Loading story…
A Canadian man from Ontario’s Niagara region was sentenced to 20 years in prison after pleading guilty to terrorism-related offences tied to the Terrorgram Collective, an online violent white supremacist network. Authorities said he produced and disseminated propaganda that helped inspire multiple terrorist attacks, marking a significant court outcome against a transnational extremist ecosystem that has been designated as a terrorist entity in several countries.
Europol said its European Counter Terrorism Centre supported the case by mapping the Terrorgram network from mid-2022 onward, identifying associated individuals across Europe and other regions, and sharing intelligence packages with international partners including the Royal Canadian Mounted Police. The case underscores sustained cross-border cooperation between Canadian authorities and Europol to identify, investigate, and disrupt online extremist propaganda networks linked to real-world violence.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
A Danish-French national was sentenced by the District Court in Glostrup to six years in prison for terrorism-related offences linked to the Terrorgram network. Prosecutors said he produced and disseminated far-right extremist propaganda and provided guidance through multiple Telegram profiles; the verdict was appealed to the High Court.
On 2026-04-01, a Canadian man from Ontario’s Niagara region was sentenced to 20 years in prison for terrorism-related offences connected to the Terrorgram Collective. Europol said the conviction reflected sustained international cooperation between Canadian authorities and Europol against the transnational extremist network.
A man from Ontario’s Niagara region pleaded guilty to terrorism-related offences tied to producing and disseminating violent white supremacist propaganda for the Terrorgram Collective. Authorities said the material he co-created and shared online inspired multiple terrorist attacks.
Beginning in mid-2022, Europol’s European Counter Terrorism Centre started mapping the Terrorgram Collective’s online network, identifying linked individuals across Europe and other regions. The intelligence was packaged and shared with international partners, including the Royal Canadian Mounted Police.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
europol.europa.eu
Open sourceeuropol.europa.eu
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Europol** said it coordinated its largest-ever **Referral Action Day** targeting terrorist and extremist **audio propaganda**, referring **17,298 URLs** across **40 online platforms** for review. The operation was initiated and co-led by **Hungary** and Europol’s **EU Internet Referral Unit (EU IRU)**, with investigators from **13 countries** participating. The referred material amounted to more than **1,100 hours** of content and included speeches by designated terrorist leaders, songs glorifying violence, and **nashids** commonly used in jihadist propaganda; Europol said **77%** of the content had been removed so far. The action reflects a broader shift of extremist messaging toward **audio-sharing platforms**, where moderation is more difficult than for video or image content because detection often requires linguistic and contextual expertise. Europol said the campaign targeted propaganda used by actors across the ideological spectrum, including **jihadist** and **violent right-wing extremist** networks, and that investigators conducted deconfliction checks before referrals to avoid disrupting ongoing investigations. The case is operationally relevant as it highlights how threat actors continue to exploit less-moderated media formats to sustain online radicalization and propaganda distribution.
Jul 12, 2026
Canadian authorities executed search warrants at a Greater Toronto Area residence as part of a coordinated investigation into **Orcus RAT**, working with the **FBI** and **Australian Federal Police**. The **CRTC** and **RCMP National Division** said the case was triggered by tips from private cybersecurity firms and involves parallel investigations into remote access trojan technology used to gain unauthorized access to computers, steal personal information, and deploy additional malware. Reporting identified the location as linked to John "Armada" Revesz, who said investigators seized backup drives containing Orcus Technologies business records, user information, and financial transaction data. Researchers and law enforcement have long disputed claims that Orcus was a legitimate administration tool, citing capabilities commonly associated with malware, including **keylogging**, password theft, stealth webcam and microphone access, persistence mechanisms, remote code execution, and **DDoS** functions. Palo Alto Networks previously described Orcus as a low-cost, modular RAT sold commercially with plugin support, real-time scripting, anti-analysis checks, and delivery options such as spear phishing, malicious links, and drive-by downloads, concluding that it was clearly designed for cybercriminal use despite its marketing.
Aug 15, 2026
Europol said investigators from nine European countries flagged **4,340 URLs** for removal during Referral Action Days aimed at disrupting **The Com**, a decentralized online network tied to nihilistic violent extremism. The operation, organized by Europol’s **EU Internet Referral Unit** and Spain’s **CITCO**, targeted content spread across social media, messaging apps, and gaming platforms that promoted self-harm, suicide, child sexual abuse material, animal cruelty, violent attacks, and guides for grooming, murder, improvised explosives, doxing, and swatting. Authorities said The Com recruits and grooms young people online, often coercing minors through sextortion and pushing them toward both victimization and offending. Europol linked the action to its broader **Project COMPASS** effort, which had already produced arrests, identified suspects, and located victims, and noted that subgroups associated with the network include **764**. That subgroup drew earlier law-enforcement attention after U.S. prosecutors charged alleged leaders of 764 with operating a global child exploitation enterprise, underscoring how extremist online communities are overlapping with organized child abuse and coercion networks.
Jul 31, 2026