Threat reportThreat IntelligenceTL-2026-1734
Europol Project COMPASS Disrupts "The Com" Network Turning Teen Hackers Into Extortionists and Violent Offenders
Europol Project COMPASS Disrupts "The Com" Network Turning (TL-2026-1734), also tracked as Project COMPASS, is a high-severity tracked intrusion set, first published 2026-07-28. It is attributed to The Com with high confidence, affects Retail Marks & Spencer, maps to 38 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 38MITRE ATT&CK
- Actors
- 2The Com
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1734
- Threat ID
- TL-2026-1734
- Also known as
- Project COMPASS, The Com, The Community, 764
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- The Com, Cyber Com
- Attribution confidence
- HIGH
- Motivation
- DESTRUCTION
- Target sectors
- retail, hospitality, gaming, transport, technology, socialmedia, education
- Target regions
- North America, united kingdom, Europe, Oceania
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Europol Project COMPASS Disrupts "The Com" Network Turning
Malware and tooling: BlackCat/ALPHV, DragonForce, RansomHub - S1212, SystemBC - S9001, AnyDesk, Cobalt Strike, ConnectWise ScreenConnect, Impacket - S0357, LaZagne - S0349, Mimikatz, ngrok - S0508
How Europol Project COMPASS Disrupts "The Com" Network Turning works
Europol-led Project COMPASS, run with 28-29 partner countries including all Five Eyes members, has disrupted "The Com", a decentralized online ecosystem whose subgroups (Cyber Com, (S)extortion/Extortion Com, Offline Com/In Real Life Com, and the especially notorious 764) funnel minors into network intrusions, ransomware deployment, sexual exploitation/(s)extortion, and offline violence. The network's cyber-intrusion wing overlaps with the financially motivated collective Scattered Spider (Octo Tempest/UNC3944), whose DragonForce-ransomware attacks on Marks & Spencer, Co-op, and Harrods, and earlier BlackCat/ALPHV attacks on MGM Resorts and Caesars Entertainment, are among the highest-profile incidents linked to Com-recruited actors.
Project COMPASS is a year-long, Europol-coordinated law-enforcement initiative (launched January 2025 by Europol's European Counter Terrorism Centre) targeting "The Com" (also called "The Community"), a loose, decentralized web of online subgroups rather than a single hierarchical organization. The Com operates across Discord, Telegram, Twitch, TikTok, YouTube, and gaming platforms such as Minecraft, using grooming and coercion to funnel minors and other vulnerable individuals into three broad, overlapping activity streams: Cyber Com (network intrusions, credential theft, ransomware deployment, and disruption of online services), (S)extortion Com / Extortion Com (coercing minors into producing CSAM, self-harm, and suicide content), and Offline Com / In Real Life Com (encouraging property damage and physical violence aligned with an accelerationist, nihilistic-violent-extremist worldview).
764, active since 2020-2021 and founded by Bradley Chance Cadenhead (alias 'Felix'/'Brad764') in Stephenville, Texas, is identified as one of the network's most notorious communities. Two of its subsequent leaders, Leonidas Varagiannis ('War') and Prasan Nepal ('Trippy'), were indicted in April 2025 for operating a global child-exploitation enterprise, including an invite-only sub-cell dubbed '764 Inferno', directing victims to commit self-harm and produce escalating abusive content used for blackmail.
The Cyber Com wing overlaps in industry and law-enforcement reporting with Scattered Spider (MITRE ATT&CK group G1015; aka Octo Tempest, UNC3944, Roasted 0ktapus, Storm-0875, Muddled Libra) — a native-English-speaking, largely teen/young-adult cybercriminal collective active since at least 2022 that recruits from The Com/The Community. Scattered Spider relies on social engineering (SIM swapping, MFA-fatigue/push-bombing, and help-desk-impersonation vishing) to bypass identity controls in Okta, AWS, and Microsoft 365 environments, then pivots to Active Directory credential theft, cloud-service abuse, and ransomware deployment. In 2025 Scattered Spider-linked actors adopted DragonForce ransomware — a group that pivoted from pro-Palestine hacktivism (est. August 2023) into a ransomware-as-a-service cartel operating the white-label 'RansomBay' affiliate program (80/20 revenue split) and reportedly absorbing RansomHub infrastructure. DragonForce-affiliated intrusions detonated against Marks & Spencer (initial access February 2025, encryptor deployed 24 April 2025 after months of Active Directory reconnaissance) and were claimed against Co-op and Harrods in May 2025. Earlier, BlackCat/ALPHV ransomware tied to Scattered Spider hit MGM Resorts and Caesars Entertainment in the September 2023 Las Vegas casino breaches, and in 2025 UK teenagers Thalha Jubair and Owen Flowers were charged by the National Crime Agency over the Transport for London (TfL) intrusion.
