the Philippines rather than to the perpetrators’ involvement with them. The Philippine National Police reported rescuing 24 minors involved in the True Crime Community (TCC), which it described as encompassing 764 and No Lives Matter subcultures. While that description is not strictly accurate, it indicates a complex domestic NVE-adjacent ecosystem. It should be noted that despite the proliferation of extreme-right violence (XRV) globally, local authorities have not found any common ground between global XRV and this NVE-related attack. Even the expert most closely associated with the 764 framing made the claim conditionally, with Angel Redoble describing Tacloban as potentially the network’s first completed mass shooting only ‘if’ it could eventually be attributed to it.
Discord Group with Alleged Ties to a Perpetrator
Reinforcing the official account, an OSINT analyst who also spoke at the July Senate hearing noted in a Facebook post that the social media account linked to the suspect had drawn comments from users associated with a Discord group, suggesting the suspect may have been a member. He later clarified that the group was hijacked by 764-associated users who were responsible for “brainwash[ing]” the perpetrators. These claims remain unverified, but the content of the group’s Discord members in the aftermath of the shooting speaks to wider NVE trends in the region.
After the original server was taken down, a successor group reconvened four days after the attack and had 75 members by the end of July, with users claiming to be aged between 11 and 15 years old. Responding to accusations of grooming and to the Tacloban shooting, members discussed how 764-linked users – who often pose as minors or are themselves under 18 – had infiltrated the group and used them as a “decoy” and speculated that Nash may have belonged to those networks since he had not been in their previous server. The extremist narratives and violent facets of the comments produced by these users are concerning from a threat assessment viewpoint, even if they had no connection to the Tacloban shooting or to 764 grooming.
One member, reflecting on the attack in a note, argued that most members are “larpers”¹, before claiming that the Tacloban perpetrators had been radicalised and “brainwashed” into acting. He then said he understood how this happens because he does it himself, describing how he brainwashes children who seek validation. In a later comment, he claims to be building “a niche community in school” by “recruiting helpless sensitive children who goes through what I did [sic]” (Fig 2). Notably, his account appears to treat grooming as sexual exploitation alone, which leaves peer grooming towards violence unrecognised as grooming at all.
Figure 2. Comment by a self-identified 15-year-old in the reconvened Discord server describing his intention to recruit other children.
In a separate exchange about the True Crime Community, another member said he did not worship school shooters but identified with them as an outcast and a loner, describing himself as “basically Eric Harris” (Fig. 3). Asked what shooting up a school achieved, he framed it as revenge, and as a means of killing others before taking his own life — a resolution he presented as an escape from a life characterised as unbearable.
Figure 3. Members of the reconvened Discord server discussing identification with school shooters as fellow students.
Indicators of violent ideation are also present. One member expressed a wish to carry out a bombing modelled on the SMAN 72 attack, though others can be seen trying to dissuade him (Fig. 4). Elsewhere, members discuss and share their own experimentation with explosives and makeshift guns.
Figure 4. Exchange in the reconvened Discord server in which a member expresses a wish to carry out a bombing modelled on the SMAN 72 attack.
As such, while the group alone cannot prove vertical grooming by adult 764 actors, horizontal grooming between minors is plainly visible, alongside violent ideation and discussion of explosives. Indeed, given previous cases of mass attackers emerging from such spaces, it is plausible that a group of this kind could radicalise and produce an attacker.
The Online Ecosystem and Afterlife
The importance of the aforementioned Discord channel lies in what it represents of the wider NVE online ecosystem. While attribution of the attack to 764 and related networks remains disputed, this should not obscure the clear online finding highlighted in this report: that the Tacloban shooting was rapidly absorbed into the wider NVE online canon and milieu, both regionally and transnationally, shortly after it occurred.
First, the attack was converted into shareable entertainment. One TikTok account posted an AI-assisted edit placing Nash alongside one of the perpetrators of the Islamic Center of San Diego shooting, accompanied by casualty-style score graphics and the euphemistic caption “they helped 6 people” (Fig 5). AI’s role in this case is therefore in the attack’s afterlife: accessible generative and editing tools let users quickly produce multiple stylised versions of perpetrator content.
Fig. 5. TikTok edit pairing Nash with a San Diego shooting perpetrator, with casualty-style score graphics and the caption “they helped 6 people”.
Second, users appropriated Nash as an identity template. One Philippine youth wearing clothing resembling Nash’s posted a “do you get déjà vu?” comparison while displaying an apparent firearm of unverified authenticity (Fig. 6). Another user asked which mass attacker they most resembled and received comparisons to Nash, Finland’s Pekka-Eric Auvinen and the SMAN 72 Jakarta attacker. These posts turn perpetrators into character types through which users present themselves, reflecting a shift from interest to parasocial identification, aesthetic imitation, and perpetrator-centred content production.
