74° and Overcast
MINNEAPOLIMEDIA NEWS | Inside the Two-Year FBI Investigation That Foiled an Alleged ISIS-Inspired Mass Shooting at Mall of America
Federal court documents detail how an 18-year-old Richfield man allegedly moved from discussing overseas terrorism to planning an October 24 attack at the Mall of America, where thousands of visitors and a Hmong cultural celebration could have been placed at risk.
BLOOMINGTON, MN (October 14, 2026). For nearly two years, federal investigators followed a series of online conversations involving a Minnesota teenager who allegedly expressed admiration for terrorist organizations, considered traveling overseas to join their ranks, and eventually turned his attention toward carrying out a mass shooting in the Twin Cities.
By the time the FBI arrested 18-year-old Sheikhdoon Abdullahi Mohamud of Richfield on October 6, prosecutors say those conversations had progressed into an alleged plan to attack the Mall of America on October 24, the same day a Hmong cultural celebration was scheduled to bring families, performers, artists and visitors to the Bloomington shopping center.
Federal authorities say Mohamud had discussed killing between 30 and 60 people, identified potential targets based on religion and ethnicity, and recorded a video pledging allegiance to the Islamic State, commonly known as ISIS.
His arrest followed an undercover operation in which he allegedly paid $600 for a rifle, four magazines and approximately 200 rounds of ammunition from an FBI employee he believed was associated with the terrorist organization.
The rifle had been rendered inoperable before the transaction. The ammunition was live.
Mohamud was arrested shortly after taking possession of the items, bringing to an end what federal prosecutors describe as an increasingly serious plan for mass violence.
The case has generated widespread concern not only because of the alleged scale of the attack but also because of the intended setting: one of Minnesota's busiest public destinations during a celebration of Hmong cultural heritage.
It has also raised questions about online radicalization, the responsibilities of families and institutions when warning signs emerge, the role of confidential informants in terrorism investigations, and how communities respond when public celebrations become the subject of threats.
Mohamud has been charged with knowingly receiving a firearm and ammunition to commit a federal crime of terrorism. He has not been convicted, and the allegations against him remain subject to the federal judicial process.
A Criminal Investigation That Began in December 2024
The investigation began around December 2024, according to an affidavit submitted by FBI Special Agent Keegan Rupenthal, a member of the Minneapolis Joint Terrorism Task Force.
At that time, Mohamud began exchanging messages with a confidential human source who had an established relationship with the FBI.
Over approximately 21 months, investigators documented hundreds of communications through Telegram, Signal, Discord and TikTok, along with other messaging applications.
The source had been working with the FBI since 2017 and received monetary compensation, according to the affidavit. Rupenthal stated that the source's reporting was corroborated through recordings, screenshots and independently obtained investigative information.
Those details matter because the government's case relies substantially on conversations between Mohamud and a person whose identity has not been publicly disclosed.
The affidavit describes a lengthy record of messages, photographs and videos that prosecutors contend demonstrate Mohamud's developing intentions.
In the early stages, those intentions centered on traveling to Somalia to fight for an organization designated by the United States as a foreign terrorist group.
At different points, investigators say, Mohamud discussed al-Shabaab and ISIS, including the Islamic State's affiliate operating in Somalia.
The two organizations are distinct, although both are designated foreign terrorist organizations by the United States.
The complaint alleges that Mohamud eventually identified ISIS as the organization he wanted to support.
Early Messages Revealed an Interest in Violence
The FBI's account describes conversations from January 2025 in which Mohamud allegedly praised the perpetrator of the New Year's Day terrorist attack in New Orleans.
That attack killed 14 people and injured others when a man drove a vehicle into a crowd on Bourbon Street. Investigators subsequently identified evidence that the attacker had pledged allegiance to ISIS.
According to the affidavit, Mohamud expressed approval of the attack and discussed the possibility of obtaining a gun if he failed in school.
In March 2025, he allegedly sent another message discussing the prospect of traveling abroad or committing violence in the United States.
