On 25 July 2026, a man drove into Berlin’s Christopher Street Day (CSD) celebrations, an annual LGBTQ+ event similar to Pride. The attack killed one person and injured 29 others; the alleged attacker was shot and killed by police the next day. The attack appears to have been carried out by a 21-year-old German citizen with longstanding links to the Islamist extremist scene in Berlin; he had previously attempted to join the Islamic State (IS) group.[i]

As the investigation is still ongoing, many questions remain and important facts may still come to light. The initial observations below should therefore be treated with caution. Nevertheless, the reporting around the attack so far highlights several trends and issues that are likely to be important to understand the incident and strengthen efforts to prevent similar attacks in the future:

• IS remains a major terrorist threat,
• LGBTQ+ events have become a key target for Islamist extremist attacks,
• There are major questions about the authorities handling of the case,
• Extremist and terrorist content online continues to fuel radicalisation,
• Pro-IS accounts online will exploit attacks to promote further violence.

IS remains a major terrorist threat  

Germany has experienced 17 Islamist terrorist attacks since 2016, resulting in 24 deaths. Since the October 7 attacks and the subsequent Israel-Hamas war, there have been 7 completed attacks and numerous foiled plots in Germany. Previous ISD assessments have found that a double-digit number of these attacks/plots were linked to supporters of IS.[ii]

The group has called on followers to commit attacks across Europe, especially in France and Germany, following Hamas’ attacks in October 2023. Despite its loss of territory, IS continues to pose a major terrorist threat, attracting a new generation of followers who came of age after its peak in the mid-2010s. Although not all attackers/plotters had a formal connection to IS (with the group’s ideology primarily serving as inspiration in some cases), the alleged Berlin Pride attacker had attempted to physically join the group abroad (see below).

LGBTQ+ events have become a key target for Islamist extremist attacks  

Anti-LGBTQ+ hate has long been an important element of Islamist extremist ideologies. However, over the past 10 years, Islamist extremist attacks and plots globally have increasingly targeted LGBTQ+ communities. This can be seen in attacks such as the 2016 Pulse nightclub shooting in Orlando, Florida (the perpetrator continues to be celebrated within parts of the  pro-IS online ecosystem), fatal attacks of a gay couple in Dresden in 2020 and in the 2022 Pride shooting in Oslo, and foiled plots targeting LGBTQ+ events in London, Vienna and Zurich.

This increase in Islamist extremist attacks has taken place alongside a broader international wave of anti-LGBTQ+ violence from extremists across the spectrum. For example, in recent years, there have been a significant rise in attacks on Pride events in Germany, especially from the far right.

There are major questions about the authorities handling of the case

Given the alleged attacker’s known connections to IS, a clear ideological commitment and criminal record, there are major questions about authorities’ handling of the case in the lead up to the attack. At the same time, it is important to investigate all the details of the case rather than draw premature conclusions.

According to initial reporting, the alleged perpetrator started to radicalise from 2020 onwards and was known to intelligence services due to his involvement with an Islamist extremist youth group. He also frequented a Berlin Mosque previously associated with extremism, including due to individuals who joined IS in Syria and Iraq. In 2025, the alleged perpetrator attempted to travel to Mauritania[iii] and join IS in Syria. In the latter case, he tried to contact individuals in Lebanon whom he believed to be members of IS. He was subsequently arrested by Lebanese authorities, jailed for three months and deported to Germany. There, he was again arrested upon arrival and received a suspended youth sentence in May 2026 for preparing a terrorist crime.

As part of his conditions, the alleged perpetrator was also in contact with a prominent disengagement and deradicalisation programme although they already had concerns about the sincerity of his engagement before the CSD attack.

The alleged perpetrator was judged to be a high-risk individual by the federal crime agency. Authorities undoubtedly face a challenge from the large caseload of potential attackers; 420 Islamist extremists alone are assessed to pose a risk of conducting violent attacks. This makes a full-time observation of all such individuals impossible. However, the alleged perpetrator was closely monitored with daily analysis of surveillance footage and communications. Investigators flagged when the alleged perpetrator carried a toy gun, leading to a police raid. Despite this, authorities could not prevent the attack.

