THIS DOCUMENT CONTAINS TRADE SECRETS AND CRITICAL INFRASTRUCTURE INFORMATION , AND IS EXEMPT FROM DISCLOSURE PURSUANT TO THE OHIO PUBLIC RECORDS ACT
FOR OHIO HOMELAND SECURITY , STACC , GCFC , AND NEORFC ONLY
Please do not share this Threat Bulletin outside of your organization. General conclusions and graphics (including graphs and visual elements) can be repurposed. Do not cite Moonshot in external products.
For full Terms and Conditions, please click here
About Moonshot
Moonshot is a social impact enterprise working to end online harms by applying evidence, ethics, and human rights. We work with global governments and the private sector to provide insight into emerging online threats and inform strategic responses. Our technology is compliant with international data privacy law and designed to protect individual user privacy. Moonshot CVE USA is based in Washington, DC.
Overview
Moonshot’s Threat Bulletin provides qualitative and quantitative analysis of U.S.-based Targeted Violence (TV) online. Designed to inform professional threat assessments, the bulletin analyzes online TV trends, themes, and narratives to provide readers with a critical understanding of online-to-offline risks and threats to public safety.
As part of the TV ecosystem, our analysis covers foreign terrorist inspired violence, known as Homegrown Violent Extremism (HVE), mass shootings, school shootings, grievance-based violence, anti-semitism, anarchist violent extremism, Domestic Violent Extremism (DVE), and emerging forms of violence such as the Accelerationist Occult Networks. Coverage will expand further in 2025 to include extended coverage of additional TV threats. For a detailed description of the TV types covered and definitions used, as well as our full methodology, please refer to the Appendices at the end of the bulletin.
The Threat Bulletin includes coverage of targeted violence within mainstream and niche platforms. On all platforms, the focus is on channels, narratives, groups, and users that promote premeditated acts of violence directed at specific individuals, groups, or locations, regardless of motivation and generally unrelated to other criminal activity. Platform coverage includes over 25 platforms. A full list can be found in Appendix B.
Hyperlinks have been included throughout the Threat Bulletin to enable practitioners to interrogate primary content and news sources as required. Red hyperlinks will redirect to primary content within TV spaces, while yellow hyperlinks will redirect to media outlets, mainstream websites, and other sources to provide context. For any questions you may have about the report, please contact threatbulletin@moonshotteam.com
Key Insights in January
Antioch Shooting Reveals Online Networks of Violence Promotion
The perpetrator Solomon Henderson communicated with past school shooters, while accounts that helped mobilize him to violence are utilizing the shooting to recruit
HVEs Share Islamic State Calls for Arson After California Wildfires
Glorification and promotion of an easily accessible attack method may increase the threat of arson
AVE Actors Possibly Preparing for Escalations in 2025
Anarchist Violent Extremist (AVE) media sources are urging readers to prepare for “confrontations” and, in some cases, justifying violence
Vigilante Action Against Immigrants Possible Following ICE Operations
Threats against Latin American communities are up 46% compared to a six month baseline
Proud Boys Likely Renewing Focus on Recruitment Following Pardons
Proud Boys leaders are claiming the pardons demonstrate that “the tide is turning” in their favor
ICE Offices Possible Targets of Vandalism
AVE actors have targeted ICE facilities with vandalism in the past
The FBI is receiving violent hostility amidst claims it orchestrated the New Orleans attack Threats Against Government Agencies at Highest Level in Six Months
Forward Look
AVE Actors Call for Renewed Action in 2025
On January 28, the AVE blog 'Crimethinc' called for confrontational action against the new administration, urging supporters to “act assertively at the beginning [of the fight against state repression].” An anarchist newspaper, ‘Blessed is the Flame,’ which originates in Greece, a country with historical associations to violent AVE action, also praised UHC shooting suspect Luigi Mangione and claimed “violence is the only way forward.” While AVE communities vary in their support for violent action, many perceive the early stages of the Trump administration as critical, which will likely fuel opposition, vandalism, and property damage.
Proud Boys’ Pardons Likely to Increase Recruitment Attempts
On January 20, U.S. President Donald Trump pardoned former Proud Boys (PB) leader Enrique Tarrio and several other prominent PB leaders. These pardons are likely to increase the group's recruitment efforts. This assessment is based on observed chatter in the Proud Boys’ Telegram channels calling for new members to join, specifically citing the pardons and stating, “the tide is turning.” The Proud Boys’ increased focus on open recruitment likely suggests it’s planning to become more active in the future.
