The team at the Repository of Extremist Aligned Documents (READ) developed this insight by actively monitoring and analysing online extremist ecosystems as part of their commitment to maintaining a curated, up-to-date library available on the principle of qualified free access. Click here to learn more about the platform or sign up for the Repository.
In response to the concerning trend of Nihilistic Violent Extremism (NVE), researchers and practitioners have made important contributions that inform and expand public knowledge and facilitate discussion of these groups’ motives, operations, and outcomes. These have covered NVE behaviours inside Telegram channels, transnational influence across social media platforms, and the real-world criminality of different groups operating under the label. While the term is contested, it is generally understood as a spectrum of harmful movements united by misanthropic worldviews and coercive or exploitative behaviours. The range of potential harms is broad, spanning cybercrime such as fraud and sextortion, encouraging self-harm, and, in extreme cases, acts of murder.
Throughout 2026, a relatively unique manifestation of this trend emerged: nine distinct groups initially announced on Telegram an initiative to openly share information through a collective, later launching both a clearnet and Onion-hosted website, with the latter’s forum attracting around 220 registered accounts and accumulating over 260 threads. The Institute for Strategic Dialogue (ISD) released a detailed investigation into the collective, noting its uniqueness as a grouping of separate NVE actors and referring to it as ‘the Alliance.’ To reduce leakage and amplification, READ has done the same in this piece.
This Insight examines how the Alliance’s digital infrastructure supports cooperation and information sharing, how users engage with it, and what these activities reveal about the forum’s role within the wider network, drawing on open-source analysis of social media channels and a bespoke forum. The Alliance provides space for social interaction, cooperation between groups focused on anti-societal violence, and a practical structure for creating and sharing both instructional and administrative information.
The Alliance
The Alliance’s Telegram channel was linked across the announcement channels of member NVE groups in mid-April. Intermediary gating channels host backups and sub-groups, and facilitate shoutouts, creating interconnectivity between groups without an explicit ideological relationship. The Alliance takes this further, with a membership process that includes voting by existing groups; while it initially comprised nine member groups, new groups were voted in during May and July. The last update to an official roster on 22 September lists eight constituent groups, following removals of some for inactivity or due to arrests. These changes demonstrate both formalised administration and organisational instability, as inactivity and law enforcement disruption affect constituent groups.
As ISD noted, the collective’s channel crystallises the Alliance as a place for constituents to pool knowledge and expertise, announce and claim acts of violence, and maximise access to social networks. The shared space brings together various incarnations of NVE groups, both well-known ones like MKY, 764, and No Lives Matter (NLM), and smaller, newer groups, without replacing individual groupings within the movement. The central Telegram channel thus serves as a communicative hub for administrative and leadership information about the groups that make up the Alliance. These may include links to new channels when previous ones close, permissions to lead groups, or updates on a group’s status after members are arrested (Fig. 1).
Figure 1: An April 25 Telegram message updating members of the Alliance’s channel on the status of various groups’ memberships.
In an April 15 Telegram post, the Alliance outlined its ideological motivating force: “[we are] a brotherhood, a union of like-minded individuals, where everyone is working toward a single goal: chaos.” The Alliance’s overall ethos of violence as an amoral, ideological force in itself, under the auspices of an “unusually explicit […] embrace of accelerationism,” reflects anti-system violence more often conceptualised by far-right actors seeking to benefit from society’s collapse (Fig. 2). Violence is couched in terms of revenge against society, using the terminology of struggle, liberation, and transformation, and reference to neo-Nazi ideological strains is common.
Figure 2: One section of the Alliance’s clearnet site (now moved to an Onion page), which directs readers to Telegram and the Onion forum.
In other messaging, the Alliance distances itself from other Com network groups, however, promoting itself as an active terrorist organisation rather than engaging in what it deems petty, individualised acts of criminality. On April 18, members were asked to make more constructive use of extortion; coercing others into self-harm is described as “a routine race for popularity”, with the authors instead proposing that victims are forced to booby-trap children’s playgrounds in what would be a more “proper implementation” of extortion. This aligns the Alliance with the ‘offline com’-style subset of such actors, concentrated on anti-society violence and terrorism.
The Onion Site
In a Telegram post on May 2, the group announced the creation of “the first .onion forum, exclusively for those in the know [and] created solely for terrorist purposes,” which at that stage was only open for limited early access. The official launch came on July 20, and after a period of downtime explained as a mid-August server change, the site remains live (Fig. 3). Once an account is created (with no verification required), logged-in users can access both static pages, including individual listings with ideological and contextual information about each group in the coalition, and forum thread entries.
Figure 3: The forum’s header as of publication. Notable beyond the misanthropic and violent anti-societal text, imagery associated with the neo-Nazi satanic group the Order of Nine Angles (O9A) is present alongside a swastika. One of the largest tranches of ideological material shared on the site was O9A texts.
One page outlines the forum’s rules, which generally resemble boilerplate forum user agreements. Among those that stand out as discordant with the group’s overall ethos, users are warned against clickbait headlines, using offensive nicknames and insulting others. Meanwhile, the posting of child sexual abuse material (CSAM) and bestiality content is not allowed in shared spaces, but explicitly stated to be permissible using the private message function.
Organised primarily as a forum for sharing information, the site’s main spaces are threads that provide PDF or direct textual instructions on various topics, both criminal and ideological. The practical side of the documentation includes both rudimentary and professionalised instructions on the construction of 3D-printed or other homemade firearms, explosives and harmful chemicals such as acid or poison, as well as tactical guidance intended to help carry out terrorist activity (Fig. 4). Data on the site indicates that over 260 threads have been posted, some with multiple PDFs, as of publication. Thread comments generally show low levels of engagement, with users sporadically asking technical or ideological follow-ups. The preservation and circulation of extremist instructional material is not new, with precedents including NVE ‘lorebooks’ and instructional-ideological manifestos, including collaborative ones, Islamic State forums and the Terrorgram network. Terrorgram’s stylised outputs were influential on the NVE scene in aestheticising violence, targeting infrastructure, and encouraging attacks.
Figure 4: A July screenshot of the Onion site’s sub-category for ‘Explosives Engineering.’ Each thread shown contains PDF instructions for constructing dangerous and harmful materials.
The Onion site also has a marketplace feature announced on August 22, where users can list items or services for sale. The marketplace lets users advertise goods and services, although there is no evidence of transaction volume or completion available; investigations have uncovered evidence that Russia-based NVE groups have paid others to carry out attacks. As of publication, items listed for purchase include a lifetime subscription to a legitimate open-source intelligence platform, stolen credit card details, and access to “an uncensored AI capable of generating any code and creating weapons, explosives, and poisons“. The Alliance-recommended payment method is via “a built-in escrow service” using cryptocurrency, which official communications have also cited to solicit Monero donations for the Alliance.
User Activity
A sitewide built-in chat function is available only to logged-in users and was first used internally on May 13th, when users shared messages including ‘88’ and ‘o/’. While messages here are relatively sparse, they evidence another informational fallback if Telegram channels or other networks are banned; users expressed annoyance that accounts were removed from other sites just hours after creation, shared alternative links, and asked for threads on specific attack methods. In the month prior to publication, twelve new threads were made by a total of five users. Three of these posts related to administrative information, such as a channel being taken down or a new platform launched by an Alliance member; one marketplace listing was made; and eight were uploads of new instructional information, including a recipe for chlorine gas and a thread on “methods of mass murder.”
According to data READ accessed, around 220 users are registered on the site, with 85 of them online in the month before publication. For comparison, the Alliance’s main Telegram channel had over 500 subscribers during the same period. Most contributions also clustered around power users; two founders, the site’s main administrators, account for 85% of comments and started 89% of threads. Only 22 users commented across the site, and 90% contributed neither new threads nor comments, following a standard pattern studied across the internet. These numbers indicate a fairly small user base, but one with a core of active users and a range of occasional browsers nevertheless accessing a site dedicated to sharing instructions on carrying out acts of violence and terrorism.
Figure 5: Two charts displaying the number of users over time. On 17 August, the Alliance restored the forum from a month-old backup after database corruption, losing accounts created during that period, which may have affected the recorded registration trend.