Overall, it is difficult to understand why the alleged perpetrator was out of prison already and only enrolled in a court-imposed deradicalisation programme. Both academic literature and practical experience show that disengagement from extremist groups is typically driven by disillusionment with ideology, leadership, strategy or tactics. Based on reporting to date, none of these disengagement indicators have been identified in the assailant’s case, though the investigation is ongoing. Incarceration is neither a complete nor durable solution to mitigate the risks from radicalised individuals. Nevertheless, it presents an opportunity to encourage and enable the disengagement process. Participation in a deradicalisation program can be an important tool in countering extremist violence, but it is not a silver bullet to protect the public from highly radicalised individuals.

Extremist and terrorist content online continue to fuel radicalisation 

Although the territorial caliphate has been destroyed, IS continues to resonate with young audiences online. The alleged CSD attacker, who would have been only nine when IS declared its ‘caliphate’ in 2014, is a case in point: he reportedly shared IS propaganda on Instagram in 2024 before attempting to physically join the group (see above). According to relatives, he spent much of his time online and appears to have had a small following on his accounts promoting Islamist extremist ideology.[iv] ISD researchers reviewed what appears to be the Telegram channel attributed to the alleged attacker. We identified a mixture of recitations and nasheeds[v] in addition to a sermon rejecting democracy, attacking Jews, Christians and a wide variety of Islamic preachers, and pronouncing groups including the Muslim Brotherhood, Hamas and Hayat Tahrir al-Sham as unbelievers.

ISD research in 2025 and 2026 noted that the IS ecosystem online continues to expand. In some cases, they have generated more engagement by specifically focusing on popular social media platforms such as TikTok, Facebook and Instagram. Much of that ecosystem is supported by a backbone of unofficial support outlets (ISD has catalogued almost 107 of these groups to date). These accounts distribute official content from the group while also generating their own branded content sometimes calling for attacks.

Our research shows that terrorist propaganda remains readily accessible across social media, alongside legal yet extremist content that can contribute to radicalisation. Islamist extremist online propaganda has been increasingly enhanced by AI-generated content. Broader Salafi and Islamist online subcultures continue to attract young people: pro-IS content is proliferating on youth-focused platforms such as TikTok and Roblox where the group’s supporters create multi-language propaganda and virtual worlds that mimic IS’ caliphate.

Pro-IS accounts online will exploit attacks to promote further violence  

In the aftermath of terrorist attacks, extremist movements commonly seek to exploit violent acts to strengthen their narratives, mobilise supporters and encourage further attacks. The reactions by IS supporters following the Berlin CSD attack fits this pattern.

The attack fuelled an already prominent undercurrent of IS support online for inspired and group-directed attackers who have targeted the LGBTQ+ community. IS supporters have long venerated Omar Mateen, the IS-inspired assailant responsible for the 2016 Pulse nightclub shooting (the deadliest attack on the LGBTQ+ community in the US). This has taken the form of videos and memes venerating him on TikTok, Facebook, Instagram and others, a practice known as “Mateenposting”. Similar trends in the IS ecosystem include edit videos of fighters throwing suspected members of the LGBTQ+ community from roofs when they had territorial control of parts of Iraq and Syria. IS supporters online sometimes target LGBTQ+ activists with phrases such as “to the roofs” as a nod to this form of targeted violence.

 

In the immediate wake of the Berlin attack, ISD researchers found videos on TikTok where AI video generator Viggle AI was used to create dancing versions of the assailant next to a gamified count of those killed and injured in the attack. One of those videos used what appeared to be a replica audio of the announcer from the video game Mortal Kombat. Viggle AI content has also been used by other supporters online to celebrate Mohammed Emwazi, an IS militant known as “Jihadi John” who was killed in 2015. In another video on TikTok, the Berlin assailant and Mateen were shown dancing next to each other, while a gamified kill count appeared on the screen.

Dancing jihadist attackers have appeared in other violent ecosystems on TikTok. For example, such content has been promoted by self-identified members of Total Christian Death (TCD), a subset of the True Crime Community (TCC), an internet fandom rooted in an obsessive interest in high-profile mass killers. Researchers identified TCD accounts sharing versions of the Berlin attacker AI-generated dancing video. This crossover highlights the increasingly hybrid environment online and how traditional barriers between ideology-driven communities are typically overcome by an affinity to violence. This reflects a threat landscape where imagery and tropes are cherry-picked from opposed belief systems – such as jihadist or neo-Nazi, as well as violent nihilistic online communities[vi] – for shock value rather than their ideological context. Researchers also found two TikTok Live sessions on the platform where the hosts and guests both lionised the attacker and called for more attacks; these sessions generated thousands of likes. Live sessions on TikTok both reinforce the ideology of the group and act as fora for like-minded extremists to pinpoint enemies.

