Content warning: This Insight contains language describing self-harm and suicide.
In recent months, a growing concern over online subcultures of nihilistic violence, or Nihilistic Violent Extremism (NVE), has influenced how governments are tackling extremist threats. Canada, for instance, designated the decentralised transnational NVE network known as “764” as a terrorist entity in December 2025. Other violent extremist groups that heavily influence NVE communities have also been designated as terrorist organisations, namely: Maniac Murder Cult (by Russia, Canada and the United Kingdom); Terrorgram Collective (by Canada, New Zealand, the United Kingdom, Australia and the United States); and the Order of Nine Angels (by New Zealand). These designations reveal how pervasive the threat of nihilistic violence has become, according to many nations’ highest intelligence and security organisations.
In light of these developments, this Insight adopts a behavioural and psychological lens to better understand the dynamics underpinning NVE activity. It examines the defining characteristics of many NVE actors, including their offender profiles, patterns of victimisation, pathways to radicalisation, and operational methods. The Insight will conclude with some P/CVE recommendations that practitioners can implement to combat this type of threat actor.
Unique Hallmarks of NVE Actors
Nihilistic violence is a type of extremism that radically departs from traditional understandings of ideologically motivated extremism. Unlike extremist narratives that follow an ideology rooted in supremacist worldviews, NVE communities lack an overarching political or ideological doctrine. Instead, these communities tend to combine several, sometimes disparate, ideologies, such as fascist, incel and anti-human worldviews. This hybridity of creeds manifests itself in a diversity of criminal actions perpetrated by nihilistic violent actors. Far from specialising in a singular criminal trade, these communities are associated with crimes ranging from child sexual exploitation to psychological abuse and terrorism.
The underlying objective behind conflating several ideologies and harm mechanics is to garner notoriety within an online community and to fulfil a misanthropic end. As a result, violence is gamified and becomes a form of currency traded among nihilistic violent actors. Gamified tactics employed by these communities include:
- Sadistic initiation requirements that demand proof of harm to gain entry;
- Creating and sharing stylised transgressive content to gain in-group respect and provoke external outrage;
- Progressively committing or instigating more violent acts to outperform other members of the group, and maintain or enhance symbolic standing within the group; and
- Crafting operation manuals that serve to choreograph violence, archive content, and memorialise the group.
Figure 1: Example of an operation manual crafted by an NVE community on Telegram.
Status signalling as the overarching motive for nihilistic violent actors has a direct effect on how these communities are structured. NVE formations are largely decentralised and reject in-group exclusivity. Actors operate instead in a transient fashion, engaging with multiple NVE formations to bolster their reputation and gain infamy. NVE communities also exhibit this agnosticism with regards to the platforms they operate on by leveraging gaming servers (such as Roblox and Minecraft), mainstream applications (such as TikTok, Instagram and X), as well as fringe and encrypted platforms as a means of grooming, recruitment, radicalisation and operational coordination.
However, arguably the most distinctive hallmark of NVE communities is the use of sharp, visually appealing aesthetics as ideological proxies that define their brand and strengthen in-group cohesion. In NVE subcultures, aesthetics function as a means of communication, signalling alignment and radicalisation.
Figure 2: Example of NVE’s use of aesthetics in their guidebooks.
Offender Profile and Victimology
An analysis of 42 individuals with ties to NVE formations who were arrested between 2021 and 2025 revealed that most perpetrators were male (95.2%) and between the ages of 17 and 47. Most perpetrators were in their early to mid-20s, with an average age of 25. Their victims, on the other hand, are generally females between the ages of 8 and 17 years old.
With regards to behavioural and psychological markers, there exists a significant overlap between NVE offenders and their victims. Covert enquiries into several NVE communities revealed that both perpetrators and victims:
- Craved a sense of belonging and recognition;
- Suffered from mental health issues, amongst others: depression, antisocial behaviour, substance abuse, suicidal ideation, self-harm behaviours, eating disorders, and/or loneliness;
- Endured social or romantic rejection;
- Had a tendency to build parasocial relationships;
- Had a significant online presence on social media and gaming servers, specifically: Telegram, Discord, TikTok, Instagram, Roblox and Minecraft.