His statements included references to attacking people because of their perceived religious identity.
These messages form part of the prosecution's argument that the alleged October 2026 plot was not an isolated expression made shortly before his arrest.
Instead, the government portrays the case as a prolonged progression from extremist rhetoric toward preparation for an attack.
Whether prosecutors can prove that progression, and the intent required for the charged offense, will be determined through the legal proceedings.
The FBI Visited His Family in May 2025
One of the most consequential episodes in the complaint occurred well before the arrest.
In May 2025, FBI agents went to Mohamud's residence seeking to interview him.
According to the affidavit, his mother answered the door and told investigators that he was not home but would return from school shortly.
She called Mohamud's father, who spoke with the agents by telephone.
The father told investigators that he did not want to provide information about himself or his son and would pass the agents' contact information to his attorney.
The complaint does not establish that either parent knew the full extent of the online conversations described by investigators.
Nor does it accuse either parent of involvement in the alleged plot.
At the October 7 news conference, however, U.S. Attorney Daniel N. Rosen urged parents to take law enforcement warnings about possible radicalization seriously.
His comments drew attention to the difficulty of responding when authorities suspect that a young person is becoming involved with violent extremist ideology.
There is an important distinction between declining to speak with federal investigators and knowingly allowing criminal activity to continue. The complaint establishes the attempted contact and the father's reported response, but it does not establish parental knowledge of a specific attack plan.
From Plans to Travel Abroad to Threats in Minnesota
During late 2025 and the first half of 2026, the FBI says Mohamud continued to discuss traveling to Somalia.
In December 2025, he allegedly told the confidential source that he intended to join ISIS in Somalia, even while acknowledging an interest in al-Shabaab.
Investigators say he also sought access to additional online groups and shared propaganda depicting fighters and weapons.
By March 2026, the affidavit describes him discussing the amount of money he would need to travel abroad.
In one conversation, he referred to saving between $2,000 and $3,000.
He also mentioned wanting to purchase a BB gun for practice. The complaint recounts a conversation in which Mohamud said his sister had questioned why he was talking about going to Africa while considering buying a replica firearm.
That account suggests at least one family member had noticed behavior she considered suspicious, but the court document does not establish that she knew about an alleged terrorist plan.
In May, Mohamud reportedly discussed working for several weeks to save enough money for a plane ticket.
He allegedly said he would tell airport officials he was traveling for vacation or to visit his parents' country, while intending not to return to the United States.
The investigation took a significant turn in July.
Mohamud told the confidential source that he lacked the money to travel to Somalia and would instead carry out an attack in the United States, according to the affidavit.
He began identifying Minnesota destinations, including the Mall of America in Bloomington and Valleyfair in Shakopee.
At one point, he discussed the possibility of attacking a crowded location around Christmas.
The court documents indicate that these were discussions of potential targets and timing, not proof that he had completed preparations for an attack at either venue.
Why the Mall of America Became a Target
The Mall of America eventually became the central location in the alleged plot.
In July, prosecutors say Mohamud expressed antisemitic beliefs about the shopping center's ownership and suggested that a mass shooting would discourage people from visiting.
His comments included an alleged intention to kill between 30 and 60 people.
The complaint also describes his admiration for perpetrators of previous mass-casualty attacks, including the 2016 Pulse nightclub shooting in Orlando, the 2025 New Orleans attack and an antisemitic shooting at Bondi Beach in Australia.
The relevance of those references is not simply that Mohamud consumed extremist material.
Prosecutors contend that he was discussing previous attacks as examples of the violence he wanted to carry out.
The Mall of America is a particularly sensitive setting for such allegations because it combines retail operations, entertainment attractions, public transportation access and a substantial concentration of visitors.
The shopping center is also an important workplace for employees across many businesses.
An attack there would therefore threaten not only shoppers but potentially retail workers, restaurant employees, performers, maintenance personnel and others whose daily activities bring them into the building.
