|
Suspected 764-Inspired Minor Livestreams Knife Attack on Teacher in Sicily, Italy
On 20 May 2026, during class hours at a school in San Vito lo Capo, Trapani Province, Sicily, a 12-year-old student carried out a knife attack against his technology teacher, slightly injuring him in an assault that was livestreamed to a Telegram group by the minor himself. According to authorities, the student arrived armed with two small knives and wore a helmet during the attack, suggesting a level of premeditation and symbolic staging. The teacher ultimately managed to subdue the attacker, preventing what could have escalated into a more serious incident.
Following the attack, investigators revealed that both the helmet and knives contained writings referencing past school attacks in the United States, as well as references to the 13-year-old student responsible for the March 2026 teacher stabbing in Trescore Balneario, Bergamo Province. The similarities between both cases are striking: both perpetrators were under 14 years old, both targeted teachers using knives, and both livestreamed or filmed their acts of violence, suggesting the possibility of ideological imitation, online encouragement, or even direct coordination.
Signs of a 764 Influence
The incident bears several hallmarks consistent with the increasingly concerning 764 violent nihilistic ecosystem, whose members have repeatedly targeted vulnerable youth online and encouraged acts of violence for livestreaming and propaganda purposes. Authorities revealed that prior to the attack, the minor posted a message on TikTok stating: “Don’t blame me for what I’ll do.” The post received hundreds of comments, encouragement, and supportive messages, including phrases such as “You tried” and “Good luck,” indicating the boy may have been socially reinforced or manipulated online prior to carrying out the assault.
TRAC previously assessed that the 25 March 2026 Bergamo stabbing was linked to 764-inspired influence, a decentralised extremist ecosystem known for grooming minors, encouraging violence, promoting livestreamed attacks, and psychologically manipulating vulnerable youth through Telegram, Discord, gaming platforms, and social media. Unlike conventional extremist organisations, 764 increasingly functions more as an ideology and decentralised subculture than a singular group, inspiring offshoot communities operating under different names to evade law enforcement scrutiny and platform moderation.
The “Solomon” Reference and Emerging Symbolism
Particularly notable is the presence of the name “Solomon” on the attacker’s helmet, which TRAC is certain of being an homage to Solomon Henderson, the now-infamous 764-linked attacker frequently glorified within violent nihilistic online spaces. Additionally, markings such as “51/10” and “-1-3” point to Discord or Telegram identifiers, internal nicknames, or symbolic references tied to online networks. Within 764-adjacent communities, seemingly random numbers are often used as personal identifiers, group tags, or coded references linked to usernames and internal “lore.”
While no direct operational link has yet been publicly established, TRAC does not rule out the possibility that both the Sicily and Bergamo attackers have interacted with the same online handler or influence network, as part of a broader effort to encourage school-based violence among minors. The case further highlights growing concerns that violent nihilistic ecosystems are increasingly moving beyond online exploitation and into real-world, youth-led acts of violence designed for digital audiences.
A Growing Security Blind Spot
The case also exposes a major legal and security challenge. Under Italian law, children under the age of 14 cannot be criminally prosecuted, meaning the 12-year-old attacker will not face criminal charges despite the severity of the incident. Instead, authorities will rely on juvenile courts, social services, and socio-educational interventions. For extremist ecosystems targeting minors, this creates a particularly troubling dynamic: young adolescents are both highly vulnerable to manipulation and often fall below thresholds for criminal accountability, making them attractive targets for online handlers seeking to encourage acts of violence while minimising legal consequences for perpetrators.
| | | TRAC Incident Report: Sicarios Assassinate Man in Hotel Stairwell and Leave Pink Piglet Plush Toy Behind in Culiacán, Sinaloa, Mexico | | |
On 28 May 2026, at approximately 6:50 p.m. local time, unknown sicarios ambushed and killed a man in the stairwell area of a hotel located on Hermenegildo Galeana Street, next to the Rafael Buelna Market, commonly known as “El Mercadito,” and left a pink piglet plush toy at the scene.
The killing has heightened concerns among authorities that the pink piglet plush toy left behind at the scene indicates a recurring pattern of criminal activity. The same plush toy was discovered in at least two other recent executions involving young victims in Culiacán on 15 and 17 May – the first in the Infonavit Solidaridad housing development and the second in the Rubén Jaramillo neighbourhood. In cartel-related violence, symbolic markers are often used to send messages to rival groups, specific targets, local communities, or authorities. The recurrence of the same plush toy in separate killings indicate the emergence of a new signature or operational marker associated with a particular faction active in Culiacán.
The plush toys are a form of narcomensaje, or symbolic communication, similar to previous cases in Sinaloa where objects were attached to victims to imply accusations or motives. For example, in 2019, five bodies discovered in Culiacán had toy cars placed on them, signalling that the victims were suspected car thieves. Under this interpretation, the piglet plush toy could represent an insult, accusation, or coded label directed at the victims. Within criminal slang, “pigs” can symbolise betrayal, informants, corruption, weakness, greed, or perceived disloyalty, although there is currently no confirmed evidence linking the recent victims to any specific behaviour or accusation.
