Frontline Watch delivers a weekly look at emerging terrorist activity and global threat trends, with Counterterrorism Managing Editor Mahmut Cengiz analyzing the developments shaping the security landscape at home and abroad.
764: Online Nihilistic Violent Extremist Network Targeting Children
November 2025 marked a turning point in the threat assessment of 764 when a 21-year-old in New Jersey was arrested for allegedly plotting ISIS-style terror attacks and possessing bomb-making materials, with investigators tying him to the 764 network. In April 2025, two alleged leaders of 764 were arrested in North Carolina and Greece, underscoring the group’s transnational reach. In January 2026, individuals claiming affiliation with 764 cells took responsibility online for arson attacks, including a vehicle fire in Ängelholm, Sweden. By February 2026, federal authorities continued to report active investigations nationwide, including sentencings of members in New York and Virginia. These developments highlight why 764 now warrants sustained attention in counterterrorism and emerging threat reporting.
The online extremist group known as 764 first gained sustained attention from U.S. authorities in 2023 after the arrest of Angel Luis Almeida on firearms charges. Investigators connected Almeida to factions of Atomwaffen Division, including networks influenced by the Order of Nine Angles, as well as to 764—an online collective focused on coercion, sexual exploitation, and psychological manipulation of minors. In September 2025, FBI Director Kash Patel described 764-related activity as a form of “modern-day terrorism,” citing over 250 active investigations involving grooming, sextortion, coercion of self-harm, and child sexual abuse material (CSAM). U.S. authorities classify 764 as a Tier One/Category 1 nihilistic violent extremist (NVE) threat.
Founded in Stephenville, Texas, by then–15-year-old Bradley Cadenhead, 764 grew from the larger online criminal network known as “the Com,” a decentralized group involved in hacking, extortion, swatting, and CSAM distribution. The group’s name comes from the first three digits of Cadenhead’s ZIP code. Despite arrests of its leaders, 764 continues to operate through encrypted chatrooms within a decentralized, all-channel structure. Most members are minors, though adults have also been identified. The network has fractured into multiple affiliated subgroups and has sometimes aligned with other violent accelerationist collectives.
Although influenced by white supremacist, satanic, and accelerationist doctrines associated with the Temple ov Blood and the Order of Nine Angles ecosystem, 764’s operational motivation appears mainly status-driven rather than doctrinal. Prospective members must provide proof of abuse or exploitation to gain entry, fostering a competitive culture centered on escalating harm. Recruitment occurs on youth-oriented platforms including Roblox, Minecraft, TikTok, Instagram, Snapchat, Reddit, and X, where members deliberately target minors—typically ages 9 to 17—who show signs of depression, family instability, or social isolation. Grooming tactics follow a pattern of emotional manipulation followed by sextortion and coercion, often pressuring victims to produce explicit content, engage in self-harm, recruit peers, or commit other acts designed to generate exploitable material. The group’s internal manual, Tradecraft, outlines grooming methods, operational security guidance, and strategies for network expansion.
Despite ongoing disruption efforts, 764 remains active due to its decentralized structure, youth-based recruitment, and ability to leverage mainstream digital platforms. Its combination of child exploitation, performative extremism, and sporadic violent plots—including alleged bomb-making and arson—makes 764 an evolving hybrid threat that spans online radicalization, criminal activity, and domestic extremism.
Mexico’s Escalating Cartel Violence and Expanding Cross-Border Threats
The killing of Nemesio Oseguera Cervantes, “El Mencho,” marks a crucial moment in Mexico’s ongoing battle with organized crime. On February 22, around 11:00 a.m., Mexican Army Special Forces, in cooperation with the National Guard, the National Intelligence Center, and federal prosecutors from the Specialized Prosecutor’s Office for Organized Crime, carried out a targeted operation in the mountainous area of Tapalpa, near the Jalisco–Nayarit border. Mexican authorities noted that the operation was supported by intelligence sharing from U.S. counterparts, emphasizing the increasingly binational nature of efforts against cartels. The rugged terrain, including highlands and dense forests within the Villa Purificación–Cuautla–Sierra de Amula corridor, was deliberately chosen; it has long served as a strategic sanctuary for the leader of the Cártel Jalisco Nueva Generación (CJNG).
A surge of high-casualty attacks and escalating cross-border tensions underscores why Mexico remains a central concern in 2026 threat monitoring. In late January, 10 employees of a Canadian-owned silver and gold mine were abducted in the mountains above Mazatlán, with five bodies later discovered nearby, highlighting the continued use of violent kidnappings in contested zones. The same month, gunmen opened fire on a crowded soccer field in Salamanca, Guanajuato, killing 11 people and wounding 12 in a mass-casualty attack. January alone recorded more than 1,500 cartel-related murders nationwide, including a single weekend with 161 homicides. Cartels—particularly the Jalisco New Generation Cartel (CJNG)—have continued deploying explosive-laden drones, a tactic previously demonstrated in the October 2025 drone strike on a government facility in Tijuana. Reporting also indicates that CJNG authorized attacks on U.S. Customs and Border Protection personnel using a tiered bounty system, encouraging drone strikes and direct gunfire. Simultaneously, cartels have increased their use of heavy weaponry, including .50-caliber rifles, to overwhelm local law enforcement. As of mid-February 2026, the U.S. military has conducted dozens of lethal maritime strikes against suspected trafficking vessels in the Caribbean and Pacific, reportedly killing at least 145 individuals since September 2025—illustrating the widening security spillover.