As of the most recent reporting, Project COMPASS has produced 303 arrests, 4 victims directly safeguarded, 626 identified/partially-identified victims, 179 identified/partially-identified perpetrators, and 9 joint awareness-raising activities, building on earlier February 2026 figures of 30 arrests, 179 identified suspects, and 62 identified victims. A coordinated nine-country referral action (Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, Sweden) flagged 4,340 URLs linked to The Com for platform takedown. No CVE/CVSS applies — this is a threat-actor/network disruption story, not a vulnerability disclosure — but the Cyber Com/Scattered Spider/DragonForce wing represents an actively exploited, ongoing intrusion and ransomware threat to enterprises, while 764 and its peers represent an active, ongoing child-safety and violent-extremism threat.
MITRE ATT&CK techniques used in TL-2026-1734
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores; T1621 Multi-Factor Authentication Request Generation
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1538 Cloud Service Dashboard
Lateral Movement
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1484 Domain or Tenant Policy Modification
Defense Evasion
T1070 Indicator Removal; T1564 Hide Artifacts
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing
Persistence
T1098 Account Manipulation; T1136 Create Account
Command and Control
T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft
credential-access
T1539 Steal Web Session Cookie
defense-impairment
T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Affected products and versions in Europol Project COMPASS Disrupts "The Com" Network Turning
- Retail — Marks & Spencer
Vulnerable versions: Corporate Active Directory environment; intrusion window February-April 2025 - Retail — Co-op
Vulnerable versions: Corporate network compromised, claimed May 2025 - Retail/Luxury — Harrods
Vulnerable versions: Corporate network compromised, claimed May 2025 - Hospitality/Gaming — MGM Resorts
Vulnerable versions: Corporate/casino IT systems breached September 2023 - Hospitality/Gaming — Caesars Entertainment
Vulnerable versions: Corporate IT systems breached September 2023 - Transportation — Transport for London (TfL)
Vulnerable versions: IT systems compromised 2024; suspects charged September 2025
Remediation for Europol Project COMPASS Disrupts "The Com" Network Turning
Patches
- Apply vendor patches for SimpleHelp RMM vulnerabilities exploited by DragonForce affiliates
- Apply patches for Ivanti Connect Secure and Log4Shell-class vulnerabilities used as initial-access vectors by DragonForce-affiliated actors
Immediate actions
- Require phishing-resistant MFA (FIDO2 security keys or authenticator apps, not SMS/voice OTP) for all privileged and help-desk-facing accounts
- Enforce strict identity verification for help-desk password/MFA reset requests beyond knowledge-based questions (callback to a pre-registered number, manager attestation, video verification)
- Restrict, allow-list, and log remote-monitoring/remote-access tool usage (AnyDesk, TeamViewer, ConnectWise ScreenConnect); alert on unapproved RMM installs
- Block or tightly monitor outbound tunneling utilities (ngrok) and unsanctioned file-hosting/exfiltration endpoints (MEGA, WebDAV)
- Patch internet-facing remote-access and VPN infrastructure (SimpleHelp, Ivanti Connect Secure, Log4Shell-affected services) immediately upon vendor advisory
Workarounds
- Disable legacy SMS/voice-call MFA fallback where phishing-resistant MFA cannot yet be enforced
- Educate families/guardians and minors on 764/Com grooming red flags: privacy insistence, unexplained device anxiety, sudden new accounts, cryptic emoji-laden conversations
Longer-term hardening
- Deploy EDR/XDR with behavioral detection tuned to Living-off-the-Land abuse of PowerShell, WMI, and credential-dumping tools (Mimikatz, Impacket, LaZagne)
- Segment and monitor Active Directory / NTDS access paths; alert on DCSync-style replication requests from non-DC hosts
- Establish non-judgmental internal reporting channels for employees facing personal coercion, doxing, or sextortion threats that could be leveraged for corporate access
- Fund platform trust-and-safety teams (gaming, messaging, social media) trained to recognize grooming and coercion patterns, with rapid escalation for suspected CSAM/self-harm content
- Participate in cross-industry/law-enforcement intelligence sharing (Europol, FBI, NCA) on Com-linked infrastructure and personas
Timeline of Europol Project COMPASS Disrupts "The Com" Network Turning
- Bradley Chance Cadenhead (alias 'Felix'/'Brad764'), then 15 years old, founds the 764 network in Stephenville, Texas.
