764 is a youth-heavy nihilistic violent extremist network associated with the broader Com ecosystem. It has been described by U.S. and European authorities as operating in the United States and abroad and as blending online exploitation with violent extremist themes, social destabilization narratives, and severe abuse of vulnerable minors. Security and law-enforcement reporting consistently places 764 within the extortion and exploitation side of The Com, while also noting overlap between Com subcultures involved in cybercrime, fraud, harassment, swatting, and real-world violence. The group is primarily known for the grooming, coercion, and extortion of children and other vulnerable people into producing child sexual abuse material and increasingly extreme abuse content. Reported victimization patterns include blackmail, doxing, swatting, cyberstalking, threats against victims and their families, and coercion into self-harm, animal abuse, sibling abuse, degrading acts on camera, and suicide-related acts. Authorities have characterized these activities as part of a broader nihilistic violent extremist worldview centered on hatred of society, notoriety, domination, and the deliberate corruption and exploitation of minors. 764 is commonly described as a decentralized network rather than a tightly controlled organization. It is linked to thousands of mostly young participants, often teenagers and young adults, and has spawned multiple offshoots and copycat communities. Reported associated subgroups and splinters include 764 Inferno, 7997, and 8884. The network is also tied to a wider constellation of harm communities and Com-affiliated clusters that overlap with sextortion, harassment, fraud, and intrusion activity. Researchers and investigators have noted that some actors move between child-exploitation communities and financially motivated cybercrime, reinforcing the broader convergence between Extortion Com, Hacker Com, and IRL Com. Recruitment and victim targeting are reported to occur through mainstream online platforms used by minors, including social media, messaging applications, gaming communities, chat services, and livestream or video platforms. Tradecraft attributed to 764 includes social engineering, grooming, coercive control, blackmail, operational compartmentalization through subgroup structures, and the use of cybercriminal tactics to facilitate exploitation and intimidation. The network has also been associated with propaganda-like glorification of abuse, competitive escalation among members, and attempts to build status through increasingly extreme acts. Authorities have linked 764 to racially motivated and neo-Nazi-adjacent extremist currents in some cases, and some prosecutions have framed elements of its conduct as meeting domestic-terrorism-related thresholds or as advancing violent extremist ideology. Europol and the U.S. Department of Justice have both highlighted 764 in the context of counter-extremism and child-protection operations targeting The Com. Publicly identified alleged leaders and members have faced charges related to directing and distributing child sexual abuse material, coercion and enticement of minors, cyberstalking, extortion, and related violent offenses. Known aliases and naming variants are limited, with 764 itself being the primary identifier. Known subgroups include 764 Inferno, and known affiliated or splinter communities include 7997 and 8884. In operational and analytical contexts, 764 is best understood as a violent exploitation network embedded within The Com rather than as a conventional financially motivated intrusion group, although overlap with broader Com cybercriminal activity is well documented.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A violent extremist collective and sprawling nihilistic network linked to child exploitation, sextortion, coercion, and abuse, with multiple offshoots and members facing arrests and long prison sentences.
An associated network described as neo-Nazi sextortionists, with some members later moving into corporate extortion.
Sub-group within The Com described by DOJ as a nihilistic violent extremist network; per Europol, known for recruitment/grooming of minors, coercion into violent acts, production of explicit content/CSAM, and blackmail/extortion.
Offshoot of The Com; leadership arrested/indicted in connection with child sexual abuse material distribution.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.