A prominent “social media raid” group supportive of IS created two posts almost immediately after the name and image of the Berlin attacker were released. One post came with an imposing image of the assailant’s face next to an AI-generated image of police behind him with English text that read “The Science of Trampling”. The video featured a German IS nasheed along with audio of the current IS spokesman Abu Hudhayfah al-Ansari glorifying previous attacks (such as the New Orleans New Years Eve truck ramming). The video received 13,700 views in just under 24 hours. In the comments under the video, German supporters of the group appeared to be heartbroken over the death of the Berlin assailant.

On Facebook, where an IS ecosystem of support continues to stymie moderation systems and evade detection, supporters lambasted others in the IS support ecosystem who continue to post on social media and are not “men of action”. One post carried the image of the attacker on a stylised poster for others to repost in support of the attack.

Over the coming months, it will be important to closely track online communities glorifying the perpetrator and the dehumanisation of LGBTQ+ communities. Such insights can help researchers and practitioners assess the potential for copycat violence, understand evolving propaganda strategies, and can inform more effective prevention and protection efforts.

Conclusion 

The Berlin CSD attack demonstrates that Islamist extremism (particularly inspired by or linked to IS) remains a persistent threat to public safety in Germany. The attack shows how IS ideology continues to inspire a new generation of attackers, including online. This requires a more robust and consistent enforcement against terrorist content online by platforms, but also a close monitoring of online ecosystems supportive of groups like IS. Additionally, platforms should adopt a range of broader responses beyond content moderation to limit the reach of legal but extremist content which can fuel online radicalisation pathways. This includes reducing the algorithmic amplification of such content.

LGBTQ+ communities and Pride events appear to have become increasingly symbolic and frequent targets of extremist attacks, including from Islamist extremists. Government and civil society efforts to counter anti-LGBTQ+ attitudes – many of which are facing funding cuts – and protection of at-risk events need to be strengthened.

Perhaps most importantly, the initial reporting around the attack raises questions about whether existing tools are being used effectively by the judiciary and law enforcement, or if new capabilities are needed. The alleged perpetrator had repeatedly demonstrated his commitment to IS and was already known to authorities. The key question for upcoming investigations into the evidence around the attack will be how authorities can ensure appropriate sentencing, risk management and prevention. Rather than identifying scapegoats for the Berlin CSD attack, the aim should be to identify gaps, improve future processes and minimise the threat to the public.

[i] The alleged attacker came from a Lebanese Shia family with whom he remained in contact according to his father despite IS’ genocidal anti-Shia ideology. Additionally, reporting by Yassin Musharbash in Die Zeit suggests that the attacker’s aunt is married to the infamous Islamist extremist ideologue Omar Bakri Muhammad; two of his sons were killed fighting for ISIS in Syria and Iraq. Reportedly, the alleged CSD attack perpetrator admired his cousins and referenced them when trying to connect to IS members in Lebanon.   

[ii] Internationally, attacks inspired or directed by IS, have been common since 7 October, frequently targeting Jewish, Christian and holiday-related events. ISD previously identified that between January 2024 and December 2025, 11 of 26 attacks (42%) and 27 of 84 disrupted plots (32%) outside regions where IS fights insurgencies targeted Jewish or Israeli communities and institutions across 14 countries.

[iii] The alleged perpetrator reportedly claimed that he did not intend to join IS in Mauritania or neighbouring Mali, where it has an active presence, but rather that he visited study his religion or for holiday.

[iv] Reporting by Die Welt indicates that some Islamist extremists active online were aware of the attack plans and celebrated the alleged perpetrators actions online before they had taken place.

[v] Nasheeds are works of Islamic vocal music. While nasheeds are not inherently extremist, sometimes extremist groups such as use them to promote their ideologies.

[vi] Violent nihilistic communities lack an ideological motivation and are instead driven by a misanthropic worldview.