"The Com" cross-platform criminal ecosystem: Discord/Telegram/Roblox/Minecraft/X abused for malware distribution, extortion, and predatory recruitment

Key facts for The Com youth predation ecosystem

Detection coverage for The Com youth predation ecosystem

As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2155 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Discord CDN Malicious Payload Download Followed by RAT Execution

Detects a file downloaded from Discord's attachment/CDN infrastructure (cdn.discordapp.com / media.discordapp.net) followed within minutes by execution of a non-browser process, consistent with SYK Crypter-packaged RAT delivery (AsyncRAT, njRAT, QuasarRAT, Warzone RAT, NanoCore RAT) documented in The Com's Discord-abuse campaigns.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.003, T1204.002, T1608.001
• Data sources: proxy, sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="stream:http" OR sourcetype="pan:threat"
(url="*cdn.discordapp.com/attachments/*" OR url="*media.discordapp.net/attachments/*")
(url="*.exe" OR url="*.scr" OR url="*.bat" OR url="*.js" OR url="*.vbs" OR url="*.zip" OR url="*.rar")
| rename dest_ip as download_host
| join type=left dest_ip
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-15m
      | eval parent_is_browser=if(match(ParentImage, "(?i)chrome|firefox|msedge|discord"), 1, 0)
      | table dest_ip, Image, CommandLine, ParentImage, parent_is_browser, _time ]
| where isnotnull(Image)
| table _time, src_ip, download_host, url, Image, CommandLine, ParentImage
| sort -_time

Microsoft KQL

let discordCdnHosts = dynamic(["cdn.discordapp.com","media.discordapp.net"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (discordCdnHosts)
| where RemoteUrl matches regex @"\.(exe|scr|bat|js|vbs|zip|rar|dll)(\?|$)"
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessParentFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","discord.exe")
    | project Timestamp2 = Timestamp, DeviceId, FileName, ProcessCommandLine, InitiatingProcessParentFileName
) on DeviceId
| where Timestamp2 between (Timestamp .. Timestamp + 10m)
| project Timestamp, DeviceName, RemoteUrl, FileName, ProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: Discord CDN Payload Download Followed by Suspicious Process Execution
id: c1a2e4d6-8b3f-4a1e-9c7d-2f5b6a1e3d40
status: experimental
description: Detects a file downloaded from Discord's CDN/attachment infrastructure followed by execution of a non-browser process, consistent with SYK Crypter-packaged RAT delivery observed in The Com's Discord-abuse campaigns.
references:
  - https://www.morphisec.com/blog/syk-crypter-discord/
  - https://www.zscaler.com/blogs/security-research/discord-cdn-popular-choice-hosting-malicious-payloads
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1608.001
  - attack.tool.async_rat
  - attack.tool.njrat
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Discord\app-*\Discord.exe'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.scr'
  filter_signed:
    Image|contains: '\Program Files\Discord\'
  condition: selection_parent and selection_ext and not filter_signed
falsepositives:
  - Users legitimately running executables received as Discord attachments from known/trusted contacts
level: high

Known false positives:

• Users legitimately running executables received as Discord attachments from known/trusted contacts

Tuning notes: Scope the join window to the environment's typical browser-to-disk-to-exec latency (start at 10-15m) and exclude a maintained allowlist of IT-approved Discord community servers used for legitimate file sharing.

• 🔒 SYK Crypter RAT Delivery via Discord Invite-Link Redirect Chain · unlock with TL Creds
• 🔒 Helpdesk Impersonation Vishing Leading to MFA Reset / SIM-Swap-Enabled Account Takeover · unlock with TL Creds
• 🔒 Dynamic-DNS (DuckDNS/DDNS Geek) Beaconing to Com-Linked RAT Infrastructure · unlock with TL Creds
• 🔒 Suspicious Process Execution from Discord Cache/Downloads Directory · unlock with TL Creds
• 🔒 Suspicious Process Memory Access to Browser Process Consistent with In-Memory Cookie Extraction · unlock with TL Creds
• 🔒 Non-Browser Process Network Connection to Discord Webhook or Com-Linked Dynamic-DNS C2 Domain · unlock with TL Creds
• 🔒 Infostealer Browser Credential and Cookie File Harvesting (RedLine/Lumma/ChromeKatz Pattern) · unlock with TL Creds
• 🔒 Discord Webhook API Used as Stealer Exfiltration/C2 Channel · unlock with TL Creds

Indicators of compromise for The Com youth predation ecosystem

As of 2026-08-26, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-2155.

