On 24 March 2026, a 15-year-old student allegedly carried out an armed attack at a school in Lázaro Cárdenas, Mexico, killing two female teachers before being detained. Attention soon turned to the perpetrator’s online activity, which formed part of the attack’s immediate prehistory and later became relevant to questions of motive and influence.
This Insight examines the Lázaro Cárdenas attack not as an isolated tragedy, but as a case that helps illuminate how school-targeted violence is shaped by contemporary digital environments. Rather than presenting a new form of violence, the case shows how familiar elements — including pre-attack leakage in the form of a video posted by the perpetrator hours before the attack, misogynistic signalling, and post-attack recirculation — can converge across platforms in ways that make violent content and symbolic repertoires more visible, recognisable, and reusable.
The analysis first reviews what is publicly verifiable in the case, then turns to a TikTok profile cautiously associated with the perpetrator as a possible part of his wider digital trajectory. It next examines the post-attack circulation of related content, with particular attention to how the event was recirculated, aestheticised, and made symbolically available for reuse. Finally, it considers the broader preventive implications of the case.
What Is Publicly Verifiable in the Case
Beyond the basic facts of the case, the public record about the Cardenas attack provides a more specific account of its immediate digital and investigative dimensions. Multiple reports, including statements attributed to the prosecutor in the case, indicate that the suspect posted material roughly nine hours before the attack, primarily through Instagram. Reported material included a self-taped video showing a long gun alongside the phrase “Hoy es el día” (“Today is the day”). According to public reporting, the weapon shown in the video was used in the attack that killed two female staff members, after which the suspect was restrained by students and school staff before being taken into custody.
Figure 1. Screenshot from a video reportedly posted by the perpetrator hours before the attack, showing him holding a firearm and visually staging the event in advance.
Press coverage in the immediate aftermath framed these posts through an incel-associated lens, linking the suspect’s online material to a wider digital subculture organised around misogynistic grievances and anti-feminist discourse. This matters analytically not because media framing can settle ideological identification on its own, but because it shows that the case entered public discussion through an already available vocabulary of misogynistic radicalisation and copycat concern. Authorities also indicated that the suspect did not have his phone when detained and that investigators were seeking access to the device to clarify motive, context, and possible digital connections.
Figure 2. Material reportedly posted by the perpetrator on Instagram before the attack: at left, a reference to Charles Manson, invoking a widely recognisable figure associated with violence and criminal notoriety; at right, antifeminist content with the phrase “I hate feminists.”
Digital Fingerprints and the Trajectory of Radicalisation
A further layer of the case emerges when attention shifts beyond the publicly reported pre-attack posts to the broader digital ecology visible in a TikTok profile that can be cautiously associated with the perpetrator. That association is not treated here as definitively established on the basis of handle similarity alone. Rather, it rests on a convergence of indicators, including the handle publicly reported in connection with the perpetrator’s Instagram activity, the profile’s reposted content, and comment-section responses in which other users appear to treat the account as belonging to the attacker. The material analysed in this section refers primarily to content reposted by the profile, not necessarily original content created by its holder. Read in this light, the account becomes analytically relevant not as conclusive proof of ownership, but as a plausible component of the wider digital trajectory surrounding the 24 March attack in Lázaro Cárdenas.
According to public reporting, the perpetrator used an account name incorporating the term ‘vodka’ on Instagram, and the same handle appears on the TikTok profile examined here, strengthening the basis for a cautious cross-platform attribution. The handle is itself symbolically suggestive, echoing “VoDKa”, the codename associated with Dylan Klebold, one of the Columbine perpetrators, and thereby reinforcing the profile’s proximity to Columbine-coded forms of identification. That proximity is further supported by reposted material tagged with terms such as elephant2003 and others, placing the account within a recognisable archive of school-shooter-adjacent media in which Columbine serves not merely as a historical event, but as a reusable repertoire of names, aesthetics, and symbolic cues.
Figure 3. Reposted TikTok content from the profile examined here referencing Elephant (2003), placing the account within a Columbine-coded symbolic repertoire.
The reposted material also includes direct references to recognised perpetrators of mass violence and terrorism. These references are relevant not only analytically, but also from a moderation perspective, since they involve named violent actors framed in glorifying terms. The strongest example is a post tagged with numerous hashtags directly referencing infamous misogynistic violent extremists such as Elliot Rodger, Alek Minassian, and Marc Lépine while framing them in openly valorising terms. The same reposted content environment includes references to Ted Kaczynski through various hashtags and usernames. These references are also important because they show that the account did not merely orbit generic “dark” or ironic content, but included symbolic proximity to named perpetrators of misogynistic mass violence and terrorism.
A further layer of the reposted content points towards incel– and manosphere-coded environments. The use of various tags directly referencing incel, manosphere, and lookmaxing content places the account within a lexical field strongly associated with online misogyny, sexual hierarchy, appearance-based status competition, and blackpill-style masculine grievance. Rather than indicating one fully coherent ideology, these reposts suggest repeated exposure to a milieu in which resentment, humiliation, and masculinised self-positioning were already normalised.
The profile’s reposts also suggest familiarity with imageboard and chan-like subcultural milieus. The use of hashtags referencing various online chans – those often associated with highly offensive or extremist content – points towards participatory environments organised around irony, in-group codes, obsessive posting, and transgressive humour. In such spaces, violent, misogynistic, or extremist-adjacent material may circulate less through explicit advocacy than through repetition, stylisation, mockery, and subcultural recognition. Alongside these markers, the reposted material also draws on popular-cultural figures associated with alienation, grievance, and aestheticised violence, including Travis Bickle, Patrick Bateman, Tyler Durden, Dexter, Joe Goldberg, and Homelander, as well as franchises such as Postal, Manhunt, and Hatred. Read together, these elements suggest a broader repertoire of identification organised around violent masculinity, outsider status, and transgressive self-fashioning.
