The Fagersta attack and the attacker's online community

This article was authored in partnership between Revontulet and the Swedish election monitoring project Valkollen, by Fojo Verify under the Linnaeus University

What happened

On Friday, August 21, an 18-year-old male entered Brinellskolan in Fagersta, Sweden, with a sword. He killed a 17-year-old girl and wounded 3 younger boys before police shot him in the leg and arrested him. The perpetrator later confessed his goal: to kill more people. Five weeks earlier, on an account he had been posting to since June, he had described an invented character, a mass shooter who liked dancing outside his school. Within the community, this serves as a euphemism for an attack.

Valkollen and Revontulet have monitored the surrounding online activity continuously since the day of the attack. The picture that emerges from roughly half a million comments collected is not one of concealment. The perpetrator's community had been posting publicly for months beforehand. What the case demonstrates is less a failure of detection than a shortage of people whose job was to read what had already been collected. The milieu in question calls itself the True Crime Community (TCC), a meme-inspired subculture fascinated by mass killers and terrorists. We view it as a distinct community from the more generic categories, whether NVE (Nihilistic Violent Extremism), far-right, or "salad-bar" extremism into which it is routinely folded. Based on preliminary analysis, the distinction between communities is measurable in the data, rather than merely definitional.

Research into the perpetrator’s online presence reveals his role as a fairly well-regarded "editor" within the TCC. The perpetrator had posted several “edits,” AI-generated videos of perpetrators of mass violence dancing; these included well-known attackers such as Anton Lundin Petterson, Anders Behring Breivik, and Rickard Andersson. He was particularly influenced by Lundin Petterson, who committed the Trollhättan School attack in Sweden in 2015. Lundin Petterson is known for wearing a black mask, a German World War 2 helmet, and a sword. Some members of the community describe the perpetrator in Fagersta as one of the best creators in the community.

Following the attack, content produced by and about the perpetrator has continued to be published, and the True Crime Community has come under scrutiny. We at Valkollen and Revontulet have been monitoring online content since the attack began. This report covers new details about the online activity following the attack, explanations of the content, reactions from Swedish politicians, the TCC, and the conspiracy theory movements in Sweden. It also highlights how the event can, and will, affect the Swedish election campaign and the coming Swedish election on September 13th.

The perpetrator's supporters and community

Revontulet have argued previously that the lone wolf framing obscures more than it explains, since attackers without organizational ties remain embedded in communities that supply them with tactics, precedent, and an audience, and Fagersta fits that reading closely; Myra Åhbeck Öhrman has made a similar observation in Dagens Nyheter, asking how alone a perpetrator can really be when the audience is always present: ""The old image of lone perpetrators has always been that of a person isolated with and by their discontent. The new one is that of someone constantly surrounded by their audience: observed, ranked, cheered on and already conceivable as the protagonist in someone else’s videos." Research into the perpetrator's TikTok account reveals a larger online community of like-minded individuals. We know this from the captions in the video descriptions, where they tagged each other and posted tribute videos describing the perpetrator as a friend. Like them, several posted edits made in Viggle AI of mass shooters dancing.

The community surrounding the perpetrator not only produces new AI-generated tribute videos but also reuploads the perpetrator’s content. The day after the attack, a near-identical account was published on TikTok, with one key difference noted in its bio: “Archive.” Although it has since been removed, similar accounts continue to be created faster than they are taken down, with no reliable way to determine who created which. If his close community did not reupload this account, it was most likely republished by a supporter or "fan" as part of the wider network within the True Crime Community.

*Screenshot of the Archive of the perpetrator’s account taken on Saturday 22 at 17.34 CET.*

After the attack in Fagersta, the perpetrator himself has become a part of the mythos, and thus a character in content for the same edits he and his community created. As accounts have been removed or hidden behind privacy settings, it is becoming increasingly difficult to distinguish between the inner circle and a supportive fan. Either way, content of the perpetrator dancing with footage from the Fagersta attack continues to be published on TikTok. We have also found AI-generated videos created from images of the perpetrator in which he expresses his innocence.

Screenshot of celebratory video posted at 11.33 on August 23. Includes content of the perpetrator and footage from the attack on Fagersta. In the background is opposition leader Magdalena Andersson at the memorial. Prime Minister Ulf Kristersson is to the left of her.

