Full Report
Atomwaffen Division cofounder and alleged Terrorgram Collective member Brandon Russell is facing a potential life sentence for an alleged plot on a Baltimore electrical station. His case is only the beginning.
Analysis Summary
# Threat Actor: Terrorgram Collective (and associated figures like Brandon Russell)
## Attribution & Identity
**Core Figure:** Brandon Russell (29 years old), cofounder of Atomwaffen Division.
**Associated Groups:** Atomwaffen Division (a banned neo-Nazi guerrilla organization responsible for homicides and bomb plots). The Terrorgram Collective refers to the propaganda network that gained prominence following an influx of neo-Nazis to Telegram.
**Designations:** Designated a "tier one" extremism threat by the US Department of Justice. Formally classified as a Foreign Terrorist Organization (FTO) by the US State Department (January 13th). Proscribed as an extremist organization by the UK Home Office. Atomwaffen Division was previously banned by the UK, Australia, and Canada.
**Ideology:** Neo-Nazi ideology mixed with nihilist, Columbine-style violence; accelerationist propaganda network focused on inciting mass casualty events.
## Activity Summary
The Terrorgram Collective operates as a domestic terrorism propaganda network on Telegram, developing "how-to" manuals to inspire mass casualty events.
* **Baltimore Plot:** Brandon Russell was arrested in February 2023 for allegedly conspiring to destroy an energy facility (knock out Baltimore’s power grid) to trigger a race war.
* **Inspiration:** The collective's publications have allegedly inspired several international attacks, including a 2022 mass shooting at an LGBTQ bar in Bratislava, Slovakia, successful power infrastructure attacks in North Carolina, failed energy infrastructure plots in New Jersey, and a stabbing spree in Eskisehir, Turkey.
* **Law Enforcement Action:** The Biden administration pursued a hard-charging approach against this extremism, culminating in the FTO designation. There are over a dozen federal prosecutions involving core Terrorgram members or inspired individuals in the US.
* **Brandon Russell's History:** Russell previously served federal prison time (released August 2021) after a 2018 conviction for possession of homemade hexamethylene triperoxide diamine (an unstable compound), which stemmed from an FBI investigation related to a double homicide involving Atomwaffen Division members in Tampa, Florida.
## Tactics, Techniques & Procedures
The collective's TTPs focus on propaganda dissemination and actionable instructions for physical attacks:
* Developed a series of "how-to" domestic terrorism manuals.
* Manuals include instructions for chemical weapons attacks, infrastructure sabotage, and ethnic cleansing.
* Veneration/Glorification of past mass murderers (e.g., Anders Breivik, Brenton Tarrant, Timothy McVeigh) documented in planned publications.
- *No specific MITRE ATT&CK IDs were provided in the source text.*
## Targeting
* **Sectors:** Energy infrastructure (power grid sabotage).
* **Geography:** Transnational activity noted, with members/incited attacks in the US (Baltimore, North Carolina, New Jersey), Slovakia, Turkey, Croatia, Denmark, South Africa, and Canada.
* **Victims (Planned/Inspirational):** Politicians, government officials, business leaders, journalists, and activists (listed as assassination targets in planned "The List" publication). Civilians involved in mass casualty events.
## Tools & Infrastructure
* **Malware Families Used:** Not specified (Focus is on propaganda, not specific malware).
* **Infrastructure (C2, domains, IPs):**
* Primary platform: Telegram (running several propaganda channels).
* Publications noted: Four released documents, with plans for "The Saint Encyclopedia" and "The List."
* **Intelligence/Surveillance:** The Five Eyes alliance (US, Canada, UK, Australia, New Zealand) has been monitoring the Terrorgram Collective since at least 2021.
## Implications
The Terrorgram Collective represents a globally networked, accelerationist propaganda structure aimed at inciting mass casualty events and infrastructure collapse to foment chaos (race war). The FTO designation highlights the severity of the threat posed by decentralized, ideology-driven online networks. The article notes that the incoming Trump administration threatens a wholesale shift away from prosecuting far-right extremism, suggesting future enforcement efforts may diminish following the current administration's actions.
## Mitigations
* Increased surveillance and intelligence sharing across Five Eyes allies regarding transnational far-right extremist networks.
* Monitoring and disruption of online platforms (Telegram) used for distributing domestic terrorism manuals and operational guidance.
* Prosecuting network leaders for conspiracy related to infrastructure attacks and inciting violence.