Loading threat actor…
IRL Com (In Real Life Com) is a subset of The Com, a primarily English-speaking international online criminal ecosystem that includes many minors. Originating in the SIM-swapping community, IRL Com comprises groups that market violence as a service and use real-world violence or its threat to harass, intimidate, retaliate against, and discipline targets. Its advertised services have included shootings, kidnappings, armed robbery, stabbings, physical assaults, bricking, and swatting-for-hire. Online disputes within the broader community have escalated into offline violence, while IRL Com’s violence-for-hire activity has developed into a distinct criminal market. Participants use social-media and communications platforms to advertise and recruit for paid violent acts, often seek to conceal their identities, and may accept cryptocurrency payments. Swatting and doxing are used for profit, status, retaliation, and internal coercion; members and their families may be targeted following disobedience or refusal of demands.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sub-community of The Com that provides paid physical violence services. Its violence-for-hire capability is cited as why Russian intelligence recruitment through The Com is plausible.
A sub-community of The Com that offers violence-for-hire services, frequently to resolve internal member conflicts. This ecosystem is assessed as a plausible recruitment pool for Russia-linked sabotage activity.
Subset of The Com that evolved from the SIM swapping community and is associated with violence-as-a-service, swatting-for-hire, intimidation, and retaliation tied to online conflicts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.