The one account in this cluster that remains live was created in 2023 and holds five videos posted before the attack. The earliest video currently public was posted 65 days prior to the attack, and the most recent was posted 26 days prior. We dated each of them twice over: once from the platform's own metadata, and once from the creation timestamp that TikTok encodes inside every video identifier, a field the poster cannot alter. The two methods agree to within seconds. We cannot establish at this point who operated that account. What we can say is that an account posting this material in June cannot be a tribute account created in response to an attack in August. The account references a fictional work, a 2003 feature film that presents a fictional school shooting through the perpetrators' own recordings. The account's profile text adopts that film's shooter character as its own identity alongside a phrase the Columbine attackers used to describe themselves, none of which is coded in any meaningful sense.

Camouflage against machines

A long block of encyclopedia text about a very large number from mathematics appears in the descriptions of 351 of the 6,889 videos we hold from accounts carrying any marker of this community. The text is spread across 91 of those 866 central accounts, and it has the surface appearance of an in-group signal without functioning as one. The practice of repeating the text is nearly exclusive to that population, appearing in only 3 of 10,071 videos shared by observed accounts outside the central cluster, making it a community-specific behavior despite carrying no apparent community meaning. A measurement of description length is also of significance: videos carrying the text run to a median of 1,716 characters against 71 characters for those without, a twenty-four-fold difference, while hashtag counts stay identical at a median of five either way, so the community's own tags appear in both and the padding buries them rather than adding to them.

In cases where padding is not the mathematics text, it is entirely interchangeable, ranging from encyclopedia articles about television characters to dictionary definitions of "hero" and "legend", physics passages, and repeated nonsense strings. Still, 321 of the 532 descriptions over 600 characters are using the mathematics variant, and the remainder use something else to the same end. The interchangeability is the strongest evidence that the content carries no inherent meaning at all. Comments beneath these videos consist largely of people asking what the text is, with occasional corrections from viewers who know more mathematics than the poster. This is not how we expect a community to treat its own iconography. So, while functioning as a "meme," in-joke, or in-community identifier for those in the know, we do not, at this stage, believe it has any inherent meaning beyond serving as camouflage against moderators.

We tested whether the camouflage had any effect and found no evidence that it did. Accounts using the padding survive at a lower rate than accounts not using it, a difference that is statistically real and runs opposite to the protective hypothesis. Two readings of that result cannot be separated with our data: either the tactic fails outright, or the accounts posting the most removable content are also the ones motivated to attempt concealment, in which case the association runs through the content rather than the caption.

Absolute monthly counts rise from a handful of videos in February to several hundred in August, which overstates the spread considerably, since the public endpoints through which our data was collected return only an account's most recent videos and our archive therefore holds far more August material than January material, making any absolute series rise toward the present regardless of what the community is doing. Measured instead as a share of the videos posted each month, adoption still rises, from 2.6 percent across February to April to 6.2 percent across July and August, so the practice is spreading at roughly a doubling rather than the fortyfold increase the raw counts imply.

Genuine coded language does exist in this milieu, and it is considerably less elaborate than the padding offered by the encyclopedia articles on mathematics. One recurring construction renders an attack as a gift, describing a friend as having given some number of ordinary objects at a place, where the number is a death toll and the place an attack site. The same frame extends to schools with overlays of AI-generated edits of known attackers of other characters dancing, standing in for the act.

Rendering an atrocity as a gift keeps the death toll in full view while stripping it of what it counts, and the number, rather than the act, is what the construction preserves, which is the same scoring logic Svenska Dagbladet described in reporting that the number of dead becomes points online. Nobody in the replies asks what it means. Our reading is corroborated by a separate artifact, recovered for an unrelated purpose, in which the same figure is encoded the same way.

Where the communities separate

Coverage of this space often treats the True Crime Community, misanthropic and nihilistic violent extremism (M/NVE), accelerationists, and the far right as one phenomenon, usually on the grounds that all three venerate attackers. Our data, collected in the aftermath of this attack, does not support that collapse. We label accounts only from text they wrote themselves, meaning their handle, display name, profile text, their own captions, and their own comments, never from what others said to or about them, which lets us ask how often an account displaying the markers of one of these worlds also displays the markers of another.

Who shares an audience

Each dot is an account; a line joins two accounts commented on by the same people. Size shows how many such links an account has. Accounts are unlabelled by design.

Revontulet · TikTok monitoring, 21 Aug to 1 Sep 2026

Shared commenters indicate proximity, not coordination. Only accounts carrying a content marker are shown; off-topic accounts reached by the same collection are excluded. Click a label to hide that group. Scroll to zoom, drag to pan.