The complaint does not provide an independent assessment of how many people would have been present on October 24 or establish that the alleged casualty figure was achievable.
The Hmong Arts Celebration and the October 24 Date
The alleged plot became more specific in September 2026.
According to the FBI affidavit, Mohamud identified October 24 as his intended attack date.
When the confidential source asked whether a large gathering was expected that day, Mohamud referred to Asian attendees and people he characterized as non-Muslims.
He then sent a link to the Hmong Arts Celebration scheduled for the Mall of America.
The event, organized by Cypher Side Dance School, is scheduled to return for its second year on Saturday, October 24, from noon to 5 p.m. at the Huntington Bank Rotunda.
According to the mall's official event listing, the celebration features live performances, traditional fashion, music, storytelling and other presentations reflecting Hmong cultural heritage.
The inaugural celebration in 2025 was described by organizers as the first Hmong cultural event hosted at the Mall of America.
Its return was intended to expand opportunities for artists and performers while bringing older and younger generations together.
The event also welcomes visitors outside the Hmong community, making it both a cultural celebration and an opportunity for broader public engagement.
That is the context in which the alleged targeting has been especially troubling.
Federal authorities say the suspect was not merely considering a busy shopping center. He had identified a particular event and referred to the people expected to attend.
The complaint attributes ethnic and religious hostility to Mohamud's alleged messages. Those statements are evidence of the suspect's purported views, not descriptions of the event's actual attendees.
Organizers Refuse to Let the Threat Define Their Celebration
The alleged plot has placed the Hmong Arts Celebration's organizers in an extraordinarily difficult position.
They must balance the understandable concerns of families and performers with the event's original mission of celebrating culture and community.
Lue Thao, identified in local reporting as an event organizer, described learning of the allegations as heartbreaking.
In a statement reported by FOX 9, Thao thanked the FBI and other law enforcement agencies for their intervention and acknowledged the importance of communication with the Mall of America regarding security.
Thao also emphasized that the celebration was established to create opportunities for Hmong artists and bring people of different backgrounds together.
The organizers have expressed a desire for the public to continue supporting participating artists and community organizations rather than allowing the alleged threat to overshadow their work.
That response reflects a broader challenge faced by communities whose public events become targets of intimidation or violence.
Organizers are left to address security concerns while protecting the very sense of openness that makes cultural gatherings meaningful.
As of October 14, the Mall of America's official calendar continued to list the Hmong Arts Celebration for October 24.
No attendance guarantee or specific revised security plan should be inferred from that listing. Visitors should check the event's official channels for updates before attending.
Investigators Say the Planning Intensified in August
By August, the complaint alleges that Mohamud had moved into discussions about purchasing a firearm.
He told the confidential source that he expected to have several hundred dollars after returning to Minnesota from Ohio.
The affidavit also describes messages in which Mohamud contemplated asking other people who supported ISIS to participate in an attack.
He referred to a small online group, but said he did not know whether its members would be able to join him.
The government has not publicly established that those individuals agreed to participate in the alleged plot.
At the October 7 news conference, Rosen said Mohamud acted alone and was not affiliated with a gang.
That distinction is essential. References to online contacts or possible recruitment do not establish the existence of a coordinated terrorist cell.
The evidence publicly described to date centers on Mohamud's own communications and his interaction with the confidential source and undercover FBI employee.
September Messages and an Alleged Pledge to ISIS
The complaint describes September as a particularly significant month in the investigation.
Mohamud allegedly communicated through additional messaging accounts, reaffirmed October 24 as his intended date and discussed obtaining the firearm he believed would be used in the attack.
Investigators also say he sent the confidential source a selfie-style video pledging allegiance to ISIS.
The affidavit identifies the pledge as directed toward Abu Hafs al-Hashimi al-Qurashi, whom ISIS had named as its leader.
A declaration of allegiance is important evidence in the government's account of Mohamud's claimed ideological motivation.
It does not, by itself, establish that ISIS leadership directed the alleged attack, that the organization knew about the plan or that Mohamud was operating as part of a formal network.
The distinction between an ISIS-inspired attack and an ISIS-directed operation is central to understanding the case.
The evidence made public supports the government's allegation that Mohamud sought to act in support of ISIS. It does not establish operational control by the organization.
The affidavit also says Mohamud continued referencing previous terrorist attacks and expressed determination to proceed.
When the confidential source questioned whether he was certain, Mohamud allegedly insisted that he remained committed.
The Undercover Operation Reaches Its Final Stage
On approximately September 25, the confidential source told Mohamud that a supposed associate could arrange a weapons sale on October 6.
Over the following days, investigators say Mohamud continued discussing the transaction.
On October 4, he allegedly sent a video counting cash to demonstrate that he had the money required for the purchase.
Two days later, FBI surveillance observed him leave his residence and travel alone to a predetermined meeting location near his home.
The meeting took place in Richfield.
There, Mohamud entered a vehicle driven by an undercover FBI employee whom he believed was connected to ISIS through the confidential source.
According to the affidavit, the meeting was recorded on audio and video.
Mohamud allegedly handed over $600 in cash in exchange for a Norinco AK-47-style rifle, four magazines and approximately 200 rounds of ammunition.
The FBI had disabled the rifle before the transaction for public and officer safety.
The ammunition, however, remained live.
Investigators say the undercover employee explicitly presented himself as an active ISIS member and asked Mohamud about his beliefs and intentions.
During that exchange, Mohamud allegedly discussed his interest in several terrorist organizations before identifying ISIS as the group he supported.
He also reportedly reaffirmed his intention to carry out a shooting at a festival at the Mall of America.
The affidavit states that he discussed antisemitic beliefs about the mall's ownership and other perceived grievances.
After the exchange, Mohamud left the undercover employee's vehicle carrying the weapons and ammunition.
FBI agents arrested him at gunpoint shortly afterward.
No shooting occurred.
What the FBI's Intervention Established
The October 6 operation is central to the federal case because prosecutors are relying on more than expressions of violent intent.
The government alleges that Mohamud accepted possession of a firearm and ammunition after months of communications describing how he intended to use them.
The FBI's account also indicates that investigators controlled the transaction, disabled the rifle and arrested the suspect before the proposed attack date.
At the same time, the investigation raises legal questions that may become important as the case proceeds.
The confidential source had communicated with Mohamud for approximately 21 months and, according to the affidavit, helped facilitate contact with the supposed weapons seller.
The source also presented himself as connected to ISIS.
The public complaint records Mohamud repeatedly expressing his own interest in violence, including statements prosecutors characterize as unsolicited.
Whether defense attorneys challenge the conduct of investigators, the credibility of the confidential source, or the interpretation of Mohamud's statements remains to be seen.
No such defense should be assumed before it is presented in court.
What Federal Prosecutors Actually Charged
On October 7, the U.S. Attorney's Office for the District of Minnesota announced one criminal count against Mohamud.
The charge alleges that he knowingly received a firearm and ammunition while knowing, or having reasonable cause to believe, that the items would be used to commit a felony and a federal crime of terrorism.
The cited federal statute is 18 U.S.C. § 924(h).
The complaint identifies providing, attempting to provide or conspiring to provide material support to a designated foreign terrorist organization under 18 U.S.C. § 2339B as the underlying terrorism-related offense.
This legal distinction is important.
Mohamud was not separately charged in the October 7 complaint with attempted murder, carrying out a mass shooting or a standalone count of attempting to provide material support to ISIS.
Rather, the firearm-and-ammunition charge incorporates the government's allegations concerning terrorism-related intent.
Additional charges could be brought in future proceedings, but no such development should be reported without a new court filing or official confirmation.
The First Court Appearance
Mohamud appeared before U.S. Magistrate Judge Elizabeth Cowan Wright in federal court in Saint Paul on October 7.
He was represented by federal public defender Siri Carlson McDowell.
