Loading threat actor…
The Com, short for The Community, is a global, loosely affiliated ecosystem of predominantly English-speaking cybercriminal groups rather than a single centrally controlled organization. Its participants are largely teenagers and young adults, with prominent membership in the United States and United Kingdom. Members interact through gaming communities, Discord, and Telegram, trading access, tools, and stolen data and forming smaller groups that may cooperate or compete. The ecosystem encompasses financially motivated hacking, cryptocurrency theft, digital extortion, sexual exploitation, and physical violence; it has no single uniform motivation. The FBI distinguishes three principal segments: Hacker Com, In Real Life Com, and Extortion Com. Scattered Spider is a prominent hacking subset, while members of the violent exploitation network 764 are also affiliated with the ecosystem. These affiliations do not make the constituent groups interchangeable or establish common responsibility for every participant's activities. Hacking participants specialize in social engineering, including phishing, help-desk impersonation, SIM swapping, and manipulation of password-reset and multifactor-authentication enrollment procedures. Intrusions involve credential theft, privileged network access, lateral movement, and data exfiltration. Scattered Spider participants have also deployed partner ransomware and stolen cryptocurrency. Targets include hospitality and gaming businesses, technology providers, telecommunications companies, financial services organizations, retailers, transportation operators, and healthcare organizations. Parts of The Com use doxxing, swatting, threats against victims and relatives, and physical intimidation to support extortion or settle disputes. Some participants offer violence-for-hire services. Affiliated exploitation networks target minors and other vulnerable people through grooming, sextortion, and coercion into self-harm and violence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families attributed to this actor across reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An online criminal ecosystem cited as an example of predatory youth recruitment. The article describes recruitment into social engineering and cyber fraud, with subgroups linked to sextortion of minors and coercion into self-harm. It does not identify malware or ransomware used by the ecosystem.
Described as a loose cybercriminal network that pioneered violence-as-a-service, enabling cybercriminals to commission physical attacks through local criminals. Its activities illustrate the potential for cyber extortion to escalate into real-world violence; no specific attack by the network is detailed.
A loosely connected network of online groups whose activities span cybercrime and physical violence. Europol and partner investigators flagged 4,340 URLs for removal during a crackdown on the network.
A global criminal collective with which members of 764 are affiliated. The content associates it with financially motivated, sexual, and violent crimes but provides no specific malware, vulnerabilities, or operational techniques.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.