(New York, N.Y.) — The Counter Extremism Project (CEP) reports on the methods used by extremists and terrorist groups on the Internet to spread propaganda and incite violence. In this week’s issue:
- Online Pro-ISIS Supporters Celebrate Berlin Christopher Street Day Attack
- ISIS Al-Naba Editorial Encourages Martyrdom
- Pro-ISIS Tech Group Issues Warning Regarding Monero Cryptocurrency
- ISIS Activity Roundup
- Under-18 White Supremacist United Youth Club Movement Seeks to Recruit on TikTok
- Canadian Youth Club Movement Announces Chapters in Seven Provinces
- On Substack, Active Club Movement Releases Style Guide and Advice for Anonymity and Operations Security
- Fight Promotional Group Shares Patriot Front Video
- Neo-Nazi Telegram Channel Administrator Shares Post Regarding Local Meetups from Anti-Government Channel
- Ohio White Supremacist Group Launches Website
- Neo-Nazi Accelerationist Website Requests Monero Donations
Online Pro-ISIS Supporters Celebrate Berlin Christopher Street Day Attack
Pro-ISIS online supporters celebrated the July 25 vehicular and knife attack targeting an LGBTQ+ event in Berlin, in which one person was killed and 29 others were wounded. The suspected perpetrator, identified by media as Abdul Ballout, was killed after reportedly attempting to attack police officers with an edged weapon. Ballout was an avowed ISIS supporter who shared the group’s propaganda online and traveled to Lebanon in an attempt to join the terrorist organization in Syria. He had been sentenced in May 2026 for planning an attack; however, his sentence was suspended due to pre-trial detention, confessing to his crime, and allegedly disengaging from support for ISIS.
Following the attack, ISIS supporters on Telegram, RocketChat, and Matrix celebrated the perpetrator and his act of violence. Pro-ISIS Telegram channels praised the attacker and noted the choice of targeting an LGBTQ+ Pride event. A post stated that ISIS did not need to officially claim credit for the attack due to its “ferocity” and the terror inflicted on ISIS’s enemies. An additional post stated that the attacker was an example of a “predicament” facing Middle Eastern and Western intelligence and law enforcement agencies: those prevented from traveling to join ISIS may commit attacks in their home country, seek to radicalize individuals in prison, or spread ISIS propaganda and ideology.
ISIS Al-Naba Editorial Encourages Martyrdom
The editorial in ISIS’s weekly al-Naba newsletter released on July 23 praised the concept of martyrdom, noting that death was the beginning of “eternal life.” The article stated that it was necessary to fight against the injustice and oppression of the world, and that dying was inevitable. The editorial concluded by encouraging the reader to be killed “by an airstrike or a hail of bullets” rather than passing away “in one’s bed.”
Image from ISIS editorial in al-Naba issue 557, released on July 23.
Pro-ISIS Tech Group Issues Warning Regarding Monero Cryptocurrency
On July 25, a pro-ISIS online tech group issued a warning that Monero was not a foolproof privacy cryptocurrency. The post, which contained a link to an August 2024 study on Monero traceability, claimed that certain decoys used in a Monero transaction could be identified, making the cryptocurrency less secure than previously thought and potentially leading to the identification of a transaction recipient. The message urged ISIS supporters to employ additional unnamed methods of ensuring privacy, and always to be diligent when using Monero and practice good operational security.
ISIS Activity Roundup
Between July 19 and 25, ISIS claimed credit for 15 attacks. The terrorist group claimed responsibility for seven attacks in Nigeria, six in the Democratic Republic of the Congo, and one each in Mozambique and Pakistan. ISIS claimed to have killed a judge and his bodyguard and wounded two others, including a judge, in the July 23 attack in Pakistan’s Balochistan Province
Under-18 White Supremacist United Youth Club Movement Seeks to Recruit on TikTok
In a search of TikTok on July 22, CEP researchers located 55 accounts for under-18 white supremacist United Youth Club chapters. Profiles claimed to be recruiting males between the ages of 14 or 15 and 18, directing potential applicants to a main Telegram account. The TikTok accounts posted Youth Club and Active Club propaganda, including photos of antisemitic, anti-Muslim, anti-Black, and anti-immigrant flyers, photos from meetups, and videos of Active Club co-founder Robert Rundo.
The 55 accounts had between 12 and almost 1,500 followers, averaging 359 per profile. Posts had dozens of views to several thousand for accounts with larger followings. Multiple accounts appeared to have been made in the spring or summer of 2026.
Accounts were located for clubs allegedly in 30 U.S. states: Iowa, Minnesota, North Dakota, South Dakota, Nebraska, New Jersey, South Carolina, North Carolina, West Virginia, Texas, Virginia, Maryland, Georgia, Alabama, Louisiana, California, Kentucky, Kansas, Nevada, Montana, Rhode Island, Alaska, Tennessee, Missouri, New York, Ohio, Indiana, Florida, Arizona, Pennsylvania, as well as the District of Columbia. Three accounts were additionally for the Canadian provinces of Ontario, British Columbia, and Nova Scotia. Two central accounts were also located for both the U.S. and Canada. Some Youth Club accounts claimed to represent chapters in specific cities, including San Antonia, Dallas, Austin, Philadelphia, Akron, Seattle, Savannah, New Orleans, Macon, Wichita, Kansas City, Charlotte, Winston-Salem, Helena, Providence, Nashville, and Tampa.
CEP reported the 55 accounts to TikTok on July 22 for violating the platform’s policies against accounts that “promote, support, [or] recruit” for “hateful organizations.” As of July 27, 37 accounts were still on the social media site, a removal rate of 32.7 percent.