How The Com youth predation ecosystem works

Subgroups including 764, Extortion Com, and the FBI-tracked Scattered Spider syndicate have driven federal prosecutions, a July 2025 FBI/IC3 nationwide alert, and ~300 active FBI investigations as of late 2025.

The Com ("The Community") is a decentralized, primarily English-speaking online ecosystem of loosely affiliated cybercriminal and predatory subgroups, operating chiefly through Discord, Telegram, Roblox, Minecraft, and X rather than dark-web infrastructure. The FBI and IC3 describe thousands of participants, disproportionately minors and young adults aged roughly 11-25, organized into recognized subsets: Hacker Com (financially motivated cybercrime, malware development, ransomware-as-a-service affiliation), IRL Com (violence-for-hire, armed robbery, shootings), Extortion Com (sextortion and CSAM production targeting minors), and 764 (a violent, ideologically-tinged network that coerces minors into self-harm, suicide attempts, animal cruelty, and CSAM production, with documented overlap into neo-Nazi/accelerationist networks such as M.K.U.). Scattered Spider (also tracked by MITRE as Octo Tempest/UNC3944/Roasted 0ktapus, G1015), the syndicate behind the 2023 MGM Resorts breach, the 2024 Snowflake customer-data extortion campaign, and 2025 UK retail ransomware intrusions (including DragonForce ransomware deployment), is publicly linked by the FBI to The Com's Hacker Com subset.

On the malware-distribution side, security vendors (Morphisec, Zscaler, Trend Micro, Trellix, Centripetal, Intel 471) have independently documented threat actors abusing Discord's CDN (cdn.discordapp.com / media.discordapp.net) to host and serve infostealers and remote access trojans, exploiting the fact that corporate network defenses commonly allowlist Discord domains, letting malicious traffic blend with legitimate application activity and bypass perimeter controls. The "SYK Crypter" service has been used to package and deliver AsyncRAT, njRAT, QuasarRAT, Warzone RAT, and NanoCore RAT via Discord-hosted payloads; separate campaigns push RedLine Stealer and Lumma Stealer via Discord CDN links, and a mid-2025 campaign abusing expired/recycled Discord invite links delivered AsyncRAT, Skuld Stealer, and the ChromeKatz cookie/session-token harvester to exfiltrate credentials, browser cookies, and Discord session tokens — in some cases using Discord's own webhook/API infrastructure as an exfiltration and C2 channel. Researchers have counted roughly 10,000 malware samples that leverage Discord infrastructure for distribution or C2.

On the predatory-recruitment side, Flashpoint and multiple child-safety/legal analyses describe a repeatable pipeline: (1) scouting — recruiters identify socially isolated, depressed, or attention-seeking minors on Roblox, Minecraft, and public Discord servers; (2) trust-building — "love bombing" through gifted in-game currency, subscriptions, or a romantic facade to create psychological obligation; (3) migration — moving the target from a platform's public, moderated spaces into private Discord servers or encrypted apps, isolating them from safety tooling (a documented "public-to-private" strategy). Once isolated, victims are coerced into producing sexual imagery or self-harm content, which is then used for blackmail, doxxing threats, and further extortion. Extortion Com has specifically operated fake "suicide-prevention" Telegram support chats to social-engineer isolated minors into disclosing identifying information later used to doxx and extort them. Discord alone forwarded 489,782 suspected child-exploitation reports to NCMEC in 2025 (over 1,300/day).

Other documented Com tactics weaponize consumer-facing infrastructure for both cybercrime and real-world violence: SIM swapping and IP-grabbing to deanonymize and locate victims; OSINT-based doxxing; DDoS-for-hire; swatting and hoax bomb threats; cryptocurrency theft and money laundering; and, on the Scattered Spider/Hacker Com side, telephone- and SMS-based helpdesk impersonation to obtain credential resets and MFA transfers ahead of ransomware deployment. X (Twitter) is used post-compromise to publicly broadcast proof of breaches and amplify pressure on ransomware/data-leak-site victims during extortion negotiations.

