A sprawling network of mostly young, English-speaking cybercriminals known as “the Com” is responsible for a broad range of illicit activities, from hacking major retailers to extorting vulnerable children online. This loosely affiliated criminal ecosystem comprises thousands of individuals, with members ranging from 11-year-olds attempting to breach Minecraft servers to individuals in their mid-20s targeting young people.
The Com’s activities include ransomware attacks that cripple corporate IT systems, data theft, cryptocurrency scams, and the exploitation of minors. One of its latest victims is PornHub, where a group called ShinyHunter has hacked premium users’ search histories and viewing habits.
The Com is split into three main subsets: the Hacker Com, which includes groups like ShinyHunter, Scattered Spider, and Lapsus$; the IRL (In Real Life) Com, linked to “swatting” and bomb threats; and the Extortion Com, which coerces and blackmails children into sharing self-harm or sexually explicit content.
According to Aiden Sinnott, a principal threat researcher at the cybersecurity firm Sophos, the Com operates like a “pipeline,” with older members grooming younger recruits to carry out increasingly sophisticated and damaging cybercrimes. Members communicate on platforms like Discord and Telegram, sometimes exchanging extreme imagery or boasting about their activities.
The Com is well known to law enforcement on both sides of the Atlantic. In July, the FBI issued a public warning about the group, describing it as a “primarily English-speaking, international, online ecosystem” whose members, many of whom are minors, engage in a variety of criminal violations. The UK’s National Crime Agency has reported a six-fold increase in reports of Com networks in the UK from 2022 to 2024.
The Com is a fluid and growing threat, with members motivated by a range of factors, including status, power, control, misogyny, sexual gratification, and an obsession with extreme or violent material. Tackling this sophisticated cybercrime network will require a coordinated international effort by law enforcement and the private sector.
