'The Com' Cyberattacks Support Violence & Sexploitation
This report details the activities of 'The Com,' a decentralized cybercriminal collective primarily composed of North American teenagers, many linked to groups like ShinyHunters, Lapsus$, and Scattered Spider. The group is involved in a wide range of malicious activities, including targeting cloud and SaaS platforms (Okta, Salesforce, Microsoft365), generating and distributing child sexual abuse material (CSAM), engaging in extortion, and carrying out physical attacks. The analysis highlights the interconnectedness of the group's various activities and the potential for radicalization among its members, emphasizing the broader societal cost of their crimes beyond just financial damage.
The Com is a highly organized, albeit diffuse, cybercriminal network with a disturbing focus on facilitating violence and exploitation. Primarily comprised of young, often radicalized individuals, the group operates across multiple domains, including hacking, extortion, and physical attacks. Their tactics involve targeting vulnerable cloud environments and SaaS platforms – specifically Okta, Salesforce, and Microsoft365 – to gain access and conduct further malicious activities. Flashpoint’s analysis reveals a concerning trend: The Com’s activities are directly linked to supporting more serious crimes, including the creation and distribution of CSAM, murder, and other violent acts. The group’s recruitment strategy, leveraging gaming communities and social media, combined with grooming and sextortion, creates a pathway for vulnerable individuals to become deeply involved in the criminal enterprise. Furthermore, the interconnectedness of the group’s various sub-units – IRL Com (physical attacks), Extortion Com (recruitment and manipulation), and Hacker Com (cybercrime) – creates a resilient and adaptable threat. The report underscores the need for increased vigilance and collaboration between law enforcement agencies to disrupt this network and mitigate its harmful impact.