The profile demonstrates how violence may become legible before it becomes actionable. Rather than pointing to one ideology or one decisive online influence, the account reveals a digital environment in which misogynistic grievance, school-shooter symbolism, extremist-adjacent references, and subcultural irony accumulated over time as available modes of identification. The significance of the case lies in how contemporary radicalisation may develop through symbolic layering, aesthetic familiarity, and networked participation before it manifests as overt violence.
The profile also suggests that this was not simply a matter of consuming violent content, but of moving through different stages of digital participation. As shown in the publicly verifiable material discussed earlier, this trajectory included not only engagement with violent and school-shooter-adjacent references but also the production of original content before the attack itself, including the video in which the perpetrator appeared with the weapon later used in the killings. In that sense, the attack does not stand apart from the profile; it appears as an extension of a digital trajectory already organised by coded reference, affective investment in transgressive material, and the public staging of violence in advance.
The Afterlife of Violence and the Symbolic Reinscription of the Perpetrator
The post-attack phase is analytically significant because it creates conditions under which the perpetrator can be reinserted into an existing subcultural archive of school-shooter symbolism, comparison, and notoriety. What matters at this stage is not only direct imitation, but the way violent actors become available for symbolic reuse through edits, commentary, and recirculation. In such contexts, the perpetrator is reframed less as the author of a specific act than as a recognisable figure within a wider repertoire of violent visibility, where fascination, irony, admiration, and glorification help extend the attack’s symbolic afterlife.
Figure 4. Comment section from the account’s only publicly visible post, showing post-attack comments that appear to recognise the perpetrator and frame him in admiring terms such as “Heroe” and “hero,” alongside a sticker using an image of him after the attack.
This process is visible in the circulation of “rampage”-style edits, in which the attack is reframed through montage, music, stylised movement, school-linked backgrounds, and textual markers such as victim counts. In such formats, violence is not merely documented; it is converted into a symbolic object that can be compared, ranked, recirculated, and most of all, glorified.
Figure 5. Post-attack “rampage” edit circulated on TikTok, reformatting the perpetrator and school site through stylised visual cues and victim-count imagery.
Across the material reviewed for this Insight — including reporting in the Mexican press and content visible on the TikTok profile with the attacker’s same Instagram handle — comments on videos about the attack frame the perpetrator less as an agent of violence than as an object of fascination, irony, or admiration. Reactions such as “our savior…” and “que Chad xd :v” (“what a Chad, lol :v”, with Chad functioning in internet and manosphere slang as an admiring term for an idealised, dominant, attractive, and socially successful man) point to forms of glorification, masculinised praise, and the treatment of violent media as consumable content. In this sense, the comment field becomes part of the same symbolic economy as the edit itself, extending the attack’s afterlife through irony, admiration, and normalisation.
This recirculation also creates opportunities for third-party accounts to gain visibility by inserting themselves into the event’s symbolic afterlife. In the TikTok search results for phrases related to the attack, case-related videos (not all of which may be violative) were visible within one to two days of the attack and showed engagement in the low thousands. These figures do not suggest massive virality, but they do indicate immediate and measurable traction. The event becomes not only an object of symbolic reuse but also a source of visibility for accounts that can package violence in searchable, recognisable subcultural formats.
The afterlife of the attack does not end with edits and comments alone. Reported post-attack activity also included fake accounts using nicknames similar to the perpetrator’s handle, alongside comments describing him as a “hero”, “saint”, or unexpectedly “docile”. This is analytically important because it shows that recirculation may extend into forms of symbolic imitation and identity reproduction, through which users help reproduce the perpetrator as a figure available for admiration, affiliation, and potential reuse.
Conclusion
The Lázaro Cárdenas case matters not because it reveals an unfamiliar form of violence, but because it shows how established school-shooting scripts are being reformulated within contemporary digital environments. What emerges from the available material is not a single ideological pathway or a simple act of imitation, but a layered ecology in which misogynistic grievance, symbolic borrowing, school-shooter references, subcultural irony, and aestheticised violence accumulate across time and platforms. The case is therefore best understood not as an isolated rupture, but as part of a broader process through which violent meaning becomes available, legible, and reusable before it is enacted.
This is also why the case should be read beyond the boundaries of a single country or platform. School-targeted violence is a transnational phenomenon, and the symbolic repertoires visible here circulate across languages, formats, and digital spaces that serve different functions in exposure, participation, recirculation, and escalation. In this sense, the post-attack afterlife of the case is not secondary to the event itself. Once violence is reframed through edits, comments, imitation accounts, and searchable formats, the perpetrator can be reinscribed into a wider archive of violent visibility that exceeds the original attack.
Prevention cannot rely on reactive moderation alone, nor only on detecting explicit threats once intent has become fully visible. Schools, teachers, parents, and community actors need clearer guidance to recognise leakage, misogynistic grievance, attacker fascination, and other forms of digitally mediated escalation.
At the platform level, effective response requires more than generic moderation capacity. It depends on stronger primary detection systems for violent signals in non-hegemonic languages, as well as reviewers and escalation teams with linguistic proficiency, culturally grounded signal guides, and a working understanding of the subcultural milieus through which school-shooter-coded, misogynistic, and extremist-adjacent material is often communicated. Public communication matters too: excessive recirculation of names, imagery, and stylised content can help sustain the symbolic afterlife such attacks seek to generate.
–
Ricardo Cabral Penteado is a Ph.D. candidate in Computational Linguistics at the University of São Paulo (USP). He specialises in deep learning and natural language processing (NLP), focusing on the intersection of violent extremism and technology within the Brazilian and Latin American context.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.