Federal response has been active and sustained: a May 2024 FBI tradecraft alert on 764 doxxing practices; the November 2024 sentencing of 764 operator Richard Anthony Reyna Densmore ("Rabid") to 30 years for child sexual exploitation; the October 2024 arrest and subsequent guilty plea of Connor Riley Moucka for the Snowflake-linked extortion campaign; a July 23, 2025 FBI/IC3 public service announcement (PSA250723-3) and a July 28, 2025 follow-on alert tying Com cybercrime to physical violence; a July 29, 2025 updated joint advisory on Scattered Spider tactics; FBI Director Kash Patel's November 2025 disclosure of roughly 300 active investigations into the 764 network with arrests across 23 countries; and continued congressional oversight pressure on the FBI's response into 2026.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Command and Control

T1102.002 Bidirectional Communication

Execution

T1204.002 Malicious File

initial-access

T1451 SIM Card Swap

Credential Access

T1539 Steal Web Session Cookie

Initial Access

T1566.003 Spearphishing via Service

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1585.001 Social Media Accounts; T1608.001 Upload Malware

Reconnaissance

T1589 Gather Victim Identity Information; T1598.004 Spearphishing Voice

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for The Com youth predation ecosystem

Patches

• N/A — this is a platform-abuse and criminal-ecosystem campaign, not a software vulnerability; no vendor patch applies

Immediate actions

• Do not blanket-allowlist Discord/Telegram CDN and domain traffic at the network perimeter (cdn.discordapp.com, media.discordapp.net) — apply content inspection to files downloaded from them rather than trusting the domain alone
• Restrict or monitor outbound traffic to Discord's webhook/API endpoints (discord.com/api/webhooks) from endpoints with no legitimate business use for Discord, since stealer malware abuses webhooks as an exfiltration/C2 channel
• Train helpdesk and IT support staff to resist phone- and SMS-based identity-verification bypass attempts (documented Scattered Spider vishing pattern) before performing password resets or MFA transfers
• Report suspected child grooming, sextortion, or CSAM activity immediately to NCMEC's CyberTipline (report.cybertip.org) and the FBI's IC3 (ic3.gov / 1-800-CALL-FBI)
• Enable carrier-level SIM-swap protections (port-freeze/PIN) for accounts and personnel with access to sensitive systems, given SIM swapping is a documented Com credential-access vector

Workarounds

• Scope corporate network trust of Discord/Telegram traffic to specific vetted business use cases instead of blanket allowlisting
• Educate minors and guardians on the documented 'public-to-private migration' grooming red flag: in-game gifting/love-bombing followed by pressure to move to Discord DMs or encrypted chat

Longer-term hardening

• Deploy EDR/network monitoring tuned to detect RAT/infostealer behavior distributed via trusted-CDN channels rather than relying on domain-reputation allowlisting alone
• Establish parental controls and platform-safety monitoring for minors' use of Discord, Roblox, Minecraft, and Telegram, with attention to unsolicited DMs and requests to migrate off-platform
• Adopt phishing-resistant MFA (FIDO2/hardware security keys) to blunt helpdesk social-engineering and SIM-swap-enabled account takeover used by Scattered Spider/Hacker Com
• Participate in law-enforcement information-sharing channels (FBI/IC3, NCMEC) given The Com's cross-jurisdictional, cross-platform, minor-heavy membership structure

Affected and fixed versions

• Discord Inc. — Discord (CDN, invite links, webhooks/API)
  Vulnerable versions: N/A — platform-abuse campaign, not a software vulnerability; CDN/invite/webhook features abused as designed
  Fixed in: N/A
• Telegram FZ-LLC — Telegram (channels, groups, bots)
  Vulnerable versions: N/A — abused as a marketplace and operational coordination hub
  Fixed in: N/A
• Roblox Corporation — Roblox
  Vulnerable versions: N/A — abused as a minor-recruitment scouting surface
  Fixed in: N/A
• Mojang Studios / Microsoft — Minecraft
  Vulnerable versions: N/A — abused as a minor-recruitment scouting surface
  Fixed in: N/A
• X Corp. — X (Twitter)
  Vulnerable versions: N/A — abused to amplify ransomware data-leak extortion pressure
  Fixed in: N/A

