Digital Dispatches
October 2, 2025
ISD-US
Hybrid Extremism and Nihilistic Violence, Terrorism and Extremism
Memetic violence: How the True Crime Community generates its own killers
Update, April 6 2026: Since publication, the trends outlined in this Dispatch have continued. Analysts retrospectively identified three additional disrupted plots – one in 2024 and two in 2025 – and in the final months of 2025 there was a TCC-linked attack in California as well as two disrupted plots. Thus far in 2026 no TCC-linked attacks have been identified, but authorities have disrupted four plots. With these new incidents, ISD is now aware of at least nine attacks and 16 disrupted plots associated with the True Crime Community since the beginning of 2024.
Summary
Largely unknown outside of fringe forums, an internet fandom known as the True Crime Community (TCC)—rooted in an obsessive interest in high-profile mass killers —has emerged as one of the most significant contributors to acts of public violence in the United States and around the world. ISD research has identified at least 15 school shootings or disrupted attack plots linked to TCC since the beginning of 2024. TCC-linked attackers are often driven by a desire for notoriety, and media coverage of these incidents has a high potential of mobilizing other TCC fans to carry out their own attacks. In just one week following the deadly 27 August school shooting in Minneapolis, ISD analysts provided information to law enforcement agencies across the globe about six individuals associated with TCC who appeared to be plotting acts of violence in and outside of the US. Due to the sensitivity of ongoing investigations, further information cannot be shared on these potential plots, but in at least two cases, subsequent public statements by law enforcement officials indicated that the suspects were imminently plotting attacks.
While the threat from this community appears to be growing, this is not a new phenomenon. Pre-digital true crime fandom has intersected with acts of violence since the late 1980s, and ISD researchers are working to develop a comprehensive database of TCC-linked attacks in the United States. A review of the data from 2024-2025 shows that at least seven school shootings and nine disrupted school shooting plots in the US were allegedly carried out by individuals linked to TCC. Eleven victims were killed in those attacks (not including the shooters) and 45 were injured, making TCC-linked school shootings significantly deadlier during this period than all other attackers linked to more clearly ideologically motivated extremist movements combined.
What is the True Crime Community?
TCC is a broad term for the online fandom[1] interested in true-crime media, but is used in this context to refer to the most extreme participants who obsess over high-profile killers[2] and sometimes attempt similar violence. In this community, fan-like behaviors typically reserved for celebrities are instead directed toward mass killers such as Dylann Roof and Adam Lanza. While groups of young women developing obsessions with high-profile male murderers is also a pre-internet phenomenon, public interest with Columbine shooters—Eric Harris and Dylan Klebold— spawned the dedicated online fanbase known as ‘Columbiners.’ In practice, participants in TCC behave as devoted fans of their favorite murderers: dressing like them, doodling their names in notebooks at school, putting up pictures in their rooms or lockers, creating or commissioning art of them, etc. Some even go so far as to describe themselves as “hybristophiles” (sexually attracted to violent criminals). These fans gather in online forums—including Tumblr, Discord, Telegram, X and more—and through hashtags to engage with others who share their interests. More concerningly, some fans of TCC go further and carry out violent attacks as either an expression of their own grievances, to pay tribute to their favorite killers, or to garner notoriety within TCC. These fan imitators typically value the aesthetics of attacks more than the tactics or motivations of the perpetrators, and they are less likely than traditional “copy-cat killers” to be directly inspired by recent media coverage or by ideological alignment with those perpetrators. Violence committed by attackers associated with the TCC is rarely ideological in nature, nor is it straightforward copy-cat behavior. The process through which TCC attackers take inspiration from previous attacks while still personalizing details and seeking their own notoriety is perhaps best described as memetic. It is an act of interpretation and transformation, wherein an attacker acknowledges a previous high-profile incident of interest to the fandom, modifies or adds elements to make it their own, and then guarantees their version dominates headlines. Over time, any communicative elements of an attack such as writing on a gun or the contents of a manifesto are assembled primarily from miscellaneous references to other attacks or in-group jokes and become completely nonsensical to the wider public.
