Examining the Soyjak Attacker Video Fandom (Part I)
Welcome to our new series, which will written by two guest authors who have chosen to remain pseudonymous for their own personal safety. Their unique perspectives and experiences will shed light on a network of mass shooters inspired by the Terrorgram Collective, while safeguarding their identities.
CONTENT WARNING: This article contains references to school shootings, mass attacks, suicide, animal cruelty, child sexual exploitation, self-harm, violent extremism, terrorism, gore, and eating disorders
On January 13, 2025, the United States Department of State designated The Terrorgram Collective (Terrorgram) and three of its leaders as Specially Designated Global Terrorists pursuant to Executive Order (E.O.) 13224. Former FBI Director Christopher Wray described the Terrorgram Collective as a “transnational terrorist group that our investigation found is responsible for soliciting hate crimes and the murder of government officials and providing support to terrorists.” The Terrorgram Collective creates propaganda in the form of telegram chat channels, violent videos, instructional PDFs, audiobooks, and digital books. These materials have inspired at least three individuals to mobilize to violence. There is also evidence of Terrorgram Collective leaders directly inspiring or collaborating with at least two mass casualty attackers: a) an individual who shot three people (killing two) outside of an LGBT bar in Slovakia, b) an individual who stabbed five people near a mosque in Türkiye. The are also responsible for an individual who planned an attack on energy facilities in New Jersey. Individuals inspired by the Terrorgram Collective trade their own lives or freedom in exchange for a kind of digital immortality, taking on an exalted existence in fan art, discussions, and "Saints Cards."
The propaganda produced by the Terrorgram Collective has been distributed beyond the loose network of official and unofficial channels that are collectively known as “Terrorgram.” These materials and videos are of particular interest to those in the True Crime Community (TCC,) where fans of violent mass attacks have shared the propaganda on public social media platforms and in private chat channels. The attack at a mosque in Türkiye referenced in DOJ material, refers to the attack by Arda Küçükyetim, who was inspired by the Terrorgram Collective. He was part of a fringe online subculture that we call the Soyjak Attacker Video Fandom (SAVF). Natalie Rupnow–who shot and killed a teacher and a student at Abundant Life Christian School, and Solomon Henderson–who shot and killed one student and himself January 22, 2025–were also part of the SAVF network.
This fringe subculture is heavily influenced by the Terrorgram Collective. Therefore, in this three part series we will examine how this network celebrates acts of terrorism and mass murder, and has interacted with and encouraged at least four past mass attacks, and continues to push others in the network and TCC for future attacks. In Part I we will provide an introduction to the SAVF and describe the influence of the Terrorgram Collective on the subculture of the SAVF. Part 2 of this series will cover some of the their methods of propaganda and Part 3 will cover intersections with other violent networks and online communities.
What is the Soyjak Attacker Video Fandom (SAVF)?
The Soyjak Attacker Video Fandom (SAVF) is a network of users interacting on major public social media networks such as X (formerly known as Twitter,) TikTok, Instagram, Threads, Bluesky, YouTube, Telegram, Discord, Steam, Roblox, and Minecraft, and smaller niche platforms such as the main Soyjak Party forum, and Kiwi Farms. This community is a hybrid threat network that brings together aspects of Soyjak Party, True Crime Community (TCC), Terrorgram Collective, and online trolling networks.
This network of threat actors is best understood as a fandom or subculture; it has no official membership or leaders. The fandom goes beyond simply admiring mass attackers, and is truly an active and participatory subculture. Like other fandoms, SAVF members create fan art, collect merchandise (flags, patches, etc), engage in Live Action Roleplay (LARPing), make video edits, do cosplay (emulating mass attacker outfits and gear, as well as uniforms from extremist groups like Atomwaffen Division), and interact with other fans. SAVF members typically partake in the Terrorgram Saints Culture and the True Crime Community and share related propaganda. While not all members have the same interests, these niche subcultures define the network’s unique characteristics:
A. Involvement with the subcultures around Soyjak Party
B. Creating and/or disseminating short video files that celebrate mass attackers, called “edits” within the network
C. Involvement in the True Crime Community (aka TCC or “teeceecee,”) which is a fandom of mass attackers, including school shooters and serial killers
