European Centre for Counterterrorism and Intelligence Studies, Germany & Netherlands – ECCI
Extremist Content Wrap Up 2022
Counterextremism – In 2022, extremists continued to spread various video, photo, text, and audio propaganda; call for and celebrate acts of violence; dox their perceived opponents; and spread manuals and instructions on several websites to assist individuals in committing acts of terrorism. In 2022, the Counter Extremism Project (CEP) published 36 extremist content reports containing 231 items on ISIS, al-Qaeda, white supremacists, and the extreme right. CEP reported 813 links in 2022 containing extremist content. Reporting methods included emailing abuse teams, using website report features, and sending content to relevant authorities.
CEP continued to find ISIS and pro-ISIS propaganda on Meta-owned Facebook in 2022, including videos released in previous years. CEP also located pro-ISIS and various neo-Nazi, white supremacist, and extreme right content on Meta-owned Instagram. Researchers continued to find content on the platform glorifying white supremacist terrorists, including footage from the Christchurch terrorist attack video in two cases. While YouTube has cracked down on ISIS propaganda, gaps exist regarding enforcing the site’s community guidelines regarding extreme right content. CEP found white supremacist podcasts and accounts promoting antisemitism and a white supremacist group. In multiple cases, CEP located extreme right content on Twitter, including profiles promoting various neo-Nazi and white supremacist groups. Telegram remains a primary point of communication for multiple neo-Nazis, white supremacists, and extreme right groups, individuals, and supporters. However, a group of Telegram channels attempted to relocate to the TamTam messaging app, on the assumption that TamTam does not remove content.
Regarding funding, cryptocurrency remains an important topic. CEP also found several examples of individuals in the extreme right using crowdfunding websites. E-commerce platform Spring shut down several stores on their site operated by neo-Nazis, and Barnes & Noble removed an edition of a notorious antisemitic book published by a white supremacist press.CEP located multiple explosives guides in 2022, both posted by pro-ISIS groups and the extreme right. Additionally, CEP continued to identify interest in the 3D printing and homemade production of firearms. Threats against public officials continued to circulate on accelerationist Telegram channels, as did celebrations of acts of terrorism, threats reported in the media, and the anniversaries of attacks. Two neo-Nazi accelerationist manuals were also released in 2022 on Telegram and other platforms. Segments of online extremist communities continued to focus on tech issues, vulnerabilities, account creation, and operational security.
Additionally, an Atomwaffen Division successor group created a new entity, and a neo-Nazi website severed its previous public association with James Mason. The online extreme right used Russia’s February 2022 invasion of Ukraine to spread antisemitism and racism but generally did not show significant interest in the conflict. Extreme right groups targeted drag events in 2022, both online through doxing and through public attempts to intimidate performers and attendees.Two ISIS leaders died or were killed in 2022, leading to new leaders being appointed in March and November. The group continued to release propaganda videos, especially following the appointment of new leadership. While publication of the English language magazine Voice of Hind ceased in May, ISIS released a new English language web magazine, Voice of Khurasan, earlier last year in January.
Three examples of content are provided. The first is an Atomwaffen Division propaganda video located with other white supremacist and neo-Nazi content on Instagram in March. The second content example, from August, is an al-Qaeda communique posed on JustPaste.It, before the site removed it. The last entry is from the pro-ISIS web magazine Voice of Khurasan released in November.
2022 Content Round Up
Multiple Accounts Posting Extremist Content Located on Facebook
In 2022, CEP found multiple accounts that posted pro-ISIS content on Facebook. Uploaded content included ISIS propaganda videos, Amaq propaganda photos, sections of ISIS’s weekly newsletter, text-based propaganda, and links to ISIS content on other websites and communications apps (March 21, May 31, June 27, July 18, July 25, August 1, August 8, August 16, August 22, August 29, September 12, October 31, November 7, December 12).In several cases, CEP located ISIS propaganda videos on Facebook that were originally released in 2015, 2016, and 2018 and reuploaded to the social media site (October 31, August 22, December 12, November 7). At least one ISIS video was streamed the day it was released using the “Facebook Live” feature (August 8).