ICE Buildings and Detention Centers Likely Sites of Confrontations
On January 21, an X video claiming to display Antifa members allegedly setting fire to an ICE detention center in Portland, Oregon led to calls in DVE spaces for direct confrontation with Antifa and for members to be killed . Moonshot analysts are unable to verify whether the individuals in the video are Antifa members. ICE buildings in Tacoma, Washington , and Portland, Oregon were targeted in recent years. In 2018, DVE groups and protesters clashed at an “Occupy ICE” encampment in San Antonio, Texas . Given the recent rise in deportations and growing protests against them, it is likely that ICE buildings and detention centers will become key focal points for protests and counterprotests in the coming months.
Vandalism Threats to Urban Planning Company May Expand to North Carolina
On January 6, AVE blog ‘Unravel’ reported on the destruction of computers, office equipment, and windows at a Boomerang Design office in Lexington, South Carolina. The company was targeted in response to its alleged role in designing “Cop City Charlotte,” a law enforcement training facility similar to the controversial facility in Atlanta, Georgia. Unravel’s post also contained images of graffiti from the incident stating “1 Down, 3 To Go” and lists three other Boomerang offices in North Carolina, suggesting the other locations could be future targets.
This section provides a quantitative assessment of the prevalence of violent language and threats monitored across U.S. online spaces that historically have promoted targeted violence on X (formerly Twitter), Gab, 4chan, Reddit, BitChute, Truth Social, Telegram, and Patriots.win. Threats are identified and assessed using Moonshot’s AI-powered technology, with threats monitored against over 2,650 potential targets nationwide.
▼ Threats of violence by target1,2
▼ Threat of Violence by Target: Monthly Threat Profile
Baseline is an average of
THEMATIC FINDINGS
Threats Toward Government Agencies Highest in Six Months
In January, Moonshot identified 384 threats of violence against government agencies—a 6% increase compared to a baseline of the previous six months of data. This marks the highest monthly total since July 2024, when the Trump assassination attempt led to a surge in threats against the Secret Service and FBI. The 6% increase is partly driven by FBI-related events. Following the Trump administration’s push for senior FBI officials to resign or retire, broad calls for “total glowie death” have circulated. In TV spaces, users claim the FBI staged the January 1 New Orleans attack to undermine Trump's nominee for FBI Director, Kash Patel, or justify gun seizures. Government agencies will likely continue facing conspiracy-driven threats following major security events and leadership changes.
Threats Toward Latin American Communities Highest in 11 Months
In January, Moonshot identified 146 threats of violence against Latin American communities—a 46% increase compared to a baseline of the previous six months of data. Discussion focused on deportations, immigration at the Southern border, and the recent rise in ICE activity across the U.S. Activity on 4chan spiked at the end of the month as users celebrated calls to hunt down and attack people of Hispanic descent. Some users criticized the crackdown on undocumented immigration, arguing that current efforts were insufficient and should be intensified. Notably, users in TV spaces have increasingly called for taking matters into their own hands, openly advocating for genocide, sexual violence, and murder against individuals suspected of being undocumented immigrants or of Hispanic descent. Further detail on this story can be found on page 15.
▼ Threats of violence, by month
▼ Threats of violence in January, by day
JANUARY 2
Highest Daily Peak in Threats of Violence Against Asian Communities
Threats toward Asian communities in January increased 24% compared to a six month baseline, following December’s record level of threats toward this group. This month, threats peaked on January 2 as discussions of Indian immigrants with H-1B visas continued to prompt incitements to kill Indian immigrants throughout the U.S. The now-widespread inclusion of Indian communities in the Great Replacement theory is also prompting incitements for the death of Jewish communities, who are perceived to be orchestrating the replacement of white people with Indian people.
JANUARY 31
Highest Daily Peak in Threats of Violence Against LGBTQ+ Communities
Threats toward the LGBTQ+ community peaked on January 31 at 116 threats, over half of which targeted the trans community. This surge was driven in part by President Trump's Executive Order, “Defending Women from Gender Ideology Extremism and Restoring Biological Truth to the Federal Government.” On the same day, false claims circulated on 4chan that a transgender military pilot was flying the helicopter that collided with a commercial jet near Reagan National Airport on January 30, resulting in 67 deaths. DVE users spread calls to ban trans people from the military and workplaces, along with violent rhetoric advocating for their death
THREATS AGAINST CRITICAL INFRASTRUCTURE
This section assesses notable threats toward critical infrastructure sectors identified this month, including direct threats, calls for violence, vandalism, disruption, tactical discussions, and broader themes shaping the U.S. threat landscape for critical infrastructure.
TRANSPORTATION SYSTEMS SECTOR
AVE Blog Shares Pipeline Destruction Tactics
‣ On January 14, AVE blog ‘Ellipsism' published a zine critiquing the 2022 film ‘How to Blow Up a Pipeline,’ a fictionalized account of environmental activists’ efforts to sabotage the construction of an oil pipeline in West Texas.