Timeline of The Com youth predation ecosystem

• 2023-03-01 Com subgroup locked-ioc-22 authors and distributes 'The Bible,' a criminal tradecraft manual, on locked-ioc-18.
• 2024-05-01 FBI issues a tradecraft alert on locked-ioc-23's doxxing practices used against minors.
• 2024-10-30 locked-ioc-4 is arrested in Kitchener, Canada, in connection with the Snowflake customer-data extortion campaign, later linked to Com/locked-ioc-5 circles.
• 2024-11-01 Five individuals are charged in the United States under the locked-ioc-5 cybercrime syndicate, a subset publicly linked to The Com's Hacker Com.
• 2024-11-07 locked-ioc-23 operator Richard Anthony Reyna Densmore ('Rabid') is sentenced to 30 years in prison for sexually exploiting a child via Discord 'Sewer' communities.
• 2025-07-23 FBI/IC3 publish Public Service Announcement PSA250723-3, warning that The Com poses a rising threat of theft, extortion, and violence to youth online.
• 2025-07-28 FBI issues a follow-on alert explicitly tying The Com's cybercrime activity to physical violence, building on the July 23 PSA.
• 2025-07-29 A joint cybersecurity advisory update details locked-ioc-5's evolving tactics, including locked-ioc-11 ransomware deployment.
• 2025-11-20 FBI Director Kash Patel discloses roughly 300 active investigations into the locked-ioc-23 network nationwide, with prior arrests spanning 23 countries.
• 2026-06-08 Flashpoint publishes 'Understanding Illicit Ecosystems,' documenting The Com's abuse of Discord, locked-ioc-18, locked-ioc-19, locked-ioc-16, and X across malware distribution, extortion, and minor recruitment.

Sources cited for The Com youth predation ecosystem

Showing 15 of 17 sources, primary sources first.

• The Com: Theft, Extortion, and Violence are a Rising Threat to Youth Online (PSA250723-3) ic3.gov · Government advisory · 2025-07-23
• Product ID: AA23-320A — Scattered Spider (updated joint advisory) ic3.gov · Government advisory · 2025-07-29
• Member Of Violent 764 Terror Network Sentenced to 30 Years in Prison For Sexually Exploiting a Child justice.gov · Advisory · 2024-11-07
• SYK Crypter Distributing Malware Families Via Discord morphisec.com · Vendor report · 2023-01-01
• Malware Distribution Uses Discord CDN zscaler.com · Vendor report · 2023-01-01
• Beware: Lumma Stealer Distributed via Discord CDN Trend Micro · Vendor report · 2023-01-01
• Discord Invites Are Leveraged in Malware Distribution centripetal.ai · Vendor report · 2025-06-01
• How Discord is Abused for Cybercrime intel471.com · Vendor report · 2024-01-01
• Scattered Spider: TTPs, MGM Attack & Defenses group-ib.com · Research · 2024-01-01
• Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (G1015) MITRE · Research · 2024-01-01
• Understanding Illicit Ecosystems: Mainstream Apps & Social Infrastructure flashpoint.io · Blog · 2026-06-08
• Understanding The Com: A New Cybercrime Model blackfog.com · Blog · 2025-11-06
• FBI: Thousands of people involved in 'The Com' targeting victims with ransomware, swatting The Record · News · 2025-07-24
• FBI alerts tie together threats of cybercrime, physical violence from The Com cyberscoop.com · News · 2025-07-28
• FBI intensifies crackdown on international '764' child exploitation network wjla.com · News · 2025-11-20

Threats related to The Com youth predation ecosystem

• Wrench Attacks: Physical Coercion Bypasses Cryptocurrency Wallet Encryption Amid 33% YoY Surge in H1 2026
• Malwarebytes: Scammers Increasingly Match Scam Type to Platform, Targeting Victims by Channel and Time
• Pokémon Center Confirms Customer Data Breach via CEVA Logistics Supply-Chain Compromise
• AI Agents Persist Through Failed Malware, Rewrite Tools Mid-Attack: SentinelLABS Documents Sandbox Escape, PyPI Supply-Chain Package, and Artifactory Zero-Day Abuse
• Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattack

More from The Com

• Europol Project COMPASS Disrupts "The Com" Network Turning Teen Hackers Into Extortionists and Violent Offenders
• Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted
• ShinyHunters Leaks 5.1 Million Panera Bread Customer Records
• ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypass
• ShinyHunters-Branded Extortion Campaign Expands with Vishing & SSO Attacks
• SLSH Extortion Group - Swatting and Executive Harassment Tactics

Previous and next in threat intel

• Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption Campaigns Against NATO/EU Infrastructure Previous report
• Ghost SPN: Active Directory SPN Misconfigurations Enable Stealthy Kerberoasting Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs