Full Report
For years I marked each anniversary of 9/11 with fresh analysis of how terrorism tactics and trends have been evolving, particularly recruitment, incitement and training in online spaces. Far from the days when al-Qaida would drop a videotape and hope that al-Jazeera would air their entire message, foreign terrorist organizations learned how to commandeer a…
Analysis Summary
# Threat Actor: The Com (The Community)
## Attribution & Identity
* **Actor Identification:** An international, primarily English-speaking online ecosystem described by the FBI as a collection of interconnected networks.
* **Aliases:** "The Community," "The Com," "Violent Com."
* **Known Associations:** Linked to various ransomware groups, extremist recruitment circles, and hacker collectives. Members are frequently minors or young adults ("terror-era youths").
## Activity Summary
The Com operates as a decentralized network engaged in high-harm digital and real-world criminal activities. Recent operations include large-scale extortion campaigns, "IRL" (in real life) violence for clout, and systemic swatting of critical infrastructure. The group is noted for evolving beyond traditional jihadi-style recruitment into a "nihilism-based" model that targets vulnerable individuals for exploitation and forced criminal acts.
## Tactics, Techniques & Procedures
* **Social Engineering:** Cultivating fake relationships with victims on gaming sites and social media to gain trust.
* **Doxing:** Releasing personally identifiable information (PII) on anonymous individuals, often for a cryptocurrency fee.
* **Swatting:** Making false reports to emergency services to trigger an armed police response to a specific location.
* **Extortion/Sextortion:** Using intimate photos, explicit videos, or PII to coerce victims into compliance.
* **Coerced Self-Harm:** Forcing victims to commit degrading acts, self-mutilation, or suicide on livestreams.
* **Incitement to Violence:** Requiring "IRL" acts (assault, property crime) as a prerequisite for group membership or "clout."
* **Psychological Operations:** Utilizing "ideology-lite" or nihilistic messaging to recruit rudderless youth.
*(Note: Specific MITRE ATT&CK IDs were not explicitly detailed in the text, but activities correspond to T1566 Phishing/Social Engineering and T1567 Exfiltration.)*
## Targeting
* **Sectors:** Education (schools), Healthcare (hospitals), Transportation (airports), Critical Infrastructure.
* **Geography:** International; specifically targets English-speaking regions (U.S., UK).
* **Victims:** Primarily minor females, often those with underlying mental health issues (e.g., depression).
## Tools & Infrastructure
* **Malware & Payloads:** Associated with various ransomware families (unnamed in text).
* **Communication Platforms:** Gaming platforms, social media, and encrypted messaging apps.
* **Payment Infrastructure:** Cryptocurrency (used for fees related to doxing and extortion).
* **Infrastructure:** Distributed C2 and decentralized online forums/networks.
## Implications
The Com represents a shift from traditional ideological terrorism to a decentralized, nihilistic form of violent extremism. The "gamification" of violence and the recruitment of minors create a high-risk environment where digital harassment translates directly into physical harm or death. Because the group lacks a centralized political motive, traditional counter-terrorism strategies may be less effective, as the primary driver is "clout" and societal disruption.
## Mitigations
* **Public Awareness:** Educating minors and parents about the risks of online grooming on gaming and social platforms.
* **Cyber Hygiene:** Encouraging the use of privacy settings to prevent doxing and the leakage of PII.
* **Law Enforcement Coordination:** Rapid reporting of swatting threats to local authorities to prevent unnecessary tactical deployments.
* **Mental Health Support:** Providing resources for vulnerable youth who are targeted due to depression or isolation.
* **Monitoring:** Enhanced monitoring of "clout-based" online communities by intelligence and law enforcement agencies (FBI/IC3).