D. Partaking in the fandom of Ongezellig, an animated series that aired on YouTube.
“Soyjak Party” is a term often used broadly for a far-right youth culture made up of various niche groups. It is the largest subculture, and is linked to the main image board of the network Soyjak Party. Soyjak Party was formed in 2020 as a 4chan splinter board made up of users who clashed with the dominant 4chan culture. Soyjak Party’s user base is more international and younger than 4chan users, with the approximate age range of 13-25 years old, based on our observations. Matching its younger user base, the Soyjak Party forum doesn’t have the pseudo-intellectual pretensions of 4chan, nor do its users imagine its /pol/ forum actually exerts a strong influence over global politics. The Soyjak Party forum is a place where young people with extreme far-right political views post bigoted Soyjak memes and attempt to one-up each other with their “edginess.” Similar to 4chan, the broader Soyjak Party network has a strong influence on the right-wing culture of its users, mainly by spreading slang and memes.
There are smaller far-right subcultures that are included under the umbrella moniker of “Soyjak Party” such as “foodists” and “UTTP” (UTubeTrollPolice,) both of which are obscure trolling groups. These subgroups participate in coordinated harassment combined with very extreme views that cross social boundaries. Most of these subgroups have negative histories with each other, and would not want to be lumped under one label. However, the subgroups intermingle with one another and share vocabularies, memes, aesthetics, behaviors, and beliefs. The rivalries within the Soyjak Party subculture are similar to the divisions in the larger Com Network.
In the Soyjack Party forums, there is a hybridization of TCC with Terrorgram (used broadly), which has played a role in potentially inspiring attackers. After a high profile mass attack or hate crime it’s common in certain online extremist circles to discuss and sometimes celebrate the violence. This type of activity can be seen in both of the broader Terrorgram and True Crime Community (TCC) networks. Some SAVF members are part of the Terrorgram Collective network and have brought its Saints culture with them and combined it with a TCC fandom.
The most violent subculture within the TCC community, which grew out of the Columbiners community, has evolved over the years. TCC is what the FBI has previously referred to as a "pronoid pseudocommunity" of people who are fascinated with targeted violence incidents or even endorse them. In anonymous online networks, people who are fascinated with extreme violence can find support and encouragement from others who have similar interests. The majority of TCC fans will often discourage real life violence. However, there have been cases of people who admired mass attackers going on to commit their own threats and crimes, such as Sol Pais and Randall Shepherd and Lindsay Souvannarath.
The SAVF community is a relatively small group of people within these larger subcultures who talk to each other across multiple social media platforms, frequently discussing real-world violence like past mass attacks and sometimes their own plans for future violence. The people in this network are prolific social media users and interact across major public social media platforms. Prior to its change in moderation policies, VidLii was a primary platform where network members would post their violent video edits. The network is transnational, composed primarily of people who live in Europe and North and South America. English is the common language of the network, and most individuals are proficient in formal written English as well as online slang. Members of the network have carried out attacks (or attempted attacks) in Australia (Jordan Patten,) Europe (Arda Küçükyetim and his alleged accomplice, “Hansen,”) and the United States, in Wisconsin (Natalie Rupnow,) and in Tennessee (Solomon Henderson.) Individuals often coordinate online to watch as members livestream or post about their attacks.