TCC is one of the most prominent online subcultures of nihilistic violence. Unlike extremist groups, subcultures of nihilistic violence pursue neither political or social change nor promote a supremacist worldview. Instead, they promulgate a misanthropic (hatred of humanity) worldview, glorify violence, and seek to fulfil their participants’ desire for notoriety. However, the community contains some elements that reject violence for either moral or practical reasons. To TCC, high-profile criminal cases are interesting and entertaining, but more violence isn’t necessarily desirable, especially if it risks reflecting poorly on the community. Many participants openly beg others not to commit their own attacks not just on moral grounds, but because they don’t want the entire fandom to be subject to platform bans or law enforcement action. Regardless of what the ‘average’ fan wants, the structure of the community can incentivize violent action by providing a guaranteed audience. Unlike traditional news outlets, TCC obsessively analyzes a killer’s actions and enshrines them within its broader pantheon of favored attackers.
Attacks linked to TCC
Since the beginning of 2024, ISD has identified seven school shooters and nine attempted attackers with links to TCC. In nearly all of these cases, ISD analysts used online content referencing mass attackers—including Adam Lanza, Dylann Roof and the Columbine shooters—that the alleged attackers shared or created prior to their attacks or arrests to link the suspects or perpetrators to TCC. In several cases, analysts were able to identify social media accounts on platforms popular within TCC, such as Tumblr and Telegram, where the attackers participated in TCC communities. For a May 2025 disrupted plot in California analysts were unable to review the original content of the plotters and based their assessment on law enforcement and media statements.
Attacks:
Plots:
While the volume of mass casualty attacks is undeniably higher in the US, this is not a uniquely American phenomenon. The cultural memes of school shootings and mass violence often reference American school shootings such as Columbine or Sandy Hook, but TCC is an international community. In June 2025, a 21-year-old participant in TCC forums killed 11 students at the Dreierschützengasse High School in Graz, Austria. In the first half of September 2025 alone, ISD analysts provided information on potential threats from TCC-linked individuals to authorities in Mexico, Australia and Romania.
TCC attacks appear to have spiked in late 2024, but analysts caution that it is difficult to determine temporal trends with the current data, particularly given the cyclical and imitative nature of TCC. TCC participants are, at their core, fans of mass killers. Any mass shooting drives increased activity on their forums, but the community becomes particularly energized when the attacker leaves behind an online footprint that can be analyzed and imitated. This effect is further magnified when the attacker was active in TCC spaces themselves. As highlighted in previous ISD research, a desire for notoriety is a significant driver of nihilistic violence and the attention gained by mass shooters can inspire vulnerable TCC fans to carry out their own attacks. Analysis of recent TCC-linked attacks suggest that these attackers may have been specifically seeking recognition and status within the community.
This “copycat” or clustering phenomenon was supercharged in the aftermath of the December 2024 Abundant Life Shooting in Wisconsin. The perpetrator, 15-year-old Natalie Rupnow, achieved a level of celebrity in online TCC spaces that is generally reserved for the most notorious mass attackers. ISD analysts found that Rupnow rose to prominence because she was not only a mass attacker, but also an active participant in TCC fora. She was known to members of the community and left a robust digital footprint for fans to dissect. This notoriety was only compounded when the January 2025 Antioch High School shooter—who was also an online associate of Rupnow’s—made references to her prior to his attack, later followed by the August 2025 Annunciation Church shooter writing Rupnow’s name on his rifle.
The Abundant Life and Antioch High School shootings have become significant events in TCC history and may have shifted the community’s focus toward younger audiences. Most TCC icons are from an earlier generation, with the 1999 Columbine shooters, the 2012 Sandy Hook attacker and the 2015 Charleston church murderer among some of the most popular figures for TCC fans. Although only a decade separates the Charleston church attack from the recent shooting in Minnesota, for a community primarily composed of juveniles and young adults in their 20s, these earlier figures may seem outdated or distant. Other, more recent mass attackers continue to be venerated and researched by TCC fans, with Rupnow currently representing a central figure in the community.