Another possibility is that the toys are intended less as a message about the victims themselves and more as a psychological tactic designed to generate fear, media attention, and confusion. Cartel factions in Mexico have increasingly used unusual or theatrical displays at crime scenes to distinguish themselves, intimidate rivals, and dominate public narratives. The repeated use of an identical plush toy could therefore represent an attempt by a faction, potentially Los Chapitos (CDS/CH) or La Mayiza (CDS/MZ), to establish a recognisable calling card during the ongoing internal conflict within the Sinaloa Cartel (CDS).
| | (Claim / Anonymous Anarchist) Anarchists Claim Annual Targeting of RED Passenger Bus Company in Honour of Mauricio Morales Near Escuela de Gendarmeria, Santiago, Región Metropolitana, Chile | | |
On 22 May 2026, an anonymous anarchist group sabotaged and burnt down a RED metropolitan passenger bus in Santiago, Chile, describing the act as a tribute to Mauricio Morales and other anarchist “comrades” killed by buses belonging to the same transport network. The incident occurred near the Escuela de Gendarmería (Gendarmerie School) in the Región Metropolitana, a location carrying symbolic significance given Morales’ death nearby in 2009.
The attack reflects a longstanding tradition of insurrectionary anarchist direct action in Chile, particularly around 22 May, the anniversary of the death of Mauricio Morales, a young anarchist militant who was killed when an improvised explosive device (IED) he was carrying detonated prematurely near a gendarmerie training facility in Santiago. Since then, the date has become an annual flashpoint for anarchist sabotage, incendiary attacks, and symbolic actions targeting state institutions, infrastructure, and corporations. While activity fluctuates from year to year, anarchist circles in Chile continue to frame Morales as a martyr figure whose death legitimises ongoing direct action.
The repeated targeting of RED Metropolitana de Movilidad (formerly Transantiago) stems from both ideological and symbolic grievances. On one level, the transport system represents everyday urban infrastructure associated with capitalism and state authority, making it a frequent target for anarchist sabotage. More specifically, anarchist actors have linked the network to the deaths of figures such as Javier Recabarren (2015) and Vicente Nicosia (2025), both struck by buses whose drivers allegedly avoided meaningful legal consequences. In this context, the sabotage of a passenger bus operating on the same route associated with Nicosia’s death appears less like random vandalism and more akin to a ritualised retaliatory act, intended to impose symbolic costs where anarchists perceive institutional impunity. The incident aligns with a broader strand of Chilean insurrectionary anarchism, which frames sabotage not as indiscriminate destruction, but as a proportional response to what it sees as structural violence upheld by corporations and protected by the state.
| | TRAC Incident Report: Suspected Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM) Jihadists Publicly Execute Quranic Teacher Abdoul Salam Maïga in Tonka, Cercle of Goudam, Timbuktu Region, Mali | | |
On the evening of 24 May 2026, suspected Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM) militants carried out an armed assault targeting a Burkinabe police installation in the village of Dora, Boucle du Mouhoun Region, western Burkina Faso. During the raid, militants seized a military vehicle and two machine guns, while also destroying an additional vehicle, highlighting the group’s continued emphasis on degrading state security capacity while simultaneously acquiring equipment to sustain future operations.
The incident also appears consistent with JNIM’s broader pattern of sustained pressure on security forces in the Dédougou area, where TRAC last recorded a JNIM-linked attack on security personnel on 20 April 2026. Rather than isolated raids, such operations increasingly resemble a deliberate campaign aimed at weakening government presence, reducing military mobility, and gradually expanding militant influence over economically and logistically important terrain.
Dora sits just off National Road 10 (N10), a critical transit corridor connecting Dédougou to Bobo-Dioulasso via Ouarkoye, and serves as an important route for cotton distribution, commercial transport, and access to the strategically important Mana gold mine, located approximately 15 kilometres northeast of Dora. Given JNIM’s growing focus on controlling resource-rich areas across the Sahel, TRAC is certain that the attack is closely linked to the group’s objective of expanding influence around mining zones and profiting through extortion of miners, transporters, and local economic activity. Control over such areas not only provides financial benefits but also enables militants to establish parallel systems of coercion and governance in regions where state authority is weakening.
| | TRAC Incident Report: Clashes Between Central General Staff (EMC/FARC) & General Staff of Blocks and Fronts (EMBF/FARC) Leave at Least 48 Dead, San José Del Guaviare Area, Guaviare, Colombia | | (Video/Right-Wing Extremism): Pennsylvania Active Club Release Training Footage “The Grind Never Stops” | | TRAC Incident Report: Afghanistan Freedom Front (AFF) Militants Target Taliban (IEA) Positions with Rockets, Baharak District of Badakhshan Province, Afghanistan | | | | |
