Internet infamy drives The Com’s crime sprees

The Com doesn’t fit into a traditional definition of cybercrime. While the majority of groups tend to either be financially-motivated or working at the behest of a government, The Com’s chaotic, sprawling network, composed of mostly teenagers and young adults, are committing their crimes primarily for notoriety amongst their peers on the internet, Allison Nixon, chief research officer at Unit 221B, said Friday during a presentation at a cybersecurity conference.

The borderless, grassroots movement is now a “bottom-up social phenomenon,” Nixon said. At a presentation Friday at Sleuthcon, she compared the path members take to a sales funnel as recruits move from harassment to full-blown physical violence. 

The catalog of crimes attributed to The Com are vast, including social engineering, crypto theft, phishing, SIM swapping, extortion, sextortion, swatting, kidnapping and murder. The Justice Department last month arrested and charged two alleged leaders of the child sextortion group 764, of which members are affiliated with The Com, for directing and distributing child sexual abuse material.

In the last month, Unit 221B researchers tracked a series of swatting incidents, including multiple instances  in Henrico County, Virginia, to what they believe is a 14-year-old boy living in Manchester, England. 

Most of the kids initially attracted to The Com quit and the majority of active participants remain low risk, but the potential for criminal activity increases for those who spend more time communicating and interacting with the subculture. 

“A lot of the reason why people get involved in The Com, young kids, they’re making a rational financial decision,” Nixon said. “They realize that, given the current economic state of things, as an 18-year-old trying to get an entry-level job you’re going to make garbage money, you’re going to have 10 roommates. Or you can get into fraud, make way more money, and they think that it’s cooler, too.”

The demographics of The Com also skew young because gangs explicitly recruit children and are incentivized to do so since minors typically face less severe legal consequences, according to Nixon. 

“The people in The Com, they are not the stereotypical old-school hacker. They do not embody the hacker spirit as it is understood from the ‘80s, ‘90s, early 2000s,” Nixon said. “A lot of us in the industry make assumptions along those lines, but it’s just not true. The culture has changed so much that the current state of things is not recognizable.”

The most consequential pivot point for the criminal hacking underground culture occurred in 2018, as the number of people affiliated with The Com exploded in size after the value of Bitcoin surged twelve-fold the year prior, she said.

“It transformed the criminal underground from a scene of petty thieves,” Nixon said. “All these esoteric hacking techniques that they had suddenly became a vector for making a ton of money.”

The Com’s criminal activity was largely financially motivated until an era of violence and sextortion began in 2021, overtimes overlapping between sextortion and high-dollar fraud since then, according to Nixon.

More recently, the idolization associates or members bestow on people affiliated with The Com is “directly correlated with how much harm they can cause and how depraved their behavior can be,” she said. 

Unit 221B research indicates the individuals engaging in the most violent crimes number in the hundreds, or maybe a few thousand people among a much larger population of individuals associated with The Com. 

During a violence prevention conference in October, an FBI agent stressed that The Com’s activities are widespread across the United States with incidents occurring in every state and agents investigating crimes linked to The Com in every field office, CyberScoop reported in December.

“A lot of the more recent activity involves a lot of this very chaotic, self-described vigilante stuff,” which law enforcement appears to be treating as terrorism, prompting crackdowns and much faster turnaround times for arrests, Nixon said.

“There’s really not a lot of them. You can throw them in jail. I’m seeing the crackdowns. I think they’re very effective,” she added. “I look at the reactions from the groups, and they calm down after they understand that there’s consequences to behavior.”

Understanding the structure and motivations of The Com can facilitate a more effective response. “These are young people looking for a place to belong, looking for a place in the world,” Nixon said. 

“We need to think about — given these motivations — what is the career path for the average 18-year-old? Why does it suck so much to apply for a job?” she said. “All these difficulties that we all have in applying for jobs, kids experience that tenfold. So we need to think about the career path. We can cut down on the sheer numbers a lot.”

Most of The Com’s activity is hosted on websites that are independently owned and operated by criminals, but a lot of the content associates and their victims produce eventually pops up on commercial social media platforms.

“What’s actually happening here is a social phenomenon where children are willfully joining violent street gangs on the internet,” Nixon said. “That’s what we need to address.”