After an attack, the SAVF network mobilizes online to distribute the attacker’s propaganda (e.g. manifesto, photos, recommended readings) as well as biographical information about the attacker. Network members benefit from these activities by gaining clout through their online connections to the mass attacker; for example, by being the first to name a perpetrator online, creating a highly active thread about the attack during a time of breaking news, and contributing information about an attacker’s online presence. They also post photographs of the attacker that they have from early access to the attacker’s file uploads (as with Küçükyetim and Patten) or from their prior interactions. These file uploads, often containing selfies and gear photos, and sometimes manifestos, function as a sort of “press kit” that is prepared by the attacker in advance. The photos that SAVF members share often get used by major media outlets in news coverage. This is a TTP regularly used by threat actors in order to trick journalists into amplifying their content and their network. Because of the nature of SAVF trolling and in-group jokes, reporters and researchers should take care when covering the claims made by people in this network, to avoid accidentally repeating disinformation, as well as to avoid amplifying violent and racist propaganda.
How Online Posting Could Reveal Real World Violence
A study of 170 individuals who had committed mass shootings showed that 46.5% of the shooters had leaked their plans for attacks. Detecting these threats could provide opportunities for intervention. SAVF users make frequent use of social media to describe their affinity for violence, and frequent discussions of a desire to commit mass murder could indicate real plans.
Despite the extremely violent content, there is an element of playfulness in the interactions and posts between the individuals in this network. Users joke around and seem to enjoy each other’s company and have genuine friendships. They often add something to their social media bios along the lines of “all of this is satire” or “this account is a parody” in an attempt to maintain plausible deniability in the event of a real world attack. They frequently share jokes and memes with each other.
Although it might be easy to dismiss these individuals as not serious about their plans for violence because of the playful and edgelord elements, there is evidence that some SAVF individuals have encouraged previous attacks and have intentions to continue to do so in the future. Individuals in the network occasionally post suggestions and threats that they intend to commit future mass violence, and some individuals have already been interviewed by law enforcement or arrested for these threats.
There is a performative nature to the SAVF network’s posts. Among each other, individuals share video edits they’ve made of past attacks, highlight favorite edits made by someone else, and participate in threads of memes on public platforms. Conversation is usually limited to their network even on public social media. When their posts are meant to traumatize out-group targets, individuals often create offensively-named accounts for the purpose of harassment, and post mostly in the replies of out-group platform users. Reply posts are often images of gore with racist overtones and violent video edits. This activity usually takes place on mainstream public social media platforms, or during raids to other Discord servers, image boards, forums, and game servers.
While threats of violence are sometimes posted publicly, there are frequent conversations that take place in direct messages, behind locked accounts, in private servers on Discord, and in private group chats on Telegram. In many cases it's impossible for researchers to access these private conversations without undertaking a long-term study of the network, which is ethically challenging when minors are involved. In many other cases researchers cannot access the network’s private communication channels due to the high likelihood of the presence of child sexual abuse material (CSAM), which is illegal for everyone to access except for law enforcement assigned to that investigation. The information gathered for this article has been compiled entirely from publicly available resources.
According to descriptions made publicly by members of the SAVF network, there is a high likelihood that evidence of past crimes will be found within these private communications. Network members brag about serious crimes, such as the manufacture and possession of CSAM, extortion, and accomplice to murder. There is a high likelihood of ongoing serious crimes, and future plans to commit more.
CSAM materials are frequently discussed and referenced as being in the possession of some members in the network and shared in less public spaces such as private Discord servers and small forums. Several NCMEC reports have been submitted in the course of researching this network because of information that network members have publicly shared or their interest in obtaining CSAM.
SAVF Members Draw Inspiration from other Mass Attackers
The attacks coming from this network closely mirror what was seen in the 2022 Buffalo, NY shooting by Payton Gendron, who used similar tactics to post photos and a manifesto ahead of his attack. Gendron’s attack was livestreamed, and his actions were discussed on the website 4chan during the attack and in the following hours and days. At least one 4chan user archived the livestream video in real time, and continued to post photos of dead civilians inside the supermarket throughout the day of the attack. Clips of the video were shared to other extremist sites, and continue to circulate online. This video is frequently used in edits made by SAVF members and cited as inspirational.
