(New York, N.Y.) — The Counter Extremism Project (CEP) reports on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. Last week, ISIS released a new propaganda video via the group’s self-proclaimed Central Africa Province.
The pro-ISIS al-Saqri Foundation circulated a 24-page manual for constructing improvised explosive devices on JustPaste.It, MediaFire, and the Internet Archive. The three sites removed the content after CEP reported it. On September 25, the pro-ISIS tech group Electronic Horizons Foundation (EHF) released a cybersecurity guide for the SimpleX Chat program. Pro-ISIS users on Telegram and RocketChat speculated on potential ISIS involvement in the September 23 throwing of grenades in Oslo, Norway, despite no evidence suggesting an act of terrorism. On September 14, the pro-ISIS online propaganda group al-Basair Media requested donations utilizing the privacy cryptocurrency Monero.
The neo-Nazi accelerationist group The Base announced on September 23 that they were planning a training event between October 10 and 12 in the mid-Atlantic region. In a September 19 post, a neo-Nazi accelerationist website connected to former members of the Atomwaffen Division noted that while Charlie Kirk was a “system elite,” the present moment offered a propaganda and recruitment opportunity. CEP researchers identified a fundraiser for Robert Rundo and an Active Club-affiliated brand on the crowdfunding platform Buy Me A Coffee. On September 24, an Illinois Active Club chapter shared emails allegedly sent by two members of Active Clubs in Arizona and Texas, condemning the chapter. On September 18, the main Active Club England X account and a movement-affiliated Substack account announced that the group had held its first combat sports event in England. Finally, on September 16, the fourth issue of a neo-Nazi prison outreach newsletter was released on Telegram, featuring an essay by Australian neo-Nazi Thomas Sewell, news updates, and a section on online privacy.
New ISIS Propaganda Video Released
On September 26, ISIS released a new propaganda video via the group’s self-proclaimed Central Africa Province. In the approximately 18-minute video, speakers called for people around the continent to travel to the Democratic Republic of Congo to join ISIS, stating that migration and fighting were religious obligations. The video threatened attacks against the Ugandan government. It also included footage of executions, combat between ISIS fighters and the Congolese and Ugandan military, and the forced conversions of Christians. The video concluded with a demand that the media stop referring to ISIS in Congo as the Allied Democratic Forces (ADF) and refer to them as the Islamic State. The video was spread via Telegram, RocketChat, Element, and SimpleX Chat.
Pro-ISIS Guide for Remotely Detonated Vehicle Bombs Located on MediaFire and Spread via JustPaste.It
On September 25, CEP researchers located a 24-page manual for constructing remotely detonated improvised explosive devices to be placed on vehicles made by the pro-ISIS al-Saqri Foundation on MediaFire and spread via JustPaste.It. The JustPaste.It page, created on September 25, was spread by a pro-ISIS channel on the RocketChat platform. The file on MediaFire was uploaded to the site on September 17. CEP reported both files on September 25. As of September 29, both files were removed.
An additional upload of the manual was located on the Internet Archive, which made it inaccessible for viewing or downloading after CEP reported it.
Image associated with al-Saqri explosives guide located on September 25. Image taken from JustPaste.It distribution bulletin board page.
Pro-ISIS Tech Group Releases SimpleX Chat Security Guide
On September 25, the pro-ISIS tech group Electronic Horizons Foundation (EHF) released a seven-page guide regarding the use of the SimpleX Chat app, indicating that its use should be permitted within limits. The pamphlet noted that SimpleX had several advantages in terms of usability, such as not requiring a phone number or email to register and not using account IDs. Additionally, EHF noted that the app features numerous security measures, including a decentralized network, encrypted servers, protection of user data, connectivity over Tor, and end-to-end encryption for group communication, person-to-person communication, file sharing, and voice and video calls. EHF also noted that SimpleX has been reviewed by third parties to ensure encryption and prevent data interception. The pamphlet noted that SimpleX also had several disadvantages, including limitations on file size and automatic deletion of files after 48 hours. EHF stated that no app was completely secure and that future vulnerabilities were always possible, declaring that users should always be cautious when sending sensitive information.
In July, the pro-ISIS tech group Qimam Electronic Foundation (QEF) warned its followers to avoid SimpleX because of the possibility of exposing a user’s IP address. Pro-ISIS users have continued to use SimpleX despite the QEF warning, and in August, CEP researchers located an explosives guide being shared on the platform.
Electronic Horizons Foundation (EHF) guide released on September 25.
Pro-ISIS Users Encourage Attacks in the West, Speculate on Oslo Grenade Attack
Pro-ISIS Telegram channels and RocketChat users mentioned the September 23 Oslo grenade attack, despite no evidence connecting it to ISIS or terrorism. Norwegian law enforcement officers arrested three boys, including two 13-year-olds, who were accused of throwing hand grenades in a downtown area. No one was injured, and police suggested that the perpetrators were paid to commit the attack, noting the possibility that the attack was “violence as a service.”
Pro-ISIS users posted that the attack occurred near the Israeli embassy in Oslo and pointed out that the editorial in the 513th edition of the ISIS newsletter al-Naba, released on September 18, had called for attacks in the West targeting “Jewish and Christian gatherings.”
Pro-ISIS Online Propaganda Group Requests Monero Donations
On September 14, al-Basair Media, a pro-ISIS online propaganda group, requested donations via the privacy cryptocurrency Monero and posted a wallet address. The post specifically claimed that donations were going to the “Mujahideen.” An al-Basair Media channel on RocketChat was created on September 14, posting in Arabic, Turkish, Russian, and English, and noted that future translations of ISIS content in Turkish would be provided. On January 14, the group released a statement condemning individuals who either lied about fundraising for ISIS or did so illegitimately.