‣ The zine examines “mistakes” activists made when conducting attacks and provides suggestions on how to conduct an operation successfully. It also urges using violence as a tool to combat climate change.
‣ The document also provides instructions on operational security, encouraging users to conceal their data via Tails (a security-focused operating system), provide guidebooks on mobile device security, and vet activist partners.
‣ In light of recent natural disasters in the U.S., AVE actors will likely continue promoting the destruction of oil pipelines in response to climate change, raising the risk of attacks against critical infrastructure.
EMERGENCY SERVICES SECTOR
AVE Blog Advocates Drone and Microphone Jamming
‣ On January 18, AVE blog ‘No Trace Project’, released a guide discussing techniques to evade physical surveillance.
‣ The guide discusses ways to obscure long-range microphones, including using audio jammers and holding meetings in isolated locations. The guide also includes instructions for shooting down drones.
‣ The booklet also provides additional guides on evading law enforcement surveillance tactics.
‣ The emphasis on evading physical surveillance, and recent calls for “confrontation” with the government, suggest AVE actors may be planning on increasing in-person organizing and preparing to conduct illegal activities that require higher levels of anonymity.
front page
“Preparing for physical surveillance (...) is the only thing that will help you if cops are tailing you on the way to a sensitive meeting or action.”
“There is a need for a good text about drones (...) and [texts] on technical countermeasures such as jamming, and in particular how to build a cheap jammer.”
Figure 2. Excerpts from the ‘Anti-Repression Talks’ guide discussing physical surveillance.
Figure 1. The
of the zine, titled ‘How Not to Blow Up a Pipeline.’
Key Event in Focus: Antioch High School Shooting
JANUARY 22
17-year-old Solomon Henderson fatally shot one student at Antioch High School before taking his own life. The attack was partially livestreamed on the streaming platform Kick.
JANUARY 22
A manifesto and online diary begin spreading in mainstream and TV spaces. In the documents, Henderson expressed neo-Nazi, accelerationist, incel, and satanic views.
The Antioch shooting demonstrates that extremists are utilizing a number of different platforms to recruit, publicize, plan and broadcast attacks, sometimes on mainstream websites. It also brings to light how loosely connected online extremist communities intersect and inspire one another.
Diverse Social Media Networks Used to Radicalize and Incite Future Attacks
‣ Henderson utilized multiple social media platforms, including Soyjak.Party, Kick, Discord, WatchPeopleDie, X, Instagram, TikTok and others. In a manifesto and diary the shooter posted, he glorified mass killers, white supremacists, and incel extremists.
‣ He claimed to have posted warnings on Soyjak.Party on October 22 and 26, which have since been removed, about an imminent “Payton-like event,” referencing Payton Gendron’s 2022 Buffalo shooting. Henderson also praised British neo-Nazi Daniel Harris, who was sentenced to 11 years in January 2023 for glorifying terrorism.
‣ After the attack, several X users, affiliated with Accelerationist Occult Networks (AON), mentioned in Henderson’s writings sarcastically claimed “responsibility” and used the event to direct followers to TV spaces on Discord and Telegram before being taken down.
‣ The shooter’s manifesto urges suicidal readers to conduct mass acts of murder and provides a list of “soft” and “hard” targets and tactical advice on evading law enforcement detection, using bombs as a diversion, and lockpicks during school shootings.
Potential to Mobilize Future School Shooters
Figure 3. A Telegram post referencing the attack and calling for further killings. A satanic accelerationist channel, Tempel Ov Bob, claimed Henderson was directed by them to carry out the shooting. While Henderson referenced the channel, this is a clear attempt at trolling.
‣ Drawing influence from numerous terrorists and mass killers, Henderson mimicked Tarrant with a livestreamed attack and manifesto Q&A, and Gendron with an online diary.
‣ The perpetrator also claimed inspiration from acts of violence committed by younger perpetrators, referencing recent attacks in Winder, GA, Madison, WI, and Perry, IA.
‣ Reports suggest that Natalie Rupnow, who conducted the December 2024 school shooting in Madison, Wisconsin, followed Henderson on X. Henderson allegedly commented on an image Rupnow posted minutes before her shooting, urging her to livestream the attack.
NATIONAL TRENDS
This section provides a qualitative and quantitative assessment of significant or emerging trends and threats in over 700 TV spaces across over 27 monitored platforms. Analysis includes topics, events, and narratives that have either received significant levels of engagement in monitored TV spaces or represent new and emerging threat areas.
