Loading threat actor…
The Com, short for The Community, is a loose, decentralized cybercriminal and violent online ecosystem composed largely of English-speaking minors and young adults. It lacks a single leadership structure or unified ideology, but is widely associated with extortion, sextortion, child exploitation, swatting, fraud, social engineering, network intrusions, and in some cases severe offline violence. Europol and other investigators have described parts of the ecosystem as driven by nihilistic, misanthropic, and sometimes accelerationist or violent extremist currents, with status often tied to the production, coercion, or circulation of increasingly harmful material. The Com is commonly described as an umbrella milieu containing multiple overlapping subgroups and brands, including Cyber Com, Offline Com, (S)extortion Com, 764, and criminal crews such as Scattered Spider; reporting has also linked the Pink extortion brand to this ecosystem. Cyber Com has been associated with credential theft, social-engineering-led intrusions, ransomware, and disruptive attacks against enterprises. (S)extortion Com and 764 have been tied to grooming minors, coercing them into producing explicit material, self-harm, and other abusive acts for blackmail, circulation, or status. Offline Com has been associated with property damage, assaults, kidnappings, arson, and violence-for-hire. Operationally, The Com relies heavily on recruitment and victimization through social media, messaging platforms, gaming communities, and closed chats. Its members use social engineering via phone, email, SMS, and chat; credential theft; extortion; doxxing; swatting; and post-compromise data theft. Com-affiliated actors have been linked to enterprise intrusions and data-extortion operations, including activity associated with Scattered Spider and Pink, where attackers used vishing, MFA interception, account takeover, and rapid exfiltration from cloud collaboration platforms to pressure victims for payment. The ecosystem has also been linked to ransomware-related intrusions and major retail and casino incidents. A defining characteristic of The Com is the convergence of cybercrime with coercive abuse of minors and glorification of violence. Investigators have tied the network to grooming, blackmail, child sexual abuse material, self-harm coercion, animal abuse, violent propaganda, and manuals covering grooming, murder, improvised explosives, doxxing, and swatting. Law-enforcement actions in Europe, the United Kingdom, and North America have treated The Com as a global threat, particularly because minors appear both as primary targets and as participants recruited into criminal and extremist conduct.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loosely organized cybercriminal network whose members engage in violence, extortion, sextortion, online abuse campaigns, and other cybercrime. In this reference, it is tied to abuse of minors and broader Com-affiliated criminal activity in the U.K., U.S., and Canada.
A loose-knit online cybercrime collective that recruits and grooms children and teenagers through online platforms, coercing them into self-harm, violence, and the production of child sexual abuse material through blackmail. The group is also described as having subgroups involved in sextortion, terrorism-promoting activity, network intrusions, and ransomware attacks.
Cybercriminal collective involved in online blackmail and sextortion of minors, with sub-groups spanning physical violence, sextortion, and cyber intrusions including ransomware activity. The content also says it was previously linked to ransomware attacks against Las Vegas casinos and UK retailers including Marks & Spencer, Co-op, and Harrods.
A sprawling cybercriminal network associated with Moucka and his co-conspirators, involved in extortion, sextortion, violence, and other cybercrime.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.