CEP researchers additionally located accounts for 10 Active Clubs in France, England, the Czech Republic, Finland, Norway, and the Netherlands, as well as the U.S. states of Alaska and two in California. The 10 accounts had an average of 473 followers, ranging from 15 to almost 1,200. CEP reported the 10 accounts on July 22. Six accounts were still on the platform on July 27.
Antisemitic, anti-Muslim, anti-Latino, and anti-Black Youth Club propaganda from a Texas chapter located on TikTok. TikTok flagged the post for potentially containing Holocaust denial content. The account was removed after CEP researchers reported it.
Screenshot taken on July 22.
Canadian Youth Club Movement Announces Chapters in Seven Provinces
On July 18, the Canadian branch of the United Youth Club movement announced that it had chapters in seven provinces: British Columbia, Alberta, Manitoba, Ontario, Quebec, Newfoundland, and Nova Scotia. The post encouraged the creation of chapters in provinces where none existed. The post included a main Telegram account for Canadian recruitment. The Manitoba Youth Club chapter Telegram channel was created on July 19. The accounts for chapters in Ontario, Nova Scotia, Alberta, Quebec, and British Columbia were created in March, and the Newfoundland channel was created in May. On July 7, the main Canadian Youth Club chapter announced the creation of a branch for young women between the ages of 15 and 18.
On Substack, Active Club Movement Releases Style Guide and Advice for Anonymity and Operations Security
The main Active Club Substack account made a post on July 19 that contained a style guide for the white supremacist movement as well as tips for preserving anonymity during protests or other “actions.” Robert Rundo and other proponents of the Active Club “3.0” ideology have previously recommended dressing in streetwear and workout clothing, a more toned-down style compared to that of the white power skinhead subculture or styles associated with some U.S. neo-Nazi groups. The July 19 post advised that Active Club members should dress in moisture-wicking T-shirts, sweatpants for day-to-day wear, and all black for what the author called “actions.” The post recommended specific brands for jackets.
For “actions,” the post endorsed wearing two pairs of surgical gloves, noting “this ensures fingerprints are not left behind” and specifically stating that compared to cloth gloves, “surgical gloves are preferred because they don’t leave behind fibres [sic] that can be used for forensic analysis.” The post also recommended putting a stone or similar object in one’s shoe to change walking patterns and defeat gait analysis software. The author claimed that gait detection software or poor operational security had led to arrests after the June 2026 Northern Ireland riots. The article advised not discussing “actions” after their commission for operational security reasons.
A photo used in the Substack post as an example of European Active Club style. Note the plaque on the wall featuring the logo of the neo-Nazi Hammerskins. Screenshot taken on July 23.
Fight Promotional Group Shares Patriot Front Video
On July 18, the fight promotional group Streets Fight Club (SFC) shared a video from the neo-fascist group Patriot Front on its Telegram channel, which has almost 7,500 subscribers. SFC organizes bare-knuckle and mixed martial arts (MMA) fights in Russia, Europe, and the U.S., which are shared via an online pay-per-view system. SFC’s U.S. contact is a member of a Texas Active Club, and individuals from Active Clubs and Patriot Front have participated in SFC-organized fights. SFC has posted photos of individuals they have claimed are fans who appear to be serving in either the Russian armed forces or affiliated private military contractor firms.
The Patriot Front video showed the group’s members participating in a nighttime rally against Purdue Pharma in Stamford, Connecticut. The video was released on the Patriot Front Telegram channel on March 24, 2020. Purdue Pharma ceased operations on May 1, 2026, after the U.S. government ordered the company to pay penalties of over $5 billion for its role in the opioid epidemic.
Neo-Nazi Telegram Channel Administrator Shares Post Regarding Local Meetups from Anti-Government Channel
On July 21, a neo-Nazi Telegram channel with over 3,200 subscribers shared a post from a white supremacist and antisemitic podcaster and influencer in the survivalist and firearms community regarding local meetups. The post encouraged Telegram users to post their general location to meet up with others for activities including hiking with firearms, noting that the chat was likely monitored by federal law enforcement and warning not to do anything illegal. Previous members of the chat have included an individual associated with the Active Club movement, and at least one individual promoting the white separatist group Northwest Front.
The podcaster and influencer has over 9,000 followers on Telegram, almost 190,000 subscribers on YouTube, over 116,000 followers on X, and over 16,000 subscribers on Instagram.
The neo-Nazi Telegram channel has previously shared posts from the same channel in March 2026, and October and May 2025. The neo-Nazi Telegram channel has previously made posts that supported the murder of politicians and shared dox information.
Ohio White Supremacist Group Launches Website
On July 21, an Ohio-based white supremacist group announced it had launched a website. The group, the Ohio Nationalist Network (ONN), was previously a chapter of the Active Club movement before rebranding as ONN in April 2025. The website, which includes a contact form for recruitment, notes the group’s goals as providing mutual aid to white people, opposing “Jewish power,” and organizing against the construction of data centers.
An inaugural blog post claimed that white people were at a disadvantage in the U.S. and encouraged physical fitness and building community. The author bragged that as the Ohio Active Club, the group had shut down a drag event held at a bookstore. The venue canceled the event after the white supremacist group doxed participants and, in at least one case, posted photos of their families online.
The website uses Namecheap as its registrar.
Neo-Nazi Accelerationist Website Requests Monero Donations
On July 23, a Telegram channel connected to a neo-Nazi accelerationist website affiliated with former members of the Atomwaffen Division (AWD) and successor groups requested donations using the privacy cryptocurrency Monero. The post contained instructions for how to obtain Monero and recommended a specific crypto wallet if users were outside the U.S. The post assured potential funders that donations only went to website expenses or “sometimes donations to movement legal funds/prison commissary funds.”
The website has requested Monero several times in the course of its six-and-a-half-year existence and previously offered a reward in Monero for information on alleged informants.