According to Associated Press reporting, Mohamud appeared in a jail uniform and told the court he was unemployed and did not own a house or car or have money in the bank.
His mother attended the proceeding.
The court ordered him to remain in custody pending further proceedings.
A hearing was scheduled for October 19, with local reporting identifying a 10 a.m. preliminary hearing.
The proceedings will determine how the federal case advances and whether the government can establish the elements of its charge.
Mohamud is presumed innocent unless proven guilty beyond a reasonable doubt.
Federal and Local Officials Respond
The October 7 announcement brought together officials from the U.S. Attorney's Office, FBI and Bloomington Police Department.
U.S. Attorney Daniel N. Rosen credited investigators with identifying and disrupting an alleged threat before anyone was harmed.
FBI Minneapolis Special Agent in Charge Christopher Dotson characterized the messages described in the complaint as evidence of a commitment to ideological violence and disregard for human life.
The Justice Department also released a statement from Assistant Attorney General for National Security John A. Eisenberg, who connected the allegations to the broader problem of ISIS-inspired violence in the United States.
FBI Director Kash Patel praised the Minneapolis investigation and the agencies involved.
The Justice Department identified the FBI, the Joint Terrorism Task Force and Bloomington police as the principal investigative partners, with assistance from IRS Criminal Investigation.
The case is being prosecuted by Assistant U.S. Attorney Benjamin Bejar and Justice Department Counterterrorism Section Trial Attorney Ryan White.
Mall of America Addresses Security Concerns
The Mall of America acknowledged that the allegations were unsettling for visitors, employees, businesses and the wider community.
In its public response, mall leadership thanked law enforcement for identifying and disrupting the alleged threat.
The mall also stated that it maintains multiple layers of security and coordinates with local, state and federal authorities.
The announcement has renewed attention to the challenges of protecting large public destinations.
A complex such as the Mall of America serves many purposes simultaneously. It is a shopping center, entertainment venue, transit destination, workplace and gathering space.
Its openness is essential to its operation, yet that same accessibility requires extensive security planning.
Former Mall of America counterterrorism official Simon Osamoh, now a security consultant, told CBS Minnesota that large gathering places are attractive targets for individuals motivated by terrorist ideology.
He described the mall's security arrangements as involving multiple layers, including law enforcement coordination and other protective measures.
The publicly available information does not establish that mall security failed or that investigators discovered a breach of the shopping center's protective systems.
The alleged plot was disrupted before the suspect reached the planned attack date.
Minnesota's Previous Terrorism Investigations Provide Context
The case arrives in a state that has confronted earlier investigations involving recruitment to foreign terrorist organizations.
During the late 2000s and subsequent years, federal authorities investigated young men from Minnesota who traveled or attempted to travel to Somalia to join al-Shabaab.
A separate wave of cases in the following decade involved attempts to join ISIS, including prosecutions connected to travel plans involving Syria.
Those investigations produced convictions and guilty pleas, but they also generated debate over the role of informants, the prevention of radicalization and the relationship between law enforcement and immigrant communities.
The current case differs in a significant respect.
According to the complaint, Mohamud's alleged interest in traveling abroad ultimately gave way to a plan for violence inside Minnesota.
That transition is one of the central developments prosecutors identify in the investigation.
Researchers who study terrorism have noted that some suspects move between ambitions to join organizations overseas and plans to carry out attacks domestically.
Such patterns may help explain why federal investigators closely monitor online expressions of support for terrorist organizations, but they do not establish criminal intent in any particular case without supporting evidence.
The Importance of Avoiding Collective Blame
Federal authorities have identified Mohamud as an American-born U.S. citizen whose parents are from Somalia.
That background has been included in official statements and news coverage.
It is not evidence that Minnesota's Somali community bears responsibility for his alleged conduct.
Nor should the case be interpreted as representative of Muslim communities more broadly.