NVE offenders demonstrate a number of typical behavioural markers, including: a desire for infamy; antisocial behaviour; an extreme interest in gore; a propensity for animal abuse prior to targeting humans; and an obsession with mass killers, even to the extent of building parasocial relationships with them.
How Individuals are Radicalised
Acts of nihilistic violence, as well as the tactics of radicalisation employed, often resemble those of other well-known extremist formations. Similar parallels may be drawn with regard to how individuals are radicalised by NVE communities.
Most research on extremism argues that radicalisation takes place when individuals gradually become more enveloped in radical content over time, ultimately becoming motivated to use violence against out-groups to achieve a particular goal. Child safety researchers recognised a similar set of radicalisation methodologies employed by NVE actors. In response to this, Alex Slotnick (@BOsintBlanc) developed and published a five-stage progression model on 3 October 2025: Socialisation; Voyeurism; Participant; Skilled Individual Abuser; and Ringleader.
Stage I (Socialisation)
As outlined by Slotnick, this stage marks the moment an individual is first exposed to extreme content, which is often due to accidental discovery, prior victimisation, or pre-existing mental health struggles. Those who start by seeking recognition on social media quickly become entangled in online communities that actively share triggering content.
This is largely due to the algorithmic curation developed by social media platforms, which presents harmful content as entertainment. For instance, Amnesty International reviewed accounts that engaged with self-harm content on TikTok and observed that, after five to six hours, almost one in every two videos featured on their “For You” page were potentially harmful.
The accessibility of harmful content, exacerbated by engagement strategies developed by social media platforms, lays the groundwork for individuals to gradually normalise and become desensitised to extreme content. It can be noted that TikTok maintains “a zero-tolerance policy for ads that promote, depict, glorify, endorse, or document suicide, self-harm, or dangerous behaviours which may lead to these.”
Stage II (Voyeurism)
At this point, Slotnick describes, a tolerance for more extreme content develops. As a result, the individual actively seeks out and consumes harm-normalising material on gore-related websites. These websites are easy to find, access, and navigate through curated topics (such as school shootings or ISIS content, for example).
Traffic to these websites arrives from direct searches for a specific URL, a shared link, or pornography websites. Many mainstream pornography sites already offer violent content – which reinforces the “socialisation to voyeurism pipeline” – where individuals become desensitised to violent content offered on mainstream platforms and take steps to find more extreme content elsewhere.
Stage III (Participant)
Slotnick describes how the individual begins to participate in the abuse, transitioning from passive consumption of extreme content to active participation in violence. At this stage, they may encourage others to commit violent acts or engage in “real-world harm like graffiti or vandalism”. As a result, the individual starts to gain recognition within NVE communities.
Stage IV (Skilled Individual Abuser)
In stage four, Slotnick describes how the individual cultivates an expertise in a specific type of harm. Their specialisation may range from editing aesthetic content for NVE groups to becoming an expert doxxer or grooming others to commit self-harm acts.
Stage V (Ringleader)
The final stage, according to Slotnick, occurs when the threat actor forms a group and assumes primary leadership. The individual ascends from perpetrating a specific crime type for the group to orchestrating harm campaigns by directing, grooming and enabling others to commit violent acts.
Modus Operandi of NVE Actors
Investigations into these threat actors revealed a pattern of behaviour which could be considered the typical modus operandi of NVEs.
Systematic victim recruitment online
For NVE offenders, the internet serves as a tool for radicalisation and victimisation. Recent undercover investigations using infiltration techniques to gain access into several NVE channels found that, when asked where best to find victims, their response was “TikTok, Roblox and Discord.” NVE actors are witnessed operating specifically on platforms where vulnerable youth are present. Social media platforms and gaming servers are prime hunting grounds for finding victims.
The lack of clear ideological objectives reduces the effort required to groom victims, as indoctrination and intellectual engagement with materials are unnecessary. Moreover, algorithm-driven engagement strategies employed by social media platforms play a significant role in narrowing down the victim pool for NVE offenders by rapidly distributing aestheticised violent content to vulnerable populations who engage with it the most. As a result, initial contact with victims is small-scale but highly targeted by showing, amongst other things, memefied violent content or casual references to cutting.