MENTIONS IN TV SPACES / 6,738
California Wildfires: Elevated HVE Risk of Arson Attacks; DVE Threats Toward Officials May Escalate
‣ Following the California wildfires, HVE audiences celebrated the disaster and recirculated calls from the Islamic State (IS) to use arson as a tactic.
‣ Between January 8 to 14, 27 posts related to the California wildfires were shared in HVE spaces across Telegram, X, and Rocket.chat, with most celebrating the fires.
‣ In the latest IS publication shared via Rocket.Chat, the group claimed arson attacks as a low-effort but high-impact tactic, and shared an infographic with instructions.
‣ In DVE spaces, CA public officials, FEMA, and minority communities were the focus of conspiracy theories and threats.
‣ Claims that CA Gov. Gavin Newsom, LA Mayor Karen Bass, LA Fire Chief Kristin Crowley, and FEMA mishandled disaster relief efforts prompted discriminatory and threatening language.
Figure 4. In the latest issue of alNaba, IS claimed "This scene of overwhelming chaos and loss of control presents an inspiring operational opportunity.”
‣ IS’s promotion of weaponizing arson, amplified by HVEs, may lower barriers to action and make it a common tactic, especially in times of environmental vulnerability.
MENTIONS IN TV SPACES / 22,964
Release of January 6 Defendants Fuels Threats Toward Judiciary
‣ On January 20, President Trump granted approximately 1,500 pardons and 14 commutations to individuals involved in the January 6 attack. Prior to leaving office, former U.S. President Joe Biden issued preemptive pardons for several relatives, former NIAID Director Dr. Anthony Fauci, and members of the House January 6 inquiry committee.
‣ DVE groups are celebrating the January 6 pardons and calling for retaliatory violence against those perceived to have facilitated their imprisonment, including calls to doxx and kill D.C. prison guards, hang judges and prosecutors, and target members of the January 6 inquiry committee.
‣ Proud Boys Telegram channels are calling for new recruits, citing election results and pardons as signs the “tide is turning.” Claims that Biden's preemptive pardons suggest the absolved individuals committed crimes are fueling calls for violence against Dr. Fauci, Gen. Mark Milley, and members of the Biden family.
“These "prosecutors" need to be prosecuted. They haven't learned their lesson yet.”
“THE HUNTERS WILL BECOME THE HUNTED!!”
“Nothing says you're guilty like a preemptive pardon.”
Figure 5. Reactions to the presidential pardons, observed on The Gateway Pundit.
Fighter’s Remarks Highlight Links between MMA and Antisemitism
‣ On January 30, UFC fighter Bryce Mitchell made pro-Nazi remarks on a now-deleted podcast, calling Hitler “a good guy” and claiming he sought to “purify [Germany] by kicking the greedy Jews out.” Users in DVE spaces praised his comments, with supporters saying he “shifted the conversation towards the truth.”
‣ Some MMA fighters and groups have been linked to REMVE recruitment since 2013, beginning with German MMA organization Kampf der Nibelungen and Robert Rundo’s 2017 founding of the Rise Above Movement (RAM). RAM trained its members in MMA to engage in violence at protests.
‣ Today, over 100 “Active Clubs” worldwide follow Rundo’s model and a wide variety of groups use MMA training and tournaments as recruitment tactics.
‣ Given Mitchell’s fame and prominent platform, his comments may further legitimize MMA as a tool for recruitment and deepen ties between extremist and MMA communities.
Figure 6. Most popular Active Club channels on Telegram, ranked by number of subscribers.
MENTIONS IN DVE SPACES / 65,779
DVE Audiences Attempt to Facilitate ICE Operations Through Online Action
‣ DVE audiences have seized on ICE operations recently actioned by Executive Orders to promote violence and vigilante actions toward immigrant communities.
‣ Widespread calls for violence against immigrants continue to circulate, with users declaring an “open season" on noncitizens, advocating users “blown[sic]up” and “shoot” immigrants.
‣ A viral X post with 3.4M views claiming ICE is offering a $750 reward for each undocumented immigrant reported is prompting users to share the names and locations of individuals they claim are illegal immigrants, the addresses of Mexican restaurants, and broader calls to “hunt slaves.”
‣ Telegram users are submitting and urging others to submit false claims about the locations of ICE operations throughout the U.S. to foil third-party “ICE Watch” sites, which claim to track ICE raid activity to prevent raids at homes, schools, and hospitals.
‣ DVE audiences’ widespread anti-immigrant hostility and support for mass deportations may increase the likelihood of vigilante action against immigrants and impede the work of federal officials in cities where ICE operations occur.
Figure 7. Images of KKK fliers advocating immigrants “self-deport,” shared on Stormfront.