- 764 is formally established and named after Cadenhead's local zip code, becoming one of the most notorious subgroups within The Com.
- Scattered Spider (Octo Tempest/UNC3944), recruiting from The Com/The Community, emerges as a financially motivated cybercriminal collective of young English-speaking members.
- DragonForce emerges as a pro-Palestine hacktivist group before pivoting into a ransomware-as-a-service operation.
- Scattered Spider-linked intrusions and BlackCat/ALPHV ransomware hit MGM Resorts and Caesars Entertainment in Las Vegas.
- Europol's European Counter Terrorism Centre launches Project COMPASS, a year-long operation across 28-29 countries targeting The Com.
- Attackers gain initial access to Marks & Spencer's network and begin exfiltrating Active Directory contents, dwelling for months before detonation.
- Europol publicly reports Project COMPASS results to date: 30 arrests, 179 identified suspects, 62 identified victims, 4 safeguarded.
- Alleged Scattered Spider member Tyler Buchanan is extradited from Spain to the United States.
- DOJ unseals an indictment against 764 leaders Leonidas Varagiannis ('War') and Prasan Nepal ('Trippy') for operating a global child-exploitation enterprise, including the invite-only '764 Inferno' cell.
- A DragonForce ransomware encryptor is deployed against Marks & Spencer, culminating the February intrusion.
- DragonForce-affiliated actors claim the Co-op and Harrods breaches, contacting the BBC and Bloomberg with evidence of network infiltration and data theft.
- The UK National Crime Agency charges Thalha Jubair and Owen Flowers in connection with the Transport for London hack.
- A coordinated nine-country referral action (Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, Sweden) flags 4,340 URLs linked to The Com for platform takedown.
- Updated Project COMPASS figures are reported: 303 arrests, 626 identified/partially-identified victims, 179 identified/partially-identified perpetrators, 4 victims safeguarded, 9 joint awareness-raising activities.
Sources cited for Europol Project COMPASS Disrupts "The Com" Network Turning
- Europol Targets the Online Network Turning Teen Hackers Into Extortionists and Violent Offenders
- 30 Alleged Members of 'The Com' Arrested in Project Compass
- Project Compass is Europol's new playbook for taking on The Com
- Police crackdown on The Com cybercrime gang leads to 30 arrests
- Europol flags 4,340 URLs for removal in 'The Com' crackdown
- Project Compass Targets 764 Network as 30 Arrested and Victims Rescued
- Europol's 4,340-URL Takedown of 'The Com' Reveals a Grooming-to-Ransomware Pipeline
- Leaders of 764 Arrested and Charged for Operating Global Child Exploitation Enterprise
- FBI Boston Warns of Nihilistic Violent Extremists Targeting Children and Vulnerable Victims Online
- Scattered Spider (CISA Advisory AA23-320A)
- Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (G1015)
- Inside DragonForce, the Group Tied to M&S, Co-op and Harrods Hacks
- 764 (organization) - background
- Alleged leaders of 764 cult arrested, charged with operating child exploitation ring
Detection coverage for TL-2026-1734
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1734 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.