# Europol Project COMPASS Disrupts "The Com" Network Turning Teen Hackers Into Extortionists and Violent Offenders

> Europol-led Project COMPASS, run with 28-29 partner countries including all Five Eyes members, has disrupted "The Com", a decentralized online ecosystem whose subgroups (Cyber Com, (S)extortion/Extortion Com, Offline Com/In Real Life Com, and the especially notorious 764) funnel minors into network intrusions, ransomware deployment, sexual exploitation/(s)extortion, and offline violence. The network's cyber-intrusion wing overlaps with the financially motivated collective Scattered Spider (Octo Tempest/UNC3944), whose DragonForce-ransomware attacks on Marks & Spencer, Co-op, and Harrods, and earlier BlackCat/ALPHV attacks on MGM Resorts and Caesars Entertainment, are among the highest-profile incidents linked to Com-recruited actors.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1734
- **ID:** TL-2026-1734
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** The Com
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Project COMPASS is a year-long, Europol-coordinated law-enforcement initiative (launched January 2025 by Europol's European Counter Terrorism Centre) targeting "The Com" (also called "The Community"), a loose, decentralized web of online subgroups rather than a single hierarchical organization. The Com operates across Discord, Telegram, Twitch, TikTok, YouTube, and gaming platforms such as Minecraft, using grooming and coercion to funnel minors and other vulnerable individuals into three broad, overlapping activity streams: Cyber Com (network intrusions, credential theft, ransomware deployment, and disruption of online services), (S)extortion Com / Extortion Com (coercing minors into producing CSAM, self-harm, and suicide content), and Offline Com / In Real Life Com (encouraging property damage and physical violence aligned with an accelerationist, nihilistic-violent-extremist worldview).

764, active since 2020-2021 and founded by Bradley Chance Cadenhead (alias 'Felix'/'Brad764') in Stephenville, Texas, is identified as one of the network's most notorious communities. Two of its subsequent leaders, Leonidas Varagiannis ('War') and Prasan Nepal ('Trippy'), were indicted in April 2025 for operating a global child-exploitation enterprise, including an invite-only sub-cell dubbed '764 Inferno', directing victims to commit self-harm and produce escalating abusive content used for blackmail.

The Cyber Com wing overlaps in industry and law-enforcement reporting with Scattered Spider (MITRE ATT&CK group G1015; aka Octo Tempest, UNC3944, Roasted 0ktapus, Storm-0875, Muddled Libra) — a native-English-speaking, largely teen/young-adult cybercriminal collective active since at least 2022 that recruits from The Com/The Community. Scattered Spider relies on social engineering (SIM swapping, MFA-fatigue/push-bombing, and help-desk-impersonation vishing) to bypass identity controls in Okta, AWS, and Microsoft 365 environments, then pivots to Active Directory credential theft, cloud-service abuse, and ransomware deployment. In 2025 Scattered Spider-linked actors adopted DragonForce ransomware — a group that pivoted from pro-Palestine hacktivism (est. August 2023) into a ransomware-as-a-service cartel operating the white-label 'RansomBay' affiliate program (80/20 revenue split) and reportedly absorbing RansomHub infrastructure. DragonForce-affiliated intrusions detonated against Marks & Spencer (initial access February 2025, encryptor deployed 24 April 2025 after months of Active Directory reconnaissance) and were claimed against Co-op and Harrods in May 2025. Earlier, BlackCat/ALPHV ransomware tied to Scattered Spider hit MGM Resorts and Caesars Entertainment in the September 2023 Las Vegas casino breaches, and in 2025 UK teenagers Thalha Jubair and Owen Flowers were charged by the National Crime Agency over the Transport for London (TfL) intrusion.

As of the most recent reporting, Project COMPASS has produced 303 arrests, 4 victims directly safeguarded, 626 identified/partially-identified victims, 179 identified/partially-identified perpetrators, and 9 joint awareness-raising activities, building on earlier February 2026 figures of 30 arrests, 179 identified suspects, and 62 identified victims. A coordinated nine-country referral action (Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, Sweden) flagged 4,340 URLs linked to The Com for platform takedown. No CVE/CVSS applies — this is a threat-actor/network disruption story, not a vulnerability disclosure — but the Cyber Com/Scattered Spider/DragonForce wing represents an actively exploited, ongoing intrusion and ransomware threat to enterprises, while 764 and its peers represent an active, ongoing child-safety and violent-extremism threat.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1047 Windows Management Instrumentation
- T1098 Account Manipulation
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1484 Domain or Tenant Policy Modification
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1621 Multi-Factor Authentication Request Generation
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1538 Cloud Service Dashboard
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1539 Steal Web Session Cookie
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Europol Targets the Online Network Turning Teen Hackers Into Extortionists and Violent Offenders](https://cybersecuritynews.com/europol-targets-online-network-teen-hackers/)
- [30 Alleged Members of 'The Com' Arrested in Project Compass](https://www.darkreading.com/threat-intelligence/30-alleged-members-the-com-arrested-project-compass)
- [Project Compass is Europol's new playbook for taking on The Com](https://cyberscoop.com/project-compass-the-com-europol/)
- [Police crackdown on The Com cybercrime gang leads to 30 arrests](https://www.bleepingcomputer.com/news/security/police-crackdown-on-the-com-cybercrime-gang-leads-to-30-arrests/)
- [Europol flags 4,340 URLs for removal in 'The Com' crackdown](https://www.bleepingcomputer.com/news/security/europol-flags-4-340-urls-for-removal-in-the-com-crackdown/)
- [Project Compass Targets 764 Network as 30 Arrested and Victims Rescued](https://hackread.com/project-compass-764-network-aarrest-victims-rescued/)
- [Europol's 4,340-URL Takedown of 'The Com' Reveals a Grooming-to-Ransomware Pipeline](https://windowsnews.ai/article/europols-4340-url-takedown-of-the-com-reveals-a-grooming-to-ransomware-pipelinewindows-users-are-in-.440368)
- [Leaders of 764 Arrested and Charged for Operating Global Child Exploitation Enterprise](https://www.justice.gov/opa/pr/leaders-764-arrested-and-charged-operating-global-child-exploitation-enterprise)
- [FBI Boston Warns of Nihilistic Violent Extremists Targeting Children and Vulnerable Victims Online](https://www.fbi.gov/contact-us/field-offices/boston/news/fbi-boston-warns-of-nihilistic-violent-extremists-targeting-children-and-vulnerable-victims-online)
- [Scattered Spider (CISA Advisory AA23-320A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (G1015)](https://attack.mitre.org/groups/G1015/)
- [Inside DragonForce, the Group Tied to M&S, Co-op and Harrods Hacks](https://www.infosecurity-magazine.com/news/dragonforce-goup-ms-coop-harrods/)
- [764 (organization) - background](https://en.wikipedia.org/wiki/764_(organization))
- [Alleged leaders of 764 cult arrested, charged with operating child exploitation ring](https://www.cbc.ca/news/fifthestate/764-alleged-leaders-arrested-charged-1.7524177)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1734