In recent years, violent attacks with weapons and other acts of politically charged violence in the US have challenged longstanding frameworks used to identify and categorize extremist and terrorist movements. The dangers those frameworks were designed to address remain pressing, but they are insufficient for explaining newer trends in the threat landscape. 

ISD’s analysis of violent attacks and foiled attack plots linked to extremism in 2024 identified several trends related to biographical characteristics of suspects and perpetrators, motivations, tactics used, and targets selected. Most strikingly, the data showed that the deadliest incidents recorded were not tied to traditionally defined extremist ideologies. Instead, they were driven by a looser network of online subcultures that ISD refers to as “nihilistic violence.” Communities associated with nihilistic violence might echo the trappings and language of extremist and terrorist ideologies, their tactics and their use of social media. However their primary motivation for violence stems from a fundamental disregard for human life and a desire to see harms done to others.  

Individuals associated with communities that promote nihilistic worldviews accounted for two-thirds of all deaths and nearly two-thirds of all injuries in attacks and attack plots recorded by ISD in 2024. It is also of note that many perpetrators and suspects in the category were juveniles: historically not a characteristic demographic for extremist violence. Only a third of the recorded incidents were easily attributed to defined ideologies. While traditionally defined extremist movements continue to pose a significant threat to public safety, this analysis reflects an increased need to adjust frameworks and methods designed to counter ideologically motivated threats to account for this changing landscape.   

Key findings 

ISD analyzed 58 violent attacks or disrupted plans for attacks in the United States in 2024: a number that analysts believe to be representative but not exhaustive. Cases were only included if suspects or perpetrators were assessed to have ties to known extremist movements or exhibited indicators of online radicalization to violence, and if they employed or allegedly sought to employ a weapon capable of inflicting serious injury or death on their victims.^[1]

Key findings include:  

• Most alleged perpetrators and plotters were young men. Of the 61 total suspects and perpetrators, more than half were aged 18 to 29 when the events were recorded, and more than 90 percent were male. 
• Approximately half of the individuals aligned with traditionally defined extremist ideologies, but the remainder held unclear or loosely defined beliefs. Individuals identified as militant Islamists/jihadists (about 15 percent) and sovereign citizens (13 percent) were most common. Notably, 13 percent of individuals were assessed to have participated in the “True Crime Community” (TCC) online subculture, which glorifies mass murderers including many extremist perpetrators and frequently adopts worldviews that overlap with extremism. Analysts were unable to assess the exact nature of the extremist beliefs for just over 30 percent of individuals. In some cases, assessments were inconclusive due to gaps in confirmed information. In others, perpetrators and suspects exhibited mixed beliefs or assorted sentiments that did not match a singular ideology. 
• Of the 23 successful attacks, just under half resulted in bodily harms to victims or deaths. In total, 12 people were killed and 36 injured. Three juveniles linked to the TCC subculture allegedly carried out school shootings. These resulted in a total of eight deaths and 21 injuries, accounting for more than two-thirds of all deaths and nearly two-thirds of all injuries.
• Weapons were successfully deployed in 40 percent of incidents. More than half of all incidents were foiled attack plots (50 percent) or unsuccessful attempts to use a weapon (10 percent). Targets included critical infrastructure, schools and religious entities. In cases where details about law enforcement investigations were included in court records, more than 40 percent began with information provided by human sources, such as confidential informants. 25 percent were initiated after police received tips from the public.  
• Law enforcement were the most common targets (25 percent of cases), while 20 percent of individuals targeted schools. Others appeared to choose victims based on race, immigration status or sexual orientation.  
• Firearms were the most common weapons, chosen by two-thirds of individuals. Another 30 percent used or planned to use explosives while 10 percent chose incendiary devices.  

Methodology 

ISD analysts used open-source reporting to identify 58 violent events or plots determined to involve individuals associated with a political motivation, evidence of online radicalization, or links to extremist movements. They subsequently coded information for the 61 individuals (allegedly) involved. Indicators of extremism included affiliation with extremist groups, motives consistent with extremist beliefs and statements indicative of radicalization (e.g. a manifesto posted prior to a mass shooting).  

ISD substantiated coding with sources including original open-source research, legal documents and credible news media reporting. While some incidents are also categorized as hate crimes, only those with a link to extremism or online radicalization were included: for example, we excluded school shootings assessed to be motivated by non-ideological criminality/interpersonal conflicts rather than extremism. Every individual was coded for age, gender and ideology and each event was coded for success, the number of attackers, weapons used, targets, and deaths or injuries to others. Where available, analysts identified the sources that led to investigations.  

Cases which produced inconclusive or unclear results for some attributes were coded as  “unknown” or “other.”  In cases where multiple categories were relevant, analysts used all applicable (e.g. an attack involving firearms and incendiary devices would be counted under both). 