Uploaders or propagandists modified multiple ISIS videos on Facebook to evade removal. Videos were altered with double images, added images, covering ISIS logos with emojis, blurring content, or changing colors in the video (June 27, July 25, August 8, October 31, August 29, November 7).CEP also located multiple photos from ISIS videos, including ISIS fighters executing a man in Kirkuk in 2015 and a modified screenshot taken from a 2015 execution video of a Jordanian pilot, Lt. Muath al-Kaseasbeh, by immolation (July 18, December 12).
One account was located in August that posted pro-Tehrik-i-Taliban Pakistan (TTP) propaganda, including videos and celebrated the killing of Pakistani police officers (August 1).Two pages, with 400 and 900 followers, respectively, were located in August that posted neo-Nazi propaganda, including a video made by the group Nationalist Social Club (NSC) and various neo-Nazi-themed t-shirts for sale (August 1). In October, a Facebook page was located attempting to raise money for an imprisoned Austrian neo-Nazi rapper (October 31). The page contained neo-Nazi symbols and images glorifying white supremacist mass shooters.
White Supremacist and Pro-ISIS Content Remains on Instagram
CEP continued to find a wide variety of white supremacist and pro-ISIS propaganda on Instagram in 2022. Researchers found footage from the Christchurch terrorist attack video in two instances (March 14, December 19). Photos from the attack video were also located in January and March (January 18, March 14). Multiple other accounts posted content glorifying white supremacist attackers, including the Christchurch terrorist, the 2011 Norway attacker, the perpetrator of the 2015 Charleston church shooting, and the individual responsible for the Buffalo terrorist attack (January 18, February 22, April 19, May 23).
CEP also located propaganda videos and photos originally released by the Atomwaffen Division or featuring the group’s propaganda on Instagram on several occasions (January 18, February 22, March 14, April 19, June 21, August 29, December 19). An infamous video from the British neo-Nazi group National Action was also located on Instagram in November (November 14). Content from other groups included merchandise for sale from the French chapter of Blood & Honour and posts supporting the active club movement and Patriot Front (June 21, May 9, November 14).
Researchers located multiple antisemitic posts on Instagram, including memes, slogans, and the promotion of Holocaust denial (January 18, April 19, May 9, August 29, November 14, December 12, December 19). Islamophobic content was also frequently located on the platform (February 22, May 9, August 29, November 14, December 19). Anti-LGBTQ+ content, including posts encouraging violence, were found in multiple instances (April 19, May 23, November 14, December 12).Several Instagram accounts were also located that posted clips from ISIS propaganda videos, propaganda photos, Amaq news statements, and content promoting ISIS’s al-Naba newsletter (June 27, October 31, November 14).
White Supremacist and Neo-Nazi Content Located on YouTube
CEP found multiple examples of white supremacist and neo-Nazi content on YouTube in 2022. Several white supremacist podcasts originally livestreamed on the platform were still available several days after CEP reported them (January 10, February 22, March 14, May 31, August 16, October 31). Podcast content included interviews with leaders of the active club movement, including Rob Rundo and a regional North Carolina chapter leader (March 14, May 31, August 16). A white supremacist podcaster with over 2,000 YouTube subscribers stated that while he could not directly endorse violence on his livestream, his listeners should be heavily armed and familiarize themselves with the works of white supremacists and anti-LGBTQ+ and anti-abortion domestic terrorists (October 31).
Additional content linked to the active club movement was found on the platform, including an interview with Rundo, a video promoting an associated clothing brand, and a channel for a regional active club in the Netherlands and Flanders (June 27, August 1, December 12).CEP also located content that promoted Holocaust denial, antisemitism, and anti-Aboriginal racism (June 27).
Extreme Right Content Located on Twitter
CEP found multiple examples of extreme right content on Twitter in 2022. In early May, approximately two dozen accounts were located that posted various anti-LGBTQ+, racist, and antisemitic statements and memes or endorsed acts of violence (May 3). Several accounts promoted the active club movement, fascist National Justice Party, Patriot Front, or the Feuerkrieg Division (May 3, May 31). In August, three Twitter accounts were found that glorified the Christchurch terrorist and other mass shooters and endorsed violence (August 8). CEP found over a dozen Twitter accounts created in October that posted various extreme right content, including Holocaust denial, antisemitic and racist tweets, and content endorsing extreme right groups (November 7).
