Earlier this year, a Pennsylvania man beheaded his father, who worked as a federal employee, and displayed the severed head in a video where he urged viewers to rise up against the government. Another man in Illinois was building bombs he hoped to one day use against a “corrupt government.” In two separate cases, people were arrested for threatening to kill President Joe Biden and federal officials. An Arizona man plotted a mass shooting at a rap concert in Atlanta because he wanted to spark a race war ahead of what he believed was “impending martial law.”

All five of these cases, which occurred over the past eight months, have been linked by the Department of Homeland Security’s Office of Intelligence and Analysis to what it sees as a concerning trend: fantasies and conspiracies of an impending civil war mobilizing individuals toward violence surrounding the US election.

The memo, first reported by WIRED, was circulated last month to law enforcement agencies.

“Some domestic violent extremists (DVEs) are reacting to the 2024 election season and prominent policy issues by engaging in illegal preparatory or violent activity that they link to the narrative of an impending civil war, raising the risk of violence against government targets and ideological opponents,” the memo states.

Online chatter about civil war has become an inevitable knee-jerk response to any divisive sociopolitical news event in recent years—from prosecutions of Capitol rioters and the attempted assassination of Donald Trump to disputes over enforcement at the US–Mexico border. And that chatter has, perhaps unsurprisingly, only continued to ramp up ahead of the 2024 election.

Intelligence analysts say that they have seen online discussions about preparing for future violence against public officials and federal agents and are aware that some extremists are using the heightened political environment as an opportunity to engage in “illegal preparatory or violent activity,” according to the DHS report. The assessment aligns with earlier WIRED reporting that indicates the paramilitary movement has been organizing and training ahead of the election. The report was first obtained by Property of the People, a nonprofit focused on transparency and national security, under open records law.

DHS also cautioned that it is unable to get a grasp on the full scale of the threat. “We lack a complete threat picture due the ability of some DVEs to evade law enforcement using advanced encryption,” the agency wrote. And because extremists have gotten tech-savvier, intelligence officials don’t really know whether they’re joining forces.

This is a trend that researchers and experts have observed especially since the Capitol riot nearly four years ago. “We’ve seen people move from mainstream platforms, where they were active in organizing January 6, and shift to platforms that offer more perceived anonymity, less moderation, and less reporting to law enforcement,” said Katherine Keneally, US director of threat analysis and prevention at the Institute for Strategic Dialogue. “It is a law enforcement intelligence gap, it’s a gap for the whole field. We don’t see everything we once did.”

Regardless of whether extremists are coalescing or whether the threat remains atomized, the assessment recognizes that online chatter about civil war had already inspired plans for real-world violence.

In January, Justin Mohn, a 32-year-old man from Levittown, Pennsylvania, beheaded his father, a federal employee, and displayed the severed head in a 15-minute tirade uploaded online. In the video, titled “Mohn’s Militia-Call to Arms for American Patriots,” Mohn urged viewers to rise up against the government and hunt down federal agents and judges.

Months later, in March, federal agents arrested Benjamin Brown, a 45-year-old man in Waterville, Maine, for making threats to kill President Biden and other officials. The man allegedly claimed he was stockpiling weapons and ammo for a civil war and, according to an affidavit, said he wanted to hunt migrants and “burn Washington to the fucking ground.” Brown was charged with making interstate threats.

Then, in May, a stop for a minor traffic violation in Pekin, Illinois, led police to discover a padlocked canvas bag inside the vehicle containing a .45-caliber pistol and two homemade pipe bombs belonging to 34-year-old Dalton Mattus. When investigators searched Mattus’ home, after a brief standoff, they allegedly found more pipe bombs. A local radio station reported that Mattus told police he hoped to use the bombs defensively against “undocumented immigrants and a corrupt government.” It turned out that Mattus also had an extensive social media presence; for years, he had promoted QAnon conspiracy theories and civil war fantasies, advocated violence against federal officials, Democrats, and immigrants, and urged his followers to prepare for imminent conflict.

In June, an Arizona man who worked as a vendor at gun shows was indicted for allegedly plotting a mass shooting targeting Black people at a rap concert in Atlanta with the goal of inciting a “race war” ahead of the 2024 election. According to an affidavit, Mark Adams Prieto, 58, believed that “martial law will be implemented shortly after the 2024 election.” He also said he hoped to leave confederate flags at the site of his planned mass shooting, to send the message that “we’re going to fight back now and every whitey will be the enemy across the whole country.”

Also in June, 27-year-old Joseph Rose, a US veteran living on New Mexico’s White Sands Missile Range, was arrested for making threats online against Biden and federal employees. He vowed to declare war on the US and “attack federal employees on sight” over Biden’s immigration policies and said if anyone voted for Biden, “I’ll shoot you on sight for supporting pedophiles.”

Intelligence analysts say that they’re most concerned about lone offenders or “small cells” taking violent action in the coming months, citing the ongoing prosecutions of the January 6 rioters as well as “false flag allegations that an event is orchestrated by the government to entrap and arrest attendees” as likely deterrents to large-scale mobilization.

DHS says it is continuing to advise federal, state, and local partners and urges law enforcement and the public to remain vigilant and report suspicious activity to authorities.

Additional reporting from Dell Cameron.