Minnesota's Somali American population includes families, educators, business owners, healthcare professionals, religious leaders, public servants and community organizations whose lives and contributions cannot be reduced to the actions alleged against one individual.
The same principle applies to the Hmong community, whose celebration was allegedly selected as a target.
Reporting on the case requires attention to the specific evidence and conduct attributed to the defendant, rather than assumptions about communities identified through ethnicity, religion or immigration history.
The federal complaint concerns the actions of one defendant. Prosecutors have not established that he acted on behalf of any Minnesota ethnic or religious community.
Online Radicalization and the Warning Signs Investigators Describe
The affidavit illustrates how investigators say extremist messaging developed across multiple digital platforms.
Mohamud allegedly moved among messaging applications, shared propaganda, sought contact with people he believed supported terrorist organizations and repeatedly discussed violent intentions.
The government describes a progression involving online identification with extremist groups, overseas travel aspirations, discussion of possible targets and an eventual weapons transaction.
These elements provide material for examining how online spaces can facilitate exposure to extremist propaganda and reinforce violent beliefs.
But the case also illustrates the limits of drawing broad conclusions from individual circumstances.
School difficulties, unemployment, frustration over housing costs or personal isolation do not establish that a person is becoming a terrorist.
Millions of young people experience such challenges without engaging in violence.
The significance of the evidence here lies in the explicit threats, repeated discussions of killing civilians, alleged pledge of allegiance to ISIS and steps toward obtaining weapons.
Those are the matters that distinguish the government's allegations from ordinary adolescent frustration or lawful religious and political expression.
Questions the Investigation Has Not Yet Answered
Despite the extensive affidavit, several significant questions remain unresolved.
The government has not publicly established that Mohamud had accomplices who agreed to participate in the alleged attack.
It has not demonstrated that ISIS leadership directed or approved the proposed shooting.
The available filings do not establish that Mohamud had independently obtained a functioning firearm for the planned attack before the undercover transaction.
Nor do they establish whether he had previously entered the Mall of America to conduct reconnaissance, developed a complete operational plan or possessed the ability to carry out the casualty figures described in his alleged messages.
The complaint also leaves unanswered what, if anything, Mohamud's family understood about his intentions and what preventive interventions might have been possible before the case reached the point of an undercover weapons sale.
These are legitimate questions for subsequent reporting, but they should not be answered through speculation.
October 24 Approaches
With the Hmong Arts Celebration scheduled for October 24, organizers, performers and visitors now face the challenge of preparing for an event that has become associated with an alleged threat.
The event's official listing remains focused on its original purpose: celebrating Hmong artistic expression, traditions and the relationships between generations.
Federal authorities say they arrested the person they accuse of planning the attack more than two weeks before the scheduled date.
That intervention is the immediate public safety outcome.
The longer-term consequences will depend on the federal prosecution, any additional evidence that becomes public and the ways Minnesota's communities and institutions respond.
For the Hmong artists and families preparing to gather at the Mall of America, October 24 was intended to be a day of music, storytelling, performance and cultural pride.
The alleged plot has brought an unwanted dimension to those preparations. It has not changed what the celebration was created to accomplish.
For Minnesota, the case presents two responsibilities that must be held together: taking credible threats of mass violence seriously and refusing to allow allegations against one person to become a judgment against entire communities.
What Happens Next
Mohamud remains subject to federal court proceedings, with the next hearing scheduled for October 19.
The Justice Department has not announced a conviction, and the criminal complaint remains an allegation.
The Hmong Arts Celebration is still listed for October 24, from noon to 5 p.m., at the Mall of America's Huntington Bank Rotunda.
Members of the public planning to attend should consult official event communications for updates.
STAY CONNECTED TO MINNEAPOLIMEDIA
Local stories matter. Subscribe free to MinneapoliMedia and receive independent news, community reporting and important updates from Minneapolis, the North Metro and communities across Minnesota.
SUBSCRIBE FREE: https://minneapolimedia.town.news/subscribe
MinneapoliMedia | Community. Culture. Civic Life