Neo-Nazi Telegram Channels That Endorse Violence Attempted Move to TamTam
In November, several Telegram chats and channels that constitute part of the “Terrogram” community attempted to move to the Russian communications app TamTam (November 22). Admins stated that the move was due to Telegram’s prior deletion of channels. Content on TamTam included guides on how to make explosives, manifestos from white supremacist terrorists, and propaganda videos from several neo-Nazi accelerationist groups. TamTam removed 18 channels after CEP reported them (December 1).
Continued Extremist Interest in Cryptocurrency
The use and promotion of cryptocurrency continued in 2022 among pro-ISIS online communities and the extreme right. The administrator of a pro-ISIS chat room dedicated to technology sought to find a domain host that accepted cryptocurrency, and a pro-ISIS tech group posted a crypto dictionary (August 16, December 19). In November, a white supremacist information and operations security chat recommended using privacy coins, such as Monero (November 22).
Extreme Right Use of Online Payment Processors and Crowdfunding Sites
CEP found four examples of extreme right adherents using online payment processors or crowdfunding websites in 2022. In January, a neo-Nazi digital artist who has made propaganda for Patriot Front, the active club movement, and a variety of content promoting neo-Nazi causes was crowdfunding on the website Buy Me a Coffee (January 10). An Austrian anti-Muslim and anti-immigrant group solicited donations via PayPal (May 9). A white supremacist group that advocated for acts of violence posted a link to their CashApp account (November 22). In September, a neo-Nazi propagandist sought to fundraise on the website GiveSendGo to develop land to hold trainings and “racist family campouts” (September 12).
Online Stores Shut Down and Content Removed from Barnes & Noble
Following action by CEP, Spring removed a fundraiser for an imprisoned Austrian neo-Nazi and two clothing stores that sold neo-Nazi merchandise (April 19, June 6, August 1). Barnes & Noble also removed an edition of Henry Ford’s notorious antisemitic book The International Jew, printed by a white supremacist press after being alerted by CEP (November 14, November 15).
Ongoing Efforts to Spread Bomb Making Instructions and Other Information Useful to Potential Attackers
CEP found multiple examples of extremists spreading information on producing explosives, bomb components, and information on toxins. Multiple pages related to explosives and detonators were located on the bulletin board website JustPaste.It, posted by the pro-ISIS al-Saqri Foundation, which disseminates information useful to potential terrorists (May 16, May 23, June 21, June 27, July 25, November 14, December 12). The same group also posted information on JustPaste.It related to the production of botulism and ricin (August 8, August 22). JustPaste.It removed all pages after they were reported by CEP. Al-Saqri guides were also located on the Internet Archive and MediaFire, which both removed explosives content (June 6, September 12, November 14).
CEP also located a notorious ISIS bomb-making video on the Internet Archive, which removed it after CEP reported it (January 31, November 22). The same video was also found in February on Jwp.Io, the distributed web platform IPFS, and the file transfer sites GoFile.Io and File.Fm (February 22).CEP located explosives content created by a pro-al-Qaeda online group on the Internet Archive, who removed it after it was reported (June 6).CEP also located guides for the production of explosive devices on Mega.Nz and BayFiles posted by white supremacists (January 10, February 7). Multiple white supremacist Telegram channels also posted instructions for making explosives and bomb components (January 31, February 22, May 3, May 16, November 22).
Continuing Spread of Homemade Firearms Plans by the Extreme Right
Neo-Nazi websites, forum users, and Telegram channels posted files and links for 3D printed firearms. In January, a Telegram channel posted files for printing handgun suppressors and rifle lower receivers (January 18). A neo-Nazi website that previously had ties to James Mason and the National Socialist Order (NSO) advised their readers to learn how to 3D print firearms and components and posted links to those files (July 18). The post was made 11 days after an NSO member pleaded guilty to making threatening online communications, one year after he was arrested while picking up an assault rifle that he had purchased.
Users of an imageboard on the dark web that encourages acts of white supremacist terrorism also posted links to plans for building homemade firearms (August 1, September 12). A user on the same imageboard also posted a link to a site on the dark web that contained over 100 different files for 3D printed firearms, including pistols, submachine guns, rifles, and shotguns, as well as components (December 5).
The neo-Nazi website also condemned the Bipartisan Safer Communities Act, a firearms safety bill that seeks to increase background checks for those under 21 and prevent individuals convicted of domestic abuse from acquiring firearms (July 5). In August, several Telegram channels, including one dedicated to spreading 3D printed firearms plans, shared a message endorsing a hypothetical assault weapons ban, claiming that it would be a positive step towards a new civil war or widespread disorder (August 16).
Threats Against Public Officials Still Circulating on Telegram
In January, a neo-Nazi Telegram channel called for acts of violence against public health officials, citing Covid-19 vaccinations, abortion, healthcare services for LGBTQ+ people, and the opioid epidemic (January 31). In April, CEP researchers located a new version of a white supremacist Telegram channel that has doxed and called for violence against judges, prominent Jewish individuals, politicians, and wealthy individuals and their families (April 19).
Online Extreme Right Routinely Celebrates Terrorism, Threats, and Attack Anniversaries
2022 began with various extreme right Telegram channels and white supremacists celebrating the first anniversary of the January 6 Capitol attack (January 10). Later that month, users on 4chan’s/pol board celebrated the 2011 Norway attacker and spread his manifesto during his parole hearing (January 24). White supremacists on Telegram celebrated the 11th anniversary of the attacks by advocating for additional violence and sharing memes and the terrorist’s manifesto (July 25).
Multiple white supremacists and accelerationist neo-Nazis on Telegram and other platforms shared the video and manifesto of the man who murdered ten African Americans in a terrorist attack on a Buffalo supermarket on May 14 (May 16). Users on Telegram, Odysee, and 4chan glorified the attacker and, in many cases, posted links to the attack video. CEP reported clips from the attack video on Twitter and links to the footage on other sites. Later in May, CEP continued to find content praising the attacker, spreading the attack video, and sharing his manifesto on Telegram and imageboards (May 23). A song on BitChute glorifying the gunman was located by CEP later in May. However, the streaming platform did not remove it after it was reported (May 31). In August, CEP reported a Telegram channel dedicated to spreading the attacker’s manifesto and the attack video. Four days later, however, the communications app had not removed it (August 8).
CEP continued to find content praising the Christchurch terrorist attack, including uploads of the attack video. Users on 4chan’s/pol board shared a link for the attack video (January 31). In February, researchers located several videos that modified the attack footage to make it appear like a popular game and found a version of the attack video made by modifying a video game (February 28). Approximately three years after the attack, CEP located content on Instagram, TikTok, and Odysee that included attack footage (March 14). Users on Telegram, 4chan, and a dark web imageboard also celebrated the attack anniversary by sharing the attacker’s manifesto and video, as well as memes and conspiracy theories (March 21).
Neo-Nazis on Telegram also spread propaganda glorifying the man charged with murdering five people and wounding 19 more in an attack on an LGBTQ+ club in Colorado Springs (December 5).White supremacists celebrated the third anniversary of the April 2019 Poway synagogue shooting and urged additional acts of antisemitic violence (May 3). Five days later, an extreme right prisoner support group declared the Poway gunman their “prisoner of the week” and featured his writing on their website (May 9). Telegram users also glorified the El Paso shooter on the third anniversary of his murderous rampage at a Walmart and advocated for other acts of violence (August 8). A video that promoted acts of terrorism and celebrated dozens of individuals who committed a variety of terrorist attacks targeting the government, police officers, women, Jews, Muslims, Sikhs, immigrants, people of color, LGBTQ+ people, leftists, journalists, and medical professionals was released on October 14 (October 31).
In February, multiple Telegram channels celebrated bomb threats targeting historically black colleges and universities (February 7).Multiple Telegram channels also celebrated the December 3 attack on two electrical substations in Moore County, North Carolina, by unknown individuals (December 12). Admins praised the attack, as well as other recent attacks on the power grid, and posted content hoping to encourage further targeting of electrical infrastructure.
Continued Spread of Neo-Nazi Accelerationist Manuals
Two neo-Nazi accelerationist guides were released in 2022. On June 1, unknown individuals released a 14-page publication in the style of “Terrorgram” Telegram content that advocated for attacks on the electrical grid, attacks on Jewish organizations, and targeted assassinations of government officials and their families (June 6). The guide was released on Telegram, 4chan, and Mega.Nz, the last site removed it after CEP reported it.
