Tren-ding on TikTok
How Supporters of the Venezuelan Criminal Organization Tren de Aragua Signal Identity, Violence, and Reach on TikTok
Download the full report
Available free for a limited time — no sign-up required.
Overview
Tren de Aragua (TdA) is a Venezuelan criminal organization that originated in the Tocorón prison in Aragua state and has since expanded across Latin America and into the U.S. The U.S. government designated TdA as a foreign terrorist organization in 2025. In June 2026, the U.S. and Venezuelan governments announced the death of TdA’s longtime leader, Héctor Rusthenford Guerrero Flores, alias "Niño Guerrero," in a joint operation. Given the group's transnational reach, heightened policy attention, and recent change in leadership, it's increasingly important to understand the organization's online presence.
We identified a cluster of TikTok accounts displaying textual and visual characteristics associated with TdA, such as train and pirate references, coded emojis, and references to the group's leadership and places of origin. We did not identify open-source indicators that definitively tie these accounts to TdA members. The recurring features signify at least support for TdA, if not direct association, and include content that appears to depict violence, identify individuals as targets, and recruit new members in Venezuela and abroad.
This report summarizes a sample of 100 TikTok accounts reviewed between Sept. 12 and 25, 2026. We collected this sample from seed accounts we identified by searching TikTok for common TdA indicators, such as "TDA," "Tren de Aragua," and train references. We then expanded the set through follower and following relationships and comment interactions. Of the 100 accounts, we identified 64 as being operated by identifiable individuals, while 36 promoted the organization without an identifiable individual behind them.
The results of our analysis reflect identity indicators and content patterns that together form a decentralized but recognizable content environment. Several of these indicators circulate widely in Venezuelan popular culture and have been disputed as markers of TdA membership; our assessments do not hinge on any single indicator, but a combination thereof.
Key Findings
Violence, Threats, and Targeting
The identified accounts used TikTok to glorify violence and relay potential targets of harassment, intimidation, or other physical threats. Twenty-six of the 100 accounts posted violent or threatening content, including depictions of killings framed as TdA actions and posts identifying individuals as targets, which other accounts acknowledged in the comments.
Train and Pirate References Across Countries
The accounts use train references – a traditional TdA signal – and pirate references, including in text, imagery, and emojis. While public and U.S. government reporting suggests that a TdA-associated group going by “Los Piratas” operates in Chile, 96 of the accounts we reviewed used both train and pirate references. Only two of these accounts used imagery or flag emojis that suggested that they were in or from Chile. The rest had indicators that suggested they were in or from Venezuela, Colombia, Peru, and five other countries. This suggests that the use of pirate references is becoming widespread among TdA supporters.
Recruitment Activity Across Borders
The accounts posted recruitment calls in Venezuela and other countries. Recruitment posts offered unspecified jobs, targeted audiences inside Venezuela and other countries, including the Venezuelan diaspora, and directed interested users to private messages and, in one case, a WhatsApp group.
Hostility and Factional Conflict
The accounts’ content included hostile language that reflected conflict within TdA. Forty-three accounts published posts or videos that referenced conflict with "carro azul" or "anti-tren." Open-source reporting describes “carro azul” as a dissident TdA faction and “anti-tren” as a term for former members or rival factions.
Coded Signals and Moderation Evasion
The accounts attempted to evade moderation through coded signals, but some operated openly. We observed accounts masking weapons and violence with emojis and spreading identity markers across images and captions. A search on TikTok in September 2026 for "tren de aragua" returned multiple accounts that had content promoting or supporting TdA.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Download the complete PDF
The full report includes the complete network graph maps, raw attribution indicators, cross-platform topology analysis, and the full takedown timeline with platform-level data.
- Full network graph visualizations
- Attribution indicators with confidence scores
- Raw behavioral modeling data
- Takedown coordination timeline
Related Reports
Jumping Off Platform
Examining How The Com and Related Networks Spread Content on Mainstream Social Media Platforms and Direct Users to Off-Platform Spaces
Read the Report
Close to the Edge
How The Edgesphere Uses AI-Generated Visual Content to Glorify, Promote, and Humanize Violence
Read the Report
The #Americans
Chinese State-Linked Influence Operation Spamouflage Masquerades as U.S. Voters to Push Divisive Online Narratives Ahead of 2024 Election
Read the ReportSee How Graphika Can Help Your Team Act on This Intelligence
This report is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.