On 21 August 2026, 18-year-old Liam Nebel walked into Brinellskolan in Fagersta, wearing all black, with a helmet and mask, and carrying a sword. Within roughly fifteen minutes, he had killed a 17-year-old girl and injured three others before police confronted Nebel, and he surrendered. The costume was not improvised, but was Nebel’s tribute to his countryman Anton Lundin Pettersson, who had killed three people at Kronan Primary School in Trollhättan, in October 2015, wearing nearly the exact same attire.
The imitation, however, ended with the costume. Lundin Pettersson had acted on anti-immigration sentiments and selected his victims accordingly. Nebel, by contrast, appears to have acted out of admiration for Lundin Pettersson himself, as well as for Elliot Rodger, Marc Lépine, Nikolas Cruz, Anders Behring Breivik, and others whose deeds he had spent two years curating, editing and reposting. Roughly twenty minutes before the attack, Nebel posted a picture of a sword concealed in a guitar case on TikTok, captioned “no more edits.” While the line may read as a joke to many, it was a declaration to those who understood what kind of edits he meant.
Those who understood the reference are largely part of a fandom known as the True Crime Community (TCC), a loose online subculture organised around fascination with — and, in its deeper layers, veneration of — serial killers and mass murderers. Since January 2024, it has been credibly linked to a rising tally of attacks and disrupted plots, overwhelmingly carried out by teenagers in diverse geographic settings. But several earlier attacks show similar drivers were present before 2024, although the community was less explicitly defined. Nebel’s fandom was, functionally, his driving ideology for the attack.
This Insight examines what Fagersta reveals about the TCC’s reach in Scandinavia. We begin by defining what the TCC is, and why it is analytically distinct from Nihilistic Violent Extremism (NVE), despite substantial overlap. We then trace the Nordic case history, from the Finnish school shootings of 2007-2008 through Copenhagen, Vantaa, and Helsingborg, before presenting open-source findings on the Fagersta attack itself and what it tells us about the reproductive nature of TCC.
Delineating the TCC
The TCC is best understood as a fragmented online fandom loosely organised around an interest in true crime, including serial killers and mass shooters. Whereas gore and true crime fandoms predate the internet, and the “Columbiner” fandom formed on message boards within months of April 1999, the TCC’s contemporary form took shape between roughly 2018 and 2020 as part of what has been dubbed the online “edge sphere.” It now lives across social media platforms like TikTok, Tumblr, Instagram, Reddit, Discord and Telegram, with a deeper layer on gore forums such as WatchPeopleDie and Documenting Reality.
While NVE and the TCC constitute distinct online phenomena, they may overlap in certain social dynamics, particularly the consumption and circulation of graphic material and the glorification of violence. As Julie Chernov Hwang has observed, such dynamics can contribute to online status economies in which increasingly extreme or transgressive content generates attention and status. This overlap does not, however, make participation in the TCC evidence of NVE affiliation. The two remain operationally distinct: networks such as the COM, examined in a previous GNET Insight, exhibit identifiable administrators, recruitment criteria, hierarchical structures and explicit involvement in sadistic online extortion (SOE), whereas the TCC is not inherently organised around SOE and encompasses substantially different structures, objectives and relationships to violence.
Existing research further demonstrates considerable variation within the modern TCC itself. The CTC’s tiered model describes a progression from mainstream true-crime consumption and parasocial identification with perpetrators to smaller sub-clusters characterised by increasing identification, glorification and, in extreme cases, movement towards violence. Similarly, Allizandra Herberhold’s Stoplight Model distinguishes between romanticizers, idolizers and identifiers according to observable behaviours and relationships to violence. Taken together, these frameworks suggest that the TCC should not be understood as a unified ideology, but as a broad, heterogeneous fandom containing a comparatively small violent fringe. This distinction is important when examining the mechanisms through which elements of the TCC may intersect with NVE environments without conflating the two.
Legibility holds the system together. Manifestos, gun inscriptions, clothing, poses, and captions all contain symbols carrying meanings intelligible only to people deeply embedded in the community. Each attack generates a wave of fandom content that enlarges the canon and draws in more participants seeking to mimic and extend it. Attacks are not merely outputs of the community; they are also important inputs.
Figure 1: Fandom-driven attacks linked to the True Crime Community 2007-2026. Source: authors’ own database of TCC-linked incidents.
TCC in Scandinavia
Scandinavia’s exposure to the TCC phenomenon considerably predates the label, and the Nordic contribution to the canon is arguably disproportionate to the region’s size. The earliest regional case displaying prototypical TCC characteristics comes from Finland. In November 2007, Pekka-Eric Auvinen killed eight people at Jokela High School before shooting himself. Auvinen ran a YouTube-mediated Columbine fandom and maintained direct contact with numerous transnational admirers. The mechanism the TCC later industrialised — public curation of one’s own influences, and a community that responds — was already fully present. Only ten months later, Matti Saari killed ten at Kauhajoki in explicit emulation of Auvinen, closing the first Nordic emulation loop: an attacker inspired by an attacker who was himself a product of the fandom.
On 3 July, 2022, in Denmark, 22-year-old Noah Esbensen carried out the Field’s shopping centre attack, in which he killed three people and wounded seven. Before the attack, he uploaded YouTube videos that directly mimicked and referenced well-known figures from the TCC ecosystem, and the investigation established a documented fascination with American mass murderers. In Finland once again, a 12-year-old killed one classmate and wounded two at the Viertola school in Vantaa in April 2024. Police established that the boy had carried out months of online research into school shootings and mass murder and compiled a list of fifteen names of fellow pupils he labelled bullies and discriminators. The case is noteworthy because it appears to be a pure consumption-to-emulation pipeline; it could not be established that the boy was an active member of the community, only that he consumed the content.
Arguably the clearest Nordic TCC case on the board is a recent attack in Sweden. On 13 July 2026, only five weeks before the Fagersta attack, a 12-year-old stabbed a 5-year-old girl in Furutorpsparken in Helsingborg. SVT tied him and a close associate to a TikTok account that had flipped during the winter of 2026 from cats, memes and games to tributes to school shooters and mass murderers — Columbine and Kerch, explicitly. The account went dark after authorities placed him in compulsory care.
“No More Edits”: From Online Activity to Real-World Attack
The suspect in the August 2026 Fagersta attack was apprehended at the scene approximately ten minutes after police received the first report of an ongoing deadly attack. He was subsequently detained on suspicion of murder and attempted murder. On 26 August, Swedish authorities announced the arrest of a second male suspect, a 16-year-old boy, on suspicion of aiding and abetting murder and attempted murder. Police said the individual had no connection to the school and was not present during the attack, having been arrested elsewhere as part of the subsequent investigation. As of 21 September 2026, both suspects had been remanded in custody, with the allegations against each expanded to include additional counts of attempted murder and aiding and abetting attempted murder, respectively.
Additionally, according to Swedish media, the teenage accomplice, who has not yet been publicly identified, allegedly communicated with Liam Nebel through encrypted chats, encouraging him to carry out the Fagersta school attack, and acting as an accomplice between 1 May and 21 August 2026. Swedish media further reports that he allegedly shared plans with Nebel for an attack on his own school in the Stockholm area. However, these claims remain under investigation.
Research into Liam Nebel’s online conduct shows an extensive digital footprint that, to some extent, remains online, with TikTok, for example, still containing highly disturbing content shared by TCC members in support of the perpetrator. An archived version of Nebel’s TikTok profile indicates that he was strongly inspired by the 2015 Trollhättan school attacker, Anton Lundin Pettersson. Pettersson had carried out the attack wearing a Star Wars-inspired outfit and armed with a two-handed sword.
Figure 2: Images showing Anton Lundin Pettersson’s outfit prior to (left) and during (right) the 2015 attack in Trollhättan, Sweden.
As shown in the screenshot below, Liam Nebel wore an outfit similar to Anton Lundin Pettersson’s, along with a T-shirt displaying the word “Massacre”. These details further indicate Nebel’s apparent inspiration from Pettersson and his engagement with broader TCC-related symbolism. For instance, 15-year-old Nathalie Rupnow, who carried out the Abundant Life Christian School attack in Madison, USA, on 16 December 2024, killing two people, also wore a T-shirt displaying the word “Wrath”. The same word appeared on a black T-shirt worn by Dylan Klebold during the Columbine attack. The recurrence of such stylised T-shirts and associated terminology among perpetrators has subsequently become a recognisable element of TCC culture and its broader system of perpetrator-focused symbolism.
Figure 3: Photograph showing the outfit worn by Liam Nebel during the Brinell School attack allegedly published on TikTok and Gore communities.
