Loading threat actor…
8884 is a splinter group of the nihilistic violent extremist network 764 and has been linked to the online sexual exploitation, grooming, coercion, and extortion of minors. Publicly identified activity ties the group to administrators and members who blackmailed victims into producing child sexual abuse material, self-harm content, degrading acts on camera, and other violent abuse. Reporting also links the broader 764 ecosystem, including affiliated offshoots such as 8884, to coercive online communities associated with the Com. Known 8884 activity reflects a pattern of targeting vulnerable children through online platforms, using manipulation, threats, and extortion to force compliance and to pressure some victims into recruiting or coercing additional victims. In documented cases associated with 8884 leadership, victims were compelled to engage in self-mutilation, animal abuse, and other acts of extreme degradation for recording or live viewing. The group’s behavior aligns with cyber-enabled exploitation operations centered on grooming, coercion, and the production and distribution of abusive material rather than traditional financially motivated intrusion activity. 8884 is best understood as part of the wider 764 milieu rather than as an independent state-backed actor. A publicly identified leader associated with 8884 used the aliases Zack and Zack8884. High-confidence reporting supports 8884’s role as an online extremist exploitation cell involved in child sexual abuse, extortion, and violent coercion of minors in the United States.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An offshoot of 764 involved in child sexual exploitation, coercion, sextortion, and abuse of minors.
A splinter group of 764; described as involved in crimes related to sexual exploitation of children (CSAM-related activity) under the direction/administration of identified individuals.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.