# The Com: Analyzing the Intersection of Cybercrime and Physical Violence

> Analysis of The Com, a criminal ecosystem using social engineering and SIM swapping to fund violent activities, sextortion, and neo-Nazi accelerationism.

- Published: 2026-05-29T13:20:49.000Z
- Severity: high
- Category: Threat Intel
- Tags: The Com, Social Engineering, Scattered Spider, Extortion, Physical Security
- Author: Runtime Rebel Intel
- Primary source: https://www.darkreading.com/threat-intelligence/the-com-cyberattacks-violence-sexploitation
- Canonical: https://runtimerebel.com/blog/the-com-analyzing-the-intersection-of-cybercrime-and-physical-violence

## Key points

- Immediate impact: Loosely affiliated threat actors within The Com ecosystem use digital extortion proceeds to fund real-world violence and physical harm.
- Affected systems: Help desks and identity providers are the primary targets for social engineering attacks used to gain initial network access.
- Remediation: Security teams must transition to phishing-resistant hardware MFA and implement strict out-of-band verification for all identity-related help desk requests.

The emergence of 'The Com' represents a significant shift in the cyber threat landscape, where the boundaries between digital exploitation and physical violence have become increasingly blurred. According to [Dark Reading](https://www.darkreading.com/threat-intelligence/the-com-cyberattacks-violence-sexploitation), this decentralized criminal ecosystem is not a single entity but a sprawling network of individuals and subgroups, many of whom are younger operators utilizing platforms like Telegram and Discord to coordinate high-impact breaches. Unlike traditional [APT](/glossary#apt) groups motivated by espionage or financial gain alone, participants in The Com often engage in 'clapping'—a term for physical violence for hire—and 'swatting' to intimidate victims or rivals.

## The Com Criminal Ecosystem Threat Analysis

The infrastructure of The Com is built on collaboration. It serves as a marketplace and social hub where various [TTP](/glossary#ttp) sets are exchanged, specifically focusing on the exploitation of human vulnerabilities. Many of the groups associated with this ecosystem, such as [Scattered Spider](https://en.wikipedia.org/wiki/Scattered_Spider) and [Lapsus$](https://en.wikipedia.org/wiki/Lapsus$), have demonstrated an advanced capability to penetrate large enterprise environments through sophisticated [Phishing](/glossary#phishing) and social engineering campaigns. 

What distinguishes this ecosystem is its ideological underpinnings. A significant portion of the community is reportedly infested with neo-Nazi or accelerationist ideologies. The revenue generated from enterprise [Ransomware](/glossary#ransomware) attacks and data theft is frequently diverted to fund violent activities, sexploitation, and the recruitment of minors into criminal operations. This convergence of cybercrime and physical threat means that a security failure within an organization does not only result in data loss but can directly contribute to the funding of violent extremist activities.

### Detecting and Preventing The Com Social Engineering Attacks

To effectively defend against these actors, organizations must understand their primary method of entry: the human element. These attackers are experts at manipulating help desk personnel to reset passwords or bypass multi-factor authentication (MFA). They often perform extensive reconnaissance on employees to make their impersonation attempts more convincing. Implementing [SIM swapping protection for enterprises](https://www.darkreading.com/threat-intelligence/the-com-cyberattacks-violence-sexploitation) is a critical step in mitigating the risk of account takeover via mobile service providers.

Technically, defenders should prioritize the following to learn **how to detect The Com social engineering attacks**:

*   **Monitor for unusual login patterns:** Look for successful logins that bypass established MFA policies or originate from suspicious IP ranges associated with known proxy services.
*   **Analyze help desk logs:** Identify accounts that have requested multiple password resets or MFA device additions within a short timeframe.
*   **Audit SIM change events:** For executives and high-value targets, monitor for unauthorized SIM swaps or port-out requests through carrier-level security features.

## Actionable Recommendations for Defenders

Addressing the risks posed by The Com requires a shift in how the [SOC](/glossary#soc) views identity security. It is no longer sufficient to rely on SMS-based or push-notification MFA, as these are easily bypassed through SIM swapping or fatigue attacks. Instead, a [Zero Trust](/glossary#zero-trust) architecture should be adopted, emphasizing the following mitigations:

1.  **Phishing-Resistant MFA:** Deploy hardware security keys (e.g., FIDO2/WebAuthn) for all employees to eliminate the effectiveness of credential harvesting.
2.  **Strict Identity Verification:** Establish a secondary, out-of-band verification process for all help desk tickets involving identity changes. This could include a video call or a pre-shared physical token.
3.  **Threat Intelligence Integration:** Actively monitor underground forums and Telegram channels associated with The Com to identify mentions of your organization or employees.
4.  **Employee Resilience Training:** Conduct specialized training for help desk staff on the specific social engineering tactics used by Gen Z and Gen Alpha threat actors, focusing on their high-pressure, manipulative conversational styles.

**Related:** [Scattered Spider Member Tylerb Pleads Guilty: Smishing Analysis](/blog/scattered-spider-member-tylerb-pleads-guilty-smishing-analysis), [Silent Ransom Group Targets Law Firms via Physical Social Engineering](/blog/silent-ransom-group-targets-law-firms-via-physical-social-engineering)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/the-com-analyzing-the-intersection-of-cybercrime-and-physical-violence