While Anton Lundin Pettersson’s motives appeared to be primarily race-related, reflecting influence beyond the TCC sphere, his attack quickly became canonical within TCC circles. Pettersson’s attack generated an immediate online afterlife, with his identity and images circulating online and with fan pages and videos appearing on Facebook, YouTube, TikTok and Discord praising him and the attack in heroic terms. It was this content that motivated Nebel.
The profile picture of Nebel’s archived TikTok account depicts Anton Lundin Pettersson ascending a staircase towards heaven. This imagery directly indicates Nebel’s admiration for and inspiration from Pettersson, while also reflecting the saint-like glorification of perpetrators observed within the TCC. The imagery may also constitute an example of pre-attack leakage, a missed indication that potentially signalled Nebel’s identification with Pettersson and foreshadowed his intention to carry out an act of violence.
Figure 4: Screenshot of an archived version of Liam Nebel’s TikTok account’s profile picture
Generally, much of Liam Nebel’s content on TikTok (see Figure 4) consisted of TCC-style video edits, comprising curated clips, imagery, music, and text presented in a stylised manner to commemorate, glorify, or otherwise elevate violent perpetrators and incidents. The online conduct associated with Liam Nebel strongly indicates his engagement with the broader TCC ecosystem. As shown in Figure 4, Nebel’s TikTok account had accumulated more than 3,500 followers and almost 50,000 likes through content incorporating cultural scripts and symbolism associated with the TCC.
Figure 5: Screenshot of an archived version of Liam Nebel’s TikTok account and TikTok story from before the attack.
Additionally, as shown in the screenshot on the right in Figure 4, Nebel published a TikTok story captioned “No more edits” a few hours prior to his attack, indicating that he was an active publisher of TCC-related content to a substantial audience. Taken together, these indicators strongly suggest that Nebel was deeply engaged in the TCC online culture.
Within days of the attack, imagery and memes featuring Nebel began circulating within TCC spaces, indicating his rapid incorporation into the community’s existing culture of perpetrator-focused content and glorification of violence:
Figure 6: Screenshot illustrating the post-attack glorification of Liam Nebel and Anton Lundin Pettersson within TCC-related TikTok content, published on 26.08.2026.
Figure 7: Screenshot illustrating the post-attack glorification of Liam Nebel within the Swedish TCC-related TikTok sphere, published on 26.08.2026.
The appropriation of the Fagersta case reinforces the importance of examining pre-attack leakage and post-attack amplification as a single process, extending the attack’s digital afterlife and reinforcing a feedback loop between content consumption, perpetrator glorification, and the potential emergence of future attackers.
Conclusion
The Fagersta attack illustrates a dynamic that conventional models of ideological radicalisation increasingly struggle to capture. Nebel’s online activity suggests that TCC content can function not merely as entertainment or fandom, but as a repository of cultural scripts, symbols and behavioural references that can be appropriated by individuals moving towards violence. Indicators such as repeated visual or written references to previous attackers, symbolic clothing, and abrupt transitions from fandom content to threatening or finalising statements may be meaningful signs of leakage when assessed in combination and in context. Nebel’s “no more edits” post has a different significance when viewed alongside a sustained history of perpetrator-focused activity and subsequent behaviour. The challenge is therefore not simply identifying individual pieces of violent content, but recognising changes in behavioural patterns and the accumulation of signals over time.
For technology companies, this suggests moderation and safety interventions should extend beyond removing individual violent posts, and identify cross-posting, rapid shifts in content, and the user migration between public fandom spaces and smaller pro-extremist communities. Given the scale of content on social media platforms, this depends on advanced technology solutions, but just as importantly on in-house human expertise to decode and analyse signals.
As with Fagersta, the same digital environment that may contain indications of an individual’s trajectory before an attack can subsequently transform that individual into a new object of fascination, imitation, and glorification. Addressing this feedback loop requires greater attention to how platforms detect behavioural escalation, preserve and interpret contextual signals, and limit the rapid amplification of perpetrators following acts of violence.
–
Valdemar Balle is an Open-Source Intelligence specialist and researcher whose work explores the intersection of computational social science, online extremism, and online threat intelligence.
Dr Tore Refslund Hamming is Director of Refslund Analytics, a boutique consultancy specialising in trust and safety, online extremism and counter-terrorism. For more than a decade, Dr Hamming has worked on issues related to radicalisation and counter-terrorism both as a researcher, consultant, and as an intelligence manager. He is a current member of GIFCT’s working group on Addressing Youth Radicalization and Mobilization (AYRM) and a member of the Christchurch Call Advisory Network.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.