Loading threat actor…
764 is a decentralized online network associated with the grooming and coercion of minors across mainstream digital platforms. Reported activity centers on trust-based manipulation and coercive control rather than conventional intrusion, espionage, or ransomware operations. The network is characterized as an online ecosystem rather than a single tightly centralized group, with activity patterns emphasizing victim targeting, grooming architecture, and the use of interpersonal trust as a mechanism of exploitation. High-confidence reporting supports describing 764 as a threat network involved in systematic online exploitation of minors, but the currently available information does not establish a specific national sponsor, geographic origin, or a broader cyber intrusion tradecraft profile such as malware deployment, credential theft, or extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.