Across roughly 5,000 labeled accounts, the mean is 1.12 markers each, and the separation is sharpest where the conflation is most common: accounts using explicitly accelerationist and neo-Nazi vocabulary overlap with True Crime Community accounts by three per cent, with paramilitary equipment references by zero, and with attacker-homage naming by under two per cent. Of all the populations we measure, the accelerationist one is the most isolated, its largest overlap with anything else sitting under six per cent, which describes adjacent communities sharing an aesthetic rather than a spectrum with the far right at one end. What the True Crime Community does substantially overlap with is its own opposition, since around seventy per cent of accounts posting anti-TCC material also carry TCC markers, which is what an internal argument looks like from outside. Analysts do, however, question the sincerity of the disputes and opposition, viewing them as akin to how different communities argue over football teams while, overall, being fans of football. The practical consequence of this is that an intervention designed for far-right recruitment will not reach this population; counter-messaging built around ideological content will miss a community organized around fandom and status. The claim that the True Crime Community functions as a feeder into far-right extremism is also not supported in the data we hold. We hold the finding to its limits: it measures displayed symbols rather than stated beliefs, and it applies only to the accounts we monitor, not the whole platform or wider community.

Overlap between community markers across 5,000 labelled accounts. Each cell is the share of the smaller group that also carries the other marker. Symbols are read only from text an account wrote itself. Revontulet, TikTok monitoring 21 August to 1 September 2026.

Reactions from Swedish Politicians and the Election

The attack landed in the middle of an election campaign, and the immediate political response was more restrained than the circumstances invited. On Saturday, Ulf Kristersson and Magdalena Andersson visited the memorial site together and announced that the election campaign was on hold until further notice. The attack will most likely remain as a shadow over the rest of the election campaign, but their joint visit to Fagersta was an important sign of unity in what has otherwise been a heated campaign.

Hopefully, the display of unity and respect has prevented the attack from being hijacked by either the election campaign or from becoming an ‘external triggering event’. These are events outside the election campaign that various actors use to influence it in different ways, amplifying messages aimed at the domestic target audience. They can be used to spin narratives about a ‘failed state’ or ‘deep state’ – as conspiracy theorists would have us believe – where the event is used to frighten citizens into obedience.

Politicians, too, can make use of these triggering events. The crisis in Ceuta is a recent example that Swedish politicians used to echo messaging from the 2015 refugee crisis, despite the fact that the dissemination of the image of Ceuta was heavily influenced by Russian influence actors.

Attention following the attack in Fagersta turned instead to the platforms, with Andersson calling for a coalition of European prime ministers to press social media companies, the government holding round-table discussions on school safety on 1 September, and a commission on school attacks announced to cover prevention, online radicalization and recruitment, school security and care and crisis support for victims, survivors and affected communities.

Reactions in the Swedish conspiracy milieu

Narratives casting the attack as a false flag began circulating in the Swedish conspiracy community within hours, on a limited scale, and within that community the reading offered was that the attack was an obvious diversion staged to draw attention during the election campaign. The joint appearance of party leaders at the memorial site, which most observers read as restraint, was taken as evidence that the established parties are indistinguishable from one another, a characteristic narrative of the milieu, and one that turns any display of consensus into confirmation of collusion.

Crisis-actor claims followed the same pattern, including a post asserting that the ambulance driver Kenneth Lavrell had been first on the scene in Fagersta just as he was first on the scene when Olof Palme was shot and during the Drottninggatan attack. The claim has surface-level plausibility in the eyes of the conspiratorial community, but Lavrell has been retired since 2018 , no outlet has reported him present in Fagersta, and the likelihood that he was there is minimal.

These narratives reached a limited audience, appeared primarily on X, and the most viral among them drew between thirty and forty-five thousand views, with no sign of circulation among a mainstream audience and a correspondingly low risk of wider uptake on the current picture.

The limits of the TikTok corpus
Our findings rest on continuous collection of public TikTok content from 21 August onward, comprising 550,842 comment rows across 21,953 videos from 275,613 distinct accounts, with 3,103 accounts monitored directly alongside preserved page captures and media. There are three key limits to be aware of with those numbers. We hold follower counts for 23,719 accounts but no follower lists, so where we describe a community, the underlying relation is co-commenting: two accounts linked because the same people commented on both, which maps ideological proximity rather than operational connection and arises through sheer volume in a dense space. The archive is capped and recent, as it was collected in the immediate aftermath of an attack, so any time series drawn from it has to be expressed as a share. And the corpus cannot contain accounts banned or removed before we began, people who posted without commenting, private communication, or other platforms. Very little of what mattered in this case was concealed, and the work of reading it in context, which is neither automatic nor finished, remains a human one. A 17-year-old girl was killed in Fagersta, and three boys were wounded; the community that celebrated it was visible beforehand and is visible now.