On July 14, the Terrorgram community released an approximately 260-page book that advocated for acts of terrorism (July 18). The book contained a distinctive graphic style and advocated for lone actor violence, workplace violence, attacks on infrastructure, law enforcement, politicians, people of color, Jews, Muslims, Sikhs, Latinos, and LGBTQ+ people. The book also included instructions on making homemade explosives and offered advice on committing livestreamed mass shootings. The text was spread widely on Telegram and several other sites later in the summer, including 4chan, a dark web imageboard, Ufile.Io, and the Internet Archive, which removed it after CEP reported it (September 12).Additionally, older, previously released content still circulates online. For example, CEP located a book on Google Drive that was initially released in June 2021 and advocated for acts of terrorism (March 28).
Online Extremists Worry About Vulnerabilities, Account Creation, and Opsec
Pro-ISIS tech groups warned their followers about potential dangers, such as metadata, hardware, and browser vulnerabilities (January 24, May 3, December 12). The online group Qimam Electronic Foundation recommended email services for ISIS supporters and offered assistance in removing ransomware (August 22, November 7). In May, a pro-ISIS RocketChat user warned others that Telegram saved information about users and advocated the use of VPNs (May 16).In the offensive category, in April, a pro-ISIS group shared what they claimed was spyware that could be deployed against opponents (April 19).A pro-ISIS Telegram user offered phone numbers to create Telegram accounts and accounts on other communications and social media sites (May 16, December 19).White supremacists on Telegram urged their followers to improve their operational security after a prolific extremist poster was sentenced to six years in prison in Slovakia (November 22).
Splits Within Post-Atomwaffen Division Groups
In September, several members of the Atomwaffen Division successor National Socialist Order (NSO) announced that they were starting a new group due to an alleged takeover by adherents of the Satanic occult group Order of Nine Angles (September 12). A neo-Nazi accelerationist website and The Base also announced that they were severing ties with NSO.In November, the website, which previously extensively promoted the work of the neo-Nazi James Mason, announced that they were severing ties with him (November 7). Site admins stated that Mason was working with a former NSO member who was ejected from the group, had criticized AWD/NSO leaders, and was having an affair with his friend’s wife.
Online Extreme Right Generally Uninterested in Russian Invasion of Ukraine
In many cases, the online extreme right was generally indifferent to Russia’s invasion of Ukraine in February 2022 or argued for non-involvement. Several Telegram channels blamed Jews for the conflict or invoked conspiracy theories claiming that the U.S. was to blame (February 28). The Nordic Resistance Movement declared that they did not support either side and urged their supporters to remain neutral and focus on internal issues (March 14). In late February, a white supremacist Telegram channel encouraged racist trolling of a chat created to help Nigerians in Ukraine fleeing the Russian invasion (March 7).
In March, a neo-Nazi accelerationist website that had previously encouraged Americans to join Ukrainian forces stated that they were no longer encouraging Americans to participate (March 7). Similarly, a neo-Nazi Telegram propagandist who had previously advocated for Americans to become foreign fighters reversed his position and stated that it was more important to fight the U.S. government (March 7). Later in March, the St. Petersburg located former leader of The Base, Rinaldo Nazzaro, urged his followers not to participate as foreign fighters (March 21).
Extreme Right Groups Targeted Drag Events in 2022
Members of the New England group Nationalist Social Club sought to intimidate performers and attendees of drag events (August 1, August 16). In December, the group asked for tips regarding future events they should protest (December 5). A regional Proud Boys chapter doxed the host of a drag event on Telegram in November (November 7).
ISIS Names Two New Leaders in 2022
On March 10, ISIS named Abu Hasan al-Hashimi al-Qurashi as the group’s new leader (March 14). Al-Qurashi was appointed following the February 3 death of their previous leader Amir Muhammad Sa’id Abdal-Rahman al-Mawla, a.k.a. Abu Ibrahim al-Hashimi al-Quraishi, in a U.S. Special Operations raid (February 7). ISIS online supporters had urged each other to wait for official confirmation from the terrorist group.On November 30, ISIS announced in an audio message that Abu Hasan al-Hashimi al-Qurashi had been killed and named Abu al-Hussain al-Hussaini al-Qurashi as the group’s new caliph (December 5).In both cases, the announcements were followed by propaganda videos and photos showing pledges of allegiance to the new leader from various ISIS provinces (March 21, December 5, December 12).
