In 2026, nine nihilistic violent extremism (NVE) groups formed a coalition, announced on Telegram, and later launched a Tor-hosted onion forum. The forum hosts over 260 threads containing instructional PDFs on weapons, explosives, and terrorist tactics, as well as a marketplace for stolen data and claimed attack footage. Only around 220 accounts have registered. Two administrators account for 85% of all content. Law enforcement has already arrested at least one member.
What NVE Is and Why This Coalition Is Different
Nihilistic Violent Extremism is a broad term that covers a spectrum of movements united by misanthropic worldviews rather than a specific political ideology. The groups it describes can span fraud, sextortion, encouraging self-harm, and in the most severe cases, coordinated real-world violence. The term is contested in research circles, but it describes a recognisable pattern of behaviour across the groups included in this Alliance.
What makes the Alliance unusual is the cooperation. NVE groups typically operate independently, each with its own Telegram channel, its own recruitment, its own brand. The Alliance brings several of them together under shared infrastructure without dissolving their individual identities. Member groups are voted in by existing members, and removals happen when groups go inactive or when members are arrested.
This formalised administration structure, with voting, rosters, and official communications, is more organised than what researchers typically see in this space. It also brings together both established groups with documented histories and smaller, newer formations. The coalition describes itself as a “brotherhood” united by a “single goal: chaos,” framing violence as an ideological end in itself rather than a means to political change. Reference to neo-Nazi frameworks is common, and imagery associated with the Order of Nine Angles (O9A) appears throughout the forum’s visual branding.
From Telegram to Onion: Why the Migration Matters
The pattern of extremist groups using the dark web as a more resilient fallback for content that gets removed from mainstream platforms is well documented. The dark web’s onion infrastructure makes content significantly harder to moderate, since traditional platform takedown requests and URL-based filtering don’t apply to Tor-hosted services. This is the same logic that drives drug markets, ransomware operations, and criminal forums to use onion addresses and it’s now being applied to terrorist instructional material.
The Alliance’s transition followed a staged approach. First, Telegram channels announced the coalition and shared backups and sub-groups through intermediary gating channels. Then a clearnet site appeared, soon redirected to an onion page. The forum itself launched on July 20, 2026. A marketplace feature was added on August 22. This incremental development, building infrastructure gradually rather than launching complete, is consistent with how more sophisticated dark web operations are typically set up.
The channel’s own communications reflect an acute awareness of law enforcement risk. Users have been asked to back up links and move to alternative platforms in case of takedowns. One recent message promoted an encrypted chat alternative in case their main Telegram channel is removed. These are operational security behaviours more commonly associated with criminal enterprises than with the loosely organised forums that preceded this generation of NVE groups.
What the Forum Actually Contains
The onion forum is organised primarily as a repository of instructional content. Over 260 threads have been posted, many containing PDF attachments. The practical content includes instructions on constructing 3D-printed and homemade firearms, synthesising dangerous chemicals including poisons and acid, and tactical guidance on carrying out attacks on targets.
In terms of ideological material, large collections of texts associated with the Order of Nine Angles have been shared, alongside accelerationist content drawing on neo-Nazi frameworks. A separate “Actions” thread contains ten entries claiming murders and arsons in the United States and the Netherlands, with photographs and handwritten onion addresses presented as evidence. READ notes that most of these claims lack sufficient identifying detail for independent verification, though constituent groups have been linked to real-world violence by external reporting.
The marketplace includes listings for stolen credit card details, a subscription to an open-source intelligence platform, and access to what is advertised as “an uncensored AI capable of generating any code and creating weapons, explosives, and poisons.” This last item connects directly to the broader trend we’ve covered throughout 2026, AI tools being misused by criminal and extremist actors to accelerate dangerous capabilities. Payments on the marketplace are processed via cryptocurrency escrow, with Monero specified as the preferred donation method.