Gendron’s manifesto was heavily influenced by 4chan and meme culture, featuring dozens of pages of antisemitic and racist memes. He worked disinformation into his manifesto, such as a well-known joke on certain internet forums that swapped his own image for that of Sam Hyde. Gendron’s manifesto heavily plagiarizes the manifesto of Brenton Tarrant, who also livestreamed his attack and heavily referenced 4chan in his manifesto. Gendron wrote numerous references to racist memes directly on his weapons.
Gendron used his private discord server like a diary rather than a chat room in the months leading up to his attack, initially keeping the server private and then inviting others to view the server approximately 30 minutes before the attack. Gendron posted images of his modified weapons to the discord in advance and made detailed plans about his intended attack. He cited the inspiration that he drew from past mass attackers, and described his intended influence on future attackers, especially in the form of a detailed guide of tactics, techniques, and procedures (TTPs).
SAVF members have frequently named Gendron as an influence and inspiration to their own plans. They have also posted photographs of weapons and protective gear, as well as GoPro setups, to suggest that they intend to livestream an attack. Within the SAVF network, public posts of gear, weapons, and streaming equipment have frequently occurred on the day of the attack. However, the attackers often upload their photos 5-10 days in advance of their attacks to file sharing platforms. In some cases, they’ve shared personal gear photos as well as selfies dressed in the gear with a friend ahead of time. Having created these gear photos and selfies can be an indicator that an individual in the SAVF network has obtained the tools they need for their attack, and may be intending to go through with their plans soon. Since SAVF members are often public in their interactions and threats, there may be more opportunities for intervention than in other networks.
Updated on March 23, 2025 to: correct "You Tube Troll Patrol" to "UTubeTrollPolice;" fix some stray typos; and add Rupnow and Henderson to the list of known SAVF mobilized attackers at the end of the tenth paragraph.
Resources and Support
CSAM Tip Lines:
In case you are unintentionally exposed to CSAM materials, people extorting minors for CSAM materials, or people disseminating or soliciting CSAM, or anything that seems like it might be close to any of those things, the places to report it vary by the country you’re located in:
(US) Tip line for the National Center for Missing and Exploited Children (NCMEC) at https://report.cybertip.org/
(CA) Tip line for the Canada Center for Child Protection https://cybertip.ca/en/
In the rest of the world, InHope has a referral website to help you locate the appropriate hotline https://www.inhope.org/EN#hotlineReferral
Resources for Researcher Welfare & Vicarious Trauma:
“Journalism and Vicarious Trauma: A Guide for Journalists, Editors and News Organisations” https://firstdraftnews.org/wp-content/uploads/2017/04/vicarioustrauma.pdf?x21167
“New guide offers dialogue and guidance on vicarious trauma” https://firstdraftnews.org/articles/vicarious-trauma-guide/
“Working with Traumatic Imagery” https://dartcenter.org/content/working-with-traumatic-imagery
“Handling Traumatic Imagery: Developing a Standard Operating Procedure” https://dartcenter.org/resources/handling-traumatic-imagery-developing-standard-operating-procedure
“Can’t Stand the Heat?: Best Practices and Institutional Responsibilities to Safeguard Extremism Researchers” https://gnet-research.org/2023/12/11/cant-stand-the-heat-best-practices-and-institutional-responsibilities-to-safeguard-extremism-researchers/
“Researcher Welfare 2: Mental and Emotional Well-being and Self Care” https://voxpol.eu/researcher-welfare-2-wellbeing/
(US) National Hotline for Mental Health Crises and Suicide Prevention: https://www.nami.org/
(US) National Center for Missing & Exploited Children: https://www.missingkids.org/
(CA) Kids Help Phone: https://kidshelpphone.ca/, 1-800-668-6868. Text 686868
(US, CA) Suicide Crisis Helpline: Call or text 988.
(UK) The National Suicide Prevention Helpline UK: https://www.spuk.org.uk/