Full Report
Stop the spread (of online recruiting and propaganda)
Analysis Summary
# Incident Report: Europol Crackdown on "The Com" Online Extremist Network
## Executive Summary
Law enforcement agencies led by Europol conducted a series of Referral Action Days in June and July 2026 to disrupt "The Com," a decentralized online network of youth-oriented extremist groups. The operation resulted in the flagging of 4,340 URLs for removal, targeting violent propaganda, recruitment manuals, and digital extortion materials. This action is part of the broader "Project Compass," an international effort to mitigate the transition of online nihilistic behavior into real-world violence, including swatting, arson, and physical assault.
## Incident Details
- **Discovery Date:** Ongoing (Project Compass began in 2025)
- **Incident Date:** Flagging operations occurred June – July 2026
- **Affected Organization:** Various social media, gaming, and messaging platforms
- **Sector:** Technology / Social Media / Public Safety
- **Geography:** Global (Primarily US, UK, and EU member states)
## Timeline of Events
### Initial Access
- **Date/Time:** 2025 – July 2024 (Operational window)
- **Vector:** Social media, gaming platforms, and messaging apps.
- **Details:** "The Com" members utilize mainstream and fringe digital platforms to recruit minors and vulnerable individuals through shared nihilistic content and gamified violence.
### Lateral Movement
- **Process:** Transition from online interaction to "In Real Life" (IRL) coordination. Members move from public social media to private messaging encrypted channels to plan physical crimes.
### Data Exfiltration/Impact
- **Impact:** Dissemination of 4,340 "horrific" URLs containing CSAM, animal cruelty, self-harm, and manuals for violence.
- **Data/Privacy:** Extensive use of "doxxing" (releasing private information) and "swatting" to harass targets.
### Detection & Response
- **Detection:** FBI and UK National Crime Agency (NCA) identified an increase in "violence-as-a-service" solicitations in 2025.
- **Response:** Europol’s European Counter Terrorism Centre (ECTC) launched Referral Action Days to force the removal of illegal content by platform providers.
## Attack Methodology
- **Initial Access:** Grooming on gaming platforms and social media.
- **Persistence:** Maintaining presence through decentralized sub-groups (loosely knit network).
- **Privilege Escalation:** Status-seeking within the community; individuals gain "rank" by producing more extreme/harmful content.
- **Defense Evasion:** Use of encrypted messaging apps and aliases.
- **Credential Access:** Cyber fraud and hacking techniques used to compromise accounts.
- **Discovery:** Doxxing victims to gather intelligence for physical attacks.
- **Lateral Movement:** Shifting from digital harassment to real-world "In Real Life" (IRL) violence (arson, stabbings).
- **Collection:** Gathering sensitive personal data for extortion purposes.
- **Exfiltration:** Livestreaming violent acts to social media "bystanders."
- **Impact:** Physical injury, psychological trauma, and property damage via swatting/arson.
## Impact Assessment
- **Financial:** Costs associated with emergency response to swatting calls and cyber fraud/ransomware losses.
- **Data Breach:** Exposure of victim PII (Personally Identifiable Information) via doxxing.
- **Operational:** Disruption of law enforcement resources through false emergency reports.
- **Reputational:** Harm to social media and gaming platforms used as staging grounds for extremist recruitment.
## Indicators of Compromise
- **Network Indicators:** URLs hosted on various social media and gaming domains (defanged: hxxps[:]//[various_platforms]/[path_to_propaganda]).
- **File Indicators:** Manuals providing instructions on grooming, extortion, and physical assault.
- **Behavioral Indicators:** Imagery of "blood walls" (aliases painted in blood) and "cut-signs" (victim self-harm depicting extorter aliases).
## Response Actions
- **Containment:** Flagging 4,340 URLs for immediate removal to stop the spread of recruitment material.
- **Eradication:** Coordination between nine EU countries, the US, and the UK to identify and arrest key facilitators.
- **Recovery:** Public awareness alerts by the FBI and NCA to warn parents and vulnerable minors.
## Lessons Learned
- **Key Takeaways:** Online "nihilistic" communities are increasingly bridging the gap between digital harassment and organized physical violence.
- **What could have been done better:** Earlier identification of "violence-as-a-service" models could have prevented the escalation of IRL attacks reported in early 2025.
## Recommendations
- **Platform Monitoring:** Gaming and messaging platforms should implement stricter moderation for behavioral indicators like "swatting" solicitations.
- **Cross-Border Cooperation:** Continued support for Europol’s Project Compass to ensure international law enforcement can track decentralized networks.
- **Public Education:** Targeted awareness campaigns for minors regarding the dangers of status-seeking in extremist online subgroups.