Implications for Prevention
TCC and other similar subcultures of nihilistic violence represent a complex challenge for law enforcement and prevention professionals. As noted in a July 2025 ISD report, policymakers must “fundamentally recalibrate” approaches to extremism-related violence, shifting from a purely ideology-focused model to a comprehensive, public health oriented approach. This type of model seeks to reduce societal and individual conditions that could lead to targeted violence while strengthening factors that protect communities and individuals. In the long-term, broader violence prevention strategies have the potential to lessen the strain on counter-terrorism resources and offer more sustainable solutions than relying solely on law enforcement intervention.
TCC’s fundamental desire for notoriety also poses challenges for media and research organizations. As noted above, evidence suggests that high-profile shootings carried out by TCC fans have the potential to inspire copycat attacks or, more often, inspire others in the community to carry out their own attacks in pursuit of similar recognition. While the increased importance of in-group recognition has reduced the significance of public coverage, the fundamental nature of the community relies upon access to a body of primary sources about attackers. Journals, family photos, details about the attire worn during the attack, and other seemingly banal information is often just as (if not more) prized by TCC as video footage of attacks or manifestos. As TCC increasingly venerates attackers that come from within their community, the ability of media or research organizations to control access to that material is diminished. Simple measures such as declining to name perpetrators in media coverage remain advisable but will have a limited effect given the proliferation of information among TCC fans.
It is still critical to be mindful of material or narratives that could enable veneration or imitation. Journalists should be aware that participants have a preference for killers that are relatable, particularly when there’s a viable narrative suggesting the killer isn’t responsible for their own actions. Killers that may represent mundane social struggles such as feeling misunderstood, bullied or lonely are more likely to inspire TCC participants due to the ease with which they can identify with the subject. Additionally, attackers who are described as straightforward sadistic sociopaths become simple pop-culture archetypes of serial killers. In either case, fans consider the killers to be victims who took revenge on a society that rejected them, which is applicable to nearly any possible grievance and a desirable way to be perceived by the public for those considering their own attacks. In these narratives, the killer is empowered, recognized and feared for the first time in their life. This is the combination of empathy and notoriety that future attackers seek.
Social media platforms can also play a role in confronting this threat if they are able to effectively separate non-violent fans of true crime from those users who venerate and glorify violence. TCC fans gather on a variety of social media platforms and those linked to acts of violence are tightly intermingled with other users who pose little-to-no risk. The Terms of Service for many platforms do attempt to address glorification of violence, but the line between concerning TCC activity and ordinary discussion of true crime is difficult to police, particularly when using automated systems. Banning TCC fans from individual platforms has proven to be ineffective at diminishing the glorification of violence as they often reconstitute their groups (either on the same platform or another), and individuals who are banned from online spaces may still mobilize to violence. Platforms must dedicate resources and engage with the research community to develop nuanced approaches to detecting threats of potential violence, identifying approaches to regulating feeder communities such as self-harm and eating disorder encouragement groups. When trying to identify TCC-linked attackers, platforms should focus less on ideological markers that can be unreliable and potentially result in the restriction of speech, and instead on behavioral indicators of mobilization to violence. Platforms should ensure that information indicating that a user may be mobilizing to violence is shared with the appropriate prevention and enforcement authorities. In extreme cases this information alone may mitigate an imminent threat, but in all situations should be weighed in conjunction with other behavioral risk factors to create a holistic risk assessment.
End Notes
[1] Fandoms are subcultures whose participants are united by enthusiasm for a genre, piece of media, celebrity, or other pop culture artifacts. Fandoms are characterized by their engagement in creative activities related to their favorite topics including making their own art, writing fanfiction, and sharing photo/video compilations. While TCC operates as a fandom, some participants object to the word “fan” and find it disrespectful or misleading.
[2] The reputation of TCC as harboring psychopaths, school shooters, and neo-Nazis has led many TCCers to disavow the term and community, while others have tried to reclaim it. For the sake of simplicity, “True Crime Community” here will be referring to the fanbase in support of high-profile killers, rather than any of the variations of fans interested in case details, amateur sleuthing, or the psychology of violence despite the substantial overlap between the factions.
