The Com

The Com, short for The Community, is a decentralized, primarily English-speaking cybercriminal ecosystem composed largely of young actors and overlapping sub-networks rather than a single hierarchical organization. It is widely associated with financially motivated cybercrime, especially social-engineering-led intrusions, SIM swapping, credential theft, account takeover, data theft, and extortion. Security reporting and law-enforcement assessments consistently place multiple prominent crews and brands within or adjacent to this ecosystem, including Scattered Spider, and likely affiliates or overlapping actors tied to Pink and BlackFile. The network has also been discussed in connection with overlaps or loose associations involving Lapsus$ and ShinyHunters in some operations and personnel relationships. The Com is notable for its reliance on human-centric intrusion tradecraft. Commonly reported tactics include voice phishing, SMS phishing, impersonation of IT help desk or internal support staff, phishing against identity platforms such as Okta and Microsoft 365, MFA interception or relay, passkey-enrollment abuse, SIM swapping, and rapid post-compromise data exfiltration from cloud and SaaS platforms such as SharePoint, OneDrive, Salesforce, and similar enterprise services. Actors linked to this ecosystem frequently exploit legitimate administrative workflows and trusted communications channels, then use compromised accounts for internal messaging, extortion, and further social engineering. The ecosystem is loosely structured and adaptive, with participants often operating under changing brands, temporary crews, or rebrands after arrests or disruption. Researchers and investigators have described substantial overlap among members, infrastructure, and tradecraft across multiple extortion and intrusion clusters. Rather than maintaining stable organizational boundaries, participants appear to move fluidly between subgroups and criminal specialties depending on opportunity, reputation, and access. Law-enforcement and intelligence reporting also describe The Com as extending beyond cyber-enabled fraud and extortion into broader criminality. The FBI has characterized it as an international online ecosystem with interconnected subsets, including Hacker Com, Extortion Com, and IRL Com. IRL Com in particular has been associated with violence-as-a-service, swatting, doxing, intimidation, assault, kidnapping, arson, and other real-world coercive acts. Broader reporting has further linked parts of the ecosystem to sextortion, exploitation of minors, and child sexual abuse material production and trafficking. Analysts have emphasized that the boundaries between cybercrime, extortion, harassment, and offline violence within this milieu are often blurred. The Com is not a nation-state actor. It is best understood as a fragmented criminal social network whose members coordinate across platforms such as Telegram, Discord, and gaming communities, with reputation, status, and profit serving as major drivers. Its significance lies in the convergence of advanced social engineering, cloud-focused enterprise intrusion, extortion, and, in some subsets, real-world violence, making it one of the more consequential English-speaking cybercriminal ecosystems currently tracked.