Segment of September 14 al-Basair Media post on RocketChat.
Neo-Nazi Accelerationist Group The Base Announces Upcoming October Event
On September 23, the neo-Nazi accelerationist group The Base announced that they would be holding a camping and hiking event focusing on basic survivalist skills between October 10 and 12 in the mid-Atlantic region. The invitation, posted on VK and SimpleX Chat, noted that non-members were permitted to attend after vetting and urged interested individuals to contact the group via Proton Mail or Mail.Ru.
The group is alleged to have previously held a national training event in late spring. A photo posted by the group on June 9, allegedly from the Appalachia region, showed six individuals posing with weapons. Rinaldo Nazzaro, the group’s leader who lives in Russia, has stated that in-person events and the resulting propaganda are crucial for recruitment. In a video released on September 11, 2025, Nazzaro noted that the group was focusing on the U.S. and Ukraine because both were either “destabilized or could be destabilized,” have favorable terrain for guerrilla tactics, and because firearms could be obtained in both countries. In a podcast released on June 10, where he repeatedly denied connections to the Russian intelligence services, Nazzaro stated that Ukraine was the only area where the group was conducting “kinetic operations.”
Neo-Nazi Accelerationist Website Condemns Charlie Kirk, Notes Recruitment Opportunity
A September 19 post on a prominent neo-Nazi accelerationist website connected to former members of the Atomwaffen Division and successor organizations condemned the assassinated Turning Point USA co-founder Charlie Kirk as a “system elite,” “party boss,” and “e-celebrity,” who was allied with Jews and Israel, but noted that the accelerationist community should seek to spin his murder to their own benefit. The post stated that it was crucial to avoid blowback, noting that one’s private conversations could be drastically different from public rhetoric. It recommended that neo-Nazi groups focus on condemning violence from the left and welcome potential federal crackdowns on the left and anti-fascist activists. The post asserted that the present moment was critical for recruitment and radicalization.
CEP Reports Active Club Affiliated Fundraiser on Buy Me A Coffee
On September 23, CEP researchers located a fundraiser for Robert Rundo and the white supremacist Active Club-affiliated Will2Rise brand on the crowdfunding platform Buy Me A Coffee. As of September 29, the fundraiser had received an undisclosed amount of money from four supporters. The fundraiser description noted the movement’s affiliated clothing brand, the spread of the Active Club movement, and the recent Frontier event on August 30. Active Club linked accounts on X and Substack shared the Buy Me A Coffee link.
CEP reported the fundraiser to Buy Me A Coffee on September 23. As of September 29, the crowdfunding campaign was still active. The crowdfunding platform previously removed a campaign for the neo-Nazi group Blood Tribe that CEP reported in January.
Part of the Media2Rise / Robert Rundo Buy Me A Coffee fundraiser. Screenshot taken on September 25.
Arizona and Texas Active Clubs Condemn Illinois Chapter
In a series of Telegram posts on September 24, a Chicago area chapter of the white supremacist Active Club movement posted emails allegedly sent by two members of an Arizona and Texas club. The senders, who acknowledged being allied with Patriot Front, claimed that the Illinois club was affiliated with the accelerationist group Injekt Division, opposed Patriot Front, and was a “rogue” chapter. The email further stated that the Illinois club was “unrecognized” within the Active Club movement and had been condemned, and challenged them to a bare-knuckle fight, to be hosted by a Kansas City-based chapter.
Active Club England Holds Boxing Event
On September 18, an X account affiliated with Active Club England posted photos from a recent boxing event. Posts on an Active Club Substack stated that it was the first combat sports contest held by Active Club chapters in England, and were part of the process of creating an extreme right subculture. The meetup occurred shortly after the main U.S. Active Club event, Frontier, held in August, as well as a Canadian event also held in August, and a Netherlands fight night event held in July. CEP previously reported the X account to the platform in April 2025; however, it was still online as of September 29.
Fourth Issue of Neo-Nazi Prison Outreach Newsletter Released
On September 16, the fourth issue of a neo-Nazi prison newsletter was released on Telegram. The main article consisted of a defense of European white nationalism that condemned “vile migrant invaders.” It included summaries and a defense of anti-immigration movements, protests, or riots in the United Kingdom, Ireland, Spain, Italy, Portugal, Germany, Poland, the Netherlands, and Australia. The fourth issue also included a prison letter from Australian neo-Nazi Thomas Sewell, dated September 6, 2025, where he encouraged personal growth and self-discipline while incarcerated.
The newsletter also included a summary of different methods to enhance online privacy, specifically advocating the use of the VPN Mullvad, the operating system Tails, the encrypted messenger Wire, and the privacy cryptocurrency Monero. A timeline of recent events was also included, mentioning the assassination of Charlie Kirk, the U.S. economic slowdown, the September 13 anti-immigration march in London, the youth uprising in Nepal, and updates regarding Shiloh Hendrix and the whites-only community Return to the Land Movement in Arkansas.
The third issue of the newsletter was released on July 19 and featured an essay by Sarah Beth Clendaniel, who was sentenced in September 2024 to 18 years in prison for conspiring with former Atomwaffen Division leader Brandon Russell to damage or destroy electrical facilities in Maryland, thereby knocking power out to Baltimore.
On July 23, a Telegram channel connected to the newsletter claimed that they were in contact with the man who murdered 11 people and wounded seven others in an October 27, 2018, antisemitic attack on a Pittsburgh synagogue.