The Com: Cybercrime Subculture Linking DDoS, Violence, and Child Exploitation

The Com (short for "The Community") is a decentralized, globally active cybercrime subculture primarily composed of English-speaking actors aged 11 to 25, operating through Discord servers, Telegram groups, and private forums, that the FBI and Europol have identified as a rising threat combining conventional cybercrime with real-world violence and child sexual exploitation. A recent Europol-led crackdown resulted in 30 arrests across multiple countries. The group's structure — three specialized factions with fluid membership and no central leadership — makes it uniquely difficult to disrupt and has allowed it to escalate from DDoS attacks to contract violence with alarming speed.

// 01 The Com: Technical and Structural Details

The Com does not resemble a traditional organized crime syndicate with a hierarchy and formal membership. It is better described as a subculture — a network of loosely affiliated individuals who recruit each other online, share techniques, compete for status through escalating criminal acts, and organize into temporary working groups for specific operations.

Europol describes The Com as a "decentralized nihilistic extremist network" — a characterization that captures its defining feature: members are motivated primarily by status, notoriety, and a warped sense of achievement rather than purely financial gain. Criminal acts are documented, shared, and rated within the community, creating a gamified incentive structure that rewards escalation.

The group operates through three specialized factions, each with distinct capabilities and target sets:

Hacker Com focuses on conventional cybercrime:

• DDoS (Distributed Denial of Service) attacks against businesses, games, and individuals
• Data breaches targeting corporate and government systems
• SIM swapping (convincing phone carriers to transfer a victim's phone number to an attacker-controlled SIM, defeating SMS-based MFA)
• Phishing campaigns and spearphishing
• Sale of government employee email accounts on criminal forums

IRL Com (IRL = "In Real Life") bridges the digital and physical worlds:

• Swatting (making false emergency reports — typically of an active shooting or hostage situation — to send armed police to a victim's address, with risk of lethal force)
• Doxing (publishing personal information including home addresses, family members' names, and workplace details)
• Physical violence for hire, with documented price lists for shootings, stabbings, kidnappings, armed robberies, and physical assaults
• Using violence and swatting to discipline or punish members who violate group norms

Extortion Com targets minors:

• Sextortion (coercing victims into producing sexual images under threat of exposure)
• Targeting victims as young as nine years old, according to the FBI
• Production and distribution of Child Sexual Abuse Material (CSAM)
• Coordinated harassment and doxing of victims who refuse to comply

// 02 Exploitation Status and Threat Landscape

The FBI issued a public service announcement (PSA) warning about The Com's activities, specifically highlighting that the group uses cybercriminal tactics to execute and facilitate violent crimes — a convergence that traditional cybercrime frameworks are not designed to address. The FBI's Internet Crime Complaint Center (IC3) has documented thousands of individual participants, most aged 11 to 25, making this one of the youngest threat actor populations tracked by a major law enforcement agency.

Europol led an international crackdown that resulted in 30 arrests across multiple countries, but given the group's decentralized structure and the anonymous communication platforms it uses, arrests have limited long-term disruptive effect. New members are continuously recruited, often through gaming communities and social media, where the group presents a glamorized image of criminal success.

The FBI has identified specific concerns about The Com's intersection with violent extremism: some IRL Com subsets hold nihilistic or anarchist ideologies that extend beyond financial motivation into politically or racially motivated violence. The group's willingness to target members' own families as a control mechanism — swatting relatives of disobedient members — represents a level of internal coercion unusual even in organized criminal networks.

Notable incidents attributed to The Com's various factions include corporate data breaches, harassment campaigns against journalists and streamers, and swatting incidents that have resulted in physical injuries and, in documented cases, death.

// 03 Who Is Affected

Youth and minors face the highest risk of direct harm through Extortion Com's sextortion and CSAM-production schemes. The FBI's documentation of victims as young as nine years old reflects the group's willingness to target children with no digital literacy or capacity to resist coercion.

Enterprise organizations are targeted by Hacker Com for data breaches, DDoS attacks, and credential theft. The Com has been linked to high-profile corporate breaches attributed to the broader "Scattered Spider" ecosystem (Scattered Spider, also known as UNC3944, is a threat actor group with overlapping membership and techniques).

Individuals — particularly streamers, gamers, journalists, and activists — are targeted for swatting, doxing, and harassment. Swatting carries a documented risk of injury or death as armed police respond to false reports.

Government and public sector organizations have been targeted through the sale of government employee email accounts obtained through phishing, enabling impersonation and further attacks.

// 04 What You Should Do Right Now

• Parents and educators: educate young people about The Com's recruitment tactics. The group actively targets gaming communities and social media, offering status and belonging in exchange for criminal participation. Recognize warning signs including discussion of swatting, doxing, or "the community" as something aspirational.
• Report incidents immediately: swatting and sextortion targeting minors should be reported to the FBI's IC3 (ic3.gov), the National Center for Missing and Exploited Children (NCMEC), and local law enforcement simultaneously. Do not pay sextortion demands — payment does not stop harassment.
• Enterprise security teams: monitor for The Com-affiliated TTPs including SIM swapping against executives (contact your mobile carrier to add a SIM lock or port freeze), DDoS preparation signatures, and social engineering attempts targeting help desk staff.
• Individuals at risk: remove personal information from data broker sites, lock social media accounts, and inform local law enforcement of any threats before an incident escalates to swatting.
• Platform trust and safety teams: The Com uses Discord and Telegram for recruitment and coordination. Both platforms have moderation tools and law enforcement cooperation channels. Report The Com-affiliated servers through official abuse processes.

// 05 Background: Understanding the Risk

The Com represents a criminological pattern that predates the internet — youth subcultures organized around transgression, status competition, and escalating deviance — translated into the networked age with unprecedented reach and capability. The key insight from FBI and Europol reporting is that The Com is not primarily an ideological extremist group or a financially rational criminal enterprise: it is a social phenomenon where criminal escalation is the metric of status.

This distinction matters for law enforcement strategy. Traditional cybercrime enforcement targets financial motive — seize proceeds, arrest organizers, disrupt infrastructure. But members of The Com who are motivated by status and notoriety may not be deterred by financial consequences alone. Arrest of individual members may even enhance their standing within the community.

The intersection of cybercrime and physical violence is the characteristic that elevates The Com from a conventional threat actor to a serious public safety concern. Swatting — which The Com uses both as an attack on victims and as internal discipline — has resulted in deaths. The 2017 death of Andrew Finch in Wichita, Kansas, who was shot by police responding to a false emergency report, illustrated the lethal potential of swatting before The Com existed in its current form. The com's documented price lists for physical violence against named targets represent a service model that bridges cybercrime and contract violence in a way that law enforcement frameworks struggle to address comprehensively.

The Europol crackdown and 30 arrests are a meaningful but ultimately insufficient response to a group of this structure. Sustainable disruption requires platform-level intervention, youth-focused prevention programs, and international cooperation on both law enforcement and digital platform accountability.

// 06 Conclusion

The Com is a decentralized cybercrime subculture — thousands of mostly young participants organized into three factions spanning DDoS attacks and data breaches (Hacker Com), real-world swatting and contract violence (IRL Com), and child sexual exploitation (Extortion Com). Europol's 30 arrests represent progress, but the group's structure and youth composition make sustained disruption difficult. The most immediate priorities are protecting minors from sextortion recruitment, enabling enterprises to defend against SIM-swap and DDoS attacks, and supporting individuals who receive swatting or doxing threats with a coordinated law enforcement response before physical harm occurs.