Figure 3: Examples of references to self-harm through “bread cutting” content and NVE alignment through video game content on TikTok.
Relocation to different platforms
Once contact has been made, victims are redirected to core consolidation platforms (such as Telegram and Discord), which are invite-only in order to allow NVE actors to control access, set rules and curate content.
Escalating coercion techniques
Following consolidation into groups, narratives harden, hierarchy is established, and expectations are clarified. Invite-only environments normalise violent content, amplify grievance narratives and introduce coded language and symbols to signal alignment without any immediate demands. However, NVE actors leverage the sense of community generated by the in-group dynamics to encourage victims to participate in violent acts. What quickly follows after relocation are seemingly innocent requests from the group that gradually escalate, culminating in demands to create a “stage” (i.e., generating content that depicts self-inflicted violence or is incriminating). Victims are made to feel that they will only truly be accepted into the group if they comply.
Use of victim materials
The content offered by victims from these “stages” is subsequently used to further extort them into creating more violent content. The group also leverages data leaks and open-source intelligence techniques to compile “lorebooks” containing personal information of the victim and compromising images as a tool to further coerce them into creating self-generated violent content.
NVE offenders also use these materials to create “trophy” collections of archived violent content to document victim compliance, recruit members and showcase to other offenders for “clout”.
Practical Recommendations
Given that NVE communities use evolving vernacular to avoid detection, practitioners should develop a consistently updated list of keywords. Keyword collation enables mainstream platforms to detect illicit activity and obstruct any further dissemination of NVE materials. This may be carried out through a crawler developed with the assistance of Large Language Models (LLMs), provided that the use of LLMs is permitted by the site’s terms and conditions. Since NVE communities rely heavily on numbers and spelling variants in their naming conventions, it is crucial to deploy multiple LLMs trained to identify these patterns.
Keyword collation could also be leveraged to carry out linguistic analysis using Natural Language Processing (NLP) models, such as HateBERT. In other words, text extracted from fringe and encrypted platforms may be analysed to determine the likelihood of a violent act being carried out. Moreover, this technique would be beneficial for identifying and categorising key players within the NVE community. Given the volume of violent rhetoric that exists online, this approach would help expedite the process of filtering out those individuals who only lurk within these communities.
NVE actors also rely heavily on symbols to signal alignment and recruit online. These symbols are often used as a watermark embedded in their content and are unique to their community. Conducting video logo analysis using reverse image search techniques and investigative tools (such as TinEye) is crucial for determining whether these groups appear elsewhere on the web. This would ensure that communities that use imagery in lieu of branded keywords to avoid external recognition could still be reported and taken down by the relevant service provider’s compliance team.
Lastly, community awareness is imperative. This may be carried out through off-platform movement warnings on mainstream and encrypted platforms (“Are you sure you want to leave this page?”) as well as age-verification requirements before posting or accessing shared links. Another option is to increase efforts to raise awareness among parents and caregivers about parental controls, such as Apple’s “Communication Safety” or TikTok’s “Family Pairing” measures. These protection measures, amongst other things, detect sensitive content shared with a child and present multiple interventions before it is viewed.
Figure 4: Example of parental controls implemented by Apple and TikTok.
Training parents, caregivers and educators on how to identify problematic behaviour online and offline would prove beneficial in mitigating the risk of exposure to violent content. Explaining what these groups are, those psychological precursors common among NVE threat actors, and how violent symbology might be ubiquitous in their self-expression could go a long way in preventing vulnerable minors from being victimised.
–
The writers are intelligence analysts specialising in investigating criminal networks targeting minors. Both have extensive experience investigating complex criminal organisations, including those allegedly involved in war crimes, crimes against humanity as well as violent extremism operating in the various dark corners of the online landscapes. Their recent independent projects include training law enforcement agencies and other organisations in new techniques related to nihilistic violent extremism and their most modern techniques in radicalisation, including the misuse of artificial intelligence to target minors.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.