# SLSH Extortion Group - Swatting and Executive Harassment Tactics

> SLSH is an extortion group operating within 'The Com' — a distributed cybercriminal social network spanning Telegram and Discord — that combines traditional cyber intrusion techniques (SIM swapping, social engineering, credential theft) with real-world physical intimidation tactics including swatting, executive harassment, physical surveillance, and threats of violence to coerce ransom payments from corporate victims. SLSH represents the convergence of cybercrime and physical violence ('Violence as a Service'), where data breaches are weaponized not just for financial extortion but as leverage for swatting campaigns against corporate executives, board members, and their families. The group operates alongside and overlaps with other Com groups including Scattered Spider (ALPHV/BlackCat affiliate, MGM hack), LAPSUS$, Beige Group, ViLE, and UNC5537 (Snowflake breaches). Tactics include: breaching corporate networks via social engineering and vishing, stealing sensitive data, demanding ransom, and when payment is refused, escalating to swatting attacks (fake hostage/bomb threats to executives' home addresses), doxing executives' families, sending physical threats, and in extreme cases commissioning real-world violence. FBI and international law enforcement have documented multiple arrests related to these groups, but the decentralized nature of The Com makes permanent disruption difficult.

- **Published:** 2026-02-03T00:55:00Z
- **Last reviewed:** 2026-02-03T00:55:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0035
- **ID:** TL-2026-0035
- **Severity:** HIGH (CVSS 8.5)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Scattered Lapsus ShinyHunters (United States)
- **Detections:** 6 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SLSH operates at the intersection of cybercrime and physical violence — a disturbing evolution in the threat landscape where digital attacks are amplified by real-world intimidation.

**The Com Ecosystem:**

The Com is a loosely organized archipelago of crime-focused chat communities across Telegram and Discord that functions as a distributed cybercriminal social network. Key characteristics:
- Members are predominantly young, Western (US/UK/Canada/Australia), English-speaking
- Facilitates instant collaboration between different criminal cliques
- Status-driven: members constantly compete over exploits, stolen cryptocurrency holdings
- Disputes frequently escalate to physical violence (assaults, firebombings, kidnapping)
- Overlapping membership between cybercrime groups and harm/extortion communities
- Groups include: Scattered Spider, LAPSUS$, Beige Group, ViLE, 764, CVLT, Court, Leak Society

**SLSH Extortion Methodology:**

1. **Initial Breach**: Social engineering (vishing — voice phishing of corporate helpdesks), SIM swapping (hijacking employee phone numbers to intercept MFA), credential purchase from darknet markets, targeting cloud services with weak authentication (Snowflake-style attacks)

2. **Data Theft**: Once inside corporate networks, exfiltrate sensitive data including customer PII, financial records, executive communications, board meeting minutes, M&A data

3. **Initial Extortion Demand**: Contact victim organization privately demanding cryptocurrency ransom in exchange for not leaking/selling stolen data

4. **Escalation — Executive Targeting**: When organizations refuse to pay or involve law enforcement:
   - **Swatting**: File false police reports (bomb threats, hostage situations, active shooter) at executives' home addresses, triggering armed police response. Has caused deaths (60-year-old grandfather killed in 2020 swatting incident)
   - **Doxing**: Publish executives' home addresses, family members' information, children's schools, daily routines on criminal forums
   - **Physical Threats**: Send threatening letters, packages, or hire individuals for physical confrontation ('brickings, firebombings, shootings for hire')
   - **Harassment Campaigns**: Flood executives' phones with calls, send messages to family members, post on social media
   - **AI-Generated Harassment**: Use AI to create fake nude photos of targets (documented by Mandiant in Snowflake investigation), deepfake audio for impersonation

5. **Monetization**: Sell stolen data on cybercrime forums regardless of ransom payment, trade access to compromised networks, sell doxing services on removal-for-payment forums

**Connection to Major Incidents:**

- **MGM Resorts (2023)**: Scattered Spider (Com member 'Holy'/Vsphere) social engineered MGM helpdesk, partnered with ALPHV/BlackCat ransomware. The 17-year-old British attacker was also active in harm communities targeting children.
- **Snowflake Breaches (2024)**: UNC5537 (including Com member 'Judische'/Waifu) stole data from 160+ organizations including AT&T (110M records), TicketMaster, Santander. Made death threats against Mandiant researchers, created AI-generated fake nude photos to harass investigators.
- **T-Mobile (2021)**: Beige Group member John Erin Binns breached T-Mobile (76.6M customers). Currently in Turkish prison fighting extradition.
- **GoDaddy (2020)**: Beige Group tricked employee into installing malware, redirected crypto platform traffic.
- **ViLE (2024)**: Members hacked DEA portal accessing 16 federal databases, used fraudulent emergency data requests to dox targets, operated pay-to-remove doxing forum.

**The Violence Escalation:**

KrebsOnSecurity documented 'Violence as a Service' — cybercriminals hiring people to carry out physical attacks on rivals and targets:
- Firing handguns into homes
- Molotov cocktail attacks on residences
- Kidnapping and physical assault (crypto mugging)
- Swatting resulting in death
- Coerced self-harm in minors

This represents a fundamental shift in the threat model: cybersecurity incidents now carry physical safety risks for executives and their families.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1204 User Execution
- T1098 Account Manipulation
- T1621 Multi-Factor Authentication Request Generation
- T1557 Adversary-in-the-Middle
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1657 Financial Theft
- T1486 Data Encrypted for Impact
- T1596 Search Open Technical Databases

## Sources

- [KrebsOnSecurity — The Dark Nexus Between Harm Groups and The Com](https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/)
- [KrebsOnSecurity — Violence as a Service](https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/)
- [Wired — Inside the Com Child Predator Networks](https://www.wired.com/story/764-com-child-predator-network/)
- [DOJ — ViLE Members Plead Guilty to DEA Portal Hack](https://www.justice.gov/usao-edny/pr/two-men-plead-guilty-computer-intrusion-and-aggravated-identity-theft-hacking-federal)
- [CrowdStrike — Scattered Spider Profile](https://www.crowdstrike.com/adversaries/scattered-spider/)
- [Mandiant — UNC5537 Snowflake Data Theft](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion)
- [RCMP — Warning About Violent Online Groups Targeting Youth](https://www.rcmp-grc.gc.ca/en/news/2024/rcmp-reminds-canadians-violent-online-groups-targeting-youth)
- [West Midlands Police — MGM Hack Arrest](https://www.westmidlands.police.uk/news/west-midlands/news/news/2024/july/walsall-teenager-arrested-in-joint-west-midlands-police-and-fbi-operation/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0035