These developments build on an already transformative 2025. On February 20, 2025, under President Donald Trump, the U.S. Department of State formally designated several major cartels as Foreign Terrorist Organizations (FTOs), including the Sinaloa Cartel, CJNG, Gulf Cartel, Cártel del Noreste (CDN), La Nueva Familia Michoacana, and Carteles Unidos, among others.
The Sinaloa Cartel experienced intense internal fragmentation between the Los Chapitos faction and the faction aligned with Ismael “El Mayo” Zambada, producing sustained violence across Sinaloa and neighboring states. In April 2025, a Los Chapitos–linked cell attacked a drug rehabilitation center in Culiacán, killing nine individuals. Subsequent clashes resulted in additional fatalities, with bodies displayed publicly to intimidate rivals and signal territorial control. Rather than collapse under enforcement pressure, the organization fractured into competing nodes, amplifying instability.
CJNG pursued a more expansionist trajectory. Across Michoacán, Jalisco, and Guanajuato, the cartel orchestrated coordinated highway blockades, vehicle burnings, and multi-municipality shutdowns designed to paralyze transportation corridors. In May 2025, CJNG escalated to insurgent-style IED warfare, destroying an armored vehicle and killing eight Mexican security personnel along the Michoacán–Jalisco corridor. Drone warfare also became normalized. The October 2025 drone attack on a government compound in Tijuana marked one of the clearest examples of unmanned aerial systems used offensively against state facilities in a major urban border zone. By late 2025, drones were integrated into routine cartel operations for surveillance, targeting, and explosive delivery, signaling a technological arms race between criminal organizations and security forces.
Other groups demonstrated their capacity to destabilize strategic border cities. Following the February 2025 arrest of CDN leader Ricardo González Sauceda (“El Ricky”) in Nuevo Laredo, sustained gunfights and highway blockades disrupted urban life and temporarily shut down key infrastructure, underscoring how leadership arrests can trigger immediate retaliatory violence.
GTTAC recorded attacks carried out by designated cartels from February 20 through June 30. According to GTTAC, these cartels perpetrated 52 attacks in the last 10 days of February, 262 attacks in March, 273 in April, 271 in May, and 324 in June, demonstrating a sharp escalation in operational tempo during the early months of the year. These attacks killed 1,448 individuals and wounded 438, confirming once again the cartels’ reliance on highly lethal tactics. The most active group during this period was the Jalisco New Generation Cartel (CJNG), responsible for 756 attacks, followed by the Sinaloa Cartel with 195, the Cartel del Noreste with 116, Carteles Unidos with 56, the Gulf Cartel with 29, and La Nueva Familia Michoacana with 26. Firearms were used in 950 attacks, followed by 48 involving incendiary devices, 48 involving melee weapons (blunt or bladed objects), 21 using explosives, 11 involving improvised explosive devices (IEDs), and 4 involving unmanned aerial vehicles (UAVs). The attacks targeted 756 civilians, 119 government employees, 117 professionals, 54 rival group members, and 17 military personnel, suggesting deliberate and strategic target selection. In terms of facilities, 863 attacks targeted infrastructure, 106 commercial sites, 48 government facilities, 16 cultural sites, and 12 military facilities. Vehicles were used to access attack locations in 3,896 incidents, while mail or postage methods were used in two cases.
Despite record-level drug seizures in both the United States and Mexico—including unprecedented cocaine interdictions and millions of fentanyl pills confiscated—evidence suggests these seizures reflect high production volumes intersecting with intensified enforcement rather than durable contraction. Under pressure, cartels diversified into fuel theft (huachicol), migrant smuggling, extortion, and other illicit markets to stabilize revenues. They hardened logistics, intensified counter-surveillance, expanded corruption networks, and increasingly adopted asymmetric tactics—drones, IEDs, targeted assassinations, and heavy-caliber weaponry—to raise the costs of state intervention.
Collectively, the trajectory from 2025 into 2026 indicates not the dismantling of cartel power but its adaptation. Mexico’s major criminal organizations now operate as decentralized, technologically adaptive hybrid actors capable of mass-casualty attacks, cross-border intimidation, and sustained coercive violence under unprecedented enforcement pressure.
Counterterrorism Snapshot: U.S. Operations and Policy Signals (February 13-20, 2026)
An additional 100 U.S. troops have arrived in Nigeria to strengthen counterterrorism efforts as ISIS activity increases and threatens the wider West African regional security. U.S. intelligence, surveillance, and reconnaissance (ISR) assets continue to assist Nigerian forces with target identification, highlighting Washington’s expanding operational role amid worsening security conditions in northwest Nigeria.
U.S. forces have officially transferred control of the strategic Al-Tanf base in southern Syria to local partner forces, marking a careful reduction of the American military footprint in the region. The shift demonstrates Washington’s broader move toward empowering local actors to keep pressure on ISIS remnants while decreasing the continuous U.S. ground presence near the Syria–Iraq–Jordan tri-border area.
Notable Terrorist Attacks
On February 14, 2026, suspected JNIM militants carried out an attack in Titao, Burkina Faso, killing seven Ghanaian traders and injuring several others. The incident prompted a medical evacuation by the Ghana Armed Forces. The attack underscores ongoing insecurity in northern Burkina Faso and the continued vulnerability of cross-border trade amid expanding militant activity in the Sahel.
- On February 14, 2026, nine far-left students allegedly assaulted 23-year-old far-right student Quentin Darenque in Lyon, France, leading to his death. French authorities have investigated the incident as an act of political violence. The attack highlights increasing ideological polarization in parts of Europe and the risk that extremist narratives—across the political spectrum—could lead to fatal violence.