Downloads could not be measured, and the site’s nature may further explain the low interaction rate; a logged-in user could feasibly download all available material in a single sitting without contributing, then return periodically for updates (Fig. 5). Requiring Tor access and registration may also discourage casual users, although the effect cannot be quantified.
Documents found on the site were also picked up by READ in various neo-Nazi and NVE-aligned ecosystems elsewhere, despite the Alliance stating on Telegram that the forum contained “exclusive educational materials developed by [The Alliance]”. This overlap with ‘old’ content may also explain limited visible interaction, with the security offered by an Onion site providing the main innovation rather than producing new documents – though a small number of these have been produced.
While most threads share PDFs, another contains ten entries claiming murders and arsons in the United States and the Netherlands. Branded images and handwritten Onion addresses (Fig. 6) are presented as evidence, but most claims lack sufficient identifying details for independent verification. Although external reporting has linked constituent groups to real-world violence, this does not establish that the specific incidents claimed on the forum occurred or were coordinated through it.
Figure 6: A recent addition to the ‘Actions’ thread.
Conclusions and Recommendations
Although it is a forum, limited visible participation suggests the Alliance’s forum functions more as a repository than an active discussion community. Its principal significance may therefore lie in consolidating extremist resources and facilitating cooperation, although the forum’s direct operational impact remains difficult to establish. ISD identified real-world activity – including murder threats – dating back to 2024 from constituent members of the group. The forum includes manuals covering the full range of potential outcomes, and the recent production of Alliance-branded graphic instructions further supports their continued intent to solidify the onion site as a directory for future attacks.
In contrast to their darknet activity, the group appears to have done little to reach out on clearnet sites under the Alliance’s umbrella. Aware of the risks of law enforcement targeting and platform moderation, it has avoided advertising on major platforms, with a few small accounts promoting its content to little effect on mainstream social media sites and without the collective’s official endorsement. READ detected a single instance during the research: two short-form videos posted in August that bear the branding of constituent groups rather than the Alliance itself. More notably, a third constituent member posted a link to their own onion site in October (3 and 18 October); at the time of writing, the site contains contact information and a short overview of the group and its cybercrime-focused goals.
As such, law enforcement interdiction remains an important means of disrupting the Alliance, particularly given the difficulties of identifying users and moderating content across Telegram and Onion-hosted platforms. Group messages (corroborated by secondary reporting) indicate that state intelligence services arrested the individual behind threatening videos (Fig. 7), a minor based in Dagestan, Russia. Communications from the Alliance similarly reflect a regular preoccupation with intelligence and police interference, and a recent message promoting an alternative encrypted chat platform in case of the channel’s removal strengthens this suggestion.
Figure 7: A screenshot of a video message posted in the Telegram channel in June, specifically threatening state agencies with violence. A mixture of NVE and neo-Nazi imagery and clothing is visible, such as the skull mask, which has attained meaning as a symbol of violent action in both communities.
Nevertheless, practitioners, tech platforms, and researchers must maintain awareness of NVE’s changing signals, operational procedures, and new cross-platform behaviours. Common usernames, iconography, documents, and references across social media may identify users and enable tracking and moderation. Access to PDFs containing ideological and instructional material, with a more permanent home less likely to be removed, means these items can be accessed longer term, and responses such as GIFCT’s Hash-Sharing Database remain important for identifying and removing them if they do appear on mainstream platforms. Understanding the ecosystem as a whole can help, as branding may change but hybridised harms remain similar to those recorded in previous ‘Offline Com’-style anti-society groups. The Alliance offers insight into new organisational cooperation and knowledge sharing among NVE groups, but the documents and imagery shared ultimately match trends examined in previous work.
–
The Repository of Extremist Aligned Documents (READ) is a project developed by the Centre for Statecraft & National Security (CSNS) at King’s College London. READ seeks to provide, curate and manage a secure and controlled repository where researchers and experts can access far-right/ideologically motivated violent extremism (IMVE) documents and primary sources, with entries collected according to our inclusion criteria and selected with academic rigour. The library contains four collections: far-right/IMVE-origin, manifestos, Nazi material, and material produced by NVE groups.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.