This identification also developed into canonisation. For example, a dedicated “Nash larp” account produced edits and a tier list placing Nash in every ranking category. In this ecosystem, the canon determines who is remembered, while the repertoire consists of repeatable clothing, poses, euphemisms, edits and solicited comparisons to known attackers. Tacloban thus supplied a local figure who could be placed alongside established Western and regional attackers. This extends an existing Southeast Asian pattern of importing foreign shooter aesthetics but also shows locally produced figures being added to the transnational canon.
Fig. 6. Philippine user posing in clothing resembling Nash’s with the caption “do you get déjà vu?”, holding a firearm of unverified authenticity.
Finally, a separate Russian-language TikTok account circulated Tacloban material and directed users towards a Telegram repository. This demonstrates two-way movement – Southeast Asian users draw from a predominantly foreign canon, before regional incidents are archived and recirculated internationally.
Domestic and Regional Precedents
The Tacloban shooting did not emerge from a vacuum. Apart from the aforementioned 24 minors reported during the Senate hearing, in February 2026, police intervened after seven minors in Calamba, Laguna, allegedly planned a mass-casualty school attack using Molotov cocktails and improvised explosives. Their communications and devices contained footage of foreign mass shootings, while clothing associated with Columbine and other violent subcultures was also recovered.
By 6 July, the Department of Education had recorded 12 further cases of school violence, including threats, a stabbing, a riot and weapon recovery. Although their timing prompted copycat concerns, only a threat occurring in Escalante explicitly referenced Tacloban. There was also a live-streamed school shooting incident in Zamboanga City on August 18, which had indications of TCC influence, although no direct reference to Tacloban. The evidence therefore supports possible imitation or heightened attention, but not necessarily a common extremist pathway.
Outside of the Philippines, the clearest regional analogue preceding Tacloban was the November 2025 bombing at SMAN 72 in Jakarta, Indonesia, where a 17-year-old student used improvised explosives in an attack that injured 96 people. Police recovered an airsoft rifle inscribed with the names of past attackers alongside far-right symbols and phrases, in imitation of Brenton Tarrant’s weapon, though the borrowing was aesthetic rather than ideological, with the Indonesian authorities classifying it as a case of “memetic violence.” SMAN 72 in turn drew its own imitator, with police investigating a July 2026 school explosion in Padang where the suspect was suspected of emulating the Jakarta attack. Tacloban and Jakarta differed in tactics and targets, but both drew on an imported repertoire of shooter clothing, symbols and performative violence.
That comparison implies a two-way circulation: Southeast Asian users import a predominantly foreign shooter canon, add regional perpetrators to it, which is then recirculated as an expanded canon internationally. The emerging pattern is therefore better understood as a shared online cultural repertoire than as a demonstrated regional wave of attacks.
Conclusion
The main challenge to responding to incidents such as the Tacloban shooting is that these communities cut across conventional harm categories. Platforms and practitioners should therefore assess observable behaviour and risk, rather than focusing on proving membership in 764 or another named network, or unduly prioritising any one factor over another. ISD similarly recommends an ideology-agnostic approach that connects existing policies across a range of subfields.
Such assessment should also be cumulative. KMFDM shirts, “Natural Selection” clothing, skull masks or use of GoreBox should not independently trigger an extremist assessment. Concern increases when these cultural references accompany other indicators such as sustained perpetrator glorification, imitation of a specific attacker, weapon access, threats, prospective language, leakage or attempts to conceal evidence.
The Philippine decision to block GoreBox illustrates the limits of product-level responses. Reporting established only that a perpetrator used the game, not that it caused or facilitated the attack; research likewise finds insufficient evidence linking violent games causally to real-world violence. Blocking it therefore leaves peer reinforcement, firearm access and cross-platform shooter culture unaddressed.
Ultimately, the clearest finding of the Tacloban attack lies in its online afterlife: within days, it was rapidly converted into edits, imitated by users, compared with regional and foreign attackers, and archived within a transnational TCC space. This demonstrates how a Southeast Asian attack can be absorbed into, and expand, a global repertoire of nihilistic violence.
- Within NVE milieus, “larper” (from Live Action Role-Playing) is used as a term of contempt for those whose extremism is deemed performative — aesthetics and rhetoric without real-world violence.
–
Benjamin Mok is an Associate Research Fellow at the International Centre for Political Violence and Terrorism Research, based at the S. Rajaratnam School of International Studies (RSIS).
Saddiq Basha is a Senior Analyst at the International Centre for Political Violence and Terrorism Research, based at the S. Rajaratnam School of International Studies (RSIS).
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.