The forum’s rules contain one detail that researchers specifically flag as significant: while certain content is banned from shared spaces, it is explicitly permitted in private messages. The nature of that content places the forum in a category that should be reported to the Internet Watch Foundation or, in the United States, the NCMEC CyberTipline.
A Repository With Few Active Readers
The forum’s user statistics reveal something important about how it functions. Approximately 220 accounts are registered. In the month before publication, 85 users were active. Only 22 users ever contributed a comment or thread. Two administrators account for 85% of all comments and started 89% of all threads.
These numbers suggest the forum operates less as an active community and more as a library, a place where users can download material without leaving a trace. As READ notes, a logged-in user could feasibly download everything in a single session and return later for updates without ever posting. The onion requirement and registration process filter out casual browsers, but users willing to make that effort can access months of accumulated instructional content in one visit.
For comparison, the Alliance’s Telegram channel had over 500 subscribers during the same period, more than twice the registered forum users. The forum extends what Telegram enables, rather than replacing it. It provides more permanent storage for content that would be removed quickly from Telegram or clearnet platforms, while Telegram continues to serve as the primary real-time communication channel.
A database corruption in mid-August caused the forum to restore from a month-old backup, losing accounts created in that period. That interruption is visible in the registration trend data, and it demonstrates that even dedicated dark web infrastructure faces technical instability.
What Researchers Recommend
READ’s conclusions are measured. The Alliance’s forum is more significant as a consolidation point for extremist resources than as an active operational hub. Its direct impact on specific acts of violence is difficult to establish from the available evidence. But the content it hosts covers what researchers call “the full range of potential outcomes”, from foundational ideology to specific attack methods and recent additions include Alliance-branded graphic instructions that signal ongoing intent to build out the repository.
Law enforcement has already disrupted at least one member, a minor based in Dagestan, Russia, who had posted threatening videos to the Telegram channel. Alliance communications confirm awareness of this arrest, and the group’s preoccupation with police interference is evident in its messaging.
Researchers point to GIFCT’s Hash-Sharing Database as one of the most important tools for addressing this content when it does appear on mainstream platforms. Common usernames, iconography, and documents across social media platforms allow monitoring and moderation even when group branding changes. Understanding the ecosystem matters more than tracking any single group, because the hybridised harms , combining cybercrime with extremist violence facilitation, remain consistent even when specific accounts disappear.
The pattern of dark web platforms being used to preserve and distribute content that surface web moderation removes is not new. What’s new is the organisational cooperation, multiple distinct groups pooling infrastructure and building permanent shared repositories. That structure is harder to disrupt than individual channels, and it’s what makes this particular development worth watching.
Frequently Asked Questions
What is Nihilistic Violent Extremism (NVE)?
A broad label covering movements united by misanthropic, anti-societal worldviews rather than a specific political ideology. Harms range from cybercrime and sextortion to encouraging self-harm and, in extreme cases, coordinated real-world violence including murder.
What is “the Alliance”?
A coalition of nine NVE groups that announced a shared initiative on Telegram in April 2026, later launching both a clearnet site and a Tor onion forum. Researchers at READ and ISD use “the Alliance” as a neutral designation to avoid amplifying the group’s own branding.
What does the dark web forum contain?
Over 260 threads with PDF instructions on constructing firearms, synthesising dangerous chemicals, and carrying out attacks. It also contains ideological documents, a marketplace listing stolen data and other items, and an “Actions” thread claiming responsibility for murders and arsons.
How many people are actually using it?
Around 220 accounts are registered. Only 22 users ever commented. Two administrators created 89% of all threads. The forum functions more as a download repository than an active discussion community.
Has anyone been arrested?
Yes. Law enforcement arrested at least one member , a minor based in Dagestan, Russia , who had posted threatening videos to the group’s Telegram channel. Alliance communications confirm awareness of the arrest.
Who should I report this type of content to?
If you encounter this material online, report it to the Internet Watch Foundation (IWF) in the UK, or the NCMEC CyberTipline in the US. Tech platforms can also contact GIFCT to access the hash-sharing database for identifying and removing known extremist content.
