Full Report
Law enforcement action has accelerated and senators are taking new legislative action against a cybercrime movement whose raison d’être is sowing terror and chaos, where young victims are extorted into self-harm or harm to others, and where those arrested — often young themselves — are accused of committing heinous crimes to gain extortionist cred in…
Analysis Summary
# Threat Actor: Violent Online Extortion Groups within "The Com" Ecosystem
## Attribution & Identity
**Identification:** A cybercrime movement characterized by sowing terror and chaos. The movement operates within an online ecosystem referred to as "The Com" (short for "The Community").
**Aliases/Associated Groups:**
* **The Com:** Primarily English-speaking, international online ecosystem where members (many minors) engage in criminal violations.
* **764:** Mentioned as one of the most well-known extortion groups within The Com.
* Groups using names reflecting nihilistic violent extremism (NVE), such as "No Lives Matter."
## Activity Summary
The groups are engaged in sadistic online exploitation, leading to what NCMEC calls the "most egregious exploitation reports" ever seen. Activities include extortion targeting vulnerable young victims, often coercing them into self-harm, producing explicit content, or harming others (including siblings or animals). Law enforcement action and legislative action are accelerating against this movement.
## Tactics, Techniques & Procedures
- **Recruitment/Grooming:** Drawing or recruiting victims (often minor females, especially those vulnerable due to mental health issues) from public online platforms, including popular gaming sites, into specific online social networks.
- **Trust Building:** Cultivating relationships with victims to gain trust.
- **Extortion:** Threatening to release personally identifiable information (PII), intimate photos, or explicit video online, or threatening to send explicit images to the victim’s family or cause physical harm to the victim or their relatives if demands are not met.
- **Coercion to Violence/Degradation:** Forcing victims to commit degrading acts, commit suicide on a livestream, cut themselves, or produce pornography. Victims may also be instructed to hurt siblings or animals.
- **Gaining Clout:** Sharing photographic or video evidence of these crimes among like-minded members in the community to gain notoriety/clout.
- **Associated Criminal Activity (Varying per subset of Com):** Hacking, ransomware linkage, inciting/committing real-world violence (property crimes, assault), swatting (false police reports), bomb threats, and doxing in exchange for cryptocurrency.
- **Ideology:** Activities fall under Nihilistic Violent Extremism (NVE)—accelerating societal chaos and violence for its own sake.
- **MITRE ATT&CK IDs:** Not explicitly mentioned in the text.
## Targeting
- **Sectors:** Not explicitly detailed, but the methodology suggests soft targets vulnerable to social engineering/grooming.
- **Geography:** The Com is described as "international." Specific arrests mentioned involved California and Washington state (US).
- **Victims:** Most often minor females. Specifically, 84% of reported victims were female; 75% were ages 14 to 17, 21% ages 11 to 13, and 4% 10 or younger (data span Jan 1, 2019 – Jun 30, 2025). Victims are often vulnerable due to mental health issues (e.g., depression).
- **Offenders:** 88% of offenders noted were male, and 25% of those offenders were minors.
## Tools & Infrastructure
- **Malware Families Used:** Mention of hackers sometimes linked to ransomware groups, but no specific malware families are named.
- **Infrastructure (C2, domains, IPs):** Extortion is conducted in exchange for a **cryptocurrency fee**. Specific C2s or domains are not listed. All URLs and IPs in the source document must be defanged, but none specific to actor infrastructure were provided.
## Implications
This movement represents a serious escalation in cyber-enabled exploitation, moving beyond standard financial cybercrime into sadism, real-world violence, and psychological terrorism. The involvement of minors both as perpetrators and victims, coupled with the goal of accelerating societal chaos (NVE), elevates the threat level significantly, prompting immediate high-level legislative and law enforcement focus.
## Mitigations
- Accelerated law enforcement action and new legislative strategy targeting the movement are underway.
- Increased reporting to NCMEC’s CyberTipline regarding violent online groups.
- Online platforms (like gaming sites) need enhanced detection and intervention strategies to prevent recruitment and grooming.