The actual planning and such happens on private sites with secret forums.
As a real-world example, a Danish right-wing nationalist network called ORG was exposed in 2011, after having allegedly been active since the mid-80s. Its members counted a number of well-to-do individuals, as well as members of the police and known violent white nationalists. The group ran and had control over several sports clubs, including martial arts and gun clubs, which they used for training members in street fighting and tactics.
They ran a database of basically every politician and public figure who ever espoused left-wing views, and thousands of ostensibly left-wing citizens as well, labeling them as "traitors" to be "dealt with".
At least one of their members was from the armed forces in some security-related capacity, and they had reasonably good opsec procedures in place.
I have no doubt that even after being exposed and having its members publicly named, the group or a new equivalent still exists, with new secret sites and a heightened level of paranoia towards possible infiltrators.
By deplatforming these people and driving them further underground and paranoid, we limit their ability to attract people through social media, for fear of exposure.