ISIS and Supporters Continue to Release Propaganda Videos and Magazines
ISIS continued releasing propaganda videos in 2022, and the terrorist group’s supporters persisted in releasing regional web magazines. CEP located multiple new ISIS propaganda videos, especially after new leaders were announced in March and November (January 24, March 21, March 28, June 21, June 27, July 5, July 25, August 8, November 14, December 19). For active links to ISIS propaganda videos, which the group and its supporters disseminate in the first wave of link distribution on the day of release, and excluding Telegram, RocketChat, Hoop, and pro-ISIS propaganda websites, CEP found:
- 60% of links were for content posted on file transfer sites, including cloud storage sites, anonymous download sites, or websites designed for person-to-person transfers.
- 13% of links led to websites specifically designed for streaming videos.
- 12% of links were for content on social media sites.
- 14% of links were for content on online libraries.
- 1% of links were for content posted on forums.
CEP also located several releases of the pro-ISIS English language web magazine Voice of Hind (February 7, March 7, May 9). The magazine encouraged joining ISIS and committing acts of terrorism. Articles commented on current events and sought to spread ISIS ideological content. The last edition of Voice of Hind, issue 27, was released in May (May 9). India’s National Investigative Agency (NIA) detained 50 people allegedly linked to Voice of Hind in October.In January, ISIS supporters allegedly in Afghanistan released the first edition of the English language web magazine Voice of Khurasan via the al-Azaim Foundation media outlet (February 7). Modeled on Voice of Hind, Voice of Khurasan criticizes and seeks to undermine support for the Taliban, comments on current events, and encourages joining ISIS (February 7, March 14, May 3, May 9, May 23, November 7, December 5).
Examples of Content
Atomwaffen Division Videos, Antisemitic Propaganda Located on Instagram (March 14)
CEP researchers located two Atomwaffen Division propaganda videos and a compilation video containing footage from AWD and The Base on Instagram. The two AWD videos were uploaded on March 4 and February 28 and had 199 and 176 views on March 10, respectively. The compilation video, uploaded on February 21, had 63 views. CEP also located an Instagram user that used an AWD propaganda image as a profile photo. An account was also found that contained a link in the profile for a neo-Nazi website that supports the work of James Mason and supports the National Socialist Order. Other accounts located on Instagram included using the 2011 Norway terrorist as a profile photo and posting antisemitic memes. After reporting the content, Instagram removed the compilation video and one of the AWD videos, but Instagram did not remove the second AWD video.
Pro-ISIS Web Magazine “Voice of Khurasan 17” Released (November 7)
On November 1, the pro-ISIS Al-Azaim Media Foundation released issue 17 of the web magazine Voice of Khurasan. The main article criticized the Taliban and Hamas as nationalist organizations sympathetic to Iran and linked to Qatar. The same piece accused Iran of using both the Taliban and Hamas as a counterbalance to ISIS in the Middle East and criticized the Taliban for their failure to institute religious law and continuation of relations with the government of China, despite their persecution of the Uyghurs. The magazine also contained a biography of the ISIS fighter who committed the March 2020 attack on a Sikh Gurdwara in Kabul, Afghanistan, which killed 25 people and injured eight. Other articles condemned Yusuf al-Qaradawi, following secular law, and advised the reader to participate in fighting and eventual martyrdom. Additional articles advocated strict modesty for women and criticized French colonial policies in North Africa and during the Algerian War of Independence.
In addition to Telegram, RocketChat, and a cloud storage site, the web magazine was released on at least seven other websites. Twenty-four hours later, the web magazine was available on five websites: Anonfiles, FastFileUpload.Com, Files.Fm, MediaFire, and the Internet Archive. AnonFiles, Files.Fm, and MediaFire removed the web magazine after CEP reported it. The Internet Archive made the file only accessible to logged in users after CEP reported it.