ISD analysis is intended to provide insight into broader trends, but the small sample size limits the predictive power of this analysis–particularly for variables such as age or weapon type. While analysts assess the dataset is representative of its scope, its reliance on public sourcing means it is not exhaustive.  

Attacks and alleged plots 

Of all 58 events recorded, 23 were successful attacks (i.e. cases in which the alleged perpetrator deployed a weapon, regardless of whether they resulted in deaths, injuries or other desired outcomes). Of those 23 cases, 11 resulted in injuries to victims and 7 resulted in deaths of victims. Twelve attacks did not produce bodily harms, while in another five, would-be attackers did not successfully deploy weapons. 

 

Of the 61 individuals in the dataset, 56 were men. Of the five women, three were allegedly involved in school shootings or alleged school shooting plots (including one which resulted in two deaths and six injuries). One individual arrested for a school shooting plot identified as a transgender man. Across the two genders coded, 32 percent were aged between 18 and 29 years old at the time of their respective incidents while 15 were over 40 years old.

 

Some individuals who were not identified as adherents of a specific extremist ideology engaged in attacks that involved tactics and targets reflecting political motives. These included two assassination attempts on then-candidate Trump and three separate mass shooting plots targeting migrants and federal agents, Jewish and Black community members, and White people. Among all alleged perpetrators, 26 individuals fit this category or were linked to TCC, a community which overlaps with extremism but is not necessarily associated with a specific ideology. The remainder of individuals in the dataset were assessed to fall relatively evenly across categories. 

In 34 plots and attacks, individuals were present who had known affiliations with extremist ideologies. This included nine people identified as militant Islamists/jihadists, eight as sovereign citizens, six as White nationalists/supremacists, five as militant anarchists, and two as anti-government extremists. Four supported other extreme beliefs.^[2]

About two-thirds of all deaths and injuries (eight deaths and 21 injuries) involved individuals linked to TCC who committed school shootings in Iowa, Georgia and Wisconsin (overall, attacks on schools accounted for three-quarters of recorded deaths despite a higher number of incidents targeting law enforcement). These incidents involved alleged perpetrators motivated by a subculture of nihilistic violence rather than an extremist ideology. However, it is important to note that TCC followers idolize extremist mass murderers and often espouse extremist sympathies.  

The Moorish Sovereign Citizen movement accounted for the second highest number of cases of bodily harm in the dataset, as two individuals linked to the ideology killed one law enforcement officer and injured six others in violent attacks. One individual linked to anti-government extremism was charged after beheading his father and posting a video online showing the severed head. While individuals with militant Islamist/jihadist beliefs accounted for the highest number of plots, none were recorded as successful (ISD’s 2024 dataset did not include the deadly New Year’s Day vehicle attack in New Orleans, Louisiana, since it occurred in the first hours of 2025). 

 

ISD did not identify any notable trends in target type. However, law enforcement was the most common target for alleged perpetrators with 15 attacks or plots, followed by 12 attacks/plots against schools. Other targets included religious institutions (8), politicians (4), government facilities/bureaucrats (3), racial minorities (3), critical infrastructure (3), migrants (2) and the LGBTQ+ community (1).  

 

By far the most common weapon category in the dataset was firearms: 40 individuals allegedly used or planned to use them during their attacks. Eighteen allegedly chose explosives, six incendiary devices, four edged weapons, two vehicles and four chose other methods such as sabotaging critical infrastructure. Those who allegedly chose explosives were rarely successful: only two of the 18 individuals who sought to deploy them successfully detonated a device, neither resulting in bodily harm to others.  

Analysts reviewed the 28 disrupted attack plots to determine the lead that initiated the investigation when available. According to court records viewed by analysts, 12 law enforcement investigations developed after human sources, like confidential informants, provided information. Another seven were initiated by public tips, while four originated with sources including a tip from a social media platform or family members contacting the police.  

 

Conclusion 

The attacks in 2024 support ISD’s prior research into the evolving threat landscape. They show the importance reconsidering existing prevention and response frameworks. Many of these fail to adequately address the threat of individuals who hold motives beyond identity-based definitions of extremism and terrorism.  

Whether those individuals should be considered in assessments of extremism and terrorism is still debated between researchers. Regardless, the violent threat they pose to the public is evident and merits new ways of thinking to understand the risks they pose. 

Violence and the threat of violence from traditionally defined threat actors remain an active issue for those seeking to curtail their harm. The data reviewed here, however, reveals an urgent issue that existing prevention and response frameworks cannot grapple with appropriately. If violent threats continue to emanate from individuals unassociated with rigid ideologies, they will warrant rethinking approaches to monitoring, prevention and accountability. 

End notes

[1]  Individuals accused of crimes but who have not been found guilty are referred to as “suspects.” 

[2] Two counted as “other” appeared to hold extreme conspiracy beliefs. Another was likely motivated by support for Armenia against Azerbaijan, and one